Files
felhom.eu/documentation/audits/DRILL-r361-2026-08-22/evidence/00-baselines.txt
T
admin 1eb64bec51
gates / gates (push) Successful in 17s
R-361 docs: the [FACT], the negative that cancelled Part 2, R-383/R-384, golden 0.221.1
07-backup-architecture.md gains a dated [FACT] on R-361 - a comment asserting an
invariant the code did not have, for four months - and a [DESIGN] on the db_dumps
decision INCLUDING the trap it created: a stable list lets the already-current
early return fire, so per-capture housekeeping must sit above it.

00-capability-map.md records the NEGATIVE from Part 3 so it is not re-derived: a
held app does NOT raise the dead-app alarm. It aggregates to unhealthy, which
IsDownState excludes. Measured on the shipped build with the scans demonstrably
running over it. No suppression was built and no row opened.

R-383: the double-failure message names an undo copy that is not there - R-361's
own class, one surface over, observed on both 0.220.2 and 0.221.1.
R-384: an app whose database has died reads unhealthy and raises no alarm.

R-361 closed and compressed. OPEN-ITEMS 325236 -> 327266 bytes.

Golden 0.221.1 baked, published and round-trip verified. The golden-currency gate
blocked this push and that block is not circular, so it was satisfied rather than
bypassed - no --no-verify anywhere in this session.
2026-08-23 00:33:12 +02:00

28 lines
1.7 KiB
Plaintext

Baselines re-verified at session start, 2026-08-22 (Phase 1, before any change).
repo HEAD clean in-sync
felhom-controller 2024ed99826717bf765803e159c074909b28bf83 yes yes (v0.220.2)
felhom-agent 40d857b52711dd8c9c88bdd21ffcaad819a33a84 yes yes (v0.130.0)
felhom.eu a8caa0fdde7c678bb88b5b25727044695bbdeaa9 yes yes
app-catalog 459766cb16395fd1d1a66282f5cc6da59ead5924 yes yes
Hub (/configuration, Basic auth, ClusterIP): golden_version 0.220.2, agent_version 0.130.0,
min_agent 0.129.0, global controller floor 0.220.2 — all as the runbook states.
Register ceiling: R-382.
SUBJECTS FOUND (not rebuilt): docmost + docmost-postgres + docmost-redis, bookstack + bookstack-db,
all healthy, up ~5 hours. Also on the box: privatebin, kimai, calibre-web, opengist, paperless-ngx,
romm.
R-361 CONFIRMED LIVE BEFORE ANY CHANGE — the canonical dumps are absent on BOTH subjects:
docmost/db-dumps/ : only 3x pre-restore-* (no docmost-postgres.sql)
bookstack/db-dumps/ : only 3x pre-restore-* (no bookstack-mariadb.sql)
Mechanism at source: appbackup/dbdump.go:246 builds `<stack>-<dbtype>.sql`, :247-248 derive tmp and
final from it, and writeSafetyDump (offbox_reconstitute.go:186-196) calls DumpOne into the app's own
unit dir and only THEN renames. The comment at offbox_reconstitute.go:190-191 says the rename means it
"can never overwrite the app's real dump" — false as written.
Dead-app watcher cadence: sched.Every("deadapp-check", 30s) at cmd/controller/main.go:726, with a 90s
boot grace. classifyRunStates at :2150. IsDownState (manager.go:54) includes StateDegraded.