Review round 2 (batch 2 + close-out): 02/07/09/10/11/14/15/16/inventory facts corrected at file:line (EDITS.md), undocumented decisions as notes (R-1265), rulings left for the operator (R-1266); register 190 -> 207 (R-1251..R-1267 opened: R-1251 P1 cut drive-app restore put back over newer data, R-1252 P2 rejected backup block deletes second-drive copies - reproduced on 9202); STATUS D43-D45; CONTEXT; audit README

documentation/audits/review-round-2-2026-10-24/9202/at-end-2026-10-24.txt

@@ -0,0 +1,17 @@
+Sat Oct 24 14:05:27 UTC 2026
+gitea.dooplex.hu/admin/felhom-controller:0.342.0
+    repo_url: https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
+felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.342.0 Up 6 hours (healthy)
+filebrowser gtstef/filebrowser:1.5.6-stable Up 23 hours (healthy)
+immich-machine-learning ghcr.io/immich-app/immich-machine-learning:v3.2.4 Up About an hour (healthy)
+immich-postgres ghcr.io/immich-app/postgres:16-vectorchord0.4.3-pgvectors0.2.0 Up About an hour (healthy)
+immich-redis redis:7-alpine Up About an hour (healthy)
+immich-server ghcr.io/immich-app/immich-server:v3.2.4 Up About an hour (healthy)
+paperless-postgres postgres:18-alpine Up About an hour (healthy)
+paperless-redis redis:7-alpine Up About an hour (healthy)
+paperless-webserver ghcr.io/paperless-ngx/paperless-ngx:2.20.15 Up About an hour (healthy)
+traefik traefik:v3.7.13 Up 23 hours
+324af98a77bf1b5a6e0427187c6e1991  -
+3
+/dev/loop0       32G  2.7G   27G  10% /
+/dev/nvme0n1    938G  239G  652G  27% /mnt/felhom-drives/scratch_hdd

documentation/audits/review-round-2-2026-10-24/EDITS.md

@@ -94,3 +94,102 @@ Rules, fences, „never" lines and promises were NOT edited — those are rows f
 - [S18] R-970 „does not hold" → the routes are removed, pinned by `r970_no_hub_key_door_test.go`.
 - [S19] R-971 „design gap" → `privpolicy.Admit` before every write (controller v0.328.0).
 - [S20] „hub 0.168.0 deploy pending", „R-1244 not released" → deployed / released 2026-10-24.
+
+## 07-backup-architecture.md (DOC-D1)
+- [S2/C3] Tier-1 „secret-stripped app.yaml" → carries the portable secrets (D5) — `felhom-controller/controller/internal/backup/recovery_unit.go:24-27`.
+- [S7] `main.go:604-607` → `backupwindow.LegTimes` at `cmd/controller/main.go:1258-1264`.
+- [S9] demo-hp „keep-last=1" → a dated note: keep-daily=N since R-1149 — `felhom-agent/internal/config/config.go:553-559`.
+- [S1] D22 „controller main, unreleased" → released v0.338.0.
+- [S11] §6.6 table → a row: the off-site restore also refuses a mismatched/mixed snapshot first — `internal/backup/offbox_reconstitute.go:826-833`.
+- [S8] line citations moved (`GetAppDrivePath`, F5); `mp1` → a dated note (gone).
+- [S3/C1] row 15 R-104 „open DEFECT" ×2 → FIXED 2026-10-05, v0.297.0 — `internal/backup/offbox.go:156-162`; CLOSED-ITEMS.md:895.
+- [S6] row 10 R-893 / R-973 „unreleased" → released; „the next slice on R-893" → note: D20 (v0.336.0), D22 (v0.338.0).
+- [S5] „Hub v0.158.0 … deploy waits" → deployed 2026-10-18 12:16 (hub CHANGELOG:288).
+- [S10] „a restore is refused while any second-drive copy runs" → a dated note: the kept-data load checks only RestoreStatus/IsRunning (`internal/api/kept_install.go:89-92`) — a row.
+- [U1/U2/U6 + hub U2/U3 + U7 → §8.2c, DESIGN — undocumented notes, one row for the operator]: the 60-min copy limit and stray handling; Eltávolítás refused during backups; start-after-put-back failure; the hub's off-site delivery checker (`offsite_delivery_stuck`, `maybeHeal`, the R-1230 skip — `hub/internal/monitor/offsite_delivery.go:103-110`); the release copy (D33) not in the matrix.
+- NOT edited here: C4 (a stale code comment in `felhom-agent/internal/localapi/backup_cap.go:15`) — a row; C2 (G15 „nightly") — corrected in the capability map below.
+
+## 09-update-architecture.md (DOC-C2) — dated notes; no §3 ruling text edited
+- [S1/S2/S3] §1 (the 2026-09 measurement) → one dated note: `UpdateStack` gone, `StartGuardedUpdate`; moved line numbers.
+- [S16] `stacks.update_window` „no Go code reads it" (inside ruling 11) → a dated note: removed.
+- [S17] `unattended.go:433–435` → `:449-451`.
+- [S4] §5.3 writers → note: `advancePinTo`; `pinBack`, the undo's `restoreDefinition`.
+- [S7/C1] slice 6 „OPEN — R-450" ×2 → BUILT, R-450 closed 2026-10-05.
+- [S12] R-646 residual → closed by `BackfillAppliedMeta` — `internal/stacks/undo.go:646-652`.
+- [S18] `config.go L280-281` → L278-279.
+- [S9] part 1 „DB up alone … empty-then-load" → note: the shipped folder copy — `undo.go:26-36`.
+- [S10] „a step has no .felhom.yml of its own" → closed — `ladder.go:127-132`.
+- [S11] „the box half … is not built" → built — `digest.go:15-24`.
+- [S19] reason `current` → `already_current` — `update.go:432`.
+- [S14] digest comparison „R-446 §3b Q6" → built for every ref with a ladder entry.
+- [S13] §8.6 / „stepping is slice 6" → notes: any tier, the undo, the ladder.
+- [S15] engine-major „until Slice 4" → note: MariaDB lifted, PostgreSQL by two-venue proof.
+- [S5] recordInstalledImages callers → note: the real callers.
+- [S8] §6.1 phase table → the bind-data tier order; a `converting` row (v0.273.0, `pgconvert.go`).
+- [U1–U6, S6 → §6.4.x, DESIGN — undocumented notes]: build.sh's dirty/HEAD/non-git refusals (`controller/build.sh:144-166`); the once-retry; stopped_by_household; the manual leg's deadline; already_current/engine_no_test; the unreadable-template render row and R-971 admission.
+- NOT edited (RULINGS — rows for the operator): C4 decision 13's „CompareImageRefs moves to the catalog gate" (not built); C5 decision 14's „never jumps" vs a person's press on an app older than the ladder; C7 decision 250 item 5's „by its AGE" vs the gate's proxy.
+
+## 00-capability-map.md
+- 20 PROVEN-LIVE rows marked „re-check (2026-10-24)" in their Scope cell, each with the commit that changed its mechanism after its evidence (status words unchanged): a7, a8, a10, a11, a17, b1, b2, b7, b11, c3, c4, c5, c6, d6, d10, d11, e17, g7, g15, g18. Each commit's files read with `git show --stat`.
+- [DOC-D1 C2] G15 „a nightly consistent copy" → every 6 hours since D34.
+
+## 16-storage-physical-identity.md (DOC-D2)
+- [S2] the single-copy notice „a Go constant, not i18n" → the i18n keys — `felhom-controller/controller/internal/backup/backup.go:1485-1494`.
+- [S3] `/disks/candidates` „whole disks only" → with nested partition candidates — `felhom-agent/internal/storage/candidates.go:84-90`.
+- [S4] `felhom-host-install.sh:2261-2275` → `step_grows` at `:2475`.
+- [S1] the R-1093 „not as written" → a note: fixed in agent v0.160.0 (`git tag --contains f7b7308`).
+- [U4–U7 → DESIGN — undocumented notes]: detect-virt once; unreadable = same disk (R-668); the internal place's lifecycle refusals; its size rule.
+
+## 15-media-library.md (DOC-D2)
+- [S5/S6/C2] the §10 measurement table → one dated note before it: binds rewritten, restart on the household's press, the drive kept registered, and `b01bb4b`'s stopped-app rule.
+- [S7] Transmission's watch/download folders → note: `excluded` since catalog `c50adfc` (`templates/transmission/.felhom.yml:46-51`).
+- [U1/U3 → DESIGN — undocumented note]: the „Később" timer is in memory (`media_events.go` `handleMediaRestart`); the Sonarr/Radarr key read from `config.xml` (`mediawire.go:336-345`).
+- [U2 — FIXED in code, not a note]: a media restart started a household-stopped app → controller `b01bb4b`.
+
+## _recovery-inventory-2026-07-28.md (DOC-D2 S8–S13) — a WHAT HAS MOVED SINCE banner; the inventory body kept as its date's record
+- one `mp0`, no `mp1` (`felhom-agent/configs/build-golden.sh:31-38,99`); portable secrets in the unit; `RestoreTier2Unit` (`tier2_restore.go:197`); volume tars replayed (R-354); ep0 keep-weekly 2 at 03:30 (`scripts/felhom-tenantsync.sh:187-197`); local keep-daily=3; restic pinned 0.19.1 (`Dockerfile:43-52`).
+- runbooks/RUNBOOK-manual-guest-restore.md [DOC-D2 C3]: a dated note after the example config — one `mp0` at /var/lib/felhom, no `mp1` (golden v2.1.0+); the procedure unchanged.
+
+## 14-host-power-off.md (DOC-E)
+- [S2] „two exact sudoers vectors, FELHOM_POWEROFF" → `pct shutdown` in FELHOM_GUESTHOOK + `systemctl poweroff` in FELHOM_POWEROFF — `felhom-agent/configs/felhom-agent.sudoers:81-90`.
+- [S1] heavy-gate holders → plus the line test (agent v0.164.0).
+- [S3] the website FAQ line „a later task" → published — `website/gyik.html:128,603`.
+- [S4] a paragraph that split the §3 table → moved below the table (rendering only).
+- [U1–U3 → DESIGN — undocumented notes]: a re-enroll during the hold is „gone" (`hub/internal/api/reenroll.go:67-68`); the two info events; the three confirmation words.
+
+## 11-os-updates.md (DOC-E)
+- [S8] status „§8 step 2 BUILT" → steps 2–6 built by §8's own list (the ratification left to the operator).
+- [S5] cloudflared `2026.6.0` → `2026.9.3` today — `felhom-controller/controller/internal/infra/infra.go:26`.
+- [S6] apt sudoers/caller line numbers → `sudoers:68,228`, `lanresolver.go:133`, `wgtunnel/manager.go:659`.
+- [S7] §5.4.1 „DRAFT … nothing installed" → note: built; sudoers holds only `--plan` (`sudoers:337`).
+- [S9] BUNDLE_FILES 22 → 32 (counted in `felhom-agent/configs/felhom-os-apply`).
+- [S10] HOST_SLOW_RE list → plus `linux-*`, `firmware-*`, `proxmox-secure-boot-support` (read from `felhom-os-apply`).
+- [DOC-E U5 / DOC-C1 U5] §5.7 → the System page's „Upload line" cell (`hub/internal/web/system.go` `lineStaleAfter`).
+
+## 10-localisation.md (DOC-E)
+- [S12] „Part B is the remaining piece" → built (v0.256.0) — `felhom-controller/controller/internal/config/config.go:149-154`.
+- [S13] formal-form ceiling 16 → 0 — `felhom-controller/controller/scripts/i18n_missing_gate.py:41`.
+- [S11/C1] the setup wizard „still reachable … R-554" → deleted (`internal/setup` absent; `bootstrap.WaitForConfig`).
+- [S15] `metadata.go L316` → L475.
+- [S14] „53 real catalog files" (fixtures, still 53) / „fifth row" → sixth / „all 53 apps" → the freeze file's 65.
+
+## 02-controller-module-map.md (DOC-E) — dated notes; the v0.33 plan tables kept
+- [S16/C3] two in-flight markers → four (`update-journal.json`, `.felhom-install-pending`).
+- [S17] three StartGate holders → four (1b `IsUpdating`, `cmd/controller/main.go:2459-2477`).
+- [S18] `GetAlerts` → `GetBannerAlerts(page, lang)` (R-906) — `internal/web/alerts.go:353`.
+- [S19] „no longer calls the Cloudflare API" → note: `cloudflare/` still wired with `cf_api_token` (`main.go:1992-2000`).
+- [S20] `state.go`/`updater.go` DELETE → note: both live, `AgentSwapper` (`internal/selfupdate/updater.go:38-47`).
+- [S21] `sync.go:319`, `config.go:351` → `:436`, `:399`.
+- [S22] `locked_after_deploy` „read by no code" → note: read into `LockedFields`, enforced only by an uncalled function.
+- [C2] §2 `UpdateStack` → note: deleted in v0.237.0.
+- [U4] §1 → a note naming the 22 packages with no row (an `ls` of `controller/internal/`).
+
+## felhom-controller/REUSE.md (DOC-D1 C5/U8, DOC-C2 C3)
+- `CrashPutBack … (D22 / R-1195, unreleased)` → `v0.338.0`.
+- `recordInstalledImages` callers `StartStack/RestartStack/UpdateStack/runComposeDeploy` → the real callers; `UpdateStack` deleted in v0.237.0.
+- A new row: `Tier2CopyBlocksRestore` / `ClearLeftoverTier2Copies` / `MarkTier2CopyForTest` + the `tier2Docker` seam (`internal/backup/tier2_copy_lifecycle.go:85,255,319,341`).
+
+## Late additions (the disposition check before the README)
+- 03 §6 [DOC-B U1–U5, U8; DOC-A U4 → DESIGN — undocumented note]: 41 routes (24 unlisted), the controller-started line test, the island bridge, the line-test state and switch, the WG block's OOB fields, the D30 count in memory.
+- 13 §5 [DOC-A U1 → DESIGN — undocumented note]: the file manager's one sign-in trust (`filebrowser_sso.go:15-22`).
+- 08 §9 item 6 [SEC-1 X1]: the limits list names „any viewer explains any upload" (R-1262).

documentation/audits/review-round-2-2026-10-24/README.md

@@ -0,0 +1,90 @@
+# Review round 2 — the architecture documents against the code, and a fresh data-loss and security look (2026-10-24, unattended)
+
+**Baselines (read at start, 14:42 CEST):** felhom.eu `44d19042`, felhom-controller `321df1f` (v0.342.0 released;
+„next v0.343.0" unreleased on top), felhom-agent `5e05627` (v0.164.0; „next v0.165.0"), app-catalog `5e196e1`, hub
+deployed 0.169.0. Register: 190 rows.
+
+**Method.** Thirteen read-only reviewers (each prompt carried the brief's fences word for word —
+`reviewers/FENCES-given-to-every-reviewer.md`): seven on the documents (the brief's four groups, two of them split, plus a seventh for
+`02`/`10`/`11`/`14`, which the groups did not name), four on data loss (restore and put-back; delete and retention;
+keys; time and concurrency), two on security (hub + controller; agent + ep0 + installer + the DooPlex→ep0 jobs). Their
+answers are CANDIDATES (`reviewers/`). The main session read every item it acted on at `file:line`; the edits and
+their evidence are in `EDITS.md`.
+
+## Part 1 — the documents (claims checked by the reviewers: 493; stale reported: 121)
+
+| Document | Verdict |
+|---|---|
+| `01` topology & trust | 7 stale facts corrected; 2 product statements contradict the code → R-1266 (D45) |
+| `03` host agent | 9 corrected (shipped releases, key files, listen address, swap, cloudflared's 4th state); a note: 41 local-API routes, 24 unlisted; break-glass text → R-1266 |
+| `04` control-plane authorization | 3 corrected; a note: a signed op's window has no length cap → R-1265 |
+| `05` hub | 9 corrected (the 6-hourly DB copy, version literals, the fifth bind-link path, 44 event types, the retired DR record) |
+| `06` off-site connectivity | 7 dated notes (the design-of-record kept); „no inbound listener" → R-1266 |
+| `07` backup | 12 corrected (portable secrets, R-104 fixed, keep-daily, D22/D20 released, a refusal row); §8.2c notes → R-1265; the kept-data load beside a copy → R-1256 |
+| `08` alarm ladder | 10 corrected (per-type cooldowns, R-723, per-app grain, R-998 skip, §8.1 built, §9 released, the operator-only box alarms); one ruling line kept with a dated note (operator Q1 made `backup_integrity_failed` a default) |
+| `09` updates | 19 dated notes and corrections (the §1 measurement, slice 6 built, the undo as shipped, digests, phase table); §6.4.x notes → R-1265; three rulings the code does not do as written → R-1266 |
+| `10` localisation | 7 corrected (Part B built, ceiling 0, the wizard deleted, counts) |
+| `11` OS updates | 7 corrected (cloudflared 2026.9.3, sudoers lines, the wrapper built, 32 bundle files, HOST_SLOW_RE); the System page's „Upload line" cell added |
+| `12` agent tooling | 3 corrected; the five rule copies aligned (the instruction-file edits below) |
+| `13` threat model | 11 facts corrected, every verdict cell left as it was and marked „re-check"; a note on the file manager's sign-in trust |
+| `14` power-off | 4 corrected (sudoers vectors, line-test holder, FAQ published, the table split); notes → R-1265 |
+| `15` media library | a dated note on the §10 measurement table; R-1019's fix; notes → R-1265 |
+| `16` storage identity | 4 corrected; notes → R-1265 |
+| `02` controller module map | 8 dated notes (markers, holders, banner alerts, cloudflare still wired, updater live, LockedFields, 22 packages with no row) |
+| `_hub-review.md` / `_recovery-inventory-2026-07-28.md` | a HISTORICAL banner / a „what has moved since" banner — both dated records kept as they were |
+| `00` capability map | 20 PROVEN-LIVE rows marked „re-check" with the commit that changed their mechanism (no status lowered); G15's „nightly" corrected |
+| `felhom-system-poster` facts + html | the timeline's hub-DB push (text only; no drawing needed) |
+
+**Rules, fences and promises were not edited.** Seven items that need the operator are in R-1266 (D45); about 30
+behaviours with no document are written as `[DESIGN — undocumented, found 2026-10-24]` notes for the operator to confirm
+(R-1265, D44).
+
+**Instruction files edited (unprompted-work §5 — facts only):** the workspace root, felhom-agent and app-catalog copies
+of `.claude/rules/unprompted-work.md` got the missing „A version number is pushed once" paragraph (now byte-identical to
+the other two); `felhom.eu/.claude/rules/live-probes.md:41` — the stack path `/opt/felhom/stacks/<name>` → `/opt/docker/
+stacks/<name>/app.yaml`. Details: `EDITS.md`.
+
+## Parts 2 and 3 — findings, ranked
+
+| # | Sev | Finding | What was proven | Row |
+|---|---|---|---|---|
+| 1 | **P1** | A power cut during a restore of a drive-backed app: the app runs on the cut restore's data, and a later controller restart pours the pre-restore copy back over newer writes | the real `Recover` code in a lean clone: boot 1 „copy gone → refused → marker kept", boot 2 put-back after the app ran (`proofs/H1-drive-cut-restore/`); the boot recreate's missing check read at `intermediary.go:470-476` | R-1251 |
+| 2 | P2 | One rejected backup block makes the night's second-drive copy delete the app's household-file copies | **reproduced on 9202**: control kept the copy twice; one bogus path → „removed stale dest dir userdata/media" (`proofs/H2-bad-backup-block/`) | R-1252 |
+| 3 | P2 | An export with „stop first" overwrites another app's restore marker | static, read at `file:line` | R-1253 |
+| 4 | P2 | The hub saves the escrow package in two writes; a lost answer tells the household „the previous code still works" | static | R-1254 |
+| 5 | P2 | D4's sshd drop-in reaches BYO hosts (against `11` §1); the in-force check and the all-or-nothing `sshd -t` | static | R-1257 (D43) |
+| 6 | P3 | Escrow carry / set-aside name edges | static | R-1255 |
+| 7 | P3 | Four restore edges (definition write, merge, a mirror race, the unused copy) | static | R-1256 |
+| 8 | P3 | ep0's iperf3 takes any tunnel peer's test | static (no ep0 change) | R-1258 |
+| 9 | P3 | The DooPlex→ep0 copies: the vouched agent can drop out; deletions mid-transfer; no future bound; **2026-10-25: the 02:30 push re-sends the 20:00 snapshot** | DST timing verified on DooPlex (`systemd-analyze`, Go) | R-1259 |
+| 10 | P3 | Spring 2027: the leg's deadline vs the gate's clock; two legs at one instant | Go's mapping verified | R-1260 |
+| 11 | P3 | The unreleased R-1250 line hold: two seeders, a removed app, alt-speed | static | R-1261 |
+| 12 | P3 | Any viewer explains any upload (the upload watch) | static; `08`'s limits list now names it | R-1262 |
+| 13 | P4 | Small items (a mislabelled operator mail, undeclared volumes on Remove, mount views, stale comments, a DNS-name password, rrsync) | static | R-1263 |
+| 14 | P4 | Skills tooling (no size cap on the grandfathered skill; a new skill not installed) | read | R-1264 |
+| 15 | P4 | Immich leaves an empty anonymous volume per recreate (296 on 9202); photos unaffected | read in the running image | R-1267 |
+
+**Fixed in this session (small, not recovery code, red-proved, commit only — controller `b01bb4b`, CI 2294 / #480 success):**
+a media restart („Újraindítás most", „Később", the safe removal) no longer starts an app the household stopped (R-721;
+two tests, each seen failing with the rule off); the file manager's header name file appears whole (a race the
+existing test caught 44 times in 300 runs on clean `main`; 0 in 300 after, 0 in 50 under `-race`).
+
+**NOT-A-FINDING:** SEC-1 X2 (a passphrase enroll after the operator's host delete gets ciphertext — the window D19
+accepts); SEC-1 X3 (the refused-passphrase mail is operator-only with a one-hour cooldown); DOC-D1 U4 (the fit check
+that passes on a statfs error — the copy then fails and the app restarts untouched, `restore_unit.go:502-512`);
+HUNT-3 D31's comment wording (no data effect); Immich's `/data` volume for data placement (R-1267 holds the leak);
+the stack folder left after a clean removal (it is every catalog app's template folder).
+
+## Machines
+
+- **9202** (Tier 0): as found at 12:46 UTC (`9202/as-found-2026-10-24.txt`); at the end (`9202/at-end-…`) the same
+  containers and images, healthy (restarted by the test night chains), the catalog on the live repo, the controller
+  0.342.0. The only difference: Immich's running container uses a new empty anonymous volume (R-1267); the two others
+  my test runs made were removed by name. audiobookshelf installed and removed through the product; my marker file
+  removed; its second-drive copy removed by the product's remove.
+- **DooPlex:** reads, lean clones in the scratchpad, the gates; no service changed. **ep0, household boxes, the hub:**
+  not touched (hub reads only, none needed in the end).
+
+## Teardown (three layers)
+
+Machine: 9202 as above. Host (demo-hp): nothing provisioned. Hub: nothing changed.

documentation/audits/review-round-2-2026-10-24/reviewers/FENCES-given-to-every-reviewer.md

@@ -0,0 +1,37 @@
+## FENCES — the brief's, word for word (operator ruling 2026-10-07: every helper prompt carries them in full)
+
+From the brief's §0 Scope:
+- **Class:** review + verification, unattended. **Code is not changed** except a fix that is small, not in recovery code,
+  and has a red-proof (commit only). Documents may be corrected for facts proven at `file:line` (PROMPT-TEMPLATE §9
+  rule 9: facts yes, rules and fences never without the operator).
+- **Machines:** DooPlex (lean clones, builds, read-only reads), 9202 for proofs (put back as found). No household box, no
+  ep0 change, no release.
+- **Coordination:** the catalog sweep runs in parallel on demo-hp's nested VM and writes to `felhom.eu`. `git pull
+  --rebase` before each push; never remove its lines. **Do not use 9202 between 18:00 and 20:00 if the sweep asks for it**
+  (it should not; it has its own VM).
+- **Reviewers:** read-only subagents; only the main session touches machines, git and the register.
+
+From the brief's Rules:
+1. Verify every claim at `file:line` before acting; a reviewer's word is a candidate, not a finding. 2. Documents: facts
+yes; rules, fences, „never" lines and protected-machine text never without the operator. 3. Code: only small, non-recovery
+fixes with a red-proof, commit only. 4. No release, deploy, vouch, publish, ep0 or DooPlex change. 5. Secrets: never
+printed or committed. 6. 9202 put back as found. 7. Every finding a row, a fix, or `NOT-A-FINDING: <reason>`. 8. Stop at a
+clean point. 9. No branches; no „Co-Authored-By".
+
+From the workspace CLAUDE.md (this host is production infrastructure):
+- NEVER run `docker system prune`, `docker image prune -a`, or any global Docker cleanup here.
+- NEVER touch k3s data dirs, Longhorn mounts, PBS datastores, or Gitea storage.
+- Destructive disk/guest operations belong to felhom-pve via the agent — never on this host.
+- Secrets: never `source` or `cat` a credentials file; never print a token, password, key or `PlexOnlineToken`.
+
+## WHAT THIS MEANS FOR YOU, THE HELPER (binding)
+
+You are a **read-only reviewer**. You may ONLY read files in `/mnt/5_hdd/felhom.eu/git/` (Read, Grep, Glob, and
+read-only shell such as `grep`, `rg`, `sed -n`, `git log`, `git show`, `git blame`). You may NOT: edit or write any file;
+run `git` commands that change anything (no commit, checkout, reset, stash, pull, push, worktree); run `go test`, `go
+build`, any gate script, `docker`, `kubectl`, `ssh`, `curl` to any host, `sec`; touch 9202, demo-hp, the N100, Tester 1,
+Tester 2, ep0, the hub or DooPlex's services. Only the main session touches machines, git and the register. If you
+think something needs a live test, write the test plan in your answer — do not run it.
+
+Repos (read their `main` working trees): `felhom.eu` (hub in `hub/`, docs in `documentation/`, scripts in `scripts/`),
+`felhom-controller` (Go in `controller/`), `felhom-agent`, `app-catalog-felhom.eu`.