admin d15ad105be R-569: stack-lifecycle handlers pick their status by error KIND, not English words ...

stop/start/restart/update, remove and delete matched "protected", "not found", "not deployed",
"still running", "not orphaned" in err.Error(). New sentinels in internal/stacks
(stack_errors.go) carried by the producers in manager.go/delete.go via util.KindErrorf (message
bytes unchanged); api.stackOpStatusFor maps them. Tests: reworded-message table per family,
wiring check over all three handlers, producers keep kind + words.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-05 22:24:22 +02:00

..

testdata/catalog

v0.257.0: the app catalog can speak English (R-560, slice 5 Part A)

2026-09-20 14:31:52 +02:00

after_install_test.go

v0.281.0: 'Done' asks the probe first; sign-up closed after the first admin (decision 47); R-713 code-bound values refused, ${NAME|base64}

2026-09-29 09:57:58 +02:00

after_install.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

after_setup_test.go

v0.282.0: after_setup (the app's own sign-up switch), close sign-up now (decision 49), probes read lists + done_status (R-715)

2026-09-29 16:19:12 +02:00

after_setup.go

R-773: a removed app restored from its backup gets its sign-up lock back (record opened_by restore + block, before anything starts)

2026-10-01 21:01:42 +02:00

captureset_wiring_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

classify_binds_test.go

…

classify_binds.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

classify_wiring_test.go

…

controller_image_retention_test.go

v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

2026-10-01 07:36:26 +02:00

controller_image_retention.go

v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

2026-10-01 07:36:26 +02:00

datapaths_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

datapaths.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

degraded_test.go

v0.222.0: ask whether a supervised member is DEAD before whether one is UNHEALTHY (R-384), and stop promising an undo copy nobody looked for (R-383)

2026-08-23 07:25:00 +02:00

delete_r442_test.go

v0.288.0: the remove dialog and result name the household's userdata folders, which stay (decision 67, R-800)

2026-10-02 14:03:44 +02:00

delete.go

R-569: stack-lifecycle handlers pick their status by error KIND, not English words

2026-10-05 22:24:22 +02:00

deploy_crashsafety_regression_test.go

…

deploy_errors.go

kept data: the choice at reinstall, the list, the read-only view, the load (09 decision 36); R-690 fixed

2026-09-25 13:32:30 +02:00

deploy_secretgen_test.go

…

deploy.go

v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

2026-10-05 07:13:02 +02:00

desiredstate_test.go

v0.189.0 — desired state + the app-stop crash marker (R-166 / D-b)

2026-08-02 18:40:17 +02:00

desiredstate.go

v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

2026-09-30 10:31:55 +02:00

digest_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

digest.go

v0.269.1: an installed app keeps the image digest it runs until a guarded Update moves it

2026-09-24 13:01:31 +02:00

downstate_test.go

…

export_mounts_test.go

R-203: the export-mount resolver takes the namespace root too (its own commit)

2026-08-04 18:21:17 +02:00

family_gate_test.go

The family gate (decisions 63/64, R-780): family members with their own logins, a permanent forwardAuth door per family app, anchored exceptions, min_controller

2026-10-02 07:42:47 +02:00

family_gate.go

The family gate (decisions 63/64, R-780): family members with their own logins, a permanent forwardAuth door per family app, anchored exceptions, min_controller

2026-10-02 07:42:47 +02:00

filebrowser_password_test.go

v0.243.0: FileBrowser generated admin password (R-513); per-tier whole-guest backup truth (R-517); skip absent-storage tiers (R-518); OOM-killed worker visible (R-514)

2026-09-15 10:12:08 +02:00

filebrowser_password.go

v0.243.0: FileBrowser generated admin password (R-513); per-tier whole-guest backup truth (R-517); skip absent-storage tiers (R-518); OOM-killed worker visible (R-514)

2026-09-15 10:12:08 +02:00

guestnet_test.go

R-66: the box's own address becomes visible (v0.159.0)

2026-07-22 13:49:57 +02:00

guestnet.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

hddpath_agreement_test.go

…

healthprobe.go

R-772 (found live on 9202 with v0.286.0): a stopped probe container is seen on the next tick, not when the last healthy record's 5-minute interval runs out

2026-10-01 21:11:22 +02:00

image_retention_r863_test.go

v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

2026-10-05 07:13:02 +02:00

image_retention_test.go

v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

2026-10-05 07:13:02 +02:00

image_retention.go

v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

2026-10-05 07:13:02 +02:00

import_root_classify_test.go

v0.172.0 fixup: EnsureImportRoot must apply the convention to the parent userdata dir

2026-07-26 08:15:47 +02:00

infra_test.go

…

infra_tunnel_test.go

v0.292.0: cloudflared readiness health check (R-841) — tunnel --metrics localhost:20241 run + Docker healthcheck on cloudflared's own /ready; the host agent reports running/not_running/unknown from State.Health

2026-10-04 13:16:26 +02:00

infra.go

CHANGELOG + comment: correct the file-browser claim (the start-up mount sync already moved it); 9202 gaps measured

2026-10-04 11:00:54 +02:00

initialcreds_test.go

…

initialcreds.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

install_hold_test.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

install_hold.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

install_interrupted.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

installed_test.go

v0.237.0: the Update button takes a backup first, and tells the truth (update arc slice 4 — R-448, R-443, R-439)

2026-09-13 11:41:31 +02:00

installed.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

kept_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

kept.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

ladder_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

ladder.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

life_records.go

v0.297.0: burn-down round 2 — 24 small rows (R-591 R-568 R-567 R-363 R-547 R-10 R-552 R-251 R-104 R-619 R-362 R-675 R-256 R-257 R-240 R-365 R-425 R-565 R-564 R-603 R-454 R-208 R-457-swept) + the banner countdown and deepCopyStack twins; MinAgent 0.131.0

2026-10-05 20:12:56 +02:00

lifecycle_orphan_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

lifecycle_test.go

catalog: app lifecycle states - available/hidden/abandoned (v0.158.0)

2026-07-21 16:19:58 +02:00

mailenv_test.go

…

mailenv.go

v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

2026-09-18 11:44:30 +02:00

manager.go

R-569: stack-lifecycle handlers pick their status by error KIND, not English words

2026-10-05 22:24:22 +02:00

metadata_i18n_test.go

v0.257.0: the app catalog can speak English (R-560, slice 5 Part A)

2026-09-20 14:31:52 +02:00

metadata_i18n.go

v0.297.0: burn-down round 2 — 24 small rows (R-591 R-568 R-567 R-363 R-547 R-10 R-552 R-251 R-104 R-619 R-362 R-675 R-256 R-257 R-240 R-365 R-425 R-565 R-564 R-603 R-454 R-208 R-457-swept) + the banner countdown and deepCopyStack twins; MinAgent 0.131.0

2026-10-05 20:12:56 +02:00

metadata_test.go

…

metadata.go

The family gate (decisions 63/64, R-780): family members with their own logins, a permanent forwardAuth door per family app, anchored exceptions, min_controller

2026-10-02 07:42:47 +02:00

migrate_fs3_test.go

…

migrate_setgid_linux_test.go

…

migrate_setgid_test.go

…

migrate_test.go

…

migrate.go

v0.276.0: a restore and a drive move keep the app's records (R-697, R-700)

2026-09-27 17:59:04 +02:00

oom_test.go

controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

2026-09-23 17:16:57 +02:00

oom.go

controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

2026-09-23 17:16:57 +02:00

pgconvert_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

pgconvert.go

v0.276.0: a restore and a drive move keep the app's records (R-697, R-700)

2026-09-27 17:59:04 +02:00

pin_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

pin.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

portable_secrets_test.go

D5: an app restore works from the drive alone (v0.188.0)

2026-07-30 16:33:06 +02:00

r480_r478_test.go

controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

2026-09-13 19:26:50 +02:00

r485_backup_card_test.go

controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

2026-09-13 19:26:50 +02:00

r489_volumes_removed_test.go

controller v0.242.0: a removed app is listed with its kept backup; five small ones (R-487 R-491 R-490 R-489 R-476 R-456)

2026-09-13 22:50:18 +02:00

r536_deploy_done_hook_test.go

v0.244.0: the backup page stops promising what it does not hold (R-537/R-538/R-536)

2026-09-16 16:55:55 +02:00

r553_deploy_error_kinds_test.go

v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

2026-09-18 11:44:30 +02:00

r569_stack_error_kinds_test.go

R-569: stack-lifecycle handlers pick their status by error KIND, not English words

2026-10-05 22:24:22 +02:00

r591_copy_i18n_test.go

v0.297.0: burn-down round 2 — 24 small rows (R-591 R-568 R-567 R-363 R-547 R-10 R-552 R-251 R-104 R-619 R-362 R-675 R-256 R-257 R-240 R-365 R-425 R-565 R-564 R-603 R-454 R-208 R-457-swept) + the banner countdown and deepCopyStack twins; MinAgent 0.131.0

2026-10-05 20:12:56 +02:00

r591_copy_meta_alias_test.go

v0.297.0: burn-down round 2 — 24 small rows (R-591 R-568 R-567 R-363 R-547 R-10 R-552 R-251 R-104 R-619 R-362 R-675 R-256 R-257 R-240 R-365 R-425 R-565 R-564 R-603 R-454 R-208 R-457-swept) + the banner countdown and deepCopyStack twins; MinAgent 0.131.0

2026-10-05 20:12:56 +02:00

r621_hold_log_fallback_test.go

R-621: a held app's logs show the log the hold kept

2026-10-05 21:55:37 +02:00

r630_r634_v0262_test.go

v0.262.1: the busy refusal is a CONFLICT, not a server error (R-633)

2026-09-22 21:48:01 +02:00

r634_deploying_test.go

controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

2026-09-23 17:16:57 +02:00

r649_failed_deploy_cleanup_test.go

controller v0.266.0: a failed install removes what it started (R-649, operator ruling)

2026-09-23 18:06:29 +02:00

r650_main_test.go

v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

2026-10-01 07:36:26 +02:00

r651_r658_remove_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

r658_undo_volumes_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

r665_verify_meta_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

r669_restore_meta_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r670_probe_meta_test.go

controller v0.272.0: the backup page says when a whole-box backup does not fit (R-685); R-671, R-670, R-677

2026-09-25 11:19:27 +02:00

r674_head_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r679_already_current_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r681_install_interrupted_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r694_restored_login_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

r700_records_carried_test.go

v0.276.0: a restore and a drive move keep the app's records (R-697, R-700)

2026-09-27 17:59:04 +02:00

r721_leg_stopped_test.go

v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

2026-09-30 10:31:55 +02:00

r772_not_checked_test.go

R-772 (found live on 9202 with v0.286.0): a stopped probe container is seen on the next tick, not when the last healthy record's 5-minute interval runs out

2026-10-01 21:11:22 +02:00

r773_restore_signup_lock_test.go

R-773: a removed app restored from its backup gets its sign-up lock back (record opened_by restore + block, before anything starts)

2026-10-01 21:01:42 +02:00

r864_stderr_tail_test.go

v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

2026-10-05 07:13:02 +02:00

samba_classify_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

samba_classify.go

docs(shares): R-7b v0.145.0 — CHANGELOG, CONTEXT, REUSE, README; caveats cleared

2026-07-18 13:06:41 +02:00

samba_lanaddr_test.go

v0.151.0 — the Megosztás page stops reloading, and says how to connect

2026-07-20 10:46:21 +02:00

samba_test.go

…

samba.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

setup_gate_test.go

v0.282.0: after_setup (the app's own sign-up switch), close sign-up now (decision 49), probes read lists + done_status (R-715)

2026-09-29 16:19:12 +02:00

setup_gate.go

The family gate (decisions 63/64, R-780): family members with their own logins, a permanent forwardAuth door per family app, anchored exceptions, min_controller

2026-10-02 07:42:47 +02:00

signup_block_test.go

v0.281.0: 'Done' asks the probe first; sign-up closed after the first admin (decision 47); R-713 code-bound values refused, ${NAME|base64}

2026-09-29 09:57:58 +02:00

signup_block.go

v0.282.0: after_setup (the app's own sign-up switch), close sign-up now (decision 49), probes read lists + done_status (R-715)

2026-09-29 16:19:12 +02:00

skeleton_derive.go

v0.172.0 fixup: EnsureImportRoot must apply the convention to the parent userdata dir

2026-07-26 08:15:47 +02:00

stack_errors.go

R-569: stack-lifecycle handlers pick their status by error KIND, not English words

2026-10-05 22:24:22 +02:00

start_services_test.go

v0.153.0 — R-47: the DB replay no longer races the app, on BOTH restore paths

2026-07-20 17:01:52 +02:00

unattended_test.go

v0.279.0: after_install (decision 45), known default logins on the page, Part D empty-backup alarm, night chain (R-705), R-706

2026-09-28 18:38:30 +02:00

unattended.go

v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

2026-09-30 10:31:55 +02:00

undo_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

undo.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

unhealthy_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

unhealthy.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

update_events_test.go

controller v0.264.0: the household is told when an update is undone or held, in its language

2026-09-23 13:51:21 +02:00

update_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

update_tiers_test.go

controller v0.239.0: any backup tier lets an app update (R-475)

2026-09-13 17:16:24 +02:00

update.go

v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

2026-10-05 07:13:02 +02:00

updatelock_test.go

v0.261.0 — the controller no longer swaps itself out from under an app update (R-608, R-609)

2026-09-21 14:23:59 +02:00

updateorder_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

updateorder.go

controller v0.272.0: the backup page says when a whole-box backup does not fit (R-685); R-671, R-670, R-677

2026-09-25 11:19:27 +02:00

userdata_belt_gate_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

userdata_belt_test.go

R-203: the app and its backup look in the same directory — one resolver, every caller

2026-08-04 18:17:05 +02:00

userdata_path_r203_test.go

R-203: the app and its backup look in the same directory — one resolver, every caller

2026-08-04 18:17:05 +02:00