chore(wolf): mark bug-1676 fixed (full round-trip)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AgYRU3zDTqNGV5Jk8aiKLg

.wolf/buglog.json

@@ -18515,7 +18515,7 @@
       "error_message": "Gitea issue #44 (\"FROM_HOST is -\"): `xcecli jobs list`'s FROM_HOST column always shows `-` instead of the host the job was submitted from. Reproduced live on branch scheduler-framework: submitted a job, checked `xcecli jobs list` ~1 second later (job still PEND) -- FROM_HOST blank; confirmed via the apiserver's own debug log showing `\"from_host\":\"\"` on every job regardless of state (PEND/RUN/DONE), across every job submitted in the session.",
       "file": "src/frontend/apiserver/controllers/jobs.go:1483, src/frontend/apiserver/backend/handler.go:18-20, src/schema/controller.capnp",
       "root_cause": "Three-part chain, fully traced: (1) jobs.go:1483 correctly sets `FromHost: ctx.ClientIP()` at job-CREATION time. (2) controller.capnp's Job/JobSubmitData structs have no from_host field at all (confirmed via grep -- zero matches for fromHost/from_host in the schema), so this value never round-trips to or back from the C controller. (3) handler.go's OnJobUpdated (line 18-20) does a blind `store.Jobs.Put(uint64(job.Unique_JobID), *job)` full overwrite on every controller-sourced job push, unlike OnHostUpdated/OnHostConfigUpdated (handler.go:46-70) which explicitly merge worker-sourced and config-sourced fields onto the existing stored entry. Since a controller-sourced job push never carries from_host (per #2), the very first state-change push after creation -- which happens almost immediately, well before a user can typically observe the initial value -- wipes FromHost back to \"\" via the blind overwrite.",
-      "fix": "NOT FIXED -- reproduced and root-caused during a Gitea-issue verification pass, no code change made. A full fix needs either: (a) add a from_host field to controller.capnp's Job struct and thread it through the C controller so it round-trips and OnJobUpdated's overwrite naturally carries the correct value, or (b) the smaller fix of making OnJobUpdated merge-preserve FromHost from the existing stored entry the same way OnHostUpdated preserves config-sourced fields, at the cost of only ever reflecting the value set at creation time (never updated if resubmission semantics ever change).",
+      "fix": "FIXED (2026-08-24), full fix. User directive: client should assert its own from-host and the backend should pass it through unchanged, rather than the apiserver deriving it from ctx.ClientIP() (which is an IP not a hostname, and trivially spoofable via X-Forwarded-For since this apiserver never calls gin.Engine.SetTrustedProxies()). Two independent, non-overlapping pieces:\n\n(1) Origin: xcecli's BuildJobRequest() (cmd/jobs/submit.go) now sets JobSubmitRequest.FromHost via os.Hostname(); apiserver's CreateJob (controllers/jobs.go:1483) now does `FromHost: req.FromHost` -- a straight passthrough, ctx.ClientIP() removed entirely from this path. New field added to both xcecli's and apiserver's independent models.JobSubmitRequest structs (separate Go modules, no shared code). New test TestBuildJobRequest_SetsFromHostToLocalHostname (xcecli). Full xcecli suite and apiserver controllers/models suites pass.\n\n(2) Round-trip: src/schema/controller.capnp's JobSubmitData gains `fromHost @10: Text $C.mapname(\"from_host\")` (auto-regenerates controller.capnp.c/h via the existing meson capnpc-c custom_target -- no hand-editing of generated files). src/include/xce/types.h's job_submit_data_t gains `char* from_host`. src/lib/jobj.c's jobsub_init/jobsub_destroy (the hand-written, ref-counted, content-deduped job-submit interning object -- NOT auto-generated) thread from_host through the deep-copy, the dedup identity comparison, and the destroy path; 3 existing tests updated + new test_jobsub_from_host_distinguishes_identity in test_jobj.c/testsuite. Go apiserver/backend/convert.go's modelJobToSubmit/freeJobSubmit (submit direction) and cJobToModel/cJobArrayToModels (receive direction), plus convert_pure.go's rawSubmitData/rawJobToModel (the pure-Go, CGO-free mapping layer) all thread the field through. Did NOT need to touch job.c's build_job_submit_payloads() (bare pointer borrow, flows through automatically) or any WAL persistence code (capnp_encode_job/decode_Job already generically encode/decode the whole xce_job_t including the full .submit sub-struct) or backend/handler.go's OnJobUpdated (its existing blind overwrite is correct by construction once every push genuinely carries the right value).\n\nVerified: C xcelib_test 301/301 (ASAN leak detection on, includes the 3 updated + 1 new jobsub tests, independently re-run and confirmed). Go backend suite: pure-Go tests (CGO_ENABLED=0) and full CGO suite via `make test-backend` against the real regenerated capnp headers, both independently re-run and confirmed (`ok apiserver/backend 14.6s`). Live, independently verified on a freshly-submitted job (not reusing any job the implementer had already submitted): FROM_HOST=<hostname> visible from the very first query while still PEND, survives the RUN transition, and (implementer's own live check, not independently re-run) survives a full 4-daemon restart for free via existing WAL_JOB_SUBMIT persistence.",
       "tags": [
         "gitea-issue-44",
         "apiserver",
@@ -18528,7 +18528,7 @@
       ],
       "related_bugs": [],
       "occurrences": 1,
-      "last_seen": "2026-08-24T13:40:00Z"
+      "last_seen": "2026-08-24T15:15:00Z"
     },
     {
       "id": "bug-1677",