# REPORT — release run 2026-10-29 (afternoon, attended): restart a box's controller and clear a held app from the hub

## Five lines

1. **Restart works with the controller stopped: yes.** Stopped by hand on Tester 1, one press restarted it 5 s after
   the stop. On the release builds one press read „done" on the hub 16 s after the press; the fourth press in 15
   minutes was refused.
2. **Stuck check: alarm only, for now.** So far 631 probes on Tester 1 and demo-hp: median 57–61 ms, max 163 ms, no failed
   probe, no 5-s timeout. The night chain is not in it yet; the log runs to 2026-10-30 07:00 UTC, then CC decides (R-1344).
3. **Clear stays after a save: yes.** On the release builds: cleared 3 s after the press, still gone after the next
   settings save 6.5 minutes later; the hub's list emptied.
4. **Released:** hub 0.176.1, agent 0.169.0 (vouched), controller 0.348.0 (the global floor since 14:48 CET).
5. **What you do:** nothing is blocked. One new decide row (D65: a „Reboot guest" button — CC says not now). Tester4 is
   off since 10-27; it updates when you start it.

## Readings taken

1. **The restart is the agent's, not the controller's** — a stopped or stuck controller cannot restart itself. It uses
   `felhom-controller-bootstrap.service`, the same unit as the supervisor (R-523), not the host's bootstrap unit.
2. **The brake counts operator restarts with the supervisor's**, and a 4th restart in 15 minutes opens a 30-minute
   refusal for presses (the supervisor's own pause is separate).
3. **Part 2 stopped at the alarm.** A day run cannot hold the night chain (the whole-guest vzdump), so the „no false fire"
   condition is not shown yet. Building the restart now would introduce a mechanism nobody has measured.
4. **The clear goes through the running controller's socket**, never a file edit under a running controller — the
   file edit was R-1343's cause.

## Versions, digests, CI by commit

| Repo | Commit | CI job | What |
|---|---|---|---|
| felhom.eu (hub) | `3d0c907b` | 2505 green | the two buttons, the agent channel, `controller_unresponsive`, D64 in `04`/`09` — **hub 0.176.0** (`sha256:53372198…`) |
| felhom.eu | `682015db` | 2506 green | manifest → 0.176.0 (Deployment/hub only) |
| felhom.eu (hub) | `d0dbc6f1` | 2510 green | restart button for every guest (0.176.0 gated it on a version the agent does not report); R-1345 |
| felhom.eu (hub) | `2ccf180b` | 2511 green | a token press named by its token — **hub 0.176.1** (`sha256:c105cb9a…`) |
| felhom.eu | `c1f3a163` | 2512 green | manifest → 0.176.1 |
| felhom.eu | `e4d91043` | 2516 | `03`/`05`/`08` [DESIGN], R-1346…R-1348, evidence |
| agent | `637c92c` | 2504, 2507 green | **0.169.0 built from here** (`fc066de6…`, bundle `3ca33f9c…`, tag `v0.169.0`) |
| agent | `db25eb0` | 2513 green | CHANGELOG; `pinned.day0_agent` = 0.169.0 |
| controller | `5b3b541`, `6077ac0`, `99fac06` | 2508, 2509, 2514 green | clear_hold, the socket, R-1340/R-1341, the fallback, the second R-1340 producer |
| controller | `2a0a17a` | 2515 green | v0.348.0 heading — **0.348.0 built from here** (`sha256:672fc1c1…`); rc.2 `1d96f60c…` on 9202 |

The close-out commits' CI is read at the end of the session.

## Rows

- **Closed (4):** R-1343, R-1342, R-1340, R-1341 — each released in 0.348.0 and proven live.
- **Opened (7):** R-1344 (stuck controller: alarm; restart after the measurement), R-1345 (token scopes cannot be edited),
  R-1346 (hub pages slow; the vouch's 504), R-1347 (update-held flag after a restore lift), R-1348 (restore_mixed set at
  start-up sends no mail), R-1349 (guest reboot from the hub — needs your word), R-1350 (`app_start_failed` 30 s after
  a clear).
- **Register:** 226 at the start of the brief → 229.

## Observations

- **F2 (an `app_start_failed` after a clear) is real, filed as R-1350.** The 12:44 clear showed none in 18 minutes; the
  14:57 clear did, 30 s later — the hub's cooldown swallowed the mail. The text is true; the timing is noise.
- **A hub history line from rc.1** reads „held after an off-site restore failed its database replay" for a local restore.
  That is the stored result of a 13:17 UTC clear, written before `99fac06` fixed the second producer: NOT-A-FINDING
  (history, not live text).
- **Hub speed (R-1346):** the hub itself answers its pages in 0.01–0.7 s and the registry in ~0.1 s, measured in the
  cluster; the 504 comes from the path in front of the hub.
- **Tester 1 tidy:** the test app Gokapi removed through the product (no container, no app file, no volume); 9
  PrivateBin scratch volumes from today's backup presses removed by name (277 → 268; the night's 6 belong to R-1267);
  the empty `restore-undo` folder removed. Radicale is not installed and holds nothing.

## Teardown

Machine: Tester 1 as above; 9202 runs rc.2 (the scratch box is not linked to the hub, so no floor moves it; it stays there until the next test).
Host: nothing provisioned. Hub: no test customer or host made; the per-box floors cleared after the 30-minute watch.

## Docs

`04` §6.1 [DESIGN] D64 + the agent's list; `09` §3 decision 283; `03` [DESIGN] operator restart + R-1344; `05` [DESIGN]
the two buttons; `08` table rows `controller_unresponsive`, `restore_copy_deleted`. The system poster: no fact changed
(no machine, path, backup tier or time).

Evidence: `documentation/audits/release-2026-10-29b/`.