Catalog sweep 2026-10-24: all 65 catalog apps on a fresh box (52 work, 10 with a problem, 0 broken); register 208 -> 217 (R-1269..R-1277 opened; notes on R-739, R-1267); STATUS + D46; map B1 re-checked; evidence

Every catalog app installed, used, backed up, removed keeping data, reinstalled, restored and removed with data on a fresh box from the public ISO (demo-hp VM 9360, Tester4), endpoint-level. Worst: a reinstall's capture rewrites the kept unit so its restore breaks the app (R-1269, P2), the restore still reports success (R-1270, P2), and „use my kept data" loaded another box's future-dated database (R-1271, P2). Drill catalog fixes for the morning list (n8n usage data; OpenGist 256M, proven by a cgroup probe). VM 9360 and LXC 9361 destroyed; hub host Tester4-aa9466 left for the operator. REPORT-catalog-sweep-2026-10-24.md.
2026-10-25 00:13:05 +02:00
1 parent 3add386aa9
commit 67053335d1
@@ -0,0 +1,67 @@
+# REPORT — every catalog app on a fresh box, the way a family uses it (2026-10-24 → 25 night, unattended)
+
+**Plain words first.**
+- 65 apps: **52 work, 10 work with a problem, 0 broken**; 2 are not offered for a new install (by design); Wanderer
+  cannot run on a box without DNS (known, R-739).
+- **The three worst:** (1) after „remove — keep backups" and a reinstall, restoring that backup breaks the app — the
+  household's item is gone from view (Tandoor, AdventureLog; R-1269, P2); (2) that restore still says it worked (R-1270,
+  P2); (3) „use my kept data" loaded another box's newer-dated database for Paperless-ngx, Nextcloud and Immich, and
+  Immich never answered again (R-1271, P2). In all three the data is not deleted.
+- **Fixes made in the drill catalog, not live:** n8n stops sending usage data out; OpenGist gets 256 MB (at 128 MB one
+  sign-in hit the limit 443 times and swapped 98 MB). Both proven on the sweep box pointed at the drill.
+- **Morning:** say yes to the two catalog fixes (in Monday's release list); decide D46 (Homepage behind the family gate —
+  CC's pick: yes); delete hub host Tester4-aa9466.
+
+**Safest readings taken (the brief allowed no question):** ISO 1.30.0 (the current public one, not 1.36.0); 12 GiB VM
+(the brief's minimum; demo-hp had 14 free); the kept-data question exists only for drive-folder apps, so volume apps
+were checked by a unit restore after the reinstall (that made a unit restore on every seeded app, not every fifth);
+„Mentés most" is local-only by design; backup/storage findings filed in their own category, not „Apps & catalog". All in
+the audit's head.
+
+**Table and evidence:** `documentation/audits/catalog-sweep-2026-10-24/README.md` (the 65-row table, the findings, the
+R-1269 proof, D22 put-back PASS on PrivateBin and Vikunja, the drill proofs, teardown).
+
+**Architecture read:** `07-backup-architecture.md` §6.5 (kept data) and §8, `16-storage-physical-identity.md` §5 (the
+internal place is the default drive — F3 NOT-A-FINDING), `10-localisation.md`.
+
+**Two mistakes of this session, both caught and kept in the evidence:**
+1. The first drill pass ran on the live templates: I had believed the drill repo public; the box's clone failed and the
+   controller kept its templates. Re-run through the box's local mirror (R-992's method) with a positive check before
+   any install (`DRILL-CONFIRMED`). Memory note written.
+2. I reverted the OpenGist fix on a wrong reading („it grows into its limit"); an automated security review flagged the
+   lowered cap; a cgroup measurement proved the fix needed and it went back in.
+
+**Commits:** drill catalog (never live) `a601950` (n8n), `fd23571` → `c420053` (wrong revert) → `405077f` + `492a17f`
+(OpenGist). felhom.eu: this commit (audit + tools + evidence, register, STATUS, STATUS-HISTORY, capability map B1 +
+detail). CI by hash: in the final report.
+
+**Register:** at the sweep's start 190 (other sessions filed 18 since); before this commit 208, after 217; opened 9
+(R-1269–R-1277), closed 0. Notes added to R-739 (Wanderer, no DNS) and R-1267 (anonymous volumes: OnlyOffice and RomM
+too; 52 left after every app was removed with data).
+
+**Observations:**
+- FILED: R-1269 (reinstall's capture rewrites the kept unit), R-1270 (restore says ok while the app never starts),
+  R-1271 (kept data loads another box's future-dated database), R-1272 (Homepage has no gate — operator, D46), R-1273
+  (registry rate limit shown as „exit code 1"), R-1274 (restore refusal advice when tiers exist but have not copied),
+  R-1275 (drive names in Hungarian on English pages), R-1276 (empty parent folder after remove with data), R-1277 (box
+  fixtures drifted: OpenGist, Calibre-Web, Mealie, Papra, Rallly, Vaultwarden 1.37).
+- FIXED (drill, morning list): n8n usage data (`a601950`); OpenGist memory (`405077f`, `492a17f`).
+- NOTE on existing rows: R-739 (Wanderer), R-1267 (anonymous volumes).
+- NOT-A-FINDING: F3 install default is the internal place (`16` §5, by design); F4 English guide labels (the app's own
+  words; the Hungarian copy is frozen by the copy gate); F5 Kimai in English (a Hungarian browser lands on `/hu/`); F6
+  AdventureLog 95 % (docker stats with cache; anon 75 %); database first-start lines in SparkyFitness and Dawarich (no
+  restart, item back); Radicale IP redirect (curl without Host); NZBGet/Transmission basic-auth prompt in screenshots (the
+  apps' own login); Vaultwarden stranger 200 (its own login page; sign-up closed).
+
+**Teardown:** machine — VM 9360 and LXC 9361 (both this session's) destroyed with `--purge`, no disk left on
+`nvme-scratch`; Tester 1, 9201, 9202, the thin pool and the ISO untouched; the box's logs copied off first. Host —
+DooPlex: the session's secret files shredded. Hub — host Tester4-aa9466 left for the operator to delete. ep0 — listed,
+nothing removed: the host's PBS link was set up, no whole-box copy went to it; the app copies went to the Tester4 restic
+repository on the storage box.
+
+**Secrets:** read by name through `sec`; the evidence was scanned for every known secret value (positive control seen) and
+for token shapes; one Actual Budget session token (a throwaway app) was blanked; screenshots spot-checked (passwords sit
+behind „Show", never pressed). No password, key or token is in this commit.
+
+**System poster:** no fact on it changed. **Instruction files:** none edited. **No** release, deploy, floor, vouch,
+publish or live catalog push.
@@ -2,7 +2,7 @@

 **Ready for Tester 2? Yes — tell the friend go (hand-over list: `documentation/pilot/TESTER2-handover.md`).**

-**Updated 2026-10-24 (night, unattended fix run).** Four restore and backup holes are fixed on main (three proven on test boxes); BYO hosts keep their SSH settings (D43 = A). Nothing is released — see Monday's list.
+**Updated 2026-10-25 (night).** 65 catalog apps walked on a fresh box: 52 work, 10 with a problem, 0 broken; worst: a restore after a reinstall breaks an app (R-1269).

 ## What works
 - **The Plex attack (10-17 → 10-23) did not reach Felhom's secrets** (R-1241).
@@ -32,6 +32,7 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te

 | # | Row | Question | Pick (why) | The other option costs | If you do nothing | Blocked |
 |---|---|---|---|---|---|---|
+| D46 | R-1272 | Put Homepage behind the family gate, like Glance? | **Yes** (a stranger now sees the box's CPU, memory and disk, and later the family's links; one line in the template, tried on the drill first) | leave it open: anyone who finds the address sees those | it stays open to strangers | — |
 | D45 | R-1266 | Seven places where a design document says one thing and the code does another. One line each, with a pick: `documentation/audits/review-round-2-2026-10-24/D44-D45-picks.md`. Answer „all picks" or name the ones you disagree with. | **Yes — the text follows the code** (each is how the system works today; you read every changed sentence) | the code follows the text: six code changes, one of them to the box's door for you | the documents keep saying what is not true | — |
 | D44 | R-1265 | 25 behaviours the code has but no document named. One line each, with a pick (21 confirm, 4 small changes): the same file. Answer „all picks" or name the ones you disagree with. | **All picks** (each was read in the code) | name the ones to change; each becomes a row | the notes stay marked „undocumented" | — |
 | D38 | R-1235 | Put the newest golden (637 MB) into the nightly release copy on ep0 too? | **Yes** (a new install after a DooPlex loss needs it; it fits under the 3 GB cap) | leave it out: after a loss, no new install until a golden is rebuilt and vouched | the same | — |
@@ -50,10 +51,10 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te
 6. BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. Since 2026-10-14.
 7. Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). Since 2026-10-12.

-**Monday 2026-10-26, release list (attended).** 1. Controller v0.343.0: the restore and backup fixes (R-1251–R-1253), R-1250. If not: the P1 stays open. 2. Agent v0.165.0 + your vouch: BYO keeps its SSH (R-1257). 3. Hub v0.170.0: the recovery package in one step (R-1254).
+**Monday 2026-10-26, release list (attended).** 1. Controller v0.343.0: the restore and backup fixes (R-1251–R-1253), R-1250. If not: the P1 stays open. 2. Agent v0.165.0 + your vouch: BYO keeps its SSH (R-1257). 3. Hub v0.170.0: the recovery package in one step (R-1254). 4. Catalog: n8n usage data off; OpenGist 256 MB.
 **Day, 2026-10-23 — your do list.**
 1. Print the break-glass sheet (`documentation/runbooks/break-glass-sheet.md`, the part from „The sheet”, one A4), fill it by hand, keep it outside the home (D32; R-923, R-924). If not: after a DooPlex loss no off-site copy opens.
-2. On the hub's Hosts page: Discard appliance 49, and delete host Tester4-16fdef. If not: two dead entries alarm.
+2. On the hub's Hosts page: Discard appliance 49, and delete host Tester4-aa9466. If not: two dead entries alarm.
 3. Give the homelab session R-1241, R-1242, the lists at the end of `documentation/audits/plex2shell-felhom-impact-2026-10-23/README.md` and `documentation/audits/dooplex-alarms-2026-10-24/README.md`, and an upload alarm on DooPlex's `eno1` (~100 Mbit/s line; the flood peaked at 905). If not: the next hacked app on DooPlex can read the hub's backups.
 **The rest**
 - System poster needs a refresh: the new 01:40 „release copy” arrow from DooPlex to ep0 (D33); the hub-database label already says every 6 hours. If not: the drawing misses one copy.
@@ -102,7 +102,7 @@

 | ID | Capability | Component | Status | Scope | Evidence |
 |---|---|---|---|---|---|
-| <a id="b1"></a>[B1](capability-map-detail/B.md#b1) | Deploy an app from the catalog (env config, memory guard, health-aware progress) | controller, catalog (~52 apps, images pinned) | **PROVEN-LIVE** | **re-check (2026-10-24):** mechanism changed after its evidence — 6d90374 + 2fe6341 (allow-list R-971, appdata R-1142) | `tests/CAMPAIGN-2-2026-07-07.md` (2026-07-07); `audits/RERUN-p1p3-2026-07-06.md` (2026-07-06) |
+| <a id="b1"></a>[B1](capability-map-detail/B.md#b1) | Deploy an app from the catalog (env config, memory guard, health-aware progress) | controller, catalog (65 apps, images pinned) | **PROVEN-LIVE** | **re-checked 2026-10-24** on controller 0.342.0 (after 6d90374 + 2fe6341): all 65 apps through the deploy request on a fresh box — 62 installed and answered, Wanderer installed but cannot run without DNS (R-739), 2 not offered by lifecycle; the memory guard did not fire (one app at a time) | `audits/catalog-sweep-2026-10-24/README.md` (2026-10-24); `tests/CAMPAIGN-2-2026-07-07.md` (2026-07-07); `audits/RERUN-p1p3-2026-07-06.md` (2026-07-06) |
 | <a id="b2"></a>[B2](capability-map-detail/B.md#b2) | App lifecycle: start/stop/restart/update/logs/remove/redeploy | controller | **PROVEN-LIVE** | the actions; remove-with-data re-proven 2026-09-13; **re-check (2026-10-24):** mechanism changed after its evidence — 8ae9178 (removal deletes labelled volumes, R-1117) | `audits/R442-2026-09-13/` (2026-09-13); `tests/CAMPAIGN-2-2026-07-07.md` (2026-07-07) |
 | <a id="b3"></a>[B3](capability-map-detail/B.md#b3) | Update is GUARDED: it refuses without a restorable backup, backs up first when the copy is stale, and HOLDS an app that does not come up — on ANY backup tier, and the release itself arrives by the managed floor | controller v0.237.0 + v0.238.0 + v0.238.1 + v0.239.0, hub v0.112.0 | **PROVEN-LIVE** | — | `audits/slice4-2026-09-13/` (2026-09-13); `audits/rulings-r472-r475-2026-09-13/` (2026-09-13) |
 | <a id="b4"></a>[B4](capability-map-detail/B.md#b4) | A failed update is UNDONE by the box itself — the previous version back with its data from seconds before the update; the app is held only if that undo fails too | controller v0.263.2 (the undo), v0.264.0 + hub v0.120.0 (the mail) | **PROVEN-LIVE** | scratch 9202 | `audits/undo-live-2026-09-23/README.md` (2026-09-23) |
@@ -25,6 +25,8 @@

 **Gap / roadmap (as written):** Memory-guard FIRING is not live-shown (T-RES-MEMGUARD never fired: ample RAM / auth-walled) — implemented + unit-level only

+**Re-checked 2026-10-24 (catalog sweep, `audits/catalog-sweep-2026-10-24/README.md`):** a fresh box from the public ISO 1.30.0, controller 0.342.0, Tester4. Every catalog app through `POST /api/stacks/<app>/deploy` one at a time, timed to the front door (median 61 s, Cal.com 278 s), then first login, one item, backup, keep-data remove, reinstall, unit restore, remove with data. 62 installed and answered; Wanderer installed but cannot reach its database without DNS (R-739); plant-it and wger are not offered (lifecycle, by design). 52 work, 10 work with a problem (R-1269–R-1277), 0 broken. The memory guard still did not fire (one app at a time) — the gap above stands.
+
 ---

 <a id="b2"></a>
@@ -0,0 +1,236 @@
+# Catalog sweep 2026-10-24 — every catalog app on a fresh box, the way a family uses it
+
+Unattended validation sweep (Saturday 12:30Z → Sunday ~00:00Z). Brief: the operator's „every catalog app, one by one, on
+a fresh box" prompt. Venue: demo-hp (Tier 0). Method: endpoint-level — every step is the request the dashboard or the
+app's own page sends (no browser click-through except the screenshot harness; no `docker exec` to make state).
+
+## Safest readings taken (the brief allows no question)
+
+1. **ISO 1.30.0, not 1.36.0.** The brief said „1.36.0 or the current one"; the current one on felhom.eu/letoltes was
+   1.30.0 (sha256 checked against the published `.sha256`). See `_box/README.md`.
+2. **12 GiB for the VM, not 16.** demo-hp had 14 GiB free beside 9201, 9202 and Tester 1; 12 is the brief's minimum.
+   The guest itself is 7.7 GiB (the golden's size); the box's own memory admission decided what could run.
+3. **„Remove keeping data → install again with use my kept data" is a drive-folder question.** By design (`07` §6.5)
+   the question is asked only for an app that keeps a folder on a drive (`HDD_PATH`). For the 40+ apps that keep their
+   data in Docker volumes, „keep my data" keeps the recovery unit; the reinstall starts empty, and the item comes back by
+   the unit restore („Visszaállítás"). So step 5 + 6 ran as: keep-remove → reinstall → read (empty, expected) → unit
+   restore → read. That is a unit restore on **every** app with a seed, not only every fifth.
+4. **„Mentés most" is the local copy only** (`07` §8, by design); the second-drive and off-site copies run in the night.
+   The sweep did not wait for a night, so „the right tiers ran" is checked as „the local unit holds the app".
+5. **Categories:** the brief names „Apps & catalog" for bigger issues; a row whose harm is in backup/restore or storage is
+   filed in that category instead (`register_shape_gate` has one category per row, and the owner reads it there).
+6. **Sev:** the brief's scale (data at risk P1/P2, a broken app P2, a confusing step P3). R-1269, R-1271 are P2 by that rule (the data is not deleted in either; the household loses access to it).
+7. **The sweep box reads the LIVE catalog** (main `5e196e1`, then `227a544` — rules only, no template moved). The drill
+   catalog was used only for the three apps whose fix needed proving; the box was pointed back after (`_drill-repoint.txt`).
+8. **Harness fixes live in the sweep's copy** (`tools/`), not in the catalog's scripts; porting them is R-1277.
+
+## The box (Part 0)
+
+`_box/README.md`: VM **9360** `sweep1024-box` (6 cores, 12 GiB, disks 256 + 200 + 150 GB on `nvme-scratch`), ISO 1.30.0,
+customer Tester4 (hub host `Tester4-aa9466`), guest 9201, domain `tester4.test` (no DNS: the browser LXC maps the
+names). Bind 12:42:18Z, day-0 SUCCESS 12:45:40Z, claim, recovery code escrowed (stored out-of-band), drives `hdd_1`
+(210 GB) and `hdd_2` (157 GB) plus the installer's internal place `belso`. Versions at the start: controller 0.342.0,
+agent 0.164.0, hub 0.169.0. Browser: LXC **9361** `sweep1024-browser` (Chromium + Playwright), 60 dashboard screens
+(15 pages × phone/computer × HU/EN) in `_box/screens-dashboard/`.
+
+## Method per app (Part 1)
+
+`tools/sweep.py <app>` — one app at a time, small first, heavy last (`tools/order.txt`); the next starts after the last
+is removed with its data. Each `<app>/` holds `record.json` (the measured facts), `walk.log`, the page texts
+(`page-{install,guide,overview}-{hu,en}.txt`) and `screens/` (phone + computer, HU + EN, install page and the app after
+first login). Steps: install through `POST /api/stacks/<app>/deploy` (timed to the front door answering); a stranger
+request without the family cookie (must be refused where the template gates); one item through the app's own API (the
+catalog's fixture where one exists, a new one in `tools/sweep_fixtures.py` for seven more); „Mentés most"; remove
+keeping data; reinstall (the kept-data question answered „use" where it is asked); read; unit restore; read; remove with
+data; leftovers checked (containers, volumes, `app.yaml`, `appdata`, `kept`, the subdomain → 404). Memory: the peak of
+each container's **anon** memory from its cgroup (`memory.stat`; the file cache is not counted — project rule) against
+its compose limit; a `*` in the table means only `docker stats` was read for that app (it includes the cache). The anon reading joined mid-sweep, so 22 apps carry it and 40 carry the `docker stats` upper bound; of those 40 none passed 79 % of its limit (Tandoor 1009/1280) and none restarted. Above 80 % on anon: only OpenGist (F14).
+
+## Results
+
+<!-- TABLE START -->
+| App | Verdict | Peak memory / limit (MiB) | Install → answering (s) | What we saw | Row / fix |
+|---|---|---|---|---|---|
+| actualbudget | **works** | 49* / 256 | 30 | the seeded item back after the restore |  |
+| adventurelog | **works with a problem** | 381 / 896 | 207 | works; but the keep-backups → reinstall → restore path breaks it (DB password from the new install over the old data) — reproduced in its re-run | R-1269, R-1270 |
+| audiobookshelf | **works** | 56* / 512 | 41 | the seeded item back after the restore | drive names: R-1275 |
+| bentopdf | **works** | 3* / 384 | 30 | stateless (nothing to keep); installs, answers, removes clean |  |
+| bookstack | **works** | 167* / 768 | 71 | the seeded item back after the restore |  |
+| calcom | **works** | 807 / 1792 | 278 | the seeded item back after the restore; 2 start-up messages of the image itself |  |
+| calibre-web | **works** | 211 / 768 | 76 | the book (its own upload) is listed again after the keep-data reinstall; the fixture's download check gets 401 (its sign-in for /download, not the app); the admin name is the box's generated one (re-run 2) | R-1277 |
+| claper | **works** | 267* / 640 | 86 | the seeded item back after the restore |  |
+| code-server | **works** | 81 / 1024 | 46 | first install refused by the registry's rate limit, told as „exit code 1”; the re-run installed and worked (no seed: the editor has no API) | R-1273 |
+| crafty-controller | **works** | 79* / 2048 | 76 | the seeded item back after the restore |  |
+| dawarich | **works** | 835* / 2688 | 136 | the seeded item back after the restore (every-5th: restore also before the reinstall) |  |
+| docmost | **works** | 528* / 1152 | 126 | the seeded item back after the restore |  |
+| emby | **works** | 95 / 2048 | 41 | installs, answers, removes clean; no seed (no fixture for its wizard) |  |
+| ghost | **works** | 167* / 512 | 121 | the seeded item back after the restore |  |
+| gitea | **works** | 112 / 512 | 25 | the seeded item back after the restore |  |
+| glance | **works** | 7* / 128 | 15 | family gate holds a stranger; config-only (nothing to keep); the app's own headings are English |  |
+| gokapi | **works** | 6 / 128 | 15 | installs, own login, removes clean; no seed (API key only in its UI) |  |
+| grafana | **works** | 383* / 768 | 61 | the seeded item back after the restore |  |
+| gramps-web | **works** | 347* / 1024 | 206 | installs, answers, removes clean; no seed fixture |  |
+| grimmory | **works with a problem** | 594 / 1408 | 96 | first admin, library and an EPUB upload work; setup gate then family gate work as designed; the read-back through the family gate stayed inconclusive (the harness's gate logic, R-1277); remove-with-data leaves the empty parent folder | R-1276, R-1277 |
+| grocy | **works** | 34* / 384 | 36 | the seeded item back after the restore |  |
+| home-assistant | **works** | 311 / 1024 | 161 | the seeded item back after the restore |  |
+| homebox | **works** | 205 / 256 | 20 | the seeded item back after the restore |  |
+| homepage | **works with a problem** | 91* / 256 | 25 | no gate at all: a stranger sees the box's CPU/RAM/disk (and later the family's links); still the upstream sample page | R-1272 |
+| immich | **works with a problem** | 1845 / 6016 | 121 | album (new fixture) in; „use my kept data” loaded the rehearsal's future-dated database and Immich never answered again (404, 20 min) | R-1271 |
+| jellyfin | **works** | 110 / 2048 | 41 | first user (new fixture, its wizard API) back after the restore |  |
+| karakeep | **works** | 649* / 2816 | 107 | the seeded item back after the restore |  |
+| kimai | **works** | 303* / 640 | 111 | own login; a Hungarian browser lands on /hu/ (curl without a language gets /en/) |  |
+| komga | **works** | 473* / 768 | 46 | the seeded item back after the restore | drive names: R-1275 |
+| lubelogger | **works** | 60* / 512 | 25 | the seeded item back after the restore |  |
+| mealie | **works** | 322 / 1000 | 72 | the seeded item back after the restore (the fixture raced after_install on the first run) |  |
+| metube | **works** | 90* / 768 | 61 | family gate holds a stranger; download queue entry back |  |
+| n8n | **works with a problem** | 346 / 1536 | 151 | the owner back after the restore; on the live template it tries to send usage data out ([Rudder] lines, 6 in the live re-run) — the drill fix: the variable in the running container, 0 error lines | drill a601950 (morning list) |
+| navidrome | **works** | 23* / 256 | 25 | the seeded item back after the restore | drive names: R-1275 |
+| nextcloud | **works with a problem** | 298 / 1664 | 122 | user in; „use my kept data” loaded the rehearsal's future-dated database beside today's files — the user was not there | R-1271 |
+| nzbget | **works** | 6* / 512 | 25 | the seeded item back after the restore; „no news server” until the family adds one (the guide says so) |  |
+| onlyoffice | **works** | 464 / 2048 | 71 | document server (no household data to keep); installs, answers, removes clean (every-5th restore) |  |
+| opengist | **works with a problem** | 125 / 128 | 15 | the gist owner back after the restore; but 128M is too small: one sign-up + sign-in hit the limit 443 times and swapped 98 MiB (memprobe-128M.txt); at 256M (drill) anon 216 MiB | drill 405077f (morning list) |
+| outline | **works** | 327 / 1152 | 151 | the seeded item back after the restore |  |
+| paperless-ngx | **works with a problem** | 669* / 1664 | 146 | account in; „use my kept data” loaded the rehearsal's future-dated database — the account was not there | R-1271, R-1276 |
+| papra | **works** | 320 / 768 | 76 | the seeded item back after the restore (Papra 26.6 needs an Origin header — a browser sends it) |  |
+| plant-it | **not installed** | – | – | lifecycle: abandoned — not offered for a new install (by design) |  |
+| plex | **works** | 223 / 2048 | 30 | installs, answers, removes clean; no seed (a server is claimed with a plex.tv account) |  |
+| privatebin | **works** | 31* / 128 | 15 | the seeded item back after the restore; D22 put-back PASS |  |
+| prowlarr | **works** | 114* / 512 | 21 | the seeded item back after the restore |  |
+| qbittorrent | **works** | 77* / 1024 | 15 | the seeded item back after the restore |  |
+| radarr | **works** | 100* / 512 | 41 | the seeded item back after the restore |  |
+| radicale | **works** | 33* / 128 | 25 | the seeded item back after the restore |  |
+| rallly | **works** | 346 / 1024 | 71 | installs, answers, removes clean; no seed: Rallly 4.15 closed password sign-up (login by e-mail code); the guide's polls need no account | R-1277 |
+| recipe-importer | **works** | 67* / 128 | 25 | stateless helper; installs, answers, removes clean (every-5th restore) |  |
+| romm | **works with a problem** | 748* / 1536 | 116 | item back through „use my kept data” (its own copy); remove-with-data left the empty parent folder | R-1276 |
+| sabnzbd | **works** | 69* / 1024 | 25 | the seeded item back after the restore |  |
+| seerr | **works** | 166 / 384 | 92 | installs, answers (307 to its setup), removes clean; no seed (needs a media server) |  |
+| sonarr | **works** | 80* / 512 | 41 | the seeded item back after the restore |  |
+| sparkyfitness | **works** | 417* / 1792 | 91 | the seeded item back after the restore |  |
+| tandoor | **works with a problem** | 1052* / 1536 | 177 | works; but the keep-backups → reinstall → restore path breaks it (DB password from the new install over the old data), and the restore still said success — reproduced on its own | R-1269, R-1270 |
+| termix | **works** | 111* / 256 | 61 | installs, answers, removes clean (every-5th restore); no seed fixture |  |
+| transmission | **works** | 6* / 512 | 20 | the seeded item back after the restore |  |
+| uptime-kuma | **works** | 120* / 384 | 76 | the seeded item back after the restore |  |
+| vaultwarden | **works** | 37 / 256 | 25 | installs in 25 s, its own login page, sign-up closed (404); the box admin's invite works (run-live-2), but 1.37.4 has no route for the fixture's invited sign-up, so no item was seeded | R-1277 |
+| vikunja | **works** | 37* / 256 | 10 | the seeded item back after the restore; D22 put-back PASS |  |
+| wanderer | **not testable on this box** | 140* / 1024 | 605 | not testable on this box: its web part calls its database at the PUBLIC name, which tester4.test cannot resolve (known, R-739) — unhealthy, 404 | R-739 |
+| wger | **not installed** | – | – | lifecycle: hidden — not offered for a new install (by design) |  |
+| wishlist | **works** | 200* / 512 | 71 | the seeded item back after the restore |  |
+| zipline | **works** | 233* / 768 | 81 | the seeded item back after the restore |  |
+
+works: 52, works with a problem: 10, not installed: 2, not testable on this box: 1 (of 65)
+<!-- TABLE END -->
+
+## Findings — each a row, a fix or NOT-A-FINDING
+
+| # | What | Disposition |
+|---|---|---|
+| F10 | A reinstall's own capture rewrites the unit that „remove — keep backups" kept; restoring it pairs the NEW install's DB password with the OLD data — the app never starts, the item is gone (Tandoor ×2, AdventureLog) | R-1269 (P2) |
+| F11 | The unit restore reports `ok: true` „…az alkalmazás újraindult" while the controller logged „health check failed … did not reach running state" | R-1270 (P2) |
+| F12 | „Use my kept data" loaded the rehearsal box's future-dated off-site database (2026-10-28) for Paperless-ngx, Nextcloud and Immich — another drive's install, which `07` §6.5 says is refused; Immich then never answered | R-1271 (P2) |
+| F1 | Homepage has no gate: a stranger sees the box's CPU/RAM/disk (Glance, same class, is gated) | R-1272 (operator decision) |
+| F7 | An install refused by the registry's rate limit (`toomanyrequests`) tells the household only „exit code 1" | R-1273 |
+| F8 | The restore refusal says „turn on remote backup, or connect a second drive" when both exist but have not copied yet | R-1274 |
+| F2 | English pages show the drive names in Hungarian („Belső tárhely", „Külső tárhely (hdd_1)") | R-1275 |
+| F9 | „Remove with data" leaves the empty parent folder `appdata/<app>` (Grimmory, RomM, Paperless-ngx) | R-1276 |
+| — | The catalog's box fixtures drifted from the apps (OpenGist, Calibre-Web, Mealie, Papra, Rallly; seven apps had none) | R-1277 |
+| F13 | n8n sends usage data (`[Rudder]` lines; no `N8N_DIAGNOSTICS_ENABLED=false`) | **fixed in the drill** `a601950`, proven below; morning list |
+| F14 | OpenGist at 125.8 of 128 MiB anon after one sign-up + sign-in; at 128M it hits the limit 443 times and swaps 98 MiB | **fixed in the drill** `405077f` + `492a17f` (256M), proven below; morning list |
+| — | 52 anonymous Docker volumes stayed after every app was removed with data (PrivateBin, OnlyOffice, RomM, Immich: the images' own `VOLUME` paths; 4–72 KB, no household data). The sweep's own leftover check filters by the app's label and missed them; found in the end-state read (`_box/anon-volumes.txt`) | known: note on R-1267 (widened to OnlyOffice and RomM) |
+| — | Wanderer unhealthy, 404: its web part calls its database by the public name, which a box without DNS cannot resolve | known: note on R-739 |
+| F3 | The install page's default place is the internal place `belso`, not the 210 GB drive | NOT-A-FINDING: by design — `16` §5 registers the internal place as the default drive |
+| F4 | Guide labels in English (LubeLogger „Settings", NZBGet „Settings / News-Servers") | NOT-A-FINDING: they are the app's own on-screen labels, and the Hungarian catalog copy is frozen by the copy-i18n gate (measured on the drill) |
+| F5 | Kimai opens in English | NOT-A-FINDING: a Hungarian browser lands on `/hu/`; only a request with no language gets `/en/` |
+| F6 | AdventureLog backend 95 % of its limit | NOT-A-FINDING: that was `docker stats` with the cache; on anon 288.7/384 MiB (75 %), = the ladder's 73 % |
+| — | Database error lines (SparkyFitness `database "sparky" does not exist`, Dawarich `database "dawarich" already exists`; SparkyFitness `Invalid password` = the harness's wrong-password control) | NOT-A-FINDING: the images' own first-start and restore-time checks; no restart, the item read back after the restore |
+| — | Radicale redirects to an IP | NOT-A-FINDING: a curl artefact (no Host on the redirect probe); the browser lands right |
+| — | NZBGet / Transmission screenshots show the browser's basic-auth prompt | NOT-A-FINDING: the app's own login, by design |
+| — | code-server's first install failed (`toomanyrequests`) | the failed install was removed through the product (`code-server.failed-remove.txt`); the re-run worked; the message is R-1273 |
+
+## F10 proof — the kept unit is rewritten by the reinstall (`_unitprobe/tandoor/`)
+
+`tools/unitprobe.py tandoor`: install, one account, „Mentés most" (unit 19:45:14–20), remove keeping data and
+backups, install again (a volume app: no kept-data question), wait for the controller's next capture, „Visszaállítás".
+
+- 19:50:32 `Recovery unit captured for tandoor` — the unit's `app.yaml` checksum `0f366c97…` → `4438c1c5…`,
+  `created_at` 19:45:26 → 19:50:32; the data files unchanged (`unit-1/2/3*.txt`).
+- The restore: `ok: true`, „A(z) tandoor: 3 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult."
+- After: state `starting`, the account not there, `password authentication failed` ×42 (app) and ×22 (postgres).
+- The comment at `felhom-controller/controller/internal/backup/recovery_unit.go:101-103` says the refresh never rewrites
+  the definition away from its data; after a remove + reinstall it does.
+
+Seen three times: the sweep's own Tandoor cycle (17:27:41 reinstall → 17:30:34 capture → 17:30:47 restore), this probe,
+and AdventureLog's re-run (20:03:18 → 20:05:32 → restore). AdventureLog's first run worked only because no capture fell
+between its reinstall and its restore.
+
+## D22 put-back — PASS on two apps (`_putback/`)
+
+`tools/putback.py <app>`: the largest volume tar of the app's unit truncated to half, then „Visszaállítás". PrivateBin
+and Vikunja: the restore failed honestly („Nem változott semmi…"), the pre-restore data was put back, the app ran, and the
+seeded item read back through the front door.
+
+## Drill fixes, proven on the sweep box pointed at the drill (Part 2)
+
+Drill catalog `app-catalog-drill` (never the live catalog): `742a354` (merge of live main), then:
+
+- `a601950` **n8n** — `N8N_DIAGNOSTICS_ENABLED=false` in the compose (usage data stays home).
+- `405077f` + `492a17f` **OpenGist** — memory 128M → 256M (compose + `.felhom.yml` `mem_limit`), the comment carries the
+  measured need.
+
+**How the box was pointed at the drill.** The drill repo on Gitea is private (R-992) and the box holds no catalog
+credential, so the box reads a local mirror: a bare repository in the controller's data volume, loaded from a git bundle,
+`repo_url: file:///opt/docker/felhom-controller/drill-catalog.git` (the method of
+`audits/burndown-3-2026-10-17/tools/repoint.py`; loading the mirror is a `docker exec git fetch` into the controller —
+catalog plumbing, not app state). Only `repo_url` changes; `tools/repoint.py live` puts the saved `controller.yaml` back
+and checks it byte for byte (`RESTORED-IDENTICAL`, twice in `_drill-repoint.txt`). The box ended on the live catalog
+`227a544`.
+
+**What went wrong first, and is kept as evidence.** The first drill pass (chain 3, 21:18Z) set `repo_url` to the Gitea
+URL in the belief that the repo was public. The box's clone failed (`fatal: could not read Username`), the controller kept
+the templates it had, and n8n, OpenGist and Vaultwarden ran on the LIVE templates. The leftover `[Rudder]` lines in that
+n8n run showed it. Those three runs are kept as `run-live-2/` (valid live re-runs). The second pass (chain 4) refused to
+install anything until the box's catalog cache read the drill's commit and the changed lines were in the box's copy of
+both templates: `drill main fd23571, box cache fd23571: DRILL-CONFIRMED`. (The drill also carries a six-line Plex
+ladder entry from an earlier session's test; Plex was not installed in this pass.)
+
+**n8n proof.** The running container carried `N8N_DIAGNOSTICS_ENABLED=false` (read at 21:37:58, that line only); error
+lines 0 against 6 `[Rudder]` lines in the live re-run just before it (the control); the owner account read back after the
+unit restore.
+
+**OpenGist proof — and a wrong turn.** At 256M (drill) OpenGist took 215.8 MiB anon. I first read that as „it grows into
+its limit" and reverted the fix (`c420053`); an automated security review flagged the revert as a lowered resource cap.
+A measurement settled it (`tools/memprobe-guest.sh`, `opengist/memprobe-128M.txt`): on the live 128M template one
+sign-up + sign-in hit `memory.max` 443 times and pushed 98 MiB into swap (anon 125 MiB, 0 `oom_kill`, 0 restarts). The
+real need is ~220 MiB; the fix went back in (`405077f`). Where the box has no swap room left, the same sign-up would end in a kill (not measured here).
+
+Drill gates: `catalog_gates.py --fast opengist n8n` from the drill clone — all OK except `security-scan`, which looks for
+a `felhom.eu` clone beside the drill and found none; the shared scanner run by hand on the drill clone: 0 hits.
+
+## Teardown
+
+Three layers, 2026-10-25 ~00:05Z:
+
+- **Machine (demo-hp):** VM **9360** `sweep1024-box` and LXC **9361** `sweep1024-browser` — both created by this session —
+  stopped and destroyed with `--purge`; no disk of either is left on `nvme-scratch`. Untouched: Tester 1 (VM 341), 9201,
+  9202, 9401, the thin pool, and the 1.30.0 ISO in `local:iso` (there since 2026-10-22). Before the destroy, the box's
+  controller log, the agent journal, its end state and its anonymous-volume list were copied here (`_box/`).
+- **Host (DooPlex):** the session's secret files (`/run/user/1000/sweep-sc`: the dashboard password copy, cookies, CSRF
+  tokens) shredded. The drill catalog keeps its commits (`a601950`, `405077f`, `492a17f`, and the reverted turn
+  `c420053`) for the morning list; nothing went to the live catalog.
+- **Hub:** host **Tester4-aa9466** stays for the operator to delete (CC holds no delete). Until then it reads as a box
+  that stopped reporting.
+- **ep0:** listed, nothing removed. The host's PBS link to ep0 (`felhom-pbs`) was set up at day-0 (`pbsdr: converged`,
+  14:44:48 CEST, `_box/agent-journal.log.gz`); no whole-box copy went to it (weekly cadence — only the local copy ran,
+  14:51). The app copies the box sent off-site went to the Tester4 restic repository on the storage box (unlocked with
+  the rehearsal's recovery code; a new code escrowed — stored out-of-band), not to ep0.
+
+## Evidence map
+
+- `_box/` — Part 0 (VM, ISO, bind, day-0, claim, recovery, drives, dashboard screens).
+- `<app>/` — one per app; re-run apps keep the earlier run in `first-run/`, `run-2/` or `run-drill-pre/`.
+- `<app>.console.txt`, `progress.log`, `batch.out`, `chain2.out`, `chain3.out` — the runner's own output.
+- `_unitprobe/tandoor/` — F10. `_putback/{privatebin,vikunja}/` — D22.
+- `tools/` — the harness (sweep copies of the catalog's `box_walk.py` and `upgrade_fixtures_box.py`, marked SWEEP COPY;
+  `sweep.py`, `sweep_fixtures.py`, `unitprobe.py`, `putback.py`, `repoint.py`, `table.py`, the rehearsal's VM and browser
+  helpers). Secrets were read by name through `sec` and never written here; the evidence was scanned for every known
+  secret value and for token shapes (one app session token found and blanked: Actual Budget's), with a positive control.
+- Screenshots were reduced with `pngquant` (lossy palette) to keep the repository small.
@@ -0,0 +1,20 @@
+# Part 0 — the sweep box (2026-10-24, from 12:33Z)
+
+| | |
+|---|---|
+| VM | **9360 `sweep1024-box`** on demo-hp: 6 cores (`cpu host`), **12 GiB** (demo-hp had 14 GiB available of 29; 9201, 9202 and Tester 1 untouched — the brief's minimum, not its 16 GiB aim), 256 GB system disk + 200 GB + 150 GB data disks, all raw on `nvme-scratch` (the dir storage), never the thin pool (`vm-create.txt`) |
+| ISO | `felhom-installer-1.30.0-pve9.2-1.iso` — the current one on felhom.eu/letoltes; sha256 `590d7b9b…74d5cc1` = the published `.sha256` |
+| Installer | graphical, Hungarian keyboard kept, driven by `qm sendkey` (`tools/vmctl.sh`), screens in `install/`. Install pressed **12:37:33Z**; pairing code on the console **12:41** (blacked out in `install/11-console.png`) |
+| Bind | Tester4's old host deleted by the operator (12:32, asked by CC); the hub mailed a new bind link 12:31:57Z; bound through the real page in Chromium 12:42:18Z, first try (`screens/b-bind-*`) |
+| Day-0 | 8/8 steps, **SUCCESS 12:45:40Z** — host `Tester4-aa9466`, guest 9201, golden imported and verified; Install → done **8 min 7 s** |
+| Claim | setup-code mail 12:43:14Z („Új beállító kód — újratelepült a szervered", right for a customer who had a box before); claimed 302 → `/` (`claim.txt`) |
+| Recovery | the box found Tester4's sealed off-site package (2026-10-20 14:16) and asked for the old code first (`/recovery`): the 2026-10-20 code, typed as it was written down (ten words joined by hyphens), unlocked it — controller „the offsite repository key was recovered and placed" 12:47:41Z. Then the dashboard asked for a NEW code: the ceremony in Chromium (words 4 and 9 asked), escrowed; „Távoli mentés: Aktív" (`screens/box-escrow-*`, the code blacked out) |
+| Drives | `/dev/sdb` → `hdd_1` (210 GB, the apps' data), `/dev/sdc` → `hdd_2` (157 GB), both through `POST /api/storage/init` (`drive-init.txt`); the installer's internal place `belso` (59 GB) |
+| Versions | controller **0.342.0**, agent **0.164.0**, hub **0.169.0**; the box syncs the LIVE catalog (`app-catalog-felhom.eu` main, `5e196e1` at the start; it re-syncs every 15 min) |
+| Guest | 9201 at 192.168.0.157, 7.7 GiB RAM (the golden's size), domain `tester4.test` (no DNS — the browser LXC maps the names; TLS not verified) |
+| Browser | LXC **9361 `sweep1024-browser`** (2 cores, 2 GB, nvme-scratch): Chromium 156.0.8078.47 + Playwright 1.52.0; the household's session stored in the LXC (`/root/work/state-dash.json`) |
+| Dashboard | every menu page at phone and computer size, HU and EN (`screens-dashboard/`, 60): no sideways scroll reported; a signed-in household reads its OWN language setting whatever the browser asks — by design (`langFor`), the page texts were read with `?lang=` |
+
+Secrets used (names only, `sec`): SWEEP_2026_10_24_ROOTPW (the typed root password — day-0 replaced it with the vaulted
+one; DooPlex's key was added before the bind), SWEEP_2026_10_24_BIND_TOKEN, _PAIRING_CODE, _SETUP_CODE, _DASH_PW,
+_RECOVERY_CODE, and the existing REHEARSAL_2026_10_20_PASSPHRASE / _RECOVERY_CODE.
@@ -0,0 +1,52 @@
+2026-10-24T17:15:18Z 28 assets,config,library,
+2026-10-24T12:51:57Z 24 client_body,fastcgi,proxy,
+2026-10-24T13:08:14Z 24 client_body,fastcgi,proxy,
+2026-10-24T19:54:35Z 4 
+2026-10-24T17:15:18Z 4 
+2026-10-24T12:51:49Z 24 client_body,fastcgi,proxy,
+2026-10-24T19:54:18Z 4 
+2026-10-24T13:06:43Z 24 client_body,fastcgi,proxy,
+2026-10-24T13:08:05Z 72 lock,nginx,nginx.pid,
+2026-10-24T19:06:36Z 36 documentserver,documentserver-example,
+2026-10-24T13:06:43Z 4 
+2026-10-24T13:08:05Z 24 client_body,fastcgi,proxy,
+2026-10-24T13:06:43Z 72 lock,nginx,nginx.pid,
+2026-10-24T19:54:18Z 24 client_body,fastcgi,proxy,
+2026-10-24T17:18:02Z 4 
+2026-10-24T13:07:11Z 24 client_body,fastcgi,proxy,
+2026-10-24T12:50:39Z 72 lock,nginx,nginx.pid,
+2026-10-24T13:07:11Z 72 lock,nginx,nginx.pid,
+2026-10-24T19:09:38Z 36 documentserver,documentserver-example,
+2026-10-24T17:20:41Z 28 assets,config,library,
+2026-10-24T19:54:35Z 24 client_body,fastcgi,proxy,
+2026-10-24T12:50:39Z 24 client_body,fastcgi,proxy,
+2026-10-24T12:51:57Z 72 lock,nginx,nginx.pid,
+2026-10-24T19:07:30Z 4 
+2026-10-24T12:50:57Z 24 client_body,fastcgi,proxy,
+2026-10-24T19:21:09Z 4 
+2026-10-24T19:09:38Z 4 
+2026-10-24T12:50:57Z 72 lock,nginx,nginx.pid,
+2026-10-24T19:20:01Z 4 
+2026-10-24T19:55:03Z 4 
+2026-10-24T12:51:57Z 4 
+2026-10-24T19:54:18Z 72 lock,nginx,nginx.pid,
+2026-10-24T17:18:02Z 28 assets,config,library,
+2026-10-24T19:24:43Z 4 
+2026-10-24T12:50:39Z 4 
+2026-10-24T13:08:05Z 4 
+2026-10-24T12:51:49Z 4 
+2026-10-24T19:07:30Z 32 documentserver,documentserver-example,
+2026-10-24T19:06:36Z 4 
+2026-10-24T19:07:39Z 4 
+2026-10-24T13:08:14Z 4 
+2026-10-24T17:17:24Z 4 
+2026-10-24T12:50:57Z 4 
+2026-10-24T17:17:24Z 28 assets,config,library,
+2026-10-24T19:55:03Z 24 client_body,fastcgi,proxy,
+2026-10-24T19:55:03Z 72 lock,nginx,nginx.pid,
+2026-10-24T13:08:14Z 72 lock,nginx,nginx.pid,
+2026-10-24T19:07:39Z 36 documentserver,documentserver-example,
+2026-10-24T19:54:35Z 72 lock,nginx,nginx.pid,
+2026-10-24T17:20:41Z 4 
+2026-10-24T12:51:49Z 72 lock,nginx,nginx.pid,
+2026-10-24T13:07:11Z 4 
@@ -0,0 +1,3 @@
+GET /claim HTTP/2 200 
+csrf_len 64 cookie_present yes
+POST /claim HTTP/2 302  location: /
@@ -0,0 +1,11 @@
+candidates 200 {"data": {"vmid": 9201, "initialize": [{"device": "/dev/sdb", "size_bytes": 214748364800, "model": "QEMU HARDDISK", "data_bearing": false, "mountable": false}, {"device": "/dev/sdc", "size_bytes": 161061273600, "model": "QEMU HARDDISK", "data_bearing": false, "mountable": false}], "attach": []}, "ok": true}
+12:50:04Z init /dev/sdb hdd_1 200 {"data": {"phase": "formatting", "started": true}, "ok": true}
+  status 200 {"device": "/dev/sdb", "durable_id": "", "error": "", "opsign": "", "phase": "done", "reason": "", "started_at": "2026-10-24T12:50:04.496400956Z", "updated_at": "2026-10-24T12:50:06.691612961Z", "where": "/mnt/felhom-drives/hdd_1"}
+12:50:09Z init /dev/sdc hdd_2 200 {"data": {"phase": "formatting", "started": true}, "ok": true}
+  status 200 {"device": "/dev/sdc", "durable_id": "", "error": "", "opsign": "", "phase": "done", "reason": "", "started_at": "2026-10-24T12:50:09.550638661Z", "updated_at": "2026-10-24T12:50:11.762283786Z", "where": "/mnt/felhom-drives/hdd_2"}
+  9dcbe7bf-098d-4d99-9c43-f39fe2b20f42 disk user-data attached 157 GB /mnt/felhom-drives/hdd_2 
+  belso internal user-data attached 59 GB /mnt/felhom-drives/belso 
+  e8b4f4a0-7aca-4829-9220-b394948b9368 disk user-data attached 210 GB /mnt/felhom-drives/hdd_1 
+  local system system attached 77 GB None backup_target
+  local-lvm system system attached 165 GB None 
+  felhom-pbs network backup attached 0 GB None 
@@ -0,0 +1,8 @@
+filebrowser gtstef/filebrowser:1.5.6-stable Up 9 hours (healthy)
+felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.342.0 Up 6 minutes (healthy)
+traefik traefik:v3.7.13 Up 9 hours
+54
+Filesystem                         Size  Used Avail Use% Mounted on
+/dev/sdb                           196G  268M  186G   1% /mnt/felhom-drives/hdd_1
+/dev/sdc                           147G  2.2M  140G   1% /mnt/felhom-drives/hdd_2
+/dev/mapper/pve-vm--9201--disk--0   32G  1.2G   29G   4% /
@@ -0,0 +1 @@
+Install pressed 12:37:33
@@ -0,0 +1,24 @@
+Formatting '/mnt/hdd_1/images/9360/vm-9360-disk-0.raw', fmt=raw size=274877906944 preallocation=off
+scsi0: successfully created disk 'nvme-scratch:9360/vm-9360-disk-0.raw,size=256G'
+Formatting '/mnt/hdd_1/images/9360/vm-9360-disk-1.raw', fmt=raw size=214748364800 preallocation=off
+scsi1: successfully created disk 'nvme-scratch:9360/vm-9360-disk-1.raw,size=200G'
+Formatting '/mnt/hdd_1/images/9360/vm-9360-disk-2.raw', fmt=raw size=161061273600 preallocation=off
+scsi2: successfully created disk 'nvme-scratch:9360/vm-9360-disk-2.raw,size=150G'
+update VM 9360: -boot order=scsi0;ide2
+boot: order=scsi0;ide2
+cores: 6
+cpu: host
+ide2: local:iso/felhom-installer-1.30.0-pve9.2-1.iso,media=cdrom,size=1665356K
+memory: 12288
+meta: creation-qemu=11.0.3,ctime=1792845199
+name: sweep1024-box
+net0: virtio=BC:24:11:9A:87:20,bridge=vmbr0
+ostype: l26
+scsi0: nvme-scratch:9360/vm-9360-disk-0.raw,size=256G
+scsi1: nvme-scratch:9360/vm-9360-disk-1.raw,size=200G
+scsi2: nvme-scratch:9360/vm-9360-disk-2.raw,size=150G
+scsihw: virtio-scsi-single
+smbios1: uuid=4b362477-61db-4351-ad94-f99cb082060f
+vga: std
+vmgenid: 28c510f8-d855-441b-981e-4a56d7b3b6d7
+12:33:24
@@ -0,0 +1,52 @@
+24:    repo_url: https://gitea.dooplex.hu/admin/app-catalog-drill.git
+
+2026/10/24 21:18:11 [INFO] [sync] Starting catalog sync (repo: https://gitea.dooplex.hu/admin/app-catalog-drill.git, interval: 15m0s)
+2026/10/24 21:18:11 [INFO] [sync] Starting catalog sync
+2026/10/24 21:18:11 [ERROR] [sync] Catalog sync failed: git clone --depth 1 --branch main https://gitea.dooplex.hu/admin/app-catalog-drill.git /opt/docker/felhom-controller/data/catalog-cache: exit status 128
+RESTORED-IDENTICAL
+24:    repo_url: https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
+
+2026/10/24 21:33:19 [INFO] [sync] Starting catalog sync (repo: https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git, interval: 15m0s)
+2026/10/24 21:33:19 [INFO] [sync] Starting catalog sync
+2026/10/24 21:33:19 [INFO] [sync] Cloning https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git → /opt/docker/felhom-controller/data/catalog-cache
+2026/10/24 21:33:20 [INFO] [sync] catalog moved (none) -> 227a54498f76 (0 new, 0 stack dir(s) changed)
+2026/10/24 21:33:21 [INFO] [sync] Catalog sync complete
+2026/10/24 21:33:21 [INFO] [sync] Initial sync: Sablonok frissítve — a katalógus új változata betöltve; a telepített alkalmazások fájljai nem változtak
+
+24:    repo_url: https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
+-rw------- 1 root root 2787 Oct 24 12:44 /var/lib/docker/volumes/felhom-controller-data/_data/controller.yaml.pre-sweep-drill
+fatal: cannot change to '/opt/docker/felhom-controller/drill-catalog.git': No such file or directory
+cache HEAD 227a544
+https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
+
+mirror main fd23571
+
+24:    repo_url: file:///opt/docker/felhom-controller/drill-catalog.git
+
+2026/10/24 21:34:31 [INFO] [sync] Updated opengist/.felhom.yml
+2026/10/24 21:34:31 [INFO] [sync] Updated plex/docker-compose.yml
+2026/10/24 21:34:31 [INFO] [sync] Updated plex/.felhom.yml
+2026/10/24 21:34:31 [INFO] [sync] catalog moved 227a54498f76 -> fd23571597a8 (0 new, 3 stack dir(s) changed)
+2026/10/24 21:34:31 [INFO] [sync] Catalog sync complete
+2026/10/24 21:34:31 [INFO] [sync] Initial sync: Sablonok frissítve — frissítve: n8n, opengist, plex
+
+  expect n8n/docker-compose.yml ∋ N8N_DIAGNOSTICS_ENABLED=false: 1
+  expect opengist/docker-compose.yml ∋ 256M: 2
+drill main fd23571, box cache fd23571: DRILL-CONFIRMED
+21:37:58 n8n container env: N8N_DIAGNOSTICS_ENABLED=false
+RESTORED-IDENTICAL
+24:    repo_url: https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
+
+2026/10/24 21:49:36 [INFO] [sync] Updated opengist/.felhom.yml
+2026/10/24 21:49:36 [INFO] [sync] Updated plex/docker-compose.yml
+2026/10/24 21:49:36 [INFO] [sync] Updated plex/.felhom.yml
+2026/10/24 21:49:36 [INFO] [sync] catalog moved fd23571597a8 -> 227a54498f76 (0 new, 3 stack dir(s) changed)
+2026/10/24 21:49:36 [INFO] [sync] Catalog sync complete
+2026/10/24 21:49:36 [INFO] [sync] Initial sync: Sablonok frissítve — frissítve: n8n, opengist, plex
+
+24:    repo_url: https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
+-rw------- 1 root root 2787 Oct 24 12:44 /var/lib/docker/volumes/felhom-controller-data/_data/controller.yaml.pre-sweep-drill
+mirror main fd23571
+cache HEAD 227a544
+https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
+
@@ -0,0 +1,18 @@
+19:54:14Z   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+19:54:34Z   [1] deployed, controller state=running, pinned={'privatebin': 'privatebin/pdo:2.0.6'}
+19:54:34Z     privatebin: seeded paste id=d895e53013696ba1
+19:54:34Z   [4] Mentés most -> 200 {'ok': True, 'message': 'Mentés elindítva'}
+19:54:48Z   unit before the fault:
+total 20
+drwxr-xr-x 2 root root 4096 19:54:35 .
+drwxr-xr-x 4 root root 4096 19:54:35 ..
+-rw-r--r-- 1 root root 8704 19:54:35 privatebin_privatebin_data.tar
+
+19:55:01Z   THE FAULT: /mnt/sys_drive/felhom-data/backups/primary/privatebin/volume-dumps/privatebin_privatebin_data.tar 8704 -> 4352
+19:55:01Z   [6] POST /backup/restore -> HTTP/2 302  ['location: /backups/restore?flash=flash.restore.started']
+19:55:11Z     privatebin: readback http=200 marker_present=True
+19:55:14Z   controller: 2026/10/24 19:50:54 [INFO] [offbox] tandoor: the live volumes are copied before the restore (3 copied, 0 new from the snapshot) in 2.669s — /mnt/sys_drive/felhom-data/backups/restore-undo/tandoor/20261024T195052Z (R-893)
+2026/10/24 19:55:02 [INFO] [offbox] privatebin: the live volumes are copied before the restore (1 copied, 0 new from the snapshot) in 347ms — /mnt/sys_drive/felhom-data/backups/restore-undo/privatebin/20261024T195501Z (R-893)
+2026/10/24 19:55:03 [WARN] [offbox] privatebin: the restore failed (failed to restore 1 volume(s): [privatebin_privatebin_data]) — the live volumes and d
+19:55:47Z   [7] stop 200, remove with data -> 200 {'ok': True, 'data': {'removed': 'privatebin', 'volumes_removed': ['privatebin_privatebin_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt saját adatot
+19:55:55Z   == putback {"seed": true, "state_after": "starting", "item_after": true}
@@ -0,0 +1,21 @@
+19:55:56Z   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+19:56:01Z   [1] deployed, controller state=running, pinned={'vikunja': 'vikunja/vikunja:2.6.0'}
+19:56:01Z     gate: tasks is gated — passed as the household (cookie set)
+19:56:01Z     vikunja: register http=200
+19:56:01Z     vikunja: create project http=201
+19:56:01Z   [4] Mentés most -> 200 {'ok': True, 'message': 'Mentés elindítva'}
+19:56:16Z   unit before the fault:
+total 2568
+drwxr-xr-x 2 root root    4096 19:56:03 .
+drwxr-xr-x 4 root root    4096 19:56:03 ..
+-rw-r--r-- 1 root root    1536 19:56:02 vikunja_vikunja_data.tar
+-rw-r--r-- 1 root root 2615296 19:56:02 vikunja_vikunja_db.tar
+
+19:56:29Z   THE FAULT: /mnt/sys_drive/felhom-data/backups/primary/vikunja/volume-dumps/vikunja_vikunja_db.tar 2615296 -> 1307648
+19:56:29Z   [6] POST /backup/restore -> HTTP/2 302  ['location: /backups/restore?flash=flash.restore.started']
+19:56:40Z     vikunja: readback of the seeded project http=200 ok=True
+19:56:43Z   controller: 2026/10/24 19:55:03 [ERROR] [web] Restore failed (async): stack=privatebin: a(z) privatebin visszaállítása sikertelen. Nem változott semmi: az alkalmazás adatai visszakerültek a visszaállítás előtti állapotba, és az alkalmazás újra fut
+2026/10/24 19:56:31 [INFO] [offbox] vikunja: the live volumes are copied before the restore (2 copied, 0 new from the snapshot) in 775ms — /mnt/sys_drive/felhom-data/backups/restore-undo/vikunja/20261024T195630Z (R-893)
+2026/10/24 19:56:33 [WARN] [offbox] vikunja: the restore failed (failed to restore 1 volume(s): [vikunja_vikunja_db]) — the live volumes and def
+19:57:16Z   [7] stop 200, remove with data -> 200 {'ok': True, 'data': {'removed': 'vikunja', 'volumes_removed': ['vikunja_vikunja_data', 'vikunja_vikunja_db'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt
+19:57:24Z   == putback {"seed": true, "state_after": "running", "item_after": true}
@@ -0,0 +1,35 @@
+{
+ "app": "privatebin",
+ "install": true,
+ "seed": true,
+ "backup": {
+  "code": "200",
+  "seconds": 10,
+  "status": "{\"db_dump\": {\"count\": 0, \"duration\": \"1.465525975s\", \"last_run\": \"2026-10-24T19:54:35.791259113Z\", \"success\": true}, \"enabled\": true, \"running\": false}"
+ },
+ "fault": {
+  "file": "/mnt/sys_drive/felhom-data/backups/primary/privatebin/volume-dumps/privatebin_privatebin_data.tar",
+  "from": "8704",
+  "to": "4352"
+ },
+ "restore": {
+  "points": 1,
+  "location": [
+   "location: /backups/restore?flash=flash.restore.started"
+  ],
+  "seconds": 10,
+  "status": "{\"running\": false, \"op\": \"restore\", \"stack\": \"privatebin\", \"started_at\": \"2026-10-24T19:55:01.085750365Z\", \"last\": {\"op\": \"restore\", \"stack\": \"privatebin\", \"ok\": false, \"message\": \"Visszaállítás sikertelen: a(z) privatebin visszaállítása sikertelen. Nem változott semmi: az alkalmazás adatai visszakerültek a visszaállítás előtti állapotba, és az alkalmazás újra fut\", \"finished_at\": \"2026-10-24T19:55:03.845276539Z\"}, \"last_recent\": true}",
+  "state": "starting"
+ },
+ "state_after": "starting",
+ "item_after": true,
+ "controller_log": "2026/10/24 19:50:54 [INFO] [offbox] tandoor: the live volumes are copied before the restore (3 copied, 0 new from the snapshot) in 2.669s — /mnt/sys_drive/felhom-data/backups/restore-undo/tandoor/20261024T195052Z (R-893)\n2026/10/24 19:55:02 [INFO] [offbox] privatebin: the live volumes are copied before the restore (1 copied, 0 new from the snapshot) in 347ms — /mnt/sys_drive/felhom-data/backups/restore-undo/privatebin/20261024T195501Z (R-893)\n2026/10/24 19:55:03 [WARN] [offbox] privatebin: the restore failed (failed to restore 1 volume(s): [privatebin_privatebin_data]) — the live volumes and definition are put back; starting the app (R-893)\n2026/10/24 19:55:03 [INFO] Event pushed: backup_run_failures (error) [hu-only] — App \"privatebin\": its off-site restore FAILED and was undone — the live volumes and definition from just before the restore were put back and the app was started (R-893). No support step is needed; the household was told. Error: failed to restore 1 volume(s): [privatebin_privatebin_data]\n2026/10/24 19:55:03 [ERROR] [web] Restore failed (async): stack=privatebin: a(z) privatebin visszaállítása sikertelen. Nem változott semmi: az alkalmazás adatai visszakerültek a visszaállítás előtti állapotba, és az alkalmazás újra fut\n",
+ "after_remove": {
+  "containers": "",
+  "volumes": "",
+  "appyaml": "",
+  "appdata": "",
+  "kept": "",
+  "subdomain": "404"
+ }
+}
@@ -0,0 +1,18 @@
+19:54:14Z   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+19:54:34Z   [1] deployed, controller state=running, pinned={'privatebin': 'privatebin/pdo:2.0.6'}
+19:54:34Z     privatebin: seeded paste id=d895e53013696ba1
+19:54:34Z   [4] Mentés most -> 200 {'ok': True, 'message': 'Mentés elindítva'}
+19:54:48Z   unit before the fault:
+total 20
+drwxr-xr-x 2 root root 4096 19:54:35 .
+drwxr-xr-x 4 root root 4096 19:54:35 ..
+-rw-r--r-- 1 root root 8704 19:54:35 privatebin_privatebin_data.tar
+
+19:55:01Z   THE FAULT: /mnt/sys_drive/felhom-data/backups/primary/privatebin/volume-dumps/privatebin_privatebin_data.tar 8704 -> 4352
+19:55:01Z   [6] POST /backup/restore -> HTTP/2 302  ['location: /backups/restore?flash=flash.restore.started']
+19:55:11Z     privatebin: readback http=200 marker_present=True
+19:55:14Z   controller: 2026/10/24 19:50:54 [INFO] [offbox] tandoor: the live volumes are copied before the restore (3 copied, 0 new from the snapshot) in 2.669s — /mnt/sys_drive/felhom-data/backups/restore-undo/tandoor/20261024T195052Z (R-893)
+2026/10/24 19:55:02 [INFO] [offbox] privatebin: the live volumes are copied before the restore (1 copied, 0 new from the snapshot) in 347ms — /mnt/sys_drive/felhom-data/backups/restore-undo/privatebin/20261024T195501Z (R-893)
+2026/10/24 19:55:03 [WARN] [offbox] privatebin: the restore failed (failed to restore 1 volume(s): [privatebin_privatebin_data]) — the live volumes and d
+19:55:47Z   [7] stop 200, remove with data -> 200 {'ok': True, 'data': {'removed': 'privatebin', 'volumes_removed': ['privatebin_privatebin_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt saját adatot
+19:55:55Z   == putback {"seed": true, "state_after": "starting", "item_after": true}
@@ -0,0 +1,35 @@
+{
+ "app": "vikunja",
+ "install": true,
+ "seed": true,
+ "backup": {
+  "code": "200",
+  "seconds": 11,
+  "status": "{\"db_dump\": {\"count\": 0, \"duration\": \"1.727555353s\", \"last_run\": \"2026-10-24T19:56:03.597363181Z\", \"success\": true}, \"enabled\": true, \"running\": false}"
+ },
+ "fault": {
+  "file": "/mnt/sys_drive/felhom-data/backups/primary/vikunja/volume-dumps/vikunja_vikunja_db.tar",
+  "from": "2615296",
+  "to": "1307648"
+ },
+ "restore": {
+  "points": 1,
+  "location": [
+   "location: /backups/restore?flash=flash.restore.started"
+  ],
+  "seconds": 10,
+  "status": "{\"running\": false, \"op\": \"restore\", \"stack\": \"vikunja\", \"started_at\": \"2026-10-24T19:56:29.913870108Z\", \"last\": {\"op\": \"restore\", \"stack\": \"vikunja\", \"ok\": false, \"message\": \"Visszaállítás sikertelen: a(z) vikunja visszaállítása sikertelen. Nem változott semmi: az alkalmazás adatai visszakerültek a visszaállítás előtti állapotba, és az alkalmazás újra fut\", \"finished_at\": \"2026-10-24T19:56:34.555556083Z\"}, \"last_recent\": true}",
+  "state": "running"
+ },
+ "state_after": "running",
+ "item_after": true,
+ "controller_log": "2026/10/24 19:55:03 [ERROR] [web] Restore failed (async): stack=privatebin: a(z) privatebin visszaállítása sikertelen. Nem változott semmi: az alkalmazás adatai visszakerültek a visszaállítás előtti állapotba, és az alkalmazás újra fut\n2026/10/24 19:56:31 [INFO] [offbox] vikunja: the live volumes are copied before the restore (2 copied, 0 new from the snapshot) in 775ms — /mnt/sys_drive/felhom-data/backups/restore-undo/vikunja/20261024T195630Z (R-893)\n2026/10/24 19:56:33 [WARN] [offbox] vikunja: the restore failed (failed to restore 1 volume(s): [vikunja_vikunja_db]) — the live volumes and definition are put back; starting the app (R-893)\n2026/10/24 19:56:33 [INFO] Event pushed: backup_run_failures (error) [hu-only] — App \"vikunja\": its off-site restore FAILED and was undone — the live volumes and definition from just before the restore were put back and the app was started (R-893). No support step is needed; the household was told. Error: failed to restore 1 volume(s): [vikunja_vikunja_db]\n2026/10/24 19:56:34 [ERROR] [web] Restore failed (async): stack=vikunja: a(z) vikunja visszaállítása sikertelen. Nem változott semmi: az alkalmazás adatai visszakerültek a visszaállítás előtti állapotba, és az alkalmazás újra fut\n",
+ "after_remove": {
+  "containers": "",
+  "volumes": "",
+  "appyaml": "",
+  "appdata": "",
+  "kept": "",
+  "subdomain": "404"
+ }
+}