Media all drives, S5/S6 on Tester 1: a pulled drive stops nothing, the guest keeps a dead mount; on return nothing sees it until stop+start, FileBrowser cannot be restarted (R-1038); 15 §5 written; final report

documentation/architecture/15-media-library.md

@@ -5,7 +5,7 @@
 > learn. **No document covered this before 2026-10-14** — itself a finding: the four templates were written one by one
 > and never tested together (R-1014). Rulings: `09` §3 decisions 237–241. Measured on Tester 1:
 > `audits/media-all-drives-2026-10-14/`. Marks as in `01`: **[DESIGN]** a decision or proposal; **[FACT]** read in a
-> named file or measured. **Status: DRAFT** — §5 waits on S5/S6 (after the operator's test).
+> named file or measured. **Status: DRAFT** — measured end to end on Tester 1; the operator's layout decision (§2, STATUS D9) is open.
 
 ## 1. The problem
 
@@ -79,10 +79,37 @@ decisions 238–239 needs a real restart (`up -d --force-recreate` once the per-
 that came back. Each drive card carries „apps restarted since this drive was added: yes/no" with the button
 (decision 239).
 
-## 5. A drive is pulled / comes back — PENDING (S5/S6, after the operator's test)
+## 5. A drive is pulled / comes back [FACT, measured on Tester 1 2026-10-14, `audits/media-all-drives-2026-10-14/S5-S6/`]
 
-Predictions written: a pulled drive B stops nothing (no media app has `HDD_PATH` on B); the apps keep a dead view of B;
-Plex/Jellyfin may mark items unavailable; on return, running containers do not see B until recreated.
+**S5 — Media B's disk detached at 20:10:23 while six media apps ran** (Sonarr, Radarr, qBittorrent, Transmission,
+Plex, Jellyfin; all with `HDD_PATH` on Media A):
+
+- **The host** saw the disk go in 2 s and unmounted its own mount, but the **guest kept a dead ext4 mount** of
+  `/mnt/felhom-drives/media_b`: `mountpoint` = yes, every read = Input/output error (not an empty folder — so nothing can
+  be written onto the guest's own disk there, which the brief feared).
+- **The controller** marked the drive disconnected at 20:10:47, **stopped 0 apps** (none keys on Media B), pushed
+  `storage_disconnected` (error); the hub got it the same second and mailed the operator; `health_degraded` followed at
+  20:13. It also tried to rebuild the skeleton ON the dead mount („chmod … input/output error") — the gate asks „is it a
+  mountpoint?", and a dead mount says yes (R-1038).
+- **The dashboard**: the card reads „Media B — Leválasztva 2026. 10. 14. 20:10" with „Csatlakoztatás"; it does not say
+  that six apps use the drive. No banner on the start page.
+- **The apps** did not crash; all read I/O errors on B. Sonarr/Radarr mark root folder B `accessible=false` but their
+  own health page stays EMPTY. qBittorrent's B torrents sat queued and did not notice.
+- **Plex and Jellyfin removed nothing in 30 minutes.** Plex scans only when asked (R-1037); Jellyfin's real-time monitor
+  got errors, not deletions. A scan during an outage is the risk; with Plex's „empty trash after every scan" on by default
+  such a scan would drop B's items — not measured, deliberately.
+
+**S6 — the same volume re-attached to the same slot at 20:41:00:** the agent re-mounted it (`sde`) and bound it under
+the parent within 24 s, ON TOP of the dead mount (two stacked mounts); the controller logged „drive RETURNED …
+restarted gate-stopped apps" (there were none) and `storage_reconnected`. **Every running container still saw the dead
+mount**, FileBrowser included („ensured running without recreate"). The dashboard's app „restart" changed nothing
+(same start time, still I/O error — R-1026). **Stop + start fixed all six apps at once**; files and all 13 hardlink pairs
+intact. FileBrowser is protected — the household cannot stop or start it (403), so it stays broken (R-1038).
+
+**What the restart notice (decisions 238–239) must therefore cover [DESIGN]:** a drive added, a drive removed, **and a
+drive that came back** — the last is the one where the household is told nothing today and the apps are silently half
+blind. The restart is stop + start (or `up -d --force-recreate`) of every container that binds the drive, FileBrowser
+included, and the box — not Sonarr — says that a root folder is unreachable.
 
 ## 6. The links [FACT, measured calls in `audits/media-all-drives-2026-10-14/tools/wire.py`]