From 57c06ba99ddbe96e07a4b59d85f4f2ef4d6f32b7 Mon Sep 17 00:00:00 2001
From: kisfenyo <nagyfenyvesi.viktor@gmail.com>
Date: Wed, 21 Oct 2026 23:45:05 +0200
Subject: [PATCH] CONTEXT + 08: tonight's rulings (D22, D26) and the
 CC-unattended R-1199 decision (the box's page is the list the hub mails by);
 evidence: rc.2 smoke on 9202, 9202 back as found, no-swap test tools

---
 CONTEXT.md                                    | 15 ++++++++++
 documentation/architecture/08-alarm-ladder.md |  7 +++++
 .../P2-noswap/01-host-report-carries-swap.txt |  4 +++
 .../P3-restore/03-teardown-9202.txt           |  5 ++++
 .../night-2026-10-21/P5-checks/r1199-red.txt  |  5 ++++
 .../night-2026-10-21/P6-build/01-9202-rc2.txt | 24 +++++++++++++++
 .../P6-build/02-9202-back-as-found.txt        | 11 +++++++
 .../audits/night-2026-10-21/tools/noswap.sh   | 29 +++++++++++++++++++
 .../night-2026-10-21/tools/noswaprun.sh       |  8 +++++
 9 files changed, 108 insertions(+)
 create mode 100644 documentation/audits/night-2026-10-21/P2-noswap/01-host-report-carries-swap.txt
 create mode 100644 documentation/audits/night-2026-10-21/P3-restore/03-teardown-9202.txt
 create mode 100644 documentation/audits/night-2026-10-21/P5-checks/r1199-red.txt
 create mode 100644 documentation/audits/night-2026-10-21/P6-build/01-9202-rc2.txt
 create mode 100644 documentation/audits/night-2026-10-21/P6-build/02-9202-back-as-found.txt
 create mode 100755 documentation/audits/night-2026-10-21/tools/noswap.sh
 create mode 100644 documentation/audits/night-2026-10-21/tools/noswaprun.sh

diff --git a/CONTEXT.md b/CONTEXT.md
index a3e08783..f52cb360 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -16,6 +16,21 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
 
+> **2026-10-21 night (unattended; nothing released, deployed, published or vouched).** Operator rulings recorded:
+> **D22 = yes (20:05)** — D20's put-back extended to the local unit restore, the second-drive restores and a restore cut by
+> a power loss (`07` §6.3, the 2026-10-21 `[DESIGN]` paragraph; controller `d582feb`, proven on 9202 with 0.338.0-rc.1:
+> a damaged unit → the live data back and running; a controller killed after the volume step → put back on start);
+> **D26 = A (20:03)** — release and vouch the agent with the swap fix in the morning; a host-swap warning follows (agent
+> `0da792e` reports `host_swap_mb`/`guest_swap_mb`, one WARN; hub 0.164.0 built, not deployed: operator-only
+> `host_swap_short`; controller install-page sentence). **Decided by CC unattended — operator may reverse (R-1199):** the
+> box's notification page is the source the hub mails the household by: a box whose household never saved a choice now
+> pushes the default list its page shows at start (no address; the hub's no-clobber guard keeps the stored one) —
+> `08` (the household decides; „the box's page is the source"). Measured: Tester4's hub list was saved 2026-10-18 and
+> lacked disk warning, drive disconnected and second-drive failure, so the household got 1 alarm of 9. Built tonight:
+> controller `0.338.0-rc.2` (`sha256:ae52c93e…`, all of tonight's controller work, smoke-tested on 9202, 9202 back on
+> 0.337.0), hub `0.164.0` (`sha256:931594e3…`, manifest still 0.163.0), agent candidate `0.162.0` from `0da792e`
+> (sha256 `5fd7a23b…`, not published). The 8 GB soak with the swap fix: `audits/night-2026-10-21/P1-soak/`.
+
 > **2026-10-21 (day brief, before Tester 2) — hub 0.163.0 DEPLOYED (operator yes, 11:46 UTC); controller 0.337.0 released
 > (three test boxes 14:06 UTC, global floor after the freeze proof); agent `286a7e3` committed, NOT released.** Operator rulings
 > today: **D24 = yes** (the hub's DST double run fixed: `nextDailyRun`, calendar day+1, `05` §16.5); **D25** (a second-drive
diff --git a/documentation/architecture/08-alarm-ladder.md b/documentation/architecture/08-alarm-ladder.md
index 0f190188..2e6e61ac 100644
--- a/documentation/architecture/08-alarm-ladder.md
+++ b/documentation/architecture/08-alarm-ladder.md
@@ -499,6 +499,13 @@ app-mail settings).*
 **Pick: A.** It follows the direction (the household decides three things, not 18), keeps every existing
 mechanism, and each slice is reversible on its own. B can be added later as a fourth choice if households ask.
 
+**`[DESIGN]` 2026-10-21 night — the box's page is the list the hub mails by (R-1199; decided by CC unattended — operator
+may reverse).** Measured: a fresh box shows its default list ticked, but pushed nothing until the household saved the
+page, so the hub kept mailing by an older stored list (Tester4: saved 2026-10-18, without disk warning, drive
+disconnected and second-drive failure — 1 household alarm of 9 on the rehearsal day). Now a box whose household never
+saved a choice pushes the default list at start (no address — the hub keeps the stored one); a saved choice is pushed
+only as before (R-922). Controller `ba22f9b`, unreleased.
+
 **What the operator still gets:** everything, unchanged — the operator channel never reads the household's switches
 (`processOperator` is independent of `enabled_events`).
 
diff --git a/documentation/audits/night-2026-10-21/P2-noswap/01-host-report-carries-swap.txt b/documentation/audits/night-2026-10-21/P2-noswap/01-host-report-carries-swap.txt
new file mode 100644
index 00000000..e96a32ac
--- /dev/null
+++ b/documentation/audits/night-2026-10-21/P2-noswap/01-host-report-carries-swap.txt
@@ -0,0 +1,4 @@
+['id', 'host_id', 'customer_id', 'received_at', 'report_json', 'agent_version', 'cpu_percent', 'memory_percent', 'disk_percent', 'guest_total', 'guest_running', 'cloudflared_status']
+2026-10-21 21:06:44 agent 0.162.0-night.2 host_swap_mb 7935 guest_swap_mb 4096 guest spec swap [(9201, 4294967296)] oob present True
+2026-10-21 20:51:35 agent 0.162.0-night.2 host_swap_mb 7935 guest_swap_mb 4096 guest spec swap [(9201, 4294967296)] oob present True
+2026-10-21 20:36:29 agent 0.162.0-night.1 host_swap_mb None guest_swap_mb None guest spec swap [(9201, None)] oob present True
diff --git a/documentation/audits/night-2026-10-21/P3-restore/03-teardown-9202.txt b/documentation/audits/night-2026-10-21/P3-restore/03-teardown-9202.txt
new file mode 100644
index 00000000..a553cf15
--- /dev/null
+++ b/documentation/audits/night-2026-10-21/P3-restore/03-teardown-9202.txt
@@ -0,0 +1,5 @@
+21:09:00Z stop 200
+remove 200 {"ok": true, "data": {"removed": "rallly", "volumes_removed": ["rallly_rallly_postgres_data"], "hdd_paths_removed": [], "hdd_paths_preserved": [], "hdd_note": "Az alkalmazás nem tárolt saját adatot külső meghajtón, így ott nem volt mit törölni.", "userdata_kept": [], "backup_paths_removed": ["/mnt/s
+0
+0
+0
diff --git a/documentation/audits/night-2026-10-21/P5-checks/r1199-red.txt b/documentation/audits/night-2026-10-21/P5-checks/r1199-red.txt
new file mode 100644
index 00000000..3295104f
--- /dev/null
+++ b/documentation/audits/night-2026-10-21/P5-checks/r1199-red.txt
@@ -0,0 +1,5 @@
+--- FAIL: TestR1199_ANeverSavedChoiceIsPushedAtStart (0.00s)
+    prefs_sync_wiring_test.go:15: a box with no saved choice must push the default list its page shows
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/cmd/controller	0.014s
+FAIL
diff --git a/documentation/audits/night-2026-10-21/P6-build/01-9202-rc2.txt b/documentation/audits/night-2026-10-21/P6-build/01-9202-rc2.txt
new file mode 100644
index 00000000..6c75107b
--- /dev/null
+++ b/documentation/audits/night-2026-10-21/P6-build/01-9202-rc2.txt
@@ -0,0 +1,24 @@
+gitea.dooplex.hu/admin/felhom-controller:0.338.0-rc.2
+gitea.dooplex.hu/admin/felhom-controller:0.338.0-rc.2 Up 30 seconds (healthy)
+/ 302
+/launcher 200
+/stacks 200
+/apps/immich 200
+/apps/immich/guide 200
+/backups 200
+/backups/restore 200
+/backups/remote 200
+/backups/escrow 404
+/storage 200
+/storage/init 200
+/sharing 200
+/settings/security 200
+/settings/notifications 200
+/deploy/rallly 404
+/apps/rallly 200
+/monitoring 200
+/kept-data 200
+error-or-panic lines since start: 0
+storage/init: Hagyd igy: True | prefilled hdd_ value: ['hdd_1'] | novalidate: True
+family hint accents: True
+remote: Haladó: True | restic + SFTP shown: False
diff --git a/documentation/audits/night-2026-10-21/P6-build/02-9202-back-as-found.txt b/documentation/audits/night-2026-10-21/P6-build/02-9202-back-as-found.txt
new file mode 100644
index 00000000..3c436031
--- /dev/null
+++ b/documentation/audits/night-2026-10-21/P6-build/02-9202-back-as-found.txt
@@ -0,0 +1,11 @@
+gitea.dooplex.hu/admin/felhom-controller:0.337.0
+felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.337.0 Up 30 seconds (healthy)
+filebrowser gtstef/filebrowser:1.5.6-stable Up 8 hours (healthy)
+immich-machine-learning ghcr.io/immich-app/immich-machine-learning:v3.2.4 Up 2 hours (healthy)
+immich-postgres ghcr.io/immich-app/postgres:16-vectorchord0.4.3-pgvectors0.2.0 Up 2 hours (healthy)
+immich-redis redis:7-alpine Up 2 hours (healthy)
+immich-server ghcr.io/immich-app/immich-server:v3.2.4 Up 2 hours (healthy)
+paperless-postgres postgres:18-alpine Up 2 hours (healthy)
+paperless-redis redis:7-alpine Up 2 hours (healthy)
+paperless-webserver ghcr.io/paperless-ngx/paperless-ngx:2.20.15 Up 2 hours (healthy)
+traefik traefik:v3.7.13 Up 19 hours
diff --git a/documentation/audits/night-2026-10-21/tools/noswap.sh b/documentation/audits/night-2026-10-21/tools/noswap.sh
new file mode 100755
index 00000000..07ab39fc
--- /dev/null
+++ b/documentation/audits/night-2026-10-21/tools/noswap.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+# noswap.sh MINUTES — night 2026-10-21 Part 2.1: does the freeze come back on a host with NO swap? On the soak VM
+# (host 192.168.0.128, NOT demo-hp): record → `swapoff -a` → the same upload burst (load2.py cycles on the helper CT 9332,
+# via noswaprun.sh) for MINUTES → `swapon -a` → record. The 10 s recorder and the outside probe keep running.
+# Run from DooPlex. Prints a timeline; nothing secret.
+set -u
+M=${1:-30}
+SP=/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/38fde0c6-e964-4ec1-b0c7-56e62d675225/scratchpad
+BX=$SP/bx
+F='perl:\|LC_\|LANG\|supported\|locale\|Falling'
+t() { date -u +%T; }
+echo "$(t) NOSWAP START ($M min)"
+$BX 'export LC_ALL=C; echo "## before"; swapon --show; free -m; pct config 9201 | grep -E "^(memory|swap)"; cat /sys/fs/cgroup/lxc/9201/memory.swap.max' 2>&1 | grep -v "$F"
+echo "$(t) swapoff -a"
+$BX 'export LC_ALL=C; time swapoff -a; swapon --show; free -m | grep -i swap' 2>&1 | grep -v "$F"
+echo "$(t) restarting immich-machine-learning so its models load again under the burst (as on the first afternoon)"
+$BX 'pct exec 9201 -- docker restart immich-machine-learning' 2>&1 | tail -1
+echo "$(t) burst start"
+sec run REHEARSAL_2026_10_20_IRISZ_PW,REHEARSAL_2026_10_20_ODON_PW -- sh -c 'printf "IRISZ=%s\nODON=%s\n" "$REHEARSAL_2026_10_20_IRISZ_PW" "$REHEARSAL_2026_10_20_ODON_PW" | ssh hp "pct exec 9332 -- bash -c \"umask 077; cat > /root/.burstenv\""'
+ssh hp "pct exec 9332 -- bash /root/noswaprun.sh $M" &
+BP=$!
+end=$(( $(date +%s) + M*60 ))
+while [ "$(date +%s)" -lt "$end" ]; do sleep 60; echo "$(t) health $(tail -1 $SP/soaklive/02-outside.txt | awk '{print $2, $3}')"; done
+echo "$(t) burst window over; swapon -a"
+$BX 'export LC_ALL=C; swapon -a; swapon --show; free -m | grep -i swap' 2>&1 | grep -v "$F"
+wait $BP 2>/dev/null
+echo "$(t) agent log (host-swap):"
+$BX 'journalctl -u felhom-agent --since "-60min" --no-pager | grep -E "host-swap" | cut -c1-260' 2>&1 | grep -v "$F"
+echo "$(t) NOSWAP END"
diff --git a/documentation/audits/night-2026-10-21/tools/noswaprun.sh b/documentation/audits/night-2026-10-21/tools/noswaprun.sh
new file mode 100644
index 00000000..f24a1a4e
--- /dev/null
+++ b/documentation/audits/night-2026-10-21/tools/noswaprun.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# noswaprun.sh MINUTES — on the helper CT: the no-swap burst (load2.py cycles). The env file is read into memory and
+# shredded at once (as soakrun.sh).
+cd /root
+ENVD=$(cat /root/.burstenv); shred -u /root/.burstenv
+echo "$(date -u +%T) BURST START $1 min" >> /root/noswap.log
+timeout $(( $1*60 + 300 )) python3 /root/load2.py $1 <<< "$ENVD" > /root/noswap-burst.log 2>&1
+echo "$(date -u +%T) BURST END rc=$?" >> /root/noswap.log