R-896 filed: the volume-persistence gate runs Docker locally (DooPlex)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/audits/night-burndown-2026-10-06/NIGHT-LOG.md

@@ -47,3 +47,5 @@ no reboot.
 | (bench 9401) | **a breach of the brief's „never prune by hand":** the catalog helper ran `docker volume prune -f` inside the bench guest during R-612's clean-up. The bench keeps no standing data; nothing else was pruned. Bench started 20:42, stopped ~21:10 as found; 0 test containers left | — | `cat/R-612-red.txt` |
 | (catalog held branch) | `night-held-2026-10-06` pushed (`e5a5984`, 6 commits); catalog `main` unchanged at `d63ea35` | 5 | — |
 | R-392 | **closed** — `architecture/12-agent-tooling.md` written (a map, points at the doc-authoring skill); routed from `.claude/rules/docs.md` (instruction-file edit: one table row added) | 25 | (this batch) |
+| (DooPlex fence) | **A helper ran the catalog's full gate run on DooPlex**, whose `volume-persistence` gate builds and runs canary containers on the local Docker (`scripts/check-volume-persistence.py` canary self-test). Read at 21:20: no container and no volume left; one local image `felhom-volgate-canary:1` (alpine, built ~21:10) remains — left in place (not mine to prune; it may have existed before). The helper reports the gate's self-test fails on DooPlex for every app, also on `main` — not investigated: running it again would act on DooPlex. Fence repeated to the next helper | 5 | — |
+| R-896 | **OPENED** — the volume-persistence gate runs Docker locally (acts on DooPlex); its self-test fails here | 5 | (this batch) |

documentation/backlog/OPEN-ITEMS.md

@@ -278,7 +278,7 @@ stopping line that lies.
 | **R-89** | Business & legal | P4 | Retention as a per-customer **commercial** policy on the hub | READY (increment 2) | — | Policy object + reconciler → ep0 prune job; keep box tokens write-only | CC |
 | **R-794** | Business & legal | P4 | **[P3-LOW] redis 7.4 (RSALv2 / SSPL, not OSI) runs as a private cache in seven apps: dawarich, docmost, immich, nextcloud, outline, paperless-ngx, romm.** READ 2026-10-02 (`audits/licences-2026-10-02/TABLE.md`). Read as permitted (a private cache only its app uses is not Redis offered as a service — inferred). Valkey (BSD-3) or redis 8 (AGPL option) removes the question. **Needs:** a ladder step per app to valkey or redis 8, through the harness — no hurry. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: the row itself says no hurry; usage read as permitted.** | — | — | CC |
 
-## Process & tooling — 21 rows (P3 2, P4 19)
+## Process & tooling — 22 rows (P3 2, P4 20)
 
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
@@ -303,6 +303,7 @@ stopping line that lies.
 | **R-805** | Process & tooling | P4 | **[P3-LOW] The volume-persistence gate judges an empty NAMED volume (R-788) but not an empty BIND mount.** MEASURED 2026-10-02 (`audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md`): Grimmory's `/app/data` bind held 0 files and read CLEAN (its state is in MariaDB); komga, paperless-ngx, radarr and sonarr also carry empty binds that are not judged. **Needs:** decide whether an empty bind after the exercise is UNDETERMINED like a named volume, with a decoy. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: a test-gate rule; no household meets it.** **2026-10-06 night: fixed on catalog branch `night-held-2026-10-06`** (`816c557`) — an empty bind is a NOTE in the reasons, the verdict unchanged (`09` §3 decision 159, decided by CC unattended — operator may reverse); `TestEmptyBind` red-proved (`cat/R-805-red.txt`). Closes when the branch reaches main. | — | — | CC |
 | **R-806** | Process & tooling | P4 | **[P3-LOW] The gate's GET exercise speaks plain http to an HTTPS backend (crafty-controller :8443), and gramps-web did not answer on :5000.** MEASURED 2026-10-02 (`audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md`): both reached data only through their fixture seed. **Needs:** read the `loadbalancer.server.scheme` label (upgrade_boxport already does); find why gramps-web's first GET got no answer. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: a test-gate defect; no household meets it.** **NARROWED 2026-10-05 (app-catalog `4828dc7`): the harness GET now uses the traefik scheme label (https + -k for crafty-controller). LEFT: gramps-web :5000 not answering — a live look on a box.** **2026-10-06 night: the :5000 silence is measured and fixed on catalog branch `night-held-2026-10-06`** (`1859903`): the image's default 8 gunicorn workers filled the 1024M limit (anon at limit, oom_kill 3, 4/5 GETs timed out); `GUNICORN_NUM_WORKERS=2` → first answer 10 s, ~2 ms, anon 342 MB, 0 kills (`cat/R-806-red.txt`). Closes when delivered. | — | — | CC |
 | **R-807** | Process & tooling | P4 | **[P3-LOW] 13 apps stay UNDETERMINED because their seeds write only to the database, so their upload / media / cache / redis volumes stay empty.** MEASURED 2026-10-02 (`audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md`): claper, crafty-controller, dawarich (redis), docmost, gramps-web, immich (ML cache), outline (+redis), sparkyfitness, tandoor, vikunja, wger, wishlist, zipline — plus plex (no seed route: a plex.tv claim token) and wanderer (no fixture; unhealthy under the gate). None is BROKEN: nothing was written outside a preserved folder. **Needs:** per app, a seed that uploads one file (or the volume named n/a with a reason: a redis cache, an ML model cache). | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: test coverage; nothing was found broken.** | — | — | CC |
+| **R-896** | Process & tooling | P4 | **The catalog's `volume-persistence` gate runs its canary and the apps on the LOCAL Docker, so a full gate run on DooPlex acts on the production host — and there its self-test fails for every app.** SEEN 2026-10-06 night: a helper's full `catalog_gates.py` run on DooPlex built `felhom-volgate-canary:1` and ran the canary pair locally (`scripts/check-volume-persistence.py` canary self-test, ~line 830); it reported the self-test failing for every app, also on `main` (checked with gokapi). Not re-run (it would act on DooPlex again). Same class as R-650 (tests that reach real Docker act on DooPlex). | **OPEN — filed 2026-10-06 night** | — | Point the gate at the bench guest (as the upgrade harness does) or refuse to run on a host without a marker; then find why the self-test fails | CC |
 
 <!-- DUE-CHECKS-BEGIN — machine-readable. Parsed by scripts/due_checks_gate.py.
      One row per dated check. The R-number must have a row above. Dates are UTC.