| R-756 | needs a live reading — A fix that walks up to a mounted ancestor would also loosen the boot reconciler's start gate (DriveL | 10 | — |
| (live, 9202) | the live-proof helper was stopped at 23:30 after 90 min with no result; 9202's catalog pointer put back byte-identical; no proof run — R-776, R-613 stay held, R-763/R-764 ship as a hidden app | — | `live-9202-teardown.txt` |
| R-518, R-638, R-528 | group D: one-page design proposals written (no code), in this folder | 40 | this commit |
## Release window 1 — 00:30 to 00:58 CEST (evidence: `delivery/`)
| golden 0.298.0 | **first bake unpinned** (no `GOLDEN_DOCKER_PKGS` — runbook gap, now fixed) → never vouched, re-baked pinned, sha `a2e730e9…`, round trip equal, token leak 0 with control, VM back on `virgin` |
| hub v0.138.0 | manifest `edde9e13`, synced 22:48:42Z, healthz 200 at 22:49:13Z (31 s), System page 200; 16 values sealed; raw DB copy 0 plaintext; 3 box reports after deploy, 0 auth failures; cookie `__Host-hub_session` |
| agent v0.148.0 | released (tag, sha `3e68a087…`, bundle `a6fa4f58…`), vouched, signed `agent_update`×3 → all 0.148.0 by 22:50Z; signed `agent_config_update`×3 → root files 0.148.0 by 22:58Z; host pages „matches vouched” |
| vouch + floors | agent 0.148.0 / golden 0.298.0 / min_agent 0.131.0; floors 0.298.0 for demo-hp, demo-felhom, tester-1 only; **global floor not touched; Tester 2 not touched** (DOWN, nothing sent) |
## 2026-10-06 (night) — the burn-down night: fixed and delivered in release window 1
The full text of every row below: `git show d4f8efa1:documentation/backlog/OPEN-ITEMS.md`.
| Row | What | Closed | Evidence |
|---|---|---|---|
| **R-283** | **After a rebuild the hub says "Claimed 18d ago" while the box serves its first-run setup page.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): the customer page shows the box's own claim state (hub v0.138.0) | felhom.eu `daeed175` (tests + red-proof), deployed 2026-10-05 22:49Z. NOT built, on purpose: a report clearing the hub's claim (reverses the set-only rule — the operator's call if wanted). |
| **R-498** | **[P3-LOW] The „Első lépések" on 52 of 53 app pages tell a customer to open a literal `wiki.DOMAIN` — the placeholder is never filled in.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): app pages name the real address | controller `05a447e` (116-render sweep test). Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-575** | **[P3-LOW] The soft memory-overcommit warning is returned as a Hungarian STRING, so it renders Hungarian on an English page.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): the overcommit warning follows the reader's language | controller `b05be0a`. Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-682** | **[P3-LOW] A Remove interrupted by a controller kill leaves the app half-removed: containers gone, the app still listed as installed (and held).** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): a cut-off Remove finishes at the next start | controller `4347983` (`09` decision 134: drive data and backups kept). Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-757** | **[P3-LOW] A template that gains a generated `secret` field makes the box INVENT that value for apps already installed — for calibre-web a login name the app never got.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): no invented secret for an installed app | controller `1991c74`. Boxes that already got the invented calibre-web name keep it. Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-758** | **[P3-LOW] Eight templates declare a `mem_limit` that is not the sum of their compose limits, and no gate checks it.** (P3) | CLOSED 2026-10-06 — FIXED AND PUSHED (the burn-down night): mem_limit is the sum, gated | catalog `1b24d13` (gate `mem-limit-sum` + decoys; red-proved), pushed to the live catalog 2026-10-06 00:30 (`c265b37`). The figure feeds the deploy screen and the soft warning; the hard refusal reads `mem_request` (unchanged). |
| **R-718** | **[P3-LOW] "Close sign-up now" restarts an app with its own switch, and the card does not say so.** (P4) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): the cards say the app restarts once | controller `c4f4019`. Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-798** | **[P3-LOW] Grimmory's template sets `SWAGGER_ENABLED=false`, which v3.5.0 does not read (it reads `API_DOCS_ENABLED`, default false).** (P4) | CLOSED 2026-10-06 — FIXED AND PUSHED (the burn-down night): grimmory sets the name v3.5.0 reads | catalog `84ced44` (`API_DOCS_ENABLED=false`; default false — no behaviour change), live catalog `c265b37`. |
| **R-607** | **[P3-LOW] A forced catalog sync answers „nincs változás" while the cache DOES change, and `catalog_images` stays stale until a separate rescan — so the update badge can be wrong for a window nobody bounds.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): a catalog move rescans and does not say „nincs változás” | controller `0b349e2`. Not touched: the row's removed-app applied-compose observation (undiagnosed side note). Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-615** | **[P3-LOW] Pointing a box at a different app catalog by `git.repo_url` alone is INERT — the box keeps fetching from the repository it first cloned.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): a changed repo_url re-clones | controller `0b349e2` + `28a5203` (credentials ignored in the compare). The drill-teardown half is harness work. Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-545** | **[P3-LOW] There is no product action that un-configures an off-site target — only one that re-starts an ORPHANED repository.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): the own off-site target can be un-configured | controller `27b373b` (same press as R-729; the repository password is kept whenever anything could depend on it — decision 133). Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-729** | **[P3-LOW] An off-site target, once saved on the page, cannot be removed through the product.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): „Távoli mentési cél törlése” | controller `27b373b` (decision 133). Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-25** | **Device-node TOCTOU hardening (drive init).** (P4) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): drive set-up mounts the UUID the agent verified | agent `769c4c3` (v0.148.0, delivered by signed job) + controller `1355391` (v0.298.0). Tests + red-proofs both halves. Residual, stated: the controller keeps the old path lookup for an agent that sends no `fs_uuid` (logged WARN) until the agent floor rises past 0.148.0. |
| **R-126** | **A `.fab` bundle — plaintext secrets, OPTIONAL password — can be exported ONTO a NAS.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): no .fab export without a password to a network drive | controller `33c3973` (`09` decision 128). Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-136** | **Rename `hub_session` → `__Host-hub_session`** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): the session cookie is `__Host-hub_session` (hub v0.138.0) | felhom.eu `e221476f`; live 2026-10-05 22:51Z: `POST /login` answered `Set-Cookie: __Host-hub_session=…; Path=/; …; HttpOnly; Secure; SameSite=Lax` (`delivery/hub-deploy.txt`). |
| **R-270** | **R-268's stated rotation recipe is incomplete: the controller never re-reads `bootstrap.json`'s `local_api`, so a rotation leaves the agent channel dead across restarts.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): a token-only divergence is named | controller `6fac245`. Pre-delivery: demo-hp and demo-felhom held matching tokens (hashes); after delivery 0 token-drift lines and `local-api: channel up` on both (`delivery/controller-delivery.txt`). The working rotation recipe writes both files. Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-879** | **A copy of hub.db still holds secrets readable without any key:** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): box secrets sealed at rest (hub v0.138.0) | felhom.eu `5f060e3d` + roll-back `91e4ace9`; tests `TestR879_*`, six red-proofs. **Live, 2026-10-05 22:48–22:50Z:** start-up log `box secrets sealed at rest (16 legacy plaintext value(s) sealed now)`; a raw read of a hub.db copy WITH -wal and -shm (a different channel from the log): `hosts.api_key`, `customer_configs.api_key`, `customer_configs.retrieval_password`, `host_pbs_secrets.value` — 4 non-empty each, **0 plaintext**, 4 hosts with `api_key_hash`; all three boxes' reports received after the deploy, 0 auth-failure lines (`delivery/hub-deploy.txt`). Decision 132. **Residue, stated:** the two older nightly snapshots under `/data/snapshots/` and their encrypted ep0 copies still hold the values in plaintext until they rotate out (2 kept). |
| **R-349** | **"Prove it by hand, then publish" leaves the fleet running a DIFFERENT binary under the SAME version name — and self-update cannot notice.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): a hand-built agent under the vouched name is visible | agent `64f704d` (v0.148.0) sends `agent_sha256`; hub `a5b4d29a` (v0.138.0) compares it. **Live 2026-10-05 22:52Z:** the host pages of demo-hp, demo-felhom and Tester 1 read „matches vouched” (agent 0.148.0 delivered by signed job, `delivery/sign-agent-update.txt`). |
| **R-839** | **After a Docker restart that stopped every container, the boot sweep HELD an app whose `app.yaml` `HDD_PATH` names its user folder instead of the drive.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): the deploy API refuses a folder inside a drive | controller `4867ec1`; diagnosed as a 2026-09-22 drill-harness value on 9202 (that guest's app.yaml still needs a hand correction — a scratch-box fact). Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-271** | **The `agent_channel_unauthorized` alarm can never be closed, because its own prescribed remedy is what silences the recovery.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): the channel recovery after a restart is reported | controller `f885100`. Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-522** | **[P3-LOW] While the box has no internet, the dashboard's „Cloudflare Tunnel" tile keeps saying „Fut", and no page tells the household the box is offline.** (P3) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): the tunnel row says it is unreachable | controller `b36a85a`. Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-492** | **[P3-LOW] `cfg.Paths.HDDPath` is empty on every box and still has readers; delete it.** (P4) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): the always-empty global HDD path is gone | controller `7b8216a`. Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-569** | **[P3-LOW] Four more API handlers pick their status code by matching ENGLISH words in an error — the same shape as R-553, one language over.** (P4) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): status codes by error kind | controller `d15ad10`. Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-574** | **[P3-LOW] `web/handler_debug.go` mixes page copy with JSON payload, so neither half could be converted safely.** (P4) | CLOSED 2026-10-06 — FIXED AND DELIVERED (the burn-down night): the debug page's copy follows the language | controller `391967b`. Delivered 2026-10-06 ~00:51: controller v0.298.0 on demo-hp, demo-felhom and Tester 1 (`audits/night-burndown-2026-10-05/delivery/controller-delivery.txt`). |
| **R-731** | **[P3-LOW] The catalog-currency comparison cannot see an upstream that changes its TAG SHAPE, and two newest tags need a release check.** (P4) | CLOSED 2026-10-06 — FIXED (the burn-down night): the shape-switch control is standing | catalog `181bc0d`: `scripts/check-currency.py` with fixture tests; its first run flagged jellyfin 12.1, gramps-web 26.9.1 and kimai 2.68.0 — ladder steps, not this row. |
## 2026-10-05 (night) — the burn-down night: controller tooling and tests
The full text of every row below: `git show 4372b46b:documentation/backlog/OPEN-ITEMS.md`.
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
