felhom.eu/documentation/audits/undo-fleet-2026-09-23

The undo reaches the fleet, and the household is told — controller v0.264.0 + hub v0.120.0, 2026-09-23

Method: endpoint-level. Every act is the endpoint the UI invokes (deploy, backup, sync, rescan, update, remove, the language switch); pages are fetched as HTML (/apps/<app>?lang=hu|en); the mails are read from the @felhom.eu catch-all mailbox with the Gmail connector; the hub's rows from a copy of hub.db+-wal+-shm. No browser. The product performs every undo and every hold; the harness (walk.py, live.py, bakeoff.py, copied from undo-live-2026-09-23/, now selectable by GUEST=9201|9202) only presses and reads.

Order of events

#	what	evidence
0	floor 0.263.2 (Part 0)	00-floor-0.263.2.txt
1	hub v0.120.0 deployed by manifest bump + ArgoCD, before any box ran v0.264.0; one-time add-only migration changed all 3 enabled_events rows	10-enabled-events-before.txt, 11-hub-0.120.0-deploy-and-migration.txt
2	9202 (no hub): v0.264.0; R-646 backfill recorded 3; vikunja undone then held; pages hu/en; WARN once per type, then DEBUG	20-* … 29-*
3	9201 (hub on): v0.264.0; backfill recorded 10; drill repoint with three controls; vikunja undone+held (box hu); language → en; glance undone+held (box en)	30-* … 35-*
4	8 mails as received + 8 notification_log rows	40-notification-log.txt, 41-mails-as-received.md
5	teardown of 9201, floor 0.264.0 read back	48-*, 49-*, 50-floor-0.264.0.txt

Results

proof	result
migration (hub)	demo-felhom kept its 10 types and gained 2; demo-hp and _resend-rotation-test (null / [] = nothing on) gained the 2; guard row set 11:49:03Z; log names all three
R-646	applied-meta backfill (R-646): recorded 3 [gokapi paperless-ngx privatebin] (9202); recorded 10 […] (9201); skipped 0 on both
undone (9202, vikunja)	undone at +99 s; seeds A, B, C back; ledger equal; page hu „A(z) vikunja frissítése … — semmi nem veszett el." / en "The update of vikunja … — nothing was lost."; API ?lang=en label "Put back to the previous version"
held (9202, cut-off copy)	failed 1 s into undoing; hold sentence hu on the hu page and en on the en page (R-606); both copies kept
R-620	WARN once each for controller_started, app_deploy_started, app_deployed, health_change, app_update_undone, app_update_held, app_start_failed; the second app_start_failed at 12:03:00Z is DEBUG
mails (9201)	4 household + 4 operator, rows 937–946 all sent; subjects name the app; household text in the box language (hu for vikunja, en for glance); operator text Hungarian. Quoted in 41-mails-as-received.md
per-app cooldown	glance's undone mail went 14 min after vikunja's, inside the 6 h customer cooldown
standing apps (9201)	compose + .felhom.yml byte-identical before/after (10 apps), catalog back on live cfcfe52, controller.yaml identical to the saved copy. But not untouched: the harness's two „Mentés most" presses (whole-box backups) stopped and restarted 9 of 10 standing apps for their volume dumps — R-648

Found

• R-647 — (1) a reader in the other language than the box reads a HELD sentence in the box's language (seen: 9202 box en, ?lang=hu page showed English); (2) the English mail's raw Note: line carries the Hungarian copy_holds phrase; (3) two log wordings (hold recorded: true on an undone event; severity warn printing a health status).
• R-648 — the drill's backup press is whole-box.

Teardown — three layers

• machine: 9202 — vikunja removed through the product (0 volumes, 0 undo copies), test images removed, controller.yaml identical to controller.yaml.pre-undofleet, catalog on live cfcfe52, apps as at the start. 9201 — vikunja and glance removed through the product (0 volumes, 0 copies), test images removed, language back to hu, config identical to the saved copy, catalog on live cfcfe52, the 10 standing apps deployed and healthy. Both stay on controller 0.264.0 (= the floor).
• host: nothing provisioned on demo-hp.
• hub: v0.120.0 deployed (the one planned change); floor 0.264.0 / MinAgent 0.131.0; no customer reset.
• drill repo: reset to live main (cfcfe52), read back from the remote.