felhom.eu/documentation/audits/DRILL-version-travel-2026-09-26.md

DRILL — 2026-09-26/27: a backup's data and its version travel together; the next PostgreSQL apps; adventurelog; leftovers

Brief: "a backup's data and its version always travel together; the next PostgreSQL apps; adventurelog; small leftovers". Architecture read before any claim: 07-backup-architecture.md §6 (now §6.6 added), 09-update-architecture.md §3 decisions 13–42, §5.3, §6.4 parts 4, 5, 10. Evidence: audits/version-travel-2026-09-26/.

Not done, or changed

• One controller release (v0.275.0), not two, with Parts A, D2–D4 and R-699 (found live during Part B, filed and fixed). Live proofs ran on 0.275.0-rc1 (identical except R-699); 0.275.0 itself ran the adventurelog box proof.
• The session paused ~17 h (usage limit) between the build and the live proof. In that gap the box's own night ran the engine step on docmost, which became the shape-2 live proof — observed, not pressed.
• R-691 (2) NOT built — Load does not look at the off-site copy. (1) built and red-proofed, not live-proven (no nextcloud kept folder existed on 9202).
• Part B moved 2 apps (paperless-ngx, tandoor). calcom and claper were not attempted (no seed route in the fixtures).
• adventurelog's health fix is a DROP of the override, not /usr/bin/node: no single node path works on both versions (measured). It rides the image move in the same commit, as asked.
• Off-site restore NOT exercised live (9202 has no off-site target; the boxes that do are fenced). Unit-tested.
• The conversion-copy RELEASE on a real 18 dump not observed — due on 9202 after tonight's 00:30 data run.
• D1 took THREE agent releases. Instead of waiting 6 h for the scheduled cycle, the scheduler's own read-only verdict (-selftest=restore-test-due) was read on demo-hp: the golden was skipped, but the pick fell to a leftover archive of guest 9100, deleted in August. Fixed in v0.136.0 (the guest must exist) — whose lookup then met PVE's 403 for a guest outside the agent's pool and made the local tier UNKNOWN (my regression, read the same way); fixed in v0.137.0, verified read-only on demo-hp with the pre-release binary before the release. Each red-proofed and signed-delivered to both hosts.
• Part E (night watch) not done.
• D4 is not ruled: option A is built and in force (STATUS).

Claims in the brief, judged

1. CaptureRecoveryUnit rewrites compose/ and image_pins before the data is refreshed — TRUE (measured: the refresh 2 min after the update rewrote both; the dumps stayed).
2. A restore replays the database's raw volume tar before the SQL dump — TRUE (restore_unit.go; live: the 16 datadir tar replaced the volume first).
3. The 18 definition over a 16 tar does X — REFUSED by the engine, and the app was left DOWN: postgres:18 refused the old layout, the replay timed out, the start failed. Not "a fresh cluster with the SQL".
4. A restored version older than the ladder would jump — TRUE for a person's press, FALSE for the automatic leg (LegSkipOlderThanLadder already refuses). The page now says the box will not update it by itself.
5. 07 says nothing on which version a restore brings back — TRUE for 07 (only 09 §5.3 said the restore pins to the unit's compose). 07 §6.6 now says it.

A — the data and its version (R-696)

A1 spike (A1/README.md) → A2–A4 built (stamps, the definition kept with its data, restore guard, off-site definition, data times on all three tiers, release needs a dump on the new major) → red-proofs RP1–RP6 (A5-redproofs/) → live (A5-live/README.md): shape 2 in the box's own night (restore offered 00:30 = the data; restore back whole at 16 with the sentence „A(z) docmost visszaállt a(z) 2026-09-27 02:30-i mentésből, a(z) docmost:0.96.0, postgres:16-alpine, redis:7-alpine verzióra. Elérhető frissítés: a doboz lépésenként hozza naprakészre."; climb again 55 s); shape 1 (back whole at 0.95.0, "No pending database migrations"; climb 46 s). A7: 42 of 42 ladder digests resolve; filed R-698.

B, C, D

B: B/README.md — paperless-ngx → 18 and tandoor → 17, both venues, engine gate ALLOWED, catalog 46affe0, 53b84ca. C: C/README.md — adventurelog v0.13.0, catalog 06ea7da. D1 agent v0.135.0 → v0.137.0 (signed delivery to both hosts); D2 R-695; D3 R-691 (1); D4 R-694 (per-app measurement, 6 of 7 keep the login in their data).

Teardown

• Machine: bench LXC 9401 created and destroyed (hostname checked), template removed. 9202: docmost, tandoor and adventurelog removed through the product; paperless-ngx (standing) now on PostgreSQL 18 like the live catalog, its kept 16 copy waiting for the release; back on the LIVE catalog (controller.yaml.pre-vt0926), controller 0.275.0. Drill repo reset to live main (f1a7d6c).
• Host: demo-hp pct list 9201 + 9202 only; local and nvme-scratch as before the bench.
• Hub: global floor 0.275.0 (declared MinAgent 0.131.0); six signed agent_update jobs (0.135.0, 0.136.0, 0.137.0 × 2 hosts); no customer or appliance created.

Register

Before: 339 rows / 682,159 B (the brief's count). Opened R-697, R-698, R-699; closed R-655, R-689, R-694, R-695, R-696, R-699 (moved to CLOSED-ITEMS.md); narrowed R-691 (to its (2)) and R-463 (3 of 11 moved). After: 336 rows / 678,058 B.