Baselines re-verified at session start, 2026-08-22 (Phase 1, before any change).

repo                  HEAD                                      clean  in-sync
felhom-controller     2024ed99826717bf765803e159c074909b28bf83   yes    yes   (v0.220.2)
felhom-agent          40d857b52711dd8c9c88bdd21ffcaad819a33a84   yes    yes   (v0.130.0)
felhom.eu             a8caa0fdde7c678bb88b5b25727044695bbdeaa9   yes    yes
app-catalog           459766cb16395fd1d1a66282f5cc6da59ead5924   yes    yes

Hub (/configuration, Basic auth, ClusterIP): golden_version 0.220.2, agent_version 0.130.0,
min_agent 0.129.0, global controller floor 0.220.2 — all as the runbook states.

Register ceiling: R-382.

SUBJECTS FOUND (not rebuilt): docmost + docmost-postgres + docmost-redis, bookstack + bookstack-db,
all healthy, up ~5 hours. Also on the box: privatebin, kimai, calibre-web, opengist, paperless-ngx,
romm.

R-361 CONFIRMED LIVE BEFORE ANY CHANGE — the canonical dumps are absent on BOTH subjects:
  docmost/db-dumps/   : only 3x pre-restore-*  (no docmost-postgres.sql)
  bookstack/db-dumps/ : only 3x pre-restore-*  (no bookstack-mariadb.sql)
Mechanism at source: appbackup/dbdump.go:246 builds `<stack>-<dbtype>.sql`, :247-248 derive tmp and
final from it, and writeSafetyDump (offbox_reconstitute.go:186-196) calls DumpOne into the app's own
unit dir and only THEN renames. The comment at offbox_reconstitute.go:190-191 says the rename means it
"can never overwrite the app's real dump" — false as written.

Dead-app watcher cadence: sched.Every("deadapp-check", 30s) at cmd/controller/main.go:726, with a 90s
boot grace. classifyRunStates at :2150. IsDownState (manager.go:54) includes StateDegraded.
