felhom.eu/REPORT.md

REPORT — the undo reaches the fleet, and the household is TOLD (controller v0.264.0, hub v0.120.0)

2026-09-23 (evening). Repos touched: felhom-controller (v0.264.0, bc27894), felhom.eu (hub v0.120.0 d3b2848, manifest 7caa24f, docs, register, evidence), admin/app-catalog-drill (drill commits, reset to live main at the end). felhom-agent, app-catalog-felhom.eu: untouched. Architecture read and named: documentation/architecture/09-update-architecture.md (§3 decision 15, §6.4). Evidence: documentation/audits/undo-fleet-2026-09-23/README.md. Method: endpoint-level (the endpoints the UI invokes; mails read from the catch-all mailbox; no browser).

---

1. Not done, or changed

item	state
Part 0 — floor 0.263.2	done, read back (00-floor-0.263.2.txt)
Part 1 — R-646 startup pass	done; live: 3 recorded on 9202, 10 on 9201, 0 skipped
Part 2 — two events, hub v0.120.0 first	done; hub deployed 11:49Z, before any box ran v0.264.0
Part 3 — R-606	done, with leftovers → R-647 (a reader in the other language than the box sees a HELD sentence in the box's language; the English mail's raw Note: line keeps the Hungarian copy_holds phrase)
Part 4 — R-620	done
Part 5 — live proof	done; all proofs passed → floor raised to 0.264.0
"standing apps untouched"	NOT fully met. The harness's „Mentés most" is a whole-box backup: on 9201 it stopped and restarted 9 of the 10 standing apps for their volume dumps, twice (a few seconds each). All healthy afterwards, files byte-identical. R-648 filed.
the brief's Hungarian undone line	changed: it ends „semmi nem veszett el, nincs teendőd." — the brief's „teendője nincs" is the formal „ön" voice; the product speaks „te" everywhere and the voice gate ratchets the formal form (18).
the customer cooldown	changed shape: a NEW customer-side register (perAppCustomerCooldownEvents) instead of putting the customer leg of R-389's register to work — that would also have changed app_start_failed's household grain, which nobody asked for (pinned by a test).
a box-side seed + two page toggles	added, not in the brief: the box pushes its own EnabledEvents to the hub on every notifications-page save, so the hub migration alone would be undone by the next save.

Claims in the brief, checked:

1. "No app-update event exists today" — true for apps. The only near-misses: controller_updated is the controller's OWN self-update, and update_available exists only as a debug-page test option — never emitted, and not in the hub's allow-list (it would 400).
2. "enabled_events is the household's only mail gate" — wrong. Four more gates stand in the way: the operatorOnlyEvents register, a blocked customer, a missing e-mail address, and the cooldown — keyed customer:type, which would have merged two apps' mails into one. And the box OVERWRITES the hub's list on each page save (above).
3. "9201 can follow the drill catalog without disturbing its standing apps" — true for the catalog, false for the harness. Measured: the 10 standing apps' compose + .felhom.yml were byte-identical before, during and after (the drill differed from live only in the throwaway apps). The disturbance came from the harness's whole-box backup press (R-648), not from the catalog.

2. Floor raises, read back from the hub

raise	read back	fleet
0.263.2 / MinAgent 0.131.0	min_controller_version=0.263.2, min_agent=0.131.0	00-floor-0.263.2.txt
0.264.0 / MinAgent 0.131.0 (14:35:08)	min_controller_version=0.264.0, min_agent=0.131.0; hub log managed floor SERVED for demo-felhom: floor 0.264.0 … from declared	demo-felhom 0.263.2 → 0.264.0 in 20 s; demo-hp 9201 already 0.264.0 (50-floor-0.264.0.txt)

3. The hub migration — rows changed (one-time, add-only)

customer	before	after
demo-felhom	10 types	the same 10 + app_update_undone, app_update_held
demo-hp	null (nothing on)	["app_update_undone","app_update_held"]
_resend-rotation-test	[]	["app_update_undone","app_update_held"]

Guard row seed_app_update_events_v1 = 2026-09-23T11:49:03Z. E-mail column never selected.

4. The mails (9201, customer demo-hp) and their notification_log rows

row	time (UTC)	type	leg	subject as received
937 / 938	12:15	undone	op / household	op ⚠️ demo-hp: app_update_undone · hh Figyelmeztetés: vikunja: a frissítés nem sikerült, az alkalmazás a korábbi változattal fut
939 / 940	12:16	held	op / household	op 🔴 demo-hp: app_update_held · hh Hiba: vikunja: az alkalmazás leállítva, visszaállítás szükséges
942 / 943	12:29	undone	op / household	hh Warning: glance: the update did not work; the app runs on its previous version
944 / 946	12:31	held	op / household	hh Error: glance: the app is stopped and needs a restore

All 8 sent. The box language was switched to English once, between the two rounds (the hub had two reports in English before the second round). Household bodies carry the box's own sentence (the undone line / the hold sentence) in the household's language; the operator's carry the Hungarian wire text. Verbatim bodies: 41-mails-as-received.md. Per-app cooldown, live: row 943 went out 14 minutes after row 938, inside the 6-hour customer cooldown.

5. The pages in both languages (9202, then 9201)

• undone: hu „A(z) vikunja frissítése 2026-09-23 14:00-kor nem sikerült. A doboz automatikusan visszaállította az előző változatot és az adatokat — semmi nem veszett el." · en "The update of vikunja at 2026-09-23 14:00 did not succeed. The box put back the previous version and its data automatically — nothing was lost."
• held, box hu: ?lang=hu → the Hungarian hold sentence; ?lang=en → "The update did not succeed, and the automatic undo did not either. … own drive, 2026-09-23 13:58 — this copy holds the settings, the database and the data volumes." — the whole sentence English now (before v0.264.0 only the prefix was).
• GET /api/stacks/vikunja?lang=en: label "The update did not succeed", error and hold in English.
• Leftover (R-647): box en + ?lang=hu showed the English hold.

6. Red-proofs (each seen failing, then restored)

Controller (9): backfill stores nothing → TestR646_… "the current app must have its record"; dropped() not called → TestR620_… "want exactly TWO WARN lines, got 0"; undone event not emitted → "exactly ONE app_update_undone event, got []"; held event not emitted → "…got []"; page updateErrorText not localised → TestR606_UpdateSentencesFollowTheReader; hold sentence ignores the language → undo_hold_test.go:62; UpdateErrorIn returns the Hungarian → "English = „A frissítés nem indult el…""; box seed not run → "got [backup_failed offbox_enlarge_blocked]"; sink not wired in main → "SetUpdateEventSink is never called" (first mutation did not compile; retried with a compiling one). Hub (5): seed call does nothing → "c1: enabled_events = [backup_failed], want […]"; customer per-app suffix removed → "want 3 household mails …, got 2"; allow-list entry removed → "must be in allowedEventTypes"; app-named headline removed → subject "%s: a frissítés…"; seed default removed → "defaultSeedEvents must include app_update_undone" (first attempt matched no test; retried with a new test that names both types). Every -run was checked for === RUN.

Gates: controller go test ./... rc=0, controller_gates.py rc=0; hub go build/vet/test rc=0, repo_gates.py rc=0. The R-389 fence test was widened on purpose, with its reason; the settings-page parity fixture was regenerated (measured diff: exactly the two new toggles).

7. Rows

Closed (3, moved to CLOSED-ITEMS.md): R-606, R-620, R-646. Opened (2): R-647 (the three leftovers), R-648 (the whole-box backup press). Open rows 335 → 334. 09 §6.4 parts 2 and 3 marked SHIPPED; the capability map's undo row now carries the mail; STATUS rewritten.

8. Teardown — three layers

• machine: 9202 and 9201 — throwaway apps removed through the product (0 volumes, 0 undo copies), test images removed, controller.yaml identical to the saved copy, catalog on live cfcfe52, 9201's language back to hu, standing apps deployed and healthy. Both on 0.264.0 (= the floor).
• host: nothing provisioned on demo-hp.
• hub: v0.120.0 (planned); floor 0.264.0. Scratchpad password files deleted; hub DB copies deleted.
• drill repo: reset to live main, read back from the remote.