immich's first start: cause measured, fixed in the catalog (R-732 closed); ISO clean-tree gate (R-730 closed)

- R-732: the first-start geodata import runs up to 9 concurrent 5000-row INSERTs; the database needs
  ~400 MB anon + ~170 MB touched shared_buffers (the image's FIXED 512MB, not host-RAM sizing). 512M fits
  only with swap (bench swap 0: 61-104 kills; 9202 swap 512 MiB: survived by swapping). Controls: swap
  alone, limit alone flip it; shared_buffers 128MB alone does not. Catalog 56c4888: v3.2.4 + 768M,
  proven with swap off on both venues. audits/immich-first-start-2026-09-30/A-cause.md.
- R-730: scripts/iso/build-felhom-iso.sh refuses an uncommitted/untracked/unpushed tree (no bypass),
  records repo-commit from the gate and iso-v<version>; test iso/test/clean-tree.sh, red-proof run
  (status check removed -> 2 of 4 cases fail -> restored).
- R-731 narrowed (gitea 28.0.0 GA; mariadb 13.0 a short-term Rolling line). R-676 note.
- New rows R-733 (bench has no swap, boxes 512 MiB), R-734 (immich .immich markers -> files_may_change).
- STATUS: the golden line corrected (no bake is due; 0.283.1 is the newest release). Register 364 -> 366.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/iso/test/clean-tree.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+# clean-tree.sh — R-730 regression test for build-felhom-iso.sh's clean-tree gate. No docker, no ISO:
+# the gate runs right after argument parsing, so the build dies at the gate (refused) or at the next
+# check ("--pve-iso is required", which proves it got PAST the gate). The repo is a throwaway one
+# (FELHOM_ISO_REPO, the gate's test seam) with a local bare "origin".
+#   1. a clean tree whose HEAD = origin/main        → passes the gate
+#   2. the same tree plus an UNTRACKED file          → refused ("uncommitted or untracked")
+#   3. a commit that is NOT on origin/main           → refused ("not origin/main")
+#   4. a modified TRACKED file                       → refused
+# Red-proof (run 2026-09-30, recorded in the R-730 row): delete the `[[ -z "$st" ]] || die …` line in
+# the gate → cases 2 and 4 FAIL (the build goes past the gate) → restore.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BUILD="$HERE/../build-felhom-iso.sh"
+fail=0
+check() { if eval "$2"; then echo "  ok: $1"; else echo "  FAIL: $1"; fail=1; fi; }
+S="$(mktemp -d "${TMPDIR:-/tmp}/felhom-cleantree-test.XXXXXX")"
+trap 'rm -rf "$S"' EXIT
+git init -q --bare "$S/origin.git"
+git init -q -b main "$S/repo"
+git -C "$S/repo" -c user.email=t@t -c user.name=t commit -q --allow-empty -m first
+git -C "$S/repo" remote add origin "$S/origin.git"
+git -C "$S/repo" push -q origin main
+run() { FELHOM_ISO_REPO="$S/repo" bash "$BUILD" 2>&1; }
+
+out="$(run)"
+check "1 clean + pushed passes the gate" '[[ "$out" == *"--pve-iso is required"* && "$out" != *"clean-tree gate:"*"R-730"* ]]'
+touch "$S/repo/stray.txt"
+out="$(run)"
+check "2 an untracked file is refused" '[[ "$out" == *"uncommitted or untracked"* && "$out" != *"--pve-iso is required"* ]]'
+rm -f "$S/repo/stray.txt"
+git -C "$S/repo" -c user.email=t@t -c user.name=t commit -q --allow-empty -m local-only
+out="$(run)"
+check "3 an unpushed commit is refused" '[[ "$out" == *"is not origin/main"* && "$out" != *"--pve-iso is required"* ]]'
+git -C "$S/repo" push -q origin main
+echo a > "$S/repo/f.txt"; git -C "$S/repo" add f.txt
+git -C "$S/repo" -c user.email=t@t -c user.name=t commit -q -m f; git -C "$S/repo" push -q origin main
+echo b > "$S/repo/f.txt"
+out="$(run)"
+check "4 a modified tracked file is refused" '[[ "$out" == *"uncommitted or untracked"* && "$out" != *"--pve-iso is required"* ]]'
+[[ $fail -eq 0 ]] && echo "clean-tree gate: all cases pass" || echo "clean-tree gate: FAILED"
+exit $fail

scripts/iso/test/rootpw-emission.sh

@@ -30,7 +30,12 @@ FAKE_SHA="$(sha256sum "$FAKE_ISO" | awk '{print $1}')"
 
 say "dry-run build (pairing, nested-canary) with FELHOM_ISO_KEEP_WORK=1"
 BUILD_LOG="$SCRATCH/build.log"
-FELHOM_ISO_KEEP_WORK=1 TMPDIR="$SCRATCH/tmp" bash "$BUILD" \
+# R-730: the build refuses a dirty/unpushed tree; this test is about the root password, so it builds from a
+# throwaway clean repo (the gate's own test seam) and stays runnable while the real tree has work in progress.
+git init -q --bare "$SCRATCH/origin.git"; git init -q -b main "$SCRATCH/repo"
+git -C "$SCRATCH/repo" -c user.email=t@t -c user.name=t commit -q --allow-empty -m first
+git -C "$SCRATCH/repo" remote add origin "$SCRATCH/origin.git"; git -C "$SCRATCH/repo" push -q origin main
+FELHOM_ISO_REPO="$SCRATCH/repo" FELHOM_ISO_KEEP_WORK=1 TMPDIR="$SCRATCH/tmp" bash "$BUILD" \
     --pve-iso "$FAKE_ISO" --iso-sha256 "$FAKE_SHA" \
     --profile "$HERE/../profiles/nested-canary.profile" \
     --pairing --out "$SCRATCH/out" --dry-run > "$BUILD_LOG" 2>&1