felhom.eu/REPORT-catchup-2026-10-05.md

REPORT — a box that is not always on: the catch-up, the banner, the alarms; the OS update repairs itself after a power cut (2026-10-05, afternoon)

Brief: "a box that was off at night catches up when it comes back (decision A) …" (operator, 2026-10-05). Evidence: documentation/audits/catchup-2026-10-05/. Architecture read before the claims: 07 §6.1, 08 (cool-downs, §6.2–6.3), 09 §3 decision 11, 11 §5.4.1 and §8; the Part F spike (audits/night-fixes-2026-10-05/partF/FINDINGS.md).

1. The Part table

Part	State	Note
§1 rulings recorded first	done	09 decisions 109–111
A.0 — the design	done	new 07 §6.1.1 ([DESIGN — ruled 2026-10-05] for 109–110; CC decisions 112–118 "operator may reverse"), 08 §6.4
A — the catch-up (R-871)	done	spike on 9202 first (off across 09:05 → db-dump scheduled for 2026-10-06 09:05, nothing ran); built controller v0.295.0; 13 red-proofs; live on 9202 (twice — the second after a host crash interrupted the wait) and on demo-felhom
B — the banner (decision 110)	done, changed	rule + real-page tests + red-proofs; served live on 9202 and closed by its real route. No screenshot: DooPlex has no browser or page renderer (checked: no chromium/firefox/wkhtmltoimage/playwright); the page HTML as the box served it is the evidence. 9202's ledger was set by hand to a 3-day-old dump to make it show (scratch box, stated).
C — R-872, R-873, R-874, R-875	done; R-872 live pending	hub v0.134.0 (R-872, R-873), agent v0.145.0 (R-874, R-875); each red-proofed. R-874 live on demo-felhom. R-872's first live 05:00 run: dated check 2026-10-06. R-873: tests only (no live occurrence — Tester 2 stayed off).
D — R-876 self-repair	done	agent v0.145.0; 3 red-proofs; live with the operator's go: crash mid-unpack, the next pass repaired dpkg by itself and finished; bundle signed to all three boxes
E — release, golden, records	done	controller v0.295.0, agent v0.145.0, hub v0.134.0 (one each); golden 0.295.0 baked + vouched (gate OK); floors for demo-hp, demo-felhom, tester-1

2. Claims in the brief that turned out wrong (or only partly true)

1. "A controller start is the right trigger" — not alone. A host resume is needed too: Go's timers run on CLOCK_MONOTONIC, which does not count suspended time, so on a suspended laptop the 02:30 timer fires hours late — and would start the app-update leg at noon. Built: a late daily timer (> 60 min) is skipped, and a resume watch triggers the catch-up. Reasoned and unit-tested; NOT measured — no suspend was allowed on a demo box.
2. "The whole-guest backup cannot collide with the catch-up" — it CAN: its 48 h safety valve fires on the first 5-minute poll after a start, and the catch-up's database dump needs the apps up. Built: each waits for the other.
3. "The box keeps a record of when it was on" — TRUE, and it was not designed as one: the controller's system-metrics table (one sample a minute, kept 30 days). Used for "off at 02:30" and the suggestion.
4. "The repair step can check the journal without losing R-845's speed" — TRUE: --audit and the journal are read in ONE sh -c call; a clean pass still costs one call (pinned by a test).
5. "Apps keep running during a catch-up" (my morning STATUS said "to be measured") — the dump leg stops an app with a volume for its copy: measured 1 s for opengist in the day (R-878).
6. R-873's brief offered "only when the box was off for more than 24 h" — rejected (a real outage would reach the household a day late); the weekly rule was chosen (decision 116).

3. What was proven, with numbers

• Part A (live). 9202: W 09:35, off 07:33–07:38 UTC, start 07:38:09 → missed [db-dump] … ONE catch-up in 15m0s → 07:53:09 dump, done in 21 s. Host crash at 07:56 interrupted the next wait → new start 07:58:35 → ONE catch-up of all three legs at 08:13:35, done in 22 s. demo-felhom: W 10:07, controller parked + stopped 08:05–08:10 (apps running) → catch-up 08:25:02, dump in 1 s; hub event backup_catchup_done "Kimaradt mentés pótolva: a doboz ki volt kapcsolva 10:07-kor, a mentés most elkészült." — no mail. Window set back to 02:30.
• Part B. nightchain.ComputeBanner tests (shown / fresh / upgrade day / dismissed then back after a new miss / gone after a success / off-site counts / no pattern / usually on); web tests through ServeHTTP and the real dismiss route.
• Part C. R-872 Tester 2 shape → both alarms; a dump 20 h ago → quiet; a new box → quiet. R-873: night 1 household 2 mails, night 2 household 0 / operator 2, after 8 days household again. R-874 live: demo-felhom agent start 07:38:46 → first check 08:08:46 → restore-test passed in 29 s.
• Part D (live, operator's go). 13 packages rolled back; crash 07:56:03.308 UTC during dpkg --force-confold … --unpack; new boot 07:56:41 (38 s), guard armed, 1 unclean boot in window; at boot --audit clean, journal 1 file, 1 package new / 12 old; next pass (nobody touched dpkg): REPAIR configured=0 journal=1 → PLAN upgrade=12 → DONE rc=0 upgraded=12, healthy; package list identical (279 lines). No mail.

4. Rows

Register before 340, after 336. Closed (6): R-871, R-873, R-874, R-875, R-876, R-877. Narrowed: R-872 (fixed, dated check 2026-10-06). Opened (2): R-877 (the Tester 1 VM had no start-on-boot; the morning crash left it off 1 h 17 min — filed and closed), R-878 (P4, a daytime catch-up stops a volume app for its dump). STATUS updated.

5. Slips of mine, said plainly

• This morning's report said every box was healthy; the Tester 1 VM had been off since the 06:14 crash (R-877). Found at 07:31 from its stale report time.
• The hub image 0.134.0 was first built from a commit that was not yet pushed (my unstaged doc edits blocked the git pull; the push was then refused by the golden gate). I pushed after the golden bake and REBUILT the image from the pushed commit 1b0678fa; the deployed image is the rebuilt one (sha256:f823b10e…).
• Two of my red-proofs did not convict at first (a masked mutation, a test that matched another call); both tests were strengthened and the red-proofs re-run — recorded in the red-proof files.

6. Teardown, three layers

• Machines: 9202: controller 0.295.0 (by hand, allowed there), window back to 02:30, its ledger was set by hand for the banner and has since been overwritten by real catch-up runs. demo-felhom: window 02:30 again, controller unparked. demo-hp: every package current, list identical. Tester 1: running, start-on-boot set. Bake VM: CT 9100 destroyed, token shredded, virgin, qemu gone.
• Hosts: the park file on felhom-pve removed; nothing provisioned.
• Hub: floors 0.295.0 (MinAgent 0.131.0) for demo-hp, demo-felhom, tester-1; artifacts vouched (agent 0.145.0, golden 0.295.0); 6 signed jobs (agent_update and agent_config_update for each of the three boxes); hub 0.134.0 deployed (ArgoCD Synced/Healthy). Tester 2: read only, offline all session, nothing sent.