admin f3204024e2 v0.345.1: SECURITY — cloudflared 2026.10.3 (Cloudflare's eMudhra notice, 2026-10-20) ...

Built from v0.345.0 (6bfb784) + this commit only. infra.CloudflaredImage 2026.9.3 -> 2026.10.3;
TestEnsureCloudflared_ANewImageRecreatesTheTunnel pins that an image-only change recreates the
running tunnel (red-proved). MinAgent 0.158.1 unchanged.

2026-10-26 21:02:08 +01:00

..

testdata/catalog

v0.257.0: the app catalog can speak English (R-560, slice 5 Part A)

2026-09-20 14:31:52 +02:00

after_install_test.go

v0.281.0: 'Done' asks the probe first; sign-up closed after the first admin (decision 47); R-713 code-bound values refused, ${NAME|base64}

2026-09-29 09:57:58 +02:00

after_install.go

R-717: after_setup open_command — the family window reopens an app's DB-held sign-up switch

2026-10-06 15:15:33 +02:00

after_setup_r717_test.go

Escrow re-auth answers in the box language; a stacks test no longer writes into its source folder

2026-10-17 10:18:53 +02:00

after_setup_test.go

v0.282.0: after_setup (the app's own sign-up switch), close sign-up now (decision 49), probes read lists + done_status (R-715)

2026-09-29 16:19:12 +02:00

after_setup.go

R-304 option C: operator mail when a household's code opens or may open an older package (once a day); R-298 side fix (no eject/format on a backup-target drive); R-717 comments

2026-10-08 10:07:03 +02:00

after_unclean_boot_test.go

v0.311.0 (before the build): the repair's commands run quietly — no household file name can reach a log or the operator event

2026-10-14 16:58:20 +02:00

after_unclean_boot.go

v0.311.0 (before the build): the repair's commands run quietly — no household file name can reach a log or the operator event

2026-10-14 16:58:20 +02:00

allowlist_test.go

v0.329.0 (review): an app named like another app's appdata folder gets no root; USERDATA_PATH is always derived, never the app's env

2026-10-17 23:22:54 +02:00

allowlist_wiring_test.go

v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A)

2026-10-17 16:34:12 +02:00

allowlist.go

v0.329.0 (review): an app named like another app's appdata folder gets no root; USERDATA_PATH is always derived, never the app's env

2026-10-17 23:22:54 +02:00

appinfo_address_test.go

R-498: the app page's first steps name the household's address, not wiki.DOMAIN

2026-10-05 23:12:59 +02:00

appinfo_address.go

v0.315.0: one app page with four tabs; the guide the catalog can carry; no Raspberry Pi badge

2026-10-15 18:37:50 +02:00

captureset_wiring_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

classify_binds_test.go

Backup classification: schema + parser + pure classifier (INERT, v0.132.0)

2026-07-14 18:46:32 +02:00

classify_binds.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

classify_wiring_test.go

R-1252 (P2): a rejected or absent backup block never deletes second-drive copies — reconcile only on a valid classification; a rejected block is said on the app's status and once a day to the operator (backup_run_failures); kept copies stay kept (H2); Remove drops the kept records it deleted (H9). Commit only.

2026-10-24 20:07:16 +02:00

controller_image_retention_test.go

v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

2026-10-01 07:36:26 +02:00

controller_image_retention.go

v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

2026-10-01 07:36:26 +02:00

d4_needs_drive_test.go

v0.318.0: the internal data place, partitions, an honest whole-box backup offer (R-1084), sys_drive never offered (R-1082)

2026-10-16 03:57:49 +02:00

datapaths_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

datapaths.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

degraded_test.go

v0.222.0: ask whether a supervised member is DEAD before whether one is UNHEALTHY (R-384), and stop promising an undo copy nobody looked for (R-383)

2026-08-23 07:25:00 +02:00

delete_r442_test.go

v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

2026-10-16 22:46:00 +02:00

delete_r1027_test.go

Media build part 1 (unreleased): real restart (R-1026), media apps on every PRESENT drive via an owned compose override (R-1023), dead-drive check from mountinfo, removal never deletes shared/:ro binds (R-1027), safety list knows userdata (R-1032), no drive question for media apps (R-1031)

2026-10-15 09:25:43 +02:00

delete.go

v0.331.0: a removal deletes the volumes still labelled with the app's project that its definition no longer declares (R-1117)

2026-10-18 22:42:52 +02:00

deploy_crashsafety_regression_test.go

v0.66.0: userdata layout + shared-storage ownership convention

2026-06-14 21:58:49 +02:00

deploy_errors.go

kept second-drive copies (D25: R-1175, R-1181, R-1179); .fab import keeps the family gate (R-1191); stale restore temp (R-1188 c); the overcommit sentence made true (R-1192); escrow before the floor (R-1176); unreleased

2026-10-21 15:46:10 +02:00

deploy_secretgen_test.go

fix(backup): O4 — generate a replacement for unrecoverable resettable secrets on restore

2026-07-05 11:52:04 +02:00

deploy.go

D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

2026-10-25 09:27:48 +01:00

desiredstate_test.go

v0.189.0 — desired state + the app-stop crash marker (R-166 / D-b)

2026-08-02 18:40:17 +02:00

desiredstate.go

v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

2026-09-30 10:31:55 +02:00

digest_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

digest.go

v0.269.1: an installed app keeps the image digest it runs until a guarded Update moves it

2026-09-24 13:01:31 +02:00

downstate_test.go

controller: fix-3 dead-app alerting + fix-6 ring cap/spill/spam (WIP, pre-build)

2026-07-12 10:07:47 +02:00

export_mounts_test.go

R-203: the export-mount resolver takes the namespace root too (its own commit)

2026-08-04 18:21:17 +02:00

family_gate_test.go

The family gate (decisions 63/64, R-780): family members with their own logins, a permanent forwardAuth door per family app, anchored exceptions, min_controller

2026-10-02 07:42:47 +02:00

family_gate.go

The family gate (decisions 63/64, R-780): family members with their own logins, a permanent forwardAuth door per family app, anchored exceptions, min_controller

2026-10-02 07:42:47 +02:00

filebrowser_gate.go

R-1281: FileBrowser is served on its own felhom-files network (traefik, and OnlyOffice while linked) and leaves traefik-public, so no app container reaches it. R-1126's check-then-publish gate unchanged. Red-proved. Commit only.

2026-10-25 22:26:45 +01:00

filebrowser_password_test.go

R-1281: FileBrowser is served on its own felhom-files network (traefik, and OnlyOffice while linked) and leaves traefik-public, so no app container reaches it. R-1126's check-then-publish gate unchanged. Red-proved. Commit only.

2026-10-25 22:26:45 +01:00

filebrowser_password.go

R-1126: the gate publishes the container it checked, by id (TOCTOU from the commit's security review)

2026-10-17 12:59:43 +02:00

filebrowser_reset_test.go

v0.321.0: FileBrowser's stale password and its own banners; one backup section on the Data tab; install address of an installed app

2026-10-16 17:17:26 +02:00

filebrowser_restart_gate_test.go

R-1281: FileBrowser is served on its own felhom-files network (traefik, and OnlyOffice while linked) and leaves traefik-public, so no app container reaches it. R-1126's check-then-publish gate unchanged. Red-proved. Commit only.

2026-10-25 22:26:45 +01:00

guestnet_test.go

R-66: the box's own address becomes visible (v0.159.0)

2026-07-22 13:49:57 +02:00

guestnet.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

guide_test.go

v0.315.0: one app page with four tabs; the guide the catalog can carry; no Raspberry Pi badge

2026-10-15 18:37:50 +02:00

hddpath_agreement_test.go

Phase 1 gate: lock deploy/backup HDD path agreement (no doubled felhom-data)

2026-06-13 09:25:31 +02:00

healthprobe.go

R-772 (found live on 9202 with v0.286.0): a stopped probe container is seen on the next tick, not when the last healthy record's 5-minute interval runs out

2026-10-01 21:11:22 +02:00

image_retention_r863_test.go

v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

2026-10-05 07:13:02 +02:00

image_retention_test.go

v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

2026-10-05 07:13:02 +02:00

image_retention.go

v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

2026-10-05 07:13:02 +02:00

import_record.go

D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

2026-10-25 09:27:48 +01:00

import_root_classify_test.go

v0.172.0 fixup: EnsureImportRoot must apply the convention to the parent userdata dir

2026-07-26 08:15:47 +02:00

infra_test.go

v0.41.0: first-boot base-infra bring-up + self-heal (+ Section-G mount fix)

2026-06-11 14:56:42 +02:00

infra_tunnel_test.go

v0.345.1: SECURITY — cloudflared 2026.10.3 (Cloudflare's eMudhra notice, 2026-10-20)

2026-10-26 21:02:08 +01:00

infra.go

v0.332.0: one sign-in for the file manager — a dashboard pass, a host-only files cookie, a per-box secret header (R-1100, operator D16)

2026-10-19 04:56:56 +02:00

initialcreds_test.go

v0.84.0: catalog-driven initial_credentials — read an app's auto-generated first-login from a file and show it on the app page

2026-06-26 11:00:06 +02:00

initialcreds.go

controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

2026-09-23 20:25:28 +02:00

install_hold_test.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

install_hold.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

install_id_test.go

D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

2026-10-25 09:27:48 +01:00

install_interrupted.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

installed_test.go

v0.237.0: the Update button takes a backup first, and tells the truth (update arc slice 4 — R-448, R-443, R-439)

2026-09-13 11:41:31 +02:00

installed.go

Media build part 1 (unreleased): real restart (R-1026), media apps on every PRESENT drive via an owned compose override (R-1023), dead-drive check from mountinfo, removal never deletes shared/:ro binds (R-1027), safety list knows userdata (R-1032), no drive question for media apps (R-1031)

2026-10-15 09:25:43 +02:00

kept_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

kept.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

ladder_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

ladder.go

v0.341.0: the night update takes a security_fix ladder step (D39 = B, 09 §3 decision 255, R-1239); every other leg guard unchanged; the leg names the CVE ids; MinAgent 0.158.1

2026-10-23 13:09:52 +02:00

life_records.go

D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

2026-10-25 09:27:48 +01:00

lifecycle_orphan_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

lifecycle_test.go

catalog: app lifecycle states - available/hidden/abandoned (v0.158.0)

2026-07-21 16:19:58 +02:00

mailenv_test.go

v0.89.0: app-email plaintext-only listener (:2526) + split-From mapping

2026-06-29 13:13:40 +02:00

mailenv.go

v0.253.0 — errors carry the key of the sentence they are (R-557 slice 2 release B)

2026-09-18 11:44:30 +02:00

manager.go

R-1281: FileBrowser is served on its own felhom-files network (traefik, and OnlyOffice while linked) and leaves traefik-public, so no app container reaches it. R-1126's check-then-publish gate unchanged. Red-proved. Commit only.

2026-10-25 22:26:45 +01:00

media_library_test.go

Review round 2: a media restart no longer starts an app the household stopped (R-721); the file manager's header name file appears whole (R-1100 race, 44/300 -> 0/300); both red-proved; unreleased

2026-10-24 15:26:56 +02:00

media_library.go

Review round 2: a media restart no longer starts an app the household stopped (R-721); the file manager's header name file appears whole (R-1100 race, 44/300 -> 0/300); both red-proved; unreleased

2026-10-24 15:26:56 +02:00

metadata_i18n_test.go

v0.257.0: the app catalog can speak English (R-560, slice 5 Part A)

2026-09-20 14:31:52 +02:00

metadata_i18n.go

v0.315.0: one app page with four tabs; the guide the catalog can carry; no Raspberry Pi badge

2026-10-15 18:37:50 +02:00

metadata_test.go

v0.54.0: Phase 2b — restore-from-recovery-unit + fail-closed data-key gate

2026-06-13 11:12:43 +02:00

metadata.go

R-1252 (P2): a rejected or absent backup block never deletes second-drive copies — reconcile only on a valid classification; a rejected block is said on the app's status and once a day to the operator (backup_run_failures); kept copies stay kept (H2); Remove drops the kept records it deleted (H9). Commit only.

2026-10-24 20:07:16 +02:00

migrate_fs3_test.go

F-S2 + F-S3: compose-derived appdata dir resolution (v0.131.0)

2026-07-14 17:45:53 +02:00

migrate_setgid_linux_test.go

v0.66.0: userdata layout + shared-storage ownership convention

2026-06-14 21:58:49 +02:00

migrate_setgid_test.go

controller v0.68.0: storage lifecycle on intermediary model (H2/H3/M1/M3 + boot-id)

2026-06-15 19:26:02 +02:00

migrate_test.go

B1: data-migration engine (MigrateAll + MigrateApp) + backup mutual-exclusion

2026-06-14 19:42:57 +02:00

migrate.go

v0.276.0: a restore and a drive move keep the app's records (R-697, R-700)

2026-09-27 17:59:04 +02:00

oom_test.go

controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

2026-09-23 17:16:57 +02:00

oom.go

controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

2026-09-23 17:16:57 +02:00

pgconvert_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

pgconvert.go

v0.276.0: a restore and a drive move keep the app's records (R-697, R-700)

2026-09-27 17:59:04 +02:00

pin_r645_test.go

R-645: the night backup skips an app whose pinned version is not the one it runs (09 decision 142)

2026-10-06 11:39:25 +02:00

pin_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

pin.go

v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A)

2026-10-17 16:34:12 +02:00

portable_secrets_test.go

D5: an app restore works from the drive alone (v0.188.0)

2026-07-30 16:33:06 +02:00

r480_r478_test.go

controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

2026-09-13 19:26:50 +02:00

r485_backup_card_test.go

controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

2026-09-13 19:26:50 +02:00

r489_volumes_removed_test.go

controller v0.242.0: a removed app is listed with its kept backup; five small ones (R-487 R-491 R-490 R-489 R-476 R-456)

2026-09-13 22:50:18 +02:00

r536_deploy_done_hook_test.go

v0.244.0: the backup page stops promising what it does not hold (R-537/R-538/R-536)

2026-09-16 16:55:55 +02:00

r553_deploy_error_kinds_test.go

R-1125: the install page's memory box says what to do too (fixtures re-captured under new names)

2026-10-17 13:26:46 +02:00

r569_stack_error_kinds_test.go

R-569: stack-lifecycle handlers pick their status by error KIND, not English words

2026-10-05 22:24:22 +02:00

r575_overcommit_key_test.go

R-575: the overcommit warning follows the reader's language

2026-10-05 23:12:59 +02:00

r591_copy_i18n_test.go

v0.297.0: burn-down round 2 — 24 small rows (R-591 R-568 R-567 R-363 R-547 R-10 R-552 R-251 R-104 R-619 R-362 R-675 R-256 R-257 R-240 R-365 R-425 R-565 R-564 R-603 R-454 R-208 R-457-swept) + the banner countdown and deepCopyStack twins; MinAgent 0.131.0

2026-10-05 20:12:56 +02:00

r591_copy_meta_alias_test.go

v0.297.0: burn-down round 2 — 24 small rows (R-591 R-568 R-567 R-363 R-547 R-10 R-552 R-251 R-104 R-619 R-362 R-675 R-256 R-257 R-240 R-365 R-425 R-565 R-564 R-603 R-454 R-208 R-457-swept) + the banner countdown and deepCopyStack twins; MinAgent 0.131.0

2026-10-05 20:12:56 +02:00

r621_hold_log_fallback_test.go

R-621: a held app's logs show the log the hold kept

2026-10-05 21:55:37 +02:00

r630_r634_v0262_test.go

v0.262.1: the busy refusal is a CONFLICT, not a server error (R-633)

2026-09-22 21:48:01 +02:00

r634_deploying_test.go

controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

2026-09-23 17:16:57 +02:00

r649_failed_deploy_cleanup_test.go

controller v0.266.0: a failed install removes what it started (R-649, operator ruling)

2026-09-23 18:06:29 +02:00

r650_main_test.go

v0.285.0 — a box keeps two controller versions (decision 56, R-745); the update clean-up's nil-stack crash (R-751)

2026-10-01 07:36:26 +02:00

r651_r658_remove_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

r658_undo_volumes_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

r665_verify_meta_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

r669_restore_meta_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r670_probe_meta_test.go

controller v0.272.0: the backup page says when a whole-box backup does not fit (R-685); R-671, R-670, R-677

2026-09-25 11:19:27 +02:00

r674_head_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r679_already_current_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r681_install_interrupted_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

r682_remove_interrupted_test.go

R-682: a Remove cut off by a controller restart is finished at boot

2026-10-05 23:12:59 +02:00

r694_restored_login_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

r700_records_carried_test.go

v0.276.0: a restore and a drive move keep the app's records (R-697, R-700)

2026-09-27 17:59:04 +02:00

r721_leg_stopped_test.go

v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

2026-09-30 10:31:55 +02:00

r757_inject_test.go

R-757: a secret only after_install reads is not invented for an installed app

2026-10-05 23:12:59 +02:00

r772_not_checked_test.go

R-772 (found live on 9202 with v0.286.0): a stopped probe container is seen on the next tick, not when the last healthy record's 5-minute interval runs out

2026-10-01 21:11:22 +02:00

r773_restore_signup_lock_test.go

v0.314.0: a restore puts the setup gate back as it was (R-1057); a test build moves with the floor (R-1053); Prowlarr links itself (R-1058); the box claims Plex by address (R-1060)

2026-10-15 14:34:33 +02:00

r864_stderr_tail_test.go

v0.294.0: off-site clean-up guard follows the policy's own constants (R-867); no image clean-up while compose pulls (R-863); stderr tail (R-864); move-aside destination logged (R-869)

2026-10-05 07:13:02 +02:00

r1058_prowlarr_wires_test.go

v0.314.0: a restore puts the setup gate back as it was (R-1057); a test build moves with the floor (R-1053); Prowlarr links itself (R-1058); the box claims Plex by address (R-1060)

2026-10-15 14:34:33 +02:00

r1106_set_secret_values_test.go

v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

2026-10-16 22:46:00 +02:00

r1117_leftover_volume_test.go

v0.331.0: a removal deletes the volumes still labelled with the app's project that its definition no longer declares (R-1117)

2026-10-18 22:42:52 +02:00

r1125_install_memory_test.go

R-1125: the install page shows the check's own memory reading

2026-10-17 13:37:55 +02:00

r1191_import_gate_test.go

kept second-drive copies (D25: R-1175, R-1181, R-1179); .fab import keeps the family gate (R-1191); stale restore temp (R-1188 c); the overcommit sentence made true (R-1192); escrow before the floor (R-1176); unreleased

2026-10-21 15:46:10 +02:00

remove_interrupted.go

R-682: a Remove cut off by a controller restart is finished at boot

2026-10-05 23:12:59 +02:00

restart_real_test.go

Media build part 1 (unreleased): real restart (R-1026), media apps on every PRESENT drive via an owned compose override (R-1023), dead-drive check from mountinfo, removal never deletes shared/:ro binds (R-1027), safety list knows userdata (R-1032), no drive question for media apps (R-1031)

2026-10-15 09:25:43 +02:00

restore_gate_test.go

v0.314.0: a restore puts the setup gate back as it was (R-1057); a test build moves with the floor (R-1053); Prowlarr links itself (R-1058); the box claims Plex by address (R-1060)

2026-10-15 14:34:33 +02:00

restore_gate.go

D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.

2026-10-25 09:27:48 +01:00

samba_classify_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

samba_classify.go

docs(shares): R-7b v0.145.0 — CHANGELOG, CONTEXT, REUSE, README; caveats cleared

2026-07-18 13:06:41 +02:00

samba_lanaddr_test.go

v0.151.0 — the Megosztás page stops reloading, and says how to connect

2026-07-20 10:46:21 +02:00

samba_test.go

v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

2026-10-17 09:36:34 +02:00

samba.go

v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

2026-10-16 22:46:00 +02:00

setup_gate_accept_test.go

Media build part 2 (unreleased): drive wiring in every app (R-1024/R-1037), old-install repair (R-1047), drive events notice + real restart now/later + stream check, file browser lets go of dead/removed drives and recreates on return (R-1038), safe removal keeps the drive (R-1044), Plex claim on the running server + probe accept (R-1028/R-1045)

2026-10-15 09:54:49 +02:00

setup_gate_test.go

v0.282.0: after_setup (the app's own sign-up switch), close sign-up now (decision 49), probes read lists + done_status (R-715)

2026-09-29 16:19:12 +02:00

setup_gate.go

Media build part 2 (unreleased): drive wiring in every app (R-1024/R-1037), old-install repair (R-1047), drive events notice + real restart now/later + stream check, file browser lets go of dead/removed drives and recreates on return (R-1038), safe removal keeps the drive (R-1044), Plex claim on the running server + probe accept (R-1028/R-1045)

2026-10-15 09:54:49 +02:00

signup_block_test.go

v0.281.0: 'Done' asks the probe first; sign-up closed after the first admin (decision 47); R-713 code-bound values refused, ${NAME|base64}

2026-09-29 09:57:58 +02:00

signup_block.go

R-304 option C: operator mail when a household's code opens or may open an older package (once a day); R-298 side fix (no eject/format on a backup-target drive); R-717 comments

2026-10-08 10:07:03 +02:00

skeleton_derive.go

v0.172.0 fixup: EnsureImportRoot must apply the convention to the parent userdata dir

2026-07-26 08:15:47 +02:00

stack_errors.go

R-569: stack-lifecycle handlers pick their status by error KIND, not English words

2026-10-05 22:24:22 +02:00

start_services_test.go

v0.153.0 — R-47: the DB replay no longer races the app, on BOTH restore paths

2026-07-20 17:01:52 +02:00

unattended_security_test.go

v0.341.0: the night update takes a security_fix ladder step (D39 = B, 09 §3 decision 255, R-1239); every other leg guard unchanged; the leg names the CVE ids; MinAgent 0.158.1

2026-10-23 13:09:52 +02:00

unattended_test.go

v0.279.0: after_install (decision 45), known default logins on the page, Part D empty-backup alarm, night chain (R-705), R-706

2026-09-28 18:38:30 +02:00

unattended.go

v0.341.0: the night update takes a security_fix ladder step (D39 = B, 09 §3 decision 255, R-1239); every other leg guard unchanged; the leg names the CVE ids; MinAgent 0.158.1

2026-10-23 13:09:52 +02:00

undo_test.go

controller v0.268.0: the undo finds volumes by definition; a held app names only a whole copy; one press = one tested step (R-658, R-659, R-660, R-651; 09 §6.4 part 5)

2026-09-24 08:15:27 +02:00

undo.go

v0.284.0 — a box deletes old app images (decision 53, R-736); an after_install app is held until its known login is replaced (R-741)

2026-09-30 22:29:33 +02:00

unhealthy_test.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

unhealthy.go

controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

2026-09-24 12:18:39 +02:00

update_events_test.go

controller v0.264.0: the household is told when an update is undone or held, in its language

2026-09-23 13:51:21 +02:00

update_test.go

v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

2026-09-26 10:35:22 +02:00

update_tiers_test.go

controller v0.239.0: any backup tier lets an app update (R-475)

2026-09-13 17:16:24 +02:00

update.go

R-717: after_setup open_command — the family window reopens an app's DB-held sign-up switch

2026-10-06 15:15:33 +02:00

updatelock_test.go

v0.261.0 — the controller no longer swaps itself out from under an app update (R-608, R-609)

2026-09-21 14:23:59 +02:00

updateorder_test.go

v0.270.0: no update for a current app (R-679); an interrupted install is reported (R-681); a restore brings back the pinned version's health check (R-669); R-674

2026-09-24 16:49:43 +02:00

updateorder.go

controller v0.272.0: the backup page says when a whole-box backup does not fit (R-685); R-671, R-670, R-677

2026-09-25 11:19:27 +02:00

userdata_belt_gate_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

userdata_belt_test.go

R-203: the app and its backup look in the same directory — one resolver, every caller

2026-08-04 18:17:05 +02:00

userdata_path_r203_test.go

R-203: the app and its backup look in the same directory — one resolver, every caller

2026-08-04 18:17:05 +02:00