felhom-controller/REPORT.md

REPORT — Cleanup bundle: email-wipe guard + carried hygiene — controller v0.137.0

Summary

Four closing-the-loop items from the backup-redesign arc + 6D. One code fix (Part 1, shipped v0.137.0), three operational/doc items executed inline.

Part 1 — empty-email notification save guard (CODE, v0.137.0) — SHIPPED

Problem: settingsNotificationsHandler dropped a trimmed-empty notification_email into the prefs and pushed it to the hub (SyncPreferences), overwriting the customer's provisioning-seeded alert address — a customer saving any notification change with a blank email field silently wiped their own hub-side alert delivery (the 2026-07-15 demo incident, restored by hand in 6D P3-DELIVERY).

Fix: after computing the trimmed email + enabled events, refuse the save when email == "" && len(enabledEvents) > 0 — return before SetNotificationPrefs and any hub sync, re-render with the Hungarian error "Adj meg egy értesítési e-mail címet – bekapcsolt értesítésekhez szükséges egy cím, ahova küldhetjük őket.", and repaint the just-submitted checkboxes (render-only overlay on notificationsPageData's NotificationPrefs). The legitimate empty-email + zero events clear-all still proceeds. SyncPreferences / the hub / the seed-migration are untouched. Deliberately no HTML required attr (it is unconditional and would block the legitimate clear-all — the server-side guard is the precisely-conditional floor).

Tests + red-proof (web/notifications_guard_test.go, real temp-file Settings): guard-fires (stored email survives the refused save), legitimate clear-all proceeds, normal save persists. Red-proof: neutering the guard → the stored email is wiped to "" (the incident) → the test fails. Full go build/vet/test ./... green.

Deploy + live: built + pushed felhom-controller:0.137.0, deployed to guest 9201 (Up, healthy; selfupdate: Current version 0.137.0 is up to date). The protected asset is confirmed present — the demo customer's notification email nagyfenyvesi.viktor@gmail.com is set. The authenticated UI click-through needs the customer-owned claim password (CC does not hold it), so the server-side guard is validated by the endpoint-equivalent unit test + red-proof (the CLAUDE.md live-validation proxy).

Part 2 — duplicate recovery-unit cleanup (HYGIENE) — 1 removed, 3 STOPPED

Recovery units are <drive>/backups/primary/<app>/; the controller's tie-break selects the newest by manifest CreatedAt, else dir mtime (backup/offbox.go:558-607, first-in-order wins on a CreatedAt tie). On felhom-flash:

• Removed /mnt/felhom-drives/felhom-flash/backups/primary/immich (44M) — CreatedAt 2026-06-23T10:02:35Z vs the live felhom-usb copy 2026-07-15T17:41:20Z → confirmed older, never selected. Prefix asserted (*/felhom-flash/backups/primary/*) before rm -rf.
• STOPPED (not deleted): felhom-flash audiobookshelf, komga, romm — their manifest CreatedAt is identical to the felhom-usb copy (2026-06-23T10:02:35Z), so the controller's tie-break is drive-order-dependent and I cannot confirm the flash copy is the non-selected/older one. Per the STOP discipline, left for a manual byte-identity check / disposition (not this micro-task).

Part 3 — campaign6 orphaned autofs (OPERATOR ACTION) — safe clear attempted, left for Viktor

/mnt/felhom-drives/campaign6 is a bare empty leftover directory (nobody:nogroup) — not a live mount (not a mountpoint, absent from the mount table, no autofs config / systemd unit / fstab entry). A safe non-disruptive rmdir (refuses non-empty dirs + mountpoints) was refused with Permission denied even as root (an autofs-ghost / immutable artifact). No live mount was disturbed (mount count 89→89; all 8 drive mounts intact). Not escalated to chattr/force (beyond a safe clear). Left for Viktor's demo-host reboot window — CC did not reboot.

Part 4 — 6D audit doc tag (DOC) — committed

Added the matching track-only disposition line to the campaign6 autofs LOW finding in felhom.eu/documentation/audits/CAMPAIGN-6D-2026-07-15.md (consistency with the duplicate-recovery LOW). Commit dee72cd.

Queue after this bundle

• Pending operator (Viktor): campaign6 autofs clears on the next demo-host reboot; the tied-CreatedAt felhom-flash audiobookshelf/komga/romm duplicates await a manual disposition.
• Deliberately not here (correctly deferred): Peti-return runbook (hardware-gated); P4-DEEP timing + P-TIER2 deep-4 (pre-broad-launch resilience); agent 0.88 publish (6D P-DAY0 shows the manifest already vouches 0.88/golden-0.136 — likely closeable, verify separately).