felhom-controller/REPORT.md

REPORT — v0.263.0 → v0.263.2: a failed update puts the app back by itself (R-637)

2026-09-23. Baseline b9deec19077b (v0.262.1). Commits: 8fc2b4a (v0.263.0), 5d38573 (v0.263.1), 2cd6666 (v0.263.2). MinAgent 0.131.0, unchanged. Deployed: scratch guest 9202 only; the fleet floor stays at 0.262.1 (the operator's question).

What changed

• internal/stacks/undo.go (new): the folder copy (volumeCopier, docker helper), tryUndo, the applied .felhom.yml record, last_update_undone.
• internal/stacks/update.go: phase copying after the pull; failAndHold undoes first; journal phases copying/undoing with recovery; restoreDefinition split from pinBack; waitUpdateHealthyMeta (the undo's own probe, which runs on an unhealthy app); seam probeRunFn.
• pin.go, deploy.go: every pin writer records the pinned version's .felhom.yml (applied-meta/).
• backup/: RestoreHold.UndoState; the hold sentence's undo prefix + state clause (box language).
• web/: the undone line on the app page (request language). api/: R-642 start answer.
• delete.go: a removal deletes the app's kept undo copies.
• i18n: 10 keys born as keys (hu + en). docker_run_volume_path_gate: four named-volume mounts allowlisted.

Tests and red-proofs

go build ./... && go vet ./... && go test ./... → rc=0 before each commit. Controller gates rc=0. Twelve red-proofs, each seen failing and restored — table in felhom.eu/REPORT.md §3. Two of them (9, 3b) reproduce the two live-only defects verbatim.

Live (endpoint-level, 9202)

Three apps undone by the product with seeds before/after the backup and seconds before the press read back; a cut-off copy held honestly (hu and en prefix); a power cut during undoing resumed and undone; a person's press after an undo worked; removal deleted kept copies. Evidence: felhom.eu/documentation/audits/undo-live-2026-09-23/README.md.

NOT yet live-validated

• The household mail / operator event for an undo (not built — 09 §6.4 part 2).
• An app pinned BEFORE v0.263.2 that has not been re-pinned (R-646) — its undo probes with the current .felhom.yml; reasoned, not run live.
• Any box other than 9202.