Report: Tester 1 back on the live catalog, decoy suites, memory limits, FileBrowser (2026-10-17); STATUS

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT-tester1-limits-filebrowser-2026-10-17.md

@@ -0,0 +1,166 @@
+# REPORT — Tester 1 back on the live catalog, decoy suites in every runner, memory limits, FileBrowser (2026-10-17)
+
+Written in ASD-STE100 Simplified Technical English. Brief: „Tester 1 back on the live catalog (R-1022), decoy suites in
+every runner, memory limits, FileBrowser's default password" (2026-10-17, operator „yes" 10:47). Design read first:
+`runbooks/target-selection.md` (demo-hp), `09-update-architecture.md` (corrections L156, ladder L2259–2263, frozen
+L2662), `01-topology-and-trust.md`, `03-host-agent.md`, `04-control-plane-authorization.md`, `06-offsite-connectivity.md`;
+the private security-review notes (lead C1-4, read in place, nothing copied). Evidence:
+`documentation/audits/tester1-limits-filebrowser-2026-10-17/`.
+
+## Plain words first
+
+- **Tester 1 is clean and on the live app list.** The seven test apps and four test drives are gone; bookstack,
+  paperless-ngx and privatebin stay. Today's Redis change reached it.
+  **Your step:** remove „plex-k6" on plex.tv (Settings → Authorized Devices).
+- **Every gate runner now runs its own test cases** (controller, agent; felhom.eu already did).
+- **Six memory limits raised; the 23 memory requests wait** — your answer at the STOP (they would refuse the household
+  set's sixth app on an 8 GB box). Immich waits for a bigger measurement.
+- **FileBrowser's default password is checked at every FileBrowser start** (controller 0.326.0, the floor for every
+  box since 09:55 UTC). Measured on the scratch box before: the default came back and stayed open; after: replaced in
+  2 seconds.
+- **The tunnel before the claim is a design question for you, not a change** — R-1126, two options below.
+- **A collision:** another session (cc-creds) filed R-1118–R-1122 while I filed mine, and its local commit carried my
+  uncommitted register edits. My rows are now R-1123–R-1128; nothing was lost. Its commit is not pushed yet — I asked it
+  and did not push its work.
+
+## 1. Tester 1 (R-1022) — each step, read back (`P1/`)
+
+| Step | Read-back |
+|---|---|
+| 1 apps | Sonarr, Radarr, qBittorrent, Transmission, Plex, Jellyfin, Prowlarr: stop 200, remove (keep data, keep backups) 200 each; `userdata_kept` names the media folders. Stay: **bookstack, paperless-ngx, privatebin** |
+| 2 drives | `POST /api/storage/decommission` media_a, b, c, d → 200 each (`stopped_apps: null`); settings: four „decommissioned", adatlemez live |
+| 3 repoint | `RESTORED-IDENTICAL`; only `repo_url` differed (diff by key); `repo_url` = live; sync `6589376 → 5d9450b` (64 stack dirs); `drill-catalog.git` (11 MB) removed |
+| 4 disks | the four host mounts stopped cleanly inside the VM; `qm set 341 --delete scsi2,scsi3,scsi4,scsi5` rc 0; `pvesm free nvme-scratch:341/vm-341-disk-3/-4/-5/-6.raw` rc 0 each; the four stale `unused` lines removed; `qm config 341`: scsi0 + scsi1 only; `pvesm list`: disk-0/1/2 only |
+| 5 memory | `memory: 8192` |
+| 9 release | `/etc/felhom-controller-image` = 0.325.0 by the floor (no hand pin), then 0.326.0 by today's release |
+| 6/7 drill | no box follows the drill (all four guests read the live URL); drill tree = live main, commit `6723057` — a normal commit, NOT a force-push (the brief's standing rule); the old drill commits stay in its history, unused |
+| 8 Redis | paperless-ngx restarted: `["redis-server","--appendonly","no"]`, `aof_enabled:0`, healthy |
+| walk | 10 containers, none unhealthy; dashboard 200 |
+
+Left on Tester 1: the agent's four mount units for the removed disks (R-1124).
+
+## 2. Decoy suites (R-1116)
+
+| Repo | Suite | Where | Red-proof | Commit |
+|---|---|---|---|---|
+| controller | 22.3 s, 53 cases | full run, blocking (not `--fast`: over 20 s, and it edits real files for a moment) | one decoy flipped → `CONVICTED: gate-decoys` | `55868cb` |
+| agent | 20.6 s here (5.5 s in CI), 30 cases | full run; CI runs the full set on every push | one decoy flipped → convicted | `c52d591` (script only, no release) |
+| felhom.eu | 56 s, 86 cases | already in `--fast` through `script-tests` (R-885) | — | no change |
+
+The memory index was at 202 lines (two of my morning notes); the helper removed two blank lines and I merged two lines:
+199 now.
+
+## 3. Memory (R-994) — catalog `bff82f9`
+
+| App | Limit old → new | Peak → share |
+|---|---|---|
+| docmost | 512M → 768M (total 896M → 1152M) | 475 MB → 62 % |
+| romm | 768M → 1024M (1280M → 1536M) | 703 MB → 69 % |
+| termix | 128M → 256M | 117 MB → 46 % |
+| uptime-kuma | 256M → 384M | 227 MB → 59 % |
+| grafana | 512M → 768M | 435 MB → 57 % |
+| tandoor | 1024M → 1280M (1280M → 1536M; its header said a stale 512M) | 827 MB → 65 % |
+
+**Sizing effect read first:**
+- The box refuses an install when its committed requests plus the new one exceed guest memory minus 384 MB
+  (`stacks/deploy.go:1549`).
+- The website estimator reads the measurement, not the catalog (`scripts/build_sizing_web.py:5`).
+- An 8 GB box's guest is 4,096 MiB, so 3,712 MB is usable.
+- The 23 measured requests would take the household set from 3,622 to 3,910 MB.
+
+**STOP → your answer: limits now, requests wait** (R-1125, values in `P3/requests-proposed.txt`).
+
+- **Step files:** unchanged; the same reading as for Redis holds for a limit change.
+- **Live:** on 9201, after the sync and the dashboard's restart, Docmost runs with `805306368` bytes (768 MiB) and is
+  healthy.
+- **Immich:** not changed; R-994 is narrowed to it.
+
+## 4. FileBrowser (R-977) and the tunnel (R-1126)
+
+**What the box checked, and why only once:**
+- At every base-stack round, the box tried FileBrowser's default login one time.
+- **Accepted:** it set a generated password, checked it, and stored it encrypted.
+- **Refused:** it wrote „someone set it" and never looked again.
+- Why once: to leave a password the household set by hand alone.
+
+**Measured on scratch 9202 (`P4/`):**
+- **0.324.0:** I removed FileBrowser and its data volume, and the box brought them back. The default login then answered
+  200 for 10 minutes, while the box still recorded „generated".
+- **0.326.0-rc.1:**
+  - At the controller start, the default was replaced in 1 s.
+  - After a second re-create, it was replaced only 5 minutes later. The round that started FileBrowser probed it while
+    it was still starting.
+- **rc.2:** a new run gets ~20 s to answer. Replaced 2 s after FileBrowser came back.
+
+**The fix:** the check runs once per FileBrowser start. A default that comes back is replaced. The household's own
+password is never touched. Two tests, each red-proved.
+
+**The tunnel before the claim:**
+- **What the code and docs say:**
+  - The claim needs the tunnel: the claim mail links `https://felhom.<domain>` (`hub/internal/notify/templates.go:27`).
+  - The box starts the tunnel when it has a token, with no claim check (`controller` `stacks/infra.go:85-90`).
+  - `01-topology-and-trust.md:119` and `:248` describe the tunnel and who runs it.
+  - **No document says whether the tunnel may run before the claim** — that is the finding.
+- **What a stranger can reach before the claim:**
+  - the claim page: a code, 72 h life, 5 tries, 15-minute lockout;
+  - FileBrowser on its default login, from its first start until the box replaces it: now 2 seconds.
+- **Option A (recommended):** keep the tunnel; publish FileBrowser's address only after its default is replaced.
+  Small; no promise changes.
+- **Option B:** start the tunnel only after a claim at home on the local network. The claim mail and flow change, and
+  the household must be at home.
+
+## 5. Versions, commits, fixtures
+
+- **Controller 0.326.0** (MinAgent 0.158.1, no golden), built from `334df7d`.
+  - Test builds: rc.1 (`3f01277`), rc.2 (`30956aa`, the short wait).
+  - Release timeline:
+    - per-box floors 09:54:10 UTC;
+    - all three boxes on 0.326.0 by 09:54:23;
+    - box walk green (demo-hp 24, demo-felhom 9, Tester 1 10 containers, none unhealthy; dashboards 200; https-only OK);
+    - global floor 09:55:58 UTC (303 `floor_set`), read back from `hub.db` + WAL (`0.326.0=0.158.1`, no per-box floor)
+      and from the hub page.
+  - 9202 moved to 0.326.0 by hand (it is set by hand on purpose).
+  - Row-number fix: `3e8d027`.
+- **Catalog:** `bff82f9` (limits), `356659d` (row number).
+- **Agent:** `c52d591` (script only).
+- **felhom.eu:** `fae80645` (register, evidence) and this report's commit, both waiting on the cc-creds session's push.
+- **i18n:** no page changed; every fixture byte-identical.
+
+## 6. Rows
+
+**Before 168 (this session's start).**
+- **Opened by me: 6.**
+  - R-1123 (`reuse_refs` searches stray clones)
+  - R-1124 (kept mount units)
+  - R-1125 (requests, yours)
+  - R-1126 (tunnel, yours)
+  - R-1127 (no automatic full run)
+  - R-1128 (the controller suite edits files without a lock)
+- **Closed: 3** (R-1022, R-1116, R-977). R-994 narrowed.
+- **Opened by the parallel cc-creds session: 5** (R-1118–R-1122).
+- **After: 176.**
+
+## 7. Observations
+
+1. A decommissioned and unplugged drive keeps its agent mount unit. FILED: R-1124
+2. The 23 requests would refuse the household set's sixth app on an 8 GB box. FILED: R-1125
+3. No document says whether the tunnel may run before the claim. FILED: R-1126
+4. The controller and catalog decoy suites run only in a manual full run. FILED: R-1127
+5. The controller decoy suite edits real tracked files without a lock. FILED: R-1128
+6. `reuse_refs_check` treats stray clones beside the repo as sibling repos. FILED: R-1123
+7. FileBrowser's window on rc.1 was 5 minutes, not seconds. NOT-A-FINDING: fixed in rc.2, the same release.
+8. The R-513 code comment said „before a claim there is no tunnel". NOT-A-FINDING: corrected in 0.326.0; the question itself is R-1126.
+9. The memory index reached 202 lines and would block every push. NOT-A-FINDING: two blank lines removed and two of my lines merged (199); the gate works as meant.
+10. R-1116's felhom.eu part was already covered by `script-tests`. NOT-A-FINDING: recorded in the close.
+11. The first sync on 9201 answered 429. NOT-A-FINDING: the sync's own debounce; the next try worked.
+12. Another session's local commit carried my uncommitted register edits, and our numbers collided. NOT-A-FINDING: the shared-clone risk is known (`felhom.eu-shared-worktree` memory); fixed by renumbering mine and asking before any push.
+
+## 8. Teardown (three layers)
+
+- **Machine:**
+  - Tester 1: as in §1; nothing of mine left.
+  - 9202: FileBrowser re-created three times (its old shares and users on that scratch box are gone by design of the
+    test); the probe script removed; it runs 0.326.0.
+  - 9201: Docmost restarted once.
+- **Host (demo-hp):** four volumes of VM 341 deleted by name, as the row lists; nothing else.
+- **Hub:** per-box floors set and cleared; global floor 0.326.0 / MinAgent 0.158.1.

STATUS.md

@@ -2,7 +2,7 @@
 
 **Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
 
-**Updated 2026-10-17 (day).** Controller 0.325.0 is the floor for every box since 08:21 UTC (after the three test boxes): two more password doors count a try before checking it, family sign-ins are stored as fingerprints, a file-share rename always applies; five apps' Redis saves snapshots now, which a full disk cannot damage — `REPORT-burndown-3-2026-10-17.md`. **Earlier (2026-10-17 night):** controller 0.324.0 was the floor for every box since 02:46 UTC (all three test boxes made tonight's off-site backup on it first): a restore now brings the database password back with the data (your 1A), restic 0.19.1 (your 2A), dashboard hardening — `REPORT-night-2026-10-17.md`. **Earlier (2026-10-16 evening):** 0.323.0, Debian 13 — `REPORT-debian13-restic-2026-10-16.md`. **Earlier (midday):** Controller 0.319.0 (the app page in panels, the login in one panel) is the floor, MinAgent 0.158.1 — `REPORT-app-page-tuning-2026-10-16.md`. **Earlier (morning):** Storage identity build B shipped: agent 0.158.1 and golden 0.318.0 vouched by you, controller 0.318.0 is the floor (MinAgent 0.158.1), installer 1.33.0 published — new one-disk boxes get their own data area. Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
+**Updated 2026-10-17 (afternoon).** Controller 0.326.0 is the floor for every box since 09:55 UTC: FileBrowser's default password is checked at every FileBrowser start. Tester 1 is back on the live app list (test apps and drives removed); six memory limits raised — `REPORT-tester1-limits-filebrowser-2026-10-17.md`. **Earlier today:** controller 0.325.0 was the floor since 08:21 UTC (after the three test boxes): two more password doors count a try before checking it, family sign-ins are stored as fingerprints, a file-share rename always applies; five apps' Redis saves snapshots now, which a full disk cannot damage — `REPORT-burndown-3-2026-10-17.md`. **Earlier (2026-10-17 night):** controller 0.324.0 was the floor for every box since 02:46 UTC (all three test boxes made tonight's off-site backup on it first): a restore now brings the database password back with the data (your 1A), restic 0.19.1 (your 2A), dashboard hardening — `REPORT-night-2026-10-17.md`. **Earlier (2026-10-16 evening):** 0.323.0, Debian 13 — `REPORT-debian13-restic-2026-10-16.md`. **Earlier (midday):** Controller 0.319.0 (the app page in panels, the login in one panel) is the floor, MinAgent 0.158.1 — `REPORT-app-page-tuning-2026-10-16.md`. **Earlier (morning):** Storage identity build B shipped: agent 0.158.1 and golden 0.318.0 vouched by you, controller 0.318.0 is the floor (MinAgent 0.158.1), installer 1.33.0 published — new one-disk boxes get their own data area. Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
 `documentation/backlog/STATUS-HISTORY.md`. Reports: `REPORT-night-2026-10-14.md`, `REPORT-immich-rollout-2026-10-14.md`, `REPORT-seo-felho-tarhely-2026-10-14.md`, `REPORT-immich-repair-2026-10-14.md`, `REPORT-power-cut-fixes-2026-10-14.md`, `REPORT-night-power-2026-10-13.md`, `REPORT-poweroff.md`.
 
 ## What works
@@ -56,6 +56,8 @@
 | D6 | R-992 | The scratch box cannot read the private drill catalog: give it a read-only login, or make that copy readable? | **A read-only login** | Readable copy: the drill catalog becomes public | every new-app test needs hand-staging | new-app tests |
 | D7 | R-990, R-989 | Rule yes / no / later on the forum ideas (`audits/forum-research-2026-10-12/FELHOM.md` §5) and the selfh.st ideas (`audits/selfhst-survey-2026-10-12/FELHOM.md` §6) | — | — | nothing changes; the research ages | — |
 | D8 | R-206 | Install DooPlex's Docker settings from git (restarts Docker), and prune the build cache weekly: yes or no? | **Yes, in a quiet window** | — | a rebuild of DooPlex still has the settings in git | — |
+| D10 | R-1125 | Raise the 23 memory requests to what the apps really use? Then an 8 GB box no longer installs the full household set (its sixth app is refused). | **Your call** — values ready | Keep: the box's install check stays optimistic | nothing changes | — |
+| D11 | R-1126 | The tunnel runs before the claim (the claim needs it). Close FileBrowser's first-start window (A), or claim only at home (B)? | **A** — small, no promise changes | B: the claim mail and flow change, the household must be at home | FileBrowser's default is open for ~2 s at its first start | — |
 | D9 | R-1062 | The N100's USB drive is also its whole-box backup drive. Split it in two anyway? | **No — keep one drive**; the lived-in box keeps its nightly whole-box backup | Split: the box loses its local whole-box backup (or add a second drive first) | it stays one drive; multi-drive tests stay on Tester 1 | — |
 | D10 | R-1118 | Where should CC keep its secrets, so it can use one without ever printing it? (spike 2026-10-17: the guards work; `audits/SPIKE-cc-creds-2026-10-17.md`) | **B — an encrypted file in a private Gitea repo (SOPS + age)**; then you make one empty private repo, CC cannot (its tokens lack the right) | Vaultwarden: one more service to run and back up; the spike's store test would be redone | the plain credentials file stays, and every known leak shape (sourcing it, `printenv`, curl URL echo, `kubectl get secret`) stays open | the build of the broker and guards |