REPORT: P1 fixes — vaultwarden invite-first, paperless batch sizing, live proofs

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,18 +1,32 @@
-# REPORT — privatebin drill bump and revert (BIGNIGHT, 2026-09-14)
+# REPORT — vaultwarden closed by default, paperless-ngx sized for a batch (2026-09-15)
 
-**What:** a real one-step upstream release, `privatebin/pdo` 2.0.5 → 2.0.6, pushed (`d5d91e0`) so the big night's
-test box could walk the guarded Update end to end, and reverted (`a161ccb`) in the same phase. No other template moved.
+Task: *before the volunteer — the big night's P1 fixes*, Part E. No image or version change.
 
-**Why:** the drill required an Update on real data; no app in the catalog had a newer version.
+## What changed
+- **vaultwarden (R-512):** `SIGNUPS_ALLOWED` defaults to `false`; the select explains both choices; „Első lépések" is
+  invite-first (admin panel with the generated token → invite → create account); the compose header no longer tells
+  anyone to change a setting after install.
+- **paperless-ngx (R-514, R-515):** `PAPERLESS_TASK_WORKERS=1`, `THREADS_PER_WORKER=1`, webserver `memory: 1280M`
+  (`mem_limit` hint 1664M); `default_creds: admin / admin` removed; first steps point at the generated password.
 
-**Result on the test box (VM 333, controller 0.242.0):** the change reached it on the next 15-minute sync, 14 m 25 s
-after the push; the app page offered „Frissítés elérhető — ma"; the guarded Update found a Tier-2 copy 13 min old, pinned
-2.0.6, pulled, verified healthy and finished in **11 s**; two encrypted pastes decrypted equal afterwards.
+## Measured first
+- **E.1 spike** (throwaway container on scratch 9202, SMTP off as on a box without app-email): stranger register **400**,
+  admin invite **200**, invited register **200**, second stranger **400**. So invite-first needs no controller change.
+- **E.2** (1 worker × 1 thread, no cap): 20 three-page PDFs → **20/20**, `memory.peak` 783 294 464 B → cap = peak × 1.5
+  rounded up to 256M = **1280M**. Caveat: the PDFs carried text, so OCR on scanned images may need more.
 
-**What the revert exposed:** the box that had already updated then showed „Frissítés elérhető" for the older 2.0.5 —
-a downgrade offered as an update. Filed in felhom.eu as **R-524** (controller). No catalog change is needed for it.
+## Proven live after the change (scratch 9202, deployed from the catalog through the controller API)
+- Vaultwarden: container `SIGNUPS_ALLOWED=false`; stranger `send-verification-email` via traefik → **400 „Registration
+  not allowed or user already exists"**; the app page shows the invite steps (fragment 1, negative control 0).
+  *One invalid attempt first: a hand-built register body got 422 (did not parse) — marked invalid in the evidence.*
+- Paperless: 20 PDFs posted at once → tasks **20 SUCCESS**, documents **20**, limit 1 342 177 280 B, `memory.peak`
+  **772 370 432 B**, OOMKilled false, 0 kernel OOM lines.
+- Forcing an OOM (cap 128M) showed Docker reports nothing in an LXC guest (R-528, a controller/agent row). **Mistake,
+  stated:** restoring the cap on the throwaway with a broad `sed` also changed its redis cap; moot, the stack was removed.
 
-**Net state:** the template is back on 2.0.5; `catalog_since` stays 2026-09-14 because the `catalog-since` gate
-requires an image move to carry the day of the move. Gates: `catalog_gates.py --fast` OK on both commits.
+## Teardown
+Machine: scratch 9202's throwaway `paperless-ngx` and `vaultwarden` stopped and removed (volumes removed; the paperless
+data folder on the scratch drive kept, the product default). Host: nothing. Hub: nothing (9202 reports to no hub).
 
-Full drill: `felhom.eu/documentation/audits/BIGNIGHT-household-month-2026-09-14.md`.
+## Gates
+`catalog_gates.py --fast` OK on every push. Evidence: `felhom.eu/documentation/audits/evidence-p1fixes-2026-09-15/E1-*`, `E2-*`, `teardown-9202.txt`.