From bf69bb91aca81b44f7ad728ccbe9a1ecfa46d294 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 29 Oct 2026 08:54:41 +0100 Subject: [PATCH] =?UTF-8?q?D62=20+=20D63=20(operator=202026-10-29=2008:17)?= =?UTF-8?q?:=2009=20=C2=A73=20decisions=20281/282;=2007=20=C2=A76.3=20[DES?= =?UTF-8?q?IGN]=20=E2=80=94=20restore=20copies=2030=20days=20+=20T=C3=B6rl?= =?UTF-8?q?=C3=A9s=20most;=20prove-or-revert=20for=20H4/H5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../architecture/07-backup-architecture.md | 11 +++++++++++ .../architecture/09-update-architecture.md | 13 +++++++++++++ 2 files changed, 24 insertions(+) diff --git a/documentation/architecture/07-backup-architecture.md b/documentation/architecture/07-backup-architecture.md index 0ec38f97..69242973 100644 --- a/documentation/architecture/07-backup-architecture.md +++ b/documentation/architecture/07-backup-architecture.md @@ -835,6 +835,17 @@ app-stop marker is readable and does not name the app, and no restore runs. **De operator may reverse:** *How long does an unused restore copy stay?* (a) 14 days; (b) for ever (as before); (c) 3 days. (a) holds up to two weeks of disk per restore and gives support two weeks; (b) grows without end; (c) is shorter than a support reply. A held or waiting copy is never touched under any option. Tests `TestR1256_*`, each red first. +**`[DESIGN]` 2026-10-29 — D62 replaces the age, and the household can delete a copy (operator ruling 08:17; `09` §3 +decision 281).** An unused copy stays **30 days**. The restore page's kept-copies list („Megőrzött másolatok") shows each +restore copy: the app, the date of the restore it protects, its size and „automatikusan törlődik: ". „Törlés most" +deletes one earlier after the warning („Ez a(z) adatainak másolata a -i visszaállítás előttről. Ha törlöd, a +visszaállítás többé nem vonható vissza, és ez a másolat nem hozható vissza.") and the app's name typed. Never deletable: a +copy a hold or a pending put-back needs (the same rule as the sweep; the button is off with the reason, and the handler +refuses it), and any copy while a backup or restore runs or the app updates (409). The check and the removal are one step +under the backup manager's lock. One `[WARN]` log line and one operator-only event `restore_copy_deleted` (who, app, +restore date, size; hub `19afefab`) per delete. Controller `e3fce09`, tests `TestD62_*`. **D63** (`09` §3 decision 282): +H4 and H5's failed stop ship only with a live proof, staged with a fault switch that exists only in a `-tags faultinject` +test build. **`[FACT]` 2026-10-29 night, scratch 9202 (`audits/night-2026-10-28/r1256-restore/h5-live/`):** vikunja's first volume held by a created-only container, the household's restore pressed through the page: „Failed to remove volume vikunja_vikunja_data before the restore … (not written into)", the restore failed, the put-back poured the live copy of diff --git a/documentation/architecture/09-update-architecture.md b/documentation/architecture/09-update-architecture.md index 7c92d08a..b39cdf86 100644 --- a/documentation/architecture/09-update-architecture.md +++ b/documentation/architecture/09-update-architecture.md @@ -1193,6 +1193,19 @@ a single-page app answers 200 on every path, so a „no such path" probe passed tool now probes port 1. `test-record-move` also refuses a `memory_tight` step whose range does not raise the limit — Wanderer's Meilisearch went 256 → 384 MB and was measured again (it sizes itself to its limit: 88.8 %). +### 2026-10-29 (morning, attended) — D62: an unused restore copy stays 30 days, and the household may delete it; D63: prove or revert + +281. **D62 = an unused restore copy is kept 30 days, and the household can delete it earlier** with one button + („Törlés most") in the kept-copies list on the restore page (place A), after a warning that names the app and the + restore's date and the app's name typed. A copy a hold or a pending put-back needs is never deleted — not by the + sweep, not by the button (it is off, with the reason in one line); a delete while a backup or restore runs is refused. + One log line and one operator event (`restore_copy_deleted`: who, app, date, size) per delete. Replaces the night's + 14 days (decided by CC unattended). *Operator, 2026-10-29 08:17.* `07` §6.3. +282. **D63 = R-1256 H4 and H5's failed-stop branch are released only with a live proof; else they are reverted** (their + tests stay, skipped with the reason) before the controller tag. The proof uses a fault switch that exists only in a + `-tags faultinject` test build — never in the release image (`TestD63_TheReleaseBuildHasNoFaultSwitch`). *Operator, + 2026-10-29 08:17.* `07` §6.3. + ### 2026-10-28 (day, attended) — RomM kept; the runtime cache fills itself in CI 277. **D61 = keep RomM offered** (R-1330) while no RomM release carries Node ≥ 24.22.1; the first one that does is taken