felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

TASK — offsite SLICE 4: soft-quota + health monitoring + freeze lever — 2026-07-10 — DEPLOYED

Shipped (felhom.eu): hub v0.41.0 fad5573 + bump 04826c9 — LIVE (Synced/Healthy, "Offsite checker initialized"). Pairs with controller v0.109.1 (9201, healthy). The offsite arc's last build item; operator-free (Viktor ran nothing).

Hub changes:

• monitor.OffsiteChecker — sibling of StorageFillChecker over the controller report's new offsite object: fill warn/crit at 90/95% of quota_gb (quota 0 = dedicated, silent) + offsite_stale (warning) for enabled+escrowed targets with no run >48h/never — the silently-stuck detector (recently-FAILING runs are backup_failed's signal; pending/disabled never alert — red-proofed: dropping the escrowed-only filter made the pending customer alert → FAIL). Nil-safe on pre-v0.109 reports; same-second latest-report ties processed once per sweep.
• Freeze lever: Provisioner.SetOffsiteFrozen — flips ONLY readonly on the exactly-1 labelled sub-account (SSH preserved — tested; ambiguity refuses); confirm-gated Freeze/Unfreeze buttons next to Re-issue (shared only). MANUAL only, never automatic — freezing also blocks prune, the customer's only way down from over-quota.

Live verification (free checks, real pipeline): the controller deploy's re-apply exercised key-auth-first live (re-pinned, zero password consumed) and surfaced a real bug — the re-apply demoted the escrowed demo to pending + wiped runtime status → fixed as controller v0.109.1 (re-apply preserves custody + status; red-proofed), demo repaired (manual confirm — truthful, same escrowed password — + a run). The next report carried the full offsite object (escrowed, 45 MB / 50 GB, fresh run); the checker held it healthy (0 offsite_ events)*; the /backups usage bar renders "Tárhelykeret: 43.2 MB / 50 GB (0%)".

NOT live-exercised (per the STOP): the freeze (would write-lock the demo's working offsite) and the 100% refusal (demo is at 0.08%) — unit red-proofs cover both.

The offsite arc is now build-complete: provisioning (S1/S2) → hardening (F1–F5, key-auth-first, wipe) → auto-confirm (S3) → quota + health (S4). NEXT: the Peti onboarding runbook (live-exercises auto-confirm + F4 + fresh-provision quota end-to-end), NEW-box restore round-trip → retire the old-box archive.