rehearsal 2026-10-20: report draft (night/morning parts pending); W26 marked fixed (unreleased)
gates / gates (push) Successful in 12m56s
gates / gates (push) Successful in 12m56s
This commit is contained in:
@@ -0,0 +1,124 @@
|
||||
# REPORT — Tester-2 rehearsal with a pretend household + an independent data-loss hunt (2026-10-20 → 21)
|
||||
|
||||
> DRAFT written 2026-10-20 ~21:30 UTC, before the night. Sections marked **PENDING** are filled in the morning.
|
||||
> Evidence: `documentation/audits/rehearsal-2026-10-20/` (journal, A0–B10, screens) and
|
||||
> `documentation/audits/dataloss-hunt-2026-10-20/` (C1–C3). Architecture read for the claims: `07-backup-architecture.md`,
|
||||
> `10-localisation.md`, `00-capability-map.md` (A15).
|
||||
|
||||
## Five sentences
|
||||
|
||||
PENDING (morning).
|
||||
|
||||
## The ten places a household gets stuck
|
||||
|
||||
`documentation/audits/rehearsal-2026-10-20/B10-stuck/README.md`. In short:
|
||||
|
||||
1. The box froze twice on the first afternoon (≈1 h and ≈35 min); only pulling the plug helped (R-1192, P1).
|
||||
2. The bind page needs an owner passphrase the household does not have — 2 h 4 min waiting for the operator.
|
||||
3. A power cut during a full off-site restore leaves the app on the backup's older data; the page only says „interrupted" (R-1195).
|
||||
4. A pulled drive breaks the last uploads (0 bytes or gone) although each was confirmed (R-1196).
|
||||
5. The family's warning mails went to the operator, not the family (R-1199).
|
||||
6. „Ödön" and „Írisz" are refused as family names (W12).
|
||||
7. A new drive needs a „mount name" nobody knows; the button silently does nothing (W13).
|
||||
8. Sharing waits for ever for a password the page never asks for (W21).
|
||||
9. Errors arrive as raw technical English (W22, W25).
|
||||
10. Three apps' „first steps" are wrong for this household (wrong address, wrong user name, wrong sign-up state; W17–W19).
|
||||
|
||||
## Data-loss findings, ranked
|
||||
|
||||
| row | Sev | harm | reproduced | design / defect |
|
||||
|---|---|---|---|---|
|
||||
| R-1175 | P1 | shares on two drives sharing one second drive: every night one drive's share copy is pruned; the night a drive dies its copy is deleted | unit test on production code (`C3-D1-shares-tier2/`) | defect |
|
||||
| R-1176 | P1 | a box rebuilt after „delete the old host" cannot reach its off-site history: no recovery code asked, a new key, the old history set aside on night one | hub store unit test (`C3-K1-…`); controller half read in code; live test in B7 — PENDING | defect |
|
||||
| R-1191 | P1 | a `.fab` import makes a family-only app open to anyone | LIVE on scratch 9202 | defect (security) |
|
||||
| R-1192 | P1 | the 8 GB box froze under first-day use; two plug pulls | LIVE on Tester4 (twice) | defect — cause not diagnosed (no shell on the box) |
|
||||
| R-1177 | P2 | a failed local restore destroys the live data, keeps no copy | LIVE on 9202 | design question (D22 in STATUS) |
|
||||
| R-1195 | P2 | a power cut mid full off-site restore: app on the backup's data, page says only „interrupted" | LIVE on Tester4 (B6 #2) | defect |
|
||||
| R-1178 | P2 | second-drive „whole restore" can change files, refuse the DB, leave the app stopped and say „untouched" | unit test | defect |
|
||||
| R-1180 | P2 | the nightly mirror (`rsync --delete`) can run during a restore from it | unit test | defect |
|
||||
| R-1181 | P2 | a missing app folder deletes its second-drive copy in one night (the only copy for optional folders) | unit test | defect (D23 in STATUS) |
|
||||
| R-1179 | P2 | a drive marked „away" can still be the second-drive target | code + unit test | defect |
|
||||
| R-1182 | P2 | abandoning one set-aside off-site copy deletes every retained key package | code | defect |
|
||||
| R-1199 | P2 | warning mails reach the operator, not the household | LIVE (two mailboxes) | defect |
|
||||
| R-1185 | P3 | a dump that fails its own check has already replaced the good one | unit test (docker stub) | defect (order) |
|
||||
| R-1186 | P3 | the nightly off-site copy is skipped silently when another backup holds the flag | code | defect |
|
||||
| R-1184 | P3 | a cut-off shares restore can be reported restored with files missing | code | defect |
|
||||
| R-1196 | P3 | uploads confirmed just before a drive pull are 0 bytes or gone | LIVE (B6 #4) | defect |
|
||||
| R-1183 | P3 | on 2026-10-25 every hub daily job runs twice (DB snapshot keep-2 pruned a day early) | replay of the hub's arithmetic | defect |
|
||||
| R-1187 … R-1190 | P3 | the unproven candidates of the four reviewers, grouped | code reading | mixed |
|
||||
|
||||
## Failure scenarios (B6)
|
||||
|
||||
| # | scenario | result | evidence |
|
||||
|---|---|---|---|
|
||||
| ★1 | power cut mid app install | PASS — clean rollback, honest event, reinstall in 15 s | `B6-failures/s1-…` |
|
||||
| ★2 | power cut mid off-site restore | 6 s: safe; 14 s: app on the backup's data, page „interrupted" → R-1195 | `s2-…` |
|
||||
| ★3 | data disk 100 % during backup | PASS — warned at 89 %, refused before writing, healed; SMB error unclear; system disk 97 % not run | `s3-…` |
|
||||
| ★4 | data drive pulled, put back | apps stopped in 42/34 s, back by themselves; last uploads 0 B/missing → R-1196 | `s4-…` |
|
||||
| ★5 | slow lossy line, first big off-site | run failed under 1 Mbit + 5 % loss, raw English; second press OK 3 m 38 s | `s5-…` |
|
||||
| ★6 | off-site blocked | failed in 2.5 min, raw English; catch-up OK 2 m 37 s (shortened, not a night) | `s6-…` |
|
||||
| ★7 | DST | PENDING (morning) | |
|
||||
| ★8 | wrong clock at boot ±2 y | PENDING (morning) | |
|
||||
| ★9 | two actions at once | PASS — second action refused with a clear sentence | `s9-…` |
|
||||
| ★10 | box off 3 days (+#15 restart in the catch-up) | PENDING (morning) | |
|
||||
| 11 | hard reset mid app update | PENDING — expected NOT RUN: no update is offered (nothing released during the run) | |
|
||||
| 12 | DNS dead 1 h | PASS for data; operator told after ~37 min, household never | `s12-…` |
|
||||
| 13 | second drive added later | not offered as the backup place → R-1198; safe removal OK; blank texts (W29) | `s13-…` |
|
||||
| 14 | remove keeping data → reinstall „use kept data" | PASS — 47/47 documents, 47/47 originals | `s14-…` |
|
||||
| 16 | English browser / English dashboard | follows the household's setting (by design); a few Hungarian strings → fixed W26 (unreleased) | `s16-…` |
|
||||
|
||||
## Restore paths (B8)
|
||||
|
||||
All seven customer paths PASS on the live box (`B8-restores/README.md`): A.1.1 Mealie unit 17 s; A.1.2 Nextcloud from
|
||||
the second drive 3/3 sha256; A.1.3 Radicale verify copy 5 s; A.1.4 Nextcloud missing-only 3/3 sha256 (NFC/NFD: both
|
||||
names come back on the share; Nextcloud itself folds NFD into NFC); A.1.5 BookStack full off-site 30 s; A.1.6 shares
|
||||
2 files; A.1.7 `.fab` Mealie. Gaps: the messages do not say which point in time or how many files.
|
||||
|
||||
## Night chain and DST
|
||||
|
||||
PENDING (morning). Code replay: the controller runs each daily job once on 2026-10-25 (a 02:xx job at the second,
|
||||
CET occurrence); the hub runs every daily job twice (R-1183); spring 2027 puts the 02:30 dump on the 03:30
|
||||
second-drive copy (`B6-failures/dst-replay/`).
|
||||
|
||||
## Interventions (operator-only acts)
|
||||
|
||||
| # | when (UTC) | what | minutes the household waited |
|
||||
|---|---|---|---|
|
||||
| 1 | 09:57 → 12:00:57 | the owner passphrase handed over (by design, out of band) | 124 |
|
||||
| 2 | asked 09:35, done 12:01–12:15 | off-site switched on for Tester4 | 0 (done before the household needed it) |
|
||||
| 3 | PENDING | delete host Tester4-816e21 before the reinstall (B7) | PENDING |
|
||||
|
||||
Not counted as interventions: the two plug pulls (14:11, 16:13) — a household can do that, and did.
|
||||
|
||||
## Versions
|
||||
|
||||
controller 0.336.0 (`7ca59e2`, floor), agent 0.161.0 (`4e1621c`), hub 0.162.0, golden 0.331.0, min_agent 0.158.1,
|
||||
installer 1.35.0, ISO 1.29.0 (sha256 `dceacae5…4829`), catalog `c50adfc6` (65 templates). Nothing was released, deployed,
|
||||
vouched, baked or published during the run. One text fix was committed, not released: controller `01c967e` (W26).
|
||||
|
||||
## Browser spike (A4)
|
||||
|
||||
Works: Chromium 155 + Playwright 1.52 in a throwaway LXC on demo-hp, phone and computer, HU and EN, in ~12 minutes.
|
||||
121 screenshots. Limits: no real DNS/TLS for the household's address; not a human. `A4-browser/README.md`.
|
||||
|
||||
## Teardown
|
||||
|
||||
PENDING (Part D).
|
||||
|
||||
## Secrets (names only)
|
||||
|
||||
All in `sec`, prefix `REHEARSAL_2026_10_20_`: `9202_PW`, `9202_RESETCODE`, `APP_BOOKSTACK`, `APP_RADICALE`,
|
||||
`APP_VAULTADMIN`, `BIND_TOKEN`, `BOOKSTACK_TOKEN`, `DASH_PW`, `FAMILY_IRISZ`, `FAMILY_KATA`, `FAMILY_ODON`,
|
||||
`INSTALL_ROOTPW`, `IRISZ_PW`, `KATA_PW`, `ODON_PW`, `OLD_BIND_TOKEN`, `PAIRING_CODE`, `PASSPHRASE`, `RECOVERY_CODE`,
|
||||
`SETUP_CODE`, `SMB_PW`. Kept (the operator decides); none written anywhere else. Evidence scanned for their values:
|
||||
0 hits.
|
||||
|
||||
## Register
|
||||
|
||||
Before 153 open rows; now 178 — opened R-1175 … R-1199 (25), closed 0. PENDING final count.
|
||||
|
||||
## Observations
|
||||
|
||||
FILED: everything in the tables above. NOT-A-FINDING: the dashboard ignores an English browser (by design: the
|
||||
household's setting wins); Nextcloud folding NFD into NFC (upstream behaviour; both forms survive on the share); the
|
||||
films' off-site size (CBR filler compresses; nothing missing); PENDING more.
|
||||
@@ -27,7 +27,7 @@
|
||||
| W23 | Actual Budget | the whole app is English (v26.9.0) and shows „A new version of Actual is available!" | English; an upgrade nag the household cannot act on | catalog note |
|
||||
| W24 | Távoli mentés page | an SSH key / known_hosts form with „no blind TOFU", „ssh-keyscan -p <port> <host>" on the household's page | operator detail, English | hide behind „Haladó" |
|
||||
| W25 | failed off-site run | „✗ Hiba … Utolsó hiba: offbox backup immich: exit status 1 … a pillanatképek száma még ismeretlen"; operator mail „A távoli mentés ismeretlen okból nem…"; household mail „A biztonsági mentés sikertelen! Kérjük, ellenőrizd a rendszert." | English and technical; says nothing of the apps that DID copy; the household mail gives no action | name the app in Hungarian and say „a többi alkalmazás rendben" + „holnap éjjel újra próbálja" |
|
||||
| W26 | English dashboard (B6 #16) | monitoring page: „Belső SSD – rendszer és alkalmazások", „Az operációs rendszer és a telepített alkalmazások tárhelye.", „Belső lemez – sablonok és helyi mentések", „Távoli biztonsági mentés", „Titkosított, telephelyen kívüli biztonsági mentések." (`internal/web/agent_host_metrics_handler.go:91-95`); restore page „Megosztások" (`internal/backup/shares_payload.go:42`); a stored restore message stays Hungarian | untranslated in English mode | msg keys (the localisation slice) |
|
||||
| W26 | English dashboard (B6 #16) | monitoring page: „Belső SSD – rendszer és alkalmazások", „Az operációs rendszer és a telepített alkalmazások tárhelye.", „Belső lemez – sablonok és helyi mentések", „Távoli biztonsági mentés", „Titkosított, telephelyen kívüli biztonsági mentések." (`internal/web/agent_host_metrics_handler.go:91-95`); restore page „Megosztások" (`internal/backup/shares_payload.go:42`); a stored restore message stays Hungarian | untranslated in English mode | msg keys (the localisation slice) — **FIXED 2026-10-20, controller `01c967e`, unreleased** (ships with the next version) |
|
||||
| W27 | an English BROWSER | the whole dashboard stays Hungarian with `en-US` — it follows the household's setting, not the browser | by design (a visitor switch exists for signed-out pages) | — (NOT-A-FINDING: the household's setting wins, `10-localisation.md`) |
|
||||
| W28 | share restore | „Nem állítható vissza (a mappa nincs élő adatmeghajtón): beolvasas." | names a share („beolvasas") the household never created | say what it is (Paperless's scan folder?) or skip it silently |
|
||||
| W29 | storage card after a plain decommission | „Kiváltva — Adatok átköltöztetve ide: . () Időpont: …" | the migration sentence shown with empty blanks when nothing was moved | „Leszerelve, adat nem volt rajta" |
|
||||
|
||||
Reference in New Issue
Block a user