felhom.eu/REPORT-release-2026-10-29b.md

REPORT — release run 2026-10-29 (afternoon, attended): restart a box's controller and clear a held app from the hub

Five lines

1. Restart works with the controller stopped: yes. Stopped by hand on Tester 1, one press restarted it 5 s after the stop. On the release builds one press read „done" on the hub 16 s after the press; the fourth press in 15 minutes was refused.
2. Stuck check: alarm only, for now. So far 631 probes on Tester 1 and demo-hp: median 57–61 ms, max 163 ms, no failed probe, no 5-s timeout. The night chain is not in it yet; the log runs to 2026-10-30 07:00 UTC, then CC decides (R-1344).
3. Clear stays after a save: yes. On the release builds: cleared 3 s after the press, still gone after the next settings save 6.5 minutes later; the hub's list emptied.
4. Released: hub 0.176.1, agent 0.169.0 (vouched), controller 0.348.0 (the global floor since 14:48 CET).
5. What you do: nothing is blocked. One new decide row (D65: a „Reboot guest" button — CC says not now). Tester4 is off since 10-27; it updates when you start it.

Readings taken

1. The restart is the agent's, not the controller's — a stopped or stuck controller cannot restart itself. It uses felhom-controller-bootstrap.service, the same unit as the supervisor (R-523), not the host's bootstrap unit.
2. The brake counts operator restarts with the supervisor's, and a 4th restart in 15 minutes opens a 30-minute refusal for presses (the supervisor's own pause is separate).
3. Part 2 stopped at the alarm. A day run cannot hold the night chain (the whole-guest vzdump), so the „no false fire" condition is not shown yet. Building the restart now would introduce a mechanism nobody has measured.
4. The clear goes through the running controller's socket, never a file edit under a running controller — the file edit was R-1343's cause.

Versions, digests, CI by commit

Repo	Commit	CI job	What
felhom.eu (hub)	3d0c907b	2505 green	the two buttons, the agent channel, controller_unresponsive, D64 in 04/09 — hub 0.176.0 (sha256:53372198…)
felhom.eu	682015db	2506 green	manifest → 0.176.0 (Deployment/hub only)
felhom.eu (hub)	d0dbc6f1	2510 green	restart button for every guest (0.176.0 gated it on a version the agent does not report); R-1345
felhom.eu (hub)	2ccf180b	2511 green	a token press named by its token — hub 0.176.1 (sha256:c105cb9a…)
felhom.eu	c1f3a163	2512 green	manifest → 0.176.1
felhom.eu	e4d91043	2516	03/05/08 [DESIGN], R-1346…R-1348, evidence
agent	637c92c	2504, 2507 green	0.169.0 built from here (fc066de6…, bundle 3ca33f9c…, tag v0.169.0)
agent	db25eb0	2513 green	CHANGELOG; pinned.day0_agent = 0.169.0
controller	5b3b541, 6077ac0, 99fac06	2508, 2509, 2514 green	clear_hold, the socket, R-1340/R-1341, the fallback, the second R-1340 producer
controller	2a0a17a	2515 green	v0.348.0 heading — 0.348.0 built from here (sha256:672fc1c1…); rc.2 1d96f60c… on 9202

The close-out commits' CI is read at the end of the session.

Rows

• Closed (4): R-1343, R-1342, R-1340, R-1341 — each released in 0.348.0 and proven live.
• Opened (7): R-1344 (stuck controller: alarm; restart after the measurement), R-1345 (token scopes cannot be edited), R-1346 (hub pages slow; the vouch's 504), R-1347 (update-held flag after a restore lift), R-1348 (restore_mixed set at start-up sends no mail), R-1349 (guest reboot from the hub — needs your word), R-1350 (app_start_failed 30 s after a clear).
• Register: 226 at the start of the brief → 229.

Observations

• F2 (an app_start_failed after a clear) is real, filed as R-1350. The 12:44 clear showed none in 18 minutes; the 14:57 clear did, 30 s later — the hub's cooldown swallowed the mail. The text is true; the timing is noise.
• A hub history line from rc.1 reads „held after an off-site restore failed its database replay" for a local restore. That is the stored result of a 13:17 UTC clear, written before 99fac06 fixed the second producer: NOT-A-FINDING (history, not live text).
• Hub speed (R-1346): the hub itself answers its pages in 0.01–0.7 s and the registry in ~0.1 s, measured in the cluster; the 504 comes from the path in front of the hub.
• Tester 1 tidy: the test app Gokapi removed through the product (no container, no app file, no volume); 9 PrivateBin scratch volumes from today's backup presses removed by name (277 → 268; the night's 6 belong to R-1267); the empty restore-undo folder removed. Radicale is not installed and holds nothing.

Teardown

Machine: Tester 1 as above; 9202 runs rc.2 (the scratch box is not linked to the hub, so no floor moves it; it stays there until the next test). Host: nothing provisioned. Hub: no test customer or host made; the per-box floors cleared after the 30-minute watch.

Docs

04 §6.1 [DESIGN] D64 + the agent's list; 09 §3 decision 283; 03 [DESIGN] operator restart + R-1344; 05 [DESIGN] the two buttons; 08 table rows controller_unresponsive, restore_copy_deleted. The system poster: no fact changed (no machine, path, backup tier or time).

Evidence: documentation/audits/release-2026-10-29b/.