felhom-controller/REPORT.md

REPORT — controller v0.241.0: a bind-data app leans on off-site before its own unit (2026-09-13, evening)

Overwritten each run. This records the most recent implementation only.

Operator ruling R-479, shipped as v0.241.0 and delivered by the managed floor (declared MinAgent 0.129.0): demo-hp +16 s, demo-felhom +18 s. Proven live on demo-hp with a nextcloud throwaway on the registered drive. Evidence: felhom.eu/documentation/audits/v0241-2026-09-13/.

What changed (3e81330)

• UpdateTierOrderFor / DataOutsideUnit: an app with classified binds walks 2 → 3 → 1; a volume app keeps 2 → 1 → 3. UpdateRestorePoints reads it.
• RestoreHold.CopyHolds + UpdateCopyHolds: the hold sentence ends with what the chosen copy holds; the adapter passes it through HoldAfterFailedUpdateHolding. Holds from v0.239.0–v0.240.0 keep the tier-only sentence (UpdateHoldTierFmt).

Gates, tests, red-proof, live

• go build ./... && go vet ./... && go test ./... green; controller_gates.py --fast green.
• internal/backup/r479_tier_order_test.go: order per layout, the consequence (Tier 2 absent, unit and off-site both fresh → the bind app leans on off-site), the phrases, the sentence verbatim, the older sentence; the adapter wiring test demands the phrase.
• Red-proof: a layout-blind order fails the bind case (rp-v241-R479-order-layout-blind.txt).
• Live (13-R479-live.txt): nextcloud with HDD_PATH on the drive (2 classified binds), Tier 2 off, backup now (unit with db-dump and volume tars), a never-healthy update → held, the sentence names „saját meghajtó, 2026-09-13 21:51 — ez a másolat csak a beállításokat és az adatbázist tartalmazza, a fájlokat nem." The 2→3→1 preference is unit-proven only: a live off-site run would touch the standing apps' leg.

Observations

1. A removed app keeps its update_failed hold in the store; a reinstall under the same name would start held. FILED: R-491
2. The 2→3→1 preference was not exercised live (no off-site run on a box with standing apps). NOT-A-FINDING: the unit test and red-proof pin it; a live pass belongs to a night whose throwaway has off-site of its own.