feat(svos): v0.0.21 UI 0.0.25 published on nh3-svos (draft survives a hidden tab); no restart

servers/nh3-svos/README.md

@@ -23,6 +23,16 @@ configuration, enrollment and acceptance.
 | App-consistent hook | svos-dev's `/etc/qemu/fsfreeze-hook.d/50-svos` stops the SVOS services on freeze and restarts the ones that were running on thaw. ⚠ **Debian's qemu-ga does NOT run fsfreeze hooks unless configured** (no `-F` in the unit, no `qemu-ga.conf` by default). Here `/etc/qemu/qemu-ga.conf` points it at **`/usr/local/sbin/fsfreeze-dispatch`** (`configs/qemu-ga/fsfreeze-dispatch`), which unlike the stock `/etc/qemu/fsfreeze-hook` propagates failure: if a freeze hook fails, it thaws that hook and the completed ones and exits 1, so qemu-ga refuses the freeze. **Live drill 2026-10-05 1952–1953 (services running):** quiesced backup `vm/111/2026-10-06T02:52:11Z` → kernel+interface down ~1–2 s, back by themselves, health ok. Refused freeze (temporary `60-drill-refuse` after 50-svos, since removed) `vm/111/2026-10-06T02:53:03Z` → the dispatcher unwound and restarted the services, and then **⚠ vzdump did NOT abort: it logged `ERROR: unable to freeze guest fs`, backed up UNFROZEN (crash-consistent, app live), and reported `Backup job finished successfully`, rc 0.** Both images mapped from PBS and mounted read-only (`ro,noload`) on nh3-pve-2, never booted: `svos.db` integrity ok (each image still carries its ~0.9 MB WAL: keep `-wal` with the db when restoring), interface `pins.sqlite3` integrity ok, config/key/config-generation hashes equal live, table counts equal live except `events`. **Monitoring:** `scripts/check-backup-freshness.sh` now reads the LOG of every OK vzdump task and reports ERROR lines; a freeze/thaw error is an APPLICATION-CONSISTENCY FAILURE, verdict **DEGRADED, exit 4** (alerted by the daily wrapper to infra-hermes). nh3-pve-2 was not in the check's node lists at all before 2026-10-05; it is now. Drill B is acknowledged by UPID in the script |
 | Monitoring | Beszel native agent 0.18.7 (`playbooks/beszel-native.yaml`, `configs/beszel-agent/hosts/nh3-svos.env`), hub system `t6y646ifa3x7xxv`, alerts CPU>95%/15m, Disk>85%/5m, Memory>90%/10m, offline/2m. Up 2026-10-05 |
 
+## Release 45d3a48 / v0.0.21, the /tasks draft survives a hidden tab — UI-only publish (2026-10-19 0104; svos-dev thread `01M59JY4V62Z43WZ0CWZGERK8M`)
+
+- Prime pushed main + tag `v0.0.21` → `45d3a48a8919` himself. A watcher on nh3-dev saw the tag at 0104:43, checked that it named the staged
+  commit, and ran `nh3-svos-45d3a48-v0.0.21.yaml`, which switched `current → 45d3a48` and ran `svos-front-inventory`. Nothing restarted and there was no card.
+- Kit sha256 `1d5ea371…`: the kernel 0.0.21 wheel (a version bump only) and UI 0.0.25. UI handle `/assets/index-BjJxcKQV.js` + `/assets/index-CNudli_R.css`;
+  81cc5a2 is the previous handle. The served bundle carries `45d3a48`. Health ok, gen `d750257258f9fb68`, 8 up.
+- Fix: a draft no longer dies when the page's session publishes a not-ready state (a hidden tab, a visibility change). Prime's gen-large draft at
+  0115 by svos-dev's clock read "The draft was interrupted".
+- Rollback: `current → releases/81cc5a2`, then `svos-front-inventory`.
+
 ## Release 81cc5a2 / v0.0.20, stronger look by default + the /tasks draft wait — UI-only publish (2026-10-19 0055; Prime's "deploy it" via svos-dev, threads `01M59JF8Z900KCHP5CJ98F90BW` / `01M59JHRV294CVS0BCMHQR96XY`)
 
 - **Push:** Prime pushed main (`12f2eb2`, one docs commit past the release) and the tag `v0.0.20` → `81cc5a21dfab` himself.