operator rulings 2026-10-05 18:23: 43 burn-down rows closed as accepted (292 -> 249); R-124 kept (fix now), R-698 kept (operator's known risk); R-831/R-870 not rotated; R-887 one runner online — the stale-registration guess was wrong
gates / gates (push) Successful in 1m36s
gates / gates (push) Successful in 1m36s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
@@ -26,6 +26,58 @@
|
||||
|
||||
---
|
||||
|
||||
## 2026-10-05 (late night) — burn-down round 2: the operator's answer (43 accepted), small rows fixed with releases
|
||||
|
||||
The full text of every row below: `git show e8c56c44:documentation/backlog/OPEN-ITEMS.md` (the commit before each closing commit; the burn-down evidence table is `audits/burndown-2026-10-05/`).
|
||||
|
||||
| Row | What | Closed | Evidence |
|
||||
|---|---|---|---|
|
||||
| **R-93** | `drill-r50` is both a blocked customer and the only drift fixture **FACT 2026-09-13 (R-461): the fixture is GONE — `qm list` is empty on both demo boxes, so neither option is available and the row's p (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A choice between two test fixtures that no longer exist. Fix would cost: a new fixture (a design job). If never: nothing breaks. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-161** | **The volume-persistence gate is enforced by CONVENTION, not automatically.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: The check that app data lands where backups see it runs by hand, not on every push. Fix would cost: CI starting ~53 apps per push. If never: a bad template can ship until the next periodic check. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-162** | **`docker diff` is the gate's only witness, and its failure mode is quiet.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: If Docker ran on an unusual storage driver, one catalog check would blame the wrong thing. Fix would cost: ~1 h for a driver nobody runs. If never: nothing; the check still fails safely. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-169** | **CI can only report, because there is no gate in the road.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: CI reports after a push lands instead of blocking it (no pull requests here). Fix would cost: a pull-request workflow for every change. If never: a forbidden --no-verify push could land broken code until the CI mail. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-194** | **PVE's permission cache delays every grant-state verdict by an unknown amount, so "the agent can read it" and "the ACL exists" are not the same measurement.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A removed storage permission can still look present for minutes (Proxmox cache). Fix would cost: a new probe in the agent. If never: the self-repair notices up to ~16 min late, then repairs. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-210** | **Which of the 345 local images may be deleted — 131 controller tags and 62 hub tags exist ONLY on this box and are not recoverable by `docker pull`** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: 193 old controller/hub images sit only on DooPlex (~27 GB). Fix would cost: a careful delete on DooPlex. If never: 27 GB stays used; ~199 GB is free. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-284** | **„A kiválasztott tárhely majdnem megtelt." on a store that is 93 % FREE — an apparent inverted threshold.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: An 'almost full' warning reported on an empty disk was a misreading; the page never shows it there. Fix would cost: nothing to fix. If never: nothing. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-346** | **`ActiveEnterTimestamp` answers a different question than the one a slope measurement asks, and on ep0 right now it is wrong by 5 h 56 m.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A warning about a mistake nobody has made (the audit found 0 cases). Fix would cost: nothing left. If never: nothing today. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-367** | **The database dumps already written under the wrong name are stranded, and nothing will ever collect them.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: One old 312 KB database dump sits on the demo-hp test box under an old folder name. Fix would cost: a hand delete on a demo box. If never: a small file stays on a test box. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-371** | **The off-site tier is the only backup tier that announces nothing on success.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: The weekly off-site backup sends no 'done' message (failures and staleness already alarm). Fix would cost: a new event in two repos. If never: success stays silent, as now. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-372** | **A Tier-2 copy that has NEVER been produced because its source path is missing is not surfaced prominently to the operator.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: An idea to show 'second copy never made' apart from 'second copy failed' to the operator. Fix would cost: a design and a new state end to end. If never: the existing loud warning stays. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-374** | **Three C1 refusal cases were judged borderline, left unfiled, and never named — so nobody can re-open the judgement.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A July audit says three borderline cases were left out but never named them. Fix would cost: hours to guess which three. If never: nobody can re-judge them; later sweeps exist. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-393** | **A decision-log skill for unattended runs was considered and deliberately deferred.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A proposed tool to log every small decision an unattended run makes. Fix would cost: a small project. If never: the bigger decisions are already recorded under the rules file. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-420** | **`controller_gates.py` could not express a NON-BLOCKING gate before 2026-09-01** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: The felhom.eu gate runner cannot mark a gate as advisory only. Fix would cost: add it when one is needed. If never: nothing today. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-424** | **`one_register_gate.py`: a real defect parked under the roadmap state `idea` is invisible to it.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: The roadmap gate cannot tell a real defect filed as an idea from an idea. Fix would cost: no mechanical fix exists. If never: a person must read the roadmap. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-445** | **[P3-LOW] Hub app telemetry survives the app's removal, so a 15-minute throwaway now sets a FLEET-WIDE memory recommendation.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: The hub's memory suggestion for an app can use samples from a short test install. Fix would cost: a hub change (~1-2 h). If never: a misleading suggestion for up to 7 days after a test install. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-460** | **[P3-LOW] BookStack's FILE half cannot be seeded or verified without a browser, so its upgrades can only ever be auto-proven for the DATABASE.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: BookStack's uploaded files cannot be checked automatically after an upgrade. Fix would cost: an upstream change or a browser step. If never: upgrades stay half-checked automatically. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-503** | **[P3-LOW] SPIKE (not built): an install-time disk rule for the public ISO — "exactly one internal disk → install; otherwise stop in Hungarian".** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: Letting the installer pick the disk when there is only one (you ruled no). Fix would cost: reversing your rulings. If never: a person keeps choosing the disk. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-527** | **[P3-LOW] The catalog flag `locked_after_deploy` is read by no controller code — every setting is read-only after install whatever the catalog says.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A catalog 'locked after install' flag does nothing visible (all settings are read-only anyway). Fix would cost: delete it everywhere, or build an edit page. If never: nothing a household meets. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-532** | **[P3-LOW] Vaultwarden's `/api/config` still says `disableUserRegistration:false` with signups off, so the web vault shows a register form that the server then refuses.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: Vaultwarden shows a sign-up form although sign-up is off; the server refuses it. Fix would cost: an upstream fix. If never: a stranger sees a form that fails. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-551** | **[P3-LOW] No Tier-0 box can put the escrow ceremony in the state R-546 fixes — paused AND connected to its agent — so the readiness branches are proven only by tests.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: The escrow 'waiting for the agent' screens are tested but never seen on a real box. Fix would cost: a token setup on the scratch box. If never: small chance the live page differs; the state lasts ~17 min. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-610** | **[P2-MEDIUM] The power cut AFTER the new version has started was never measured — R-520 closed on the safe half only.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A power cut inside a sub-second startup phase was never measured (same code as the measured phase). Fix would cost: a new fault injector and a drill. If never: nothing new would be learned. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-654** | **[P3-LOW] opengist 1.15 moved every page under `/-/` — a household's `/login` bookmark answers 404 after the update.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: Old opengist /login bookmarks answer 404 after an upstream move. Fix would cost: one help-text line. If never: a household re-bookmarks once. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-687** | **[P3-LOW] Part 7's live proof has four gaps a scratch box cannot close, and one observability gap.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: Three live proofs a scratch box cannot give, and one log line 20 minutes off. Fix would cost: special test venues. If never: the tests stay the proof. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-688** | **[P3-LOW] The customer delete says it removes the tunnel and zone, but no leg of it calls Cloudflare.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: Deleting a customer does not remove their Cloudflare tunnel and DNS; the dialog says so. Fix would cost: a new Cloudflare step in the delete. If never: you remove them by hand, guided by the dialog. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-768** | **[P3-LOW] Grimoire is not built: upstream rules out public exposure and publishes no image for its current line.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: Grimoire is not offered (upstream rules out public use); the row only watches upstream. Fix would cost: a re-read each catalog campaign. If never: nothing; Karakeep covers bookmarks. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-793** | **[P3-LOW] Enterprise / BUSL code ships inside four open images — Cal.com and Docmost (EE folders, off without a key), Outline (BUSL-1.1: no commercial "Document Service"), meilisearch v1.36 in Wanderer (EE modules).** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: Four apps contain paid-edition code that is off; the row says never turn it on. Fix would cost: nothing (the rule lives in the licence audit). If never: nothing unless someone enables it. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-796** | **[P3-LOW] MeTube's "send to MeTube" helpers (browser extensions, bookmarklets, phone apps) cannot work behind the family gate.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: MeTube's browser 'send' helpers cannot pass the family gate. Fix would cost: a new token design. If never: households paste links in the page. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-797** | **[P3-LOW] `check-family-gate.py` rule 3 (a family_gate template needs a baked golden ≥ 0.287.0) is checked only where the felhom.eu sibling exists — CI's single clone cannot.** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: Catalog CI cannot run one gate rule; it says 'not checked' and the push hook checks it. Fix would cost: a CI checkout of a second repo. If never: only a forbidden bypass could skip it. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-804** | **[P3-LOW] plant-it's image is gone from Docker Hub: `msdeluise/plant-it:0.10.0` answers "pull access denied … repository does not exist".** (P4) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: plant-it's image no longer exists; the template is already marked not installable. Fix would cost: hide the template (small). If never: nothing. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-190** | **A storage ACL that demonstrably WORKED in the morning was gone by mid-morning, and nothing recorded its removal.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A storage permission vanished once in August; the agent now restores it and mails you. Fix would cost: hours of live experiments. If never: one mail per recurrence; it self-repairs. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-412** | **A recovery unit lost DURING an off-site run — after its own dump leg, before its push — is shipped hollow and the run reports success.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A rare race can push one hollow off-site copy of one app; the next night repairs it. Fix would cost: a change at the backup/push boundary plus a drill. If never: rarely, one app's off-site copy is hollow for a day; the second-drive copy stays good. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-458** | **[P3-LOW] `.felhom.yml` keeps flowing to an app whose compose file is FROZEN, so a frozen app can receive a health check written for a version it is not running.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A pinned (frozen) app can get a newer health check, which can only cause a false alarm. Fix would cost: a fiddly change on the sync path. If never: maybe one false alarm one day. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-584** | **[P2-MED] Credential-bearing probe scripts were left in a live guest's `/tmp` for hours, across three releases.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: Helper scripts with the shared demo password were left in a demo box's /tmp. Fix would cost: a wrapper tool. If never: demo-password litter on throwaway boxes. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-586** | **[P2-MED] The ISO bootstrap harness captured the console to a FILE, so each banner erased the one before it — two checks were RED for two days and nobody saw.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: The ISO bootstrap harness runs at each ISO release, not on every push. Fix would cost: Docker-capable CI. If never: a break is caught at the next ISO release. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-738** | **[P2-MEDIUM] Every wger update that brings database migrations leaves wger broken, and the guarded Update reports `done`.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: The update's health check sees only the front page, so data broken behind it passes. Fix would cost: a per-app data check in every template. If never: catalog tests keep catching it before release. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-778** | **[P3-LOW] A box that rolls back to a controller ≤ 0.285 after v0.286 keeps the new traefik (an old controller never rewrites a running traefik) — and the old `clientIP` believes the LEFTMOST X-Forwarded-For, which a stranger then writes: the dashboard's login counter becomes dodgeable until the box moves forward again.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A box that rolls back below controller 0.286 trusts a forged address in the login counter. Fix would cost: a patch release or a rollback rule. If never: a short window until the next update. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-783** | **[P3-LOW] SparkyFitness: three wrong sign-ins by anyone shut EVERY visitor out of sign-in for ~10 s — a stranger retrying every 10 s keeps the household out.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: Three wrong SparkyFitness logins block sign-in for everyone for ~10 s. Fix would cost: an upstream setting. If never: a persistent stranger can annoy the household. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-853** | **After a boot the box's versions and crash facts reach the hub up to ~15 minutes late.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: After a boot, the box's versions reach the hub up to ~15 min late. Fix would cost: a new agent mode and release. If never: one report late; nothing lost. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-700** | **[P2] A drive move unpinned the app — its next start took the catalog's newest version, past the ladder.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A drive move keeps the app's records: fixed in controller v0.276.0 with tests; never seen live on a two-drive box. Fix would cost: a live two-drive move. If never: the tests stay the proof. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-704** | **[P3-LOW] The box's crash-loop stop (decision 28) outlives the app: after remove and reinstall, the new install is still held.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: A fresh install drops an old update hold: fixed in v0.278.0 with tests; not seen live. Fix would cost: a live install with a leftover hold. If never: the tests stay the proof. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-706** | **[P3-LOW] Removing an app "with its backups" leaves its off-site verification copy on the drive.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: Removing an app with its backups also deletes its off-site test copy: fixed in v0.279.0 with tests; not seen live. Fix would cost: a live remove with an off-site copy. If never: the tests stay the proof. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
| **R-723** | **[P3-LOW] A fresh box sends the operator two mails on day one that describe nothing wrong.** (P3) | CLOSED 2026-10-05 — ACCEPTED BY THE OPERATOR (ruling 2026-10-05 18:23, the burn-down list) | Reason on the list: No 'box recovered' alarm in a new box's first hour: fixed in hub v0.126.0 with tests; not seen at a real first install. Fix would cost: watch the next real install. If never: the tests stay the proof. Evidence of the verdict: `audits/burndown-2026-10-05/partA-table.md`. |
|
||||
|
||||
---
|
||||
|
||||
## 2026-10-05 (night) — the burn-down: stale rows closed with evidence, small rows fixed (rule: fix small, do not file)
|
||||
|
||||
The full text of every row below: `git show ab2b3049:documentation/backlog/OPEN-ITEMS.md` (the commit before each closing commit; the burn-down evidence table is `audits/burndown-2026-10-05/`).
|
||||
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user