docs: REPORT for paperless OCR lang-pack fix

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

REPORT.md

@@ -1,39 +1,28 @@
-# REPORT — userdata layout repoint (2026-06-14)
+# REPORT — paperless OCR lang-pack fix (2026-06-15)
 
-Repointed every customer-content mount off `${HDD_PATH}/media` onto the new `${USERDATA_PATH}/...`
-convention (controller v0.66.x injects `USERDATA_PATH = <namespace root>/userdata`). Trunk-based on
-`main` (catalog = commits, no semver). Pairs with felhom-controller v0.66.1.
+Single catalog change this round: fix the paperless-ngx OCR-language crash-loop found while deploying it
+live on guest 9201 (userdata-arc close-out). Trunk-based on `main` (commits, no semver). Pairs with
+felhom-controller v0.66.2.
 
-> Validate against the pushed compose/.felhom.yml at file:line.
+> Validate against the pushed compose at file:line.
 
-## Commits
-- `69611ce` — repoint 12 composes + update touched `.felhom.yml` first_steps/comments.
-- `0d60a5c` — komga + audiobookshelf: revert `user:1000` → root (live try-then-fallback).
-- `c99070c` — komga + audiobookshelf: add `security_opt: no-new-privileges:true` (root hardening).
+## Commit
+- `67037cc` — `templates/paperless-ngx/docker-compose.yml`: `PAPERLESS_OCR_LANGUAGES` is now a fixed
+  **space-separated** superset `eng hun deu` (was `${PAPERLESS_OCR_LANGUAGE:-}`, i.e. the `+`-joined
+  select value).
 
-## Per-app changes
-| App | media/ingest mount(s) | run-identity |
-|---|---|---|
-| jellyfin / emby / plex | `${USERDATA_PATH}/media:/media:ro` | jellyfin/plex root; emby UID/GID 1000 |
-| navidrome | `${USERDATA_PATH}/media/music:/music:ro` | root |
-| audiobookshelf | `media/audiobooks` + `media/podcasts` (RW) | **root** (user:1000 fell back) + no-new-privileges |
-| komga | `media/comics:/data` (RW) | **root** (user:1000 fell back) + no-new-privileges |
-| calibre-web | library `media/books` + ingest `import/calibre` (RW) | PUID/PGID 1000, **UMASK=002** |
-| radarr | `media/movies` + `downloads` (RW) | PUID/PGID 1000, **UMASK=002** |
-| sonarr | `media/tv` + `downloads` (RW) | PUID/PGID 1000, **UMASK=002** |
-| romm | ROM library → `userdata/roms` (RW); `resources` stays in appdata | root |
-| immich | + external `media/photos:/external/photos:ro`; managed upload stays in appdata | root |
-| paperless-ngx | consume → `import/paperless`; media/export stay in appdata | USERMAP_UID/GID 1000 |
-| nextcloud | **unchanged** (fully app-managed) | — |
+## Why
+The default `PAPERLESS_OCR_LANGUAGE: "hun+eng"` (.felhom.yml) was fed verbatim into
+`PAPERLESS_OCR_LANGUAGES` — but that var is the **install list** and must be space-separated (the image
+apt-installs `tesseract-ocr-<each>`). The `+`-joined value made it try to install a bogus package
+`tesseract-ocr-hun+eng` → not found → the `hun` pack was missing → Django's startup check failed
+(`selected ocr language hun is not installed`) → **crash-loop** on the default selection. Confirmed it was
+a malformed-name bug, not network: `apt-get install tesseract-ocr-hun` (correct name) installs cleanly.
 
-## Notes
-- **komga + audiobookshelf**: `user: "1000:1000"` was tried but crash-looped (their named config/metadata
-  volumes are Docker-created root-owned; no PUID-style root-init). Reverted to root + `no-new-privileges`.
-  They rely on the controller's setgid 2775 userdata dirs → files land group 1000 (FileBrowser
-  browses/reads; full group-write only on the PUID-1000 apps). Verified live on guest 9201.
-- **immich external library**: the `media/photos:/external/photos:ro` mount only makes the files visible.
-  The library must be **registered** in Immich (Administration → External Libraries) — a post-deploy admin
-  step; compose cannot do it. Flagged in the compose + `.felhom.yml`. Photos sharing is "mount ready,
-  registration pending". Live deploy deferred (guest 9201 has 2 GiB RAM; immich needs ~4 GiB).
-- Folder names are ASCII, no spaces (`tv`, not "tv shows") so they flow cleanly through `${}` interpolation,
-  shell, and the controller's rsync merge walk.
+## Verified live (guest 9201)
+Redeployed paperless with the default `hun+eng` → boots **healthy**; `tesseract --list-langs` reports
+`deu eng hun` (all packs installed via the space-separated list). Runs as uid 1000 (USERMAP_UID/GID 1000);
+consume end-to-end works (PDF dropped into `import/paperless` → ingested + the consume file removed).
+
+(The broader userdata repoint of media mounts to `${USERDATA_PATH}/...` shipped in the prior catalog
+commits — see git history / the controller REPORT.)