Night 2026-10-25 Part 4–5: each fix's [DESIGN] line (04, 05, 07, 08, 11, 13, 15), the register (R-1261, R-1281, R-1282, R-1288, R-1280, R-1285, R-1283, R-1287, R-1289, R-1278 to VERIFY; R-1286 waiting on the operator; R-1291 and R-1292 opened), STATUS (D51 Kimai, the Monday list), the night report with its three-layer teardown, and the rig evidence (scanned: 0 known-secret hits)

documentation/architecture/04-control-plane-authorization.md

@@ -80,7 +80,9 @@ nonce (DoS-safe). Each layer is mandatory and was proven to reject independently
   the root wrapper (`configs/felhom-os-apply`) alike (corrected 2026-10-24). **[DESIGN — the operator picked a code change
   2026-10-25 (D44); row R-1280]:** neither caps the window's LENGTH (`expires_at − issued_at`); `felhom-opsign` defaults to 30 min
   (`cmd/felhom-opsign/main.go:57`), and the nonce store keeps a record until its expiry. The pick: the agent and the
-  root wrapper refuse a window longer than 24 h. Not built yet;
+  root wrapper refuse a window longer than 24 h. **Built 2026-10-25 night (agent `d912307`, unreleased — rides the next
+  agent release):** `authz.MaxWindow = 24h` (`ErrWindowTooLong`), the wrapper's `MAX_WINDOW_S`, and `felhom-opsign -ttl`
+  refuses more; exactly 24 h is accepted;
 - **nonce** — unseen within the window (the nonce store **must be persistent across agent restarts**
   and expiry-pruned; a non-persistent store reopens the replay window after a restart).
 

documentation/architecture/05-hub-architecture.md

@@ -139,7 +139,9 @@ walk is green; the golden is baked weekly and vouched by the operator; a new box
 itself to the floor (R-1052: not yet proven end to end). Setting the global floor today needs the operator page with the
 operator's password — there is no scoped route for CC (R-1051). **An agent can be vouched mid-week; the golden stays
 weekly** (hub v0.158.0): the R-120 golden guard judges only a CHANGED golden selection, so a Day-0 save that keeps the
-vouched golden (same version and sha) saves a new agent even while that golden is behind the fleet. **The agent list
+vouched golden (same version and sha) saves a new agent even while that golden is behind the fleet. **„The fleet" is the
+newest RELEASED controller any box reported** — a test build (`-rc.N`, `-dev…`) never counts (R-1289, hub v0.171.0,
+unreleased: the semver compare could not read a suffix and kept a dev build no box ran as the fleet's newest). **The agent list
 offers real agent packages only (R-1011, hub 0.162.0, deployed since; corrected 2026-10-24):** the sha lookup asks for exactly the
 `felhom-agent` file (the golden: `golden.tar.zst`) and never falls back to another file, so a step bundle
 (`0.156.1-step1`, only the config bundle) is left out of the list, and a vouch of one is refused

documentation/architecture/07-backup-architecture.md

@@ -1720,7 +1720,7 @@ names the app and both identities). Nothing moves a unit while that app is being
 telepítés mentése") with **„Visszaállítás"** — the one unit-restore body, with the unit's own database password — and
 „Eltávolítás". Only those two, and the app's remove with „delete its backups too", ever remove it (the §8.2a / R-1252 H9
 rule). After a restore from it, the app is that unit's install; the app's own unit of the install it replaced is then
-set aside at the next backup — never lost.
+set aside ~~at the next backup~~ **at the restore itself** — never lost. **[DESIGN — R-1288, 2026-10-25 night, the brief's safest reading; controller `b5863a9`, unreleased]:** the restore of a set-aside unit moves the replaced install's unit aside whole right after it (success, or „not started yet" — the data stays, D49 = A), one log line „replaced by the restored install", **no operator alarm** — the household chose this restore; before, the next backup's writer set it aside with a second alarm and a second kept copy (measured on Tester 1, 0.343.0). **[FACT]** on the night's rig (rc.2): the line, the account back, the next backup set nothing aside, one set-aside mail only (`audits/night-2026-10-25/rig/r1288-live.txt`). A set-aside's operator mail (R-1287, hub v0.171.0, unreleased) reads „⚠️ … a backup of an earlier install was set aside — nothing failed", a warning.
 
 **Known limit, stated.** A box that reinstalled and refreshed BEFORE this release already holds a rewritten unit; its
 old password is gone and nothing can bring it back. A unit from before D47 of an app with no carried secret has no
@@ -1728,7 +1728,7 @@ signal: it is treated as this install's (the old behaviour) and gets the identit
 **Why a volume app's reinstall asks no kept-data question:** the question (§6.5, decision 36) is about the app's drive
 FOLDER (`${HDD_PATH}` binds under `appdata/`); a volume app keeps nothing there — „remove, keep my data" removes its named
 volumes and keeps only its backups — so the install starts empty, and the kept backup is now the set-aside unit on the
-restore page. (The missing offer at install is its own row, R-1278.)
+restore page. **[DESIGN — R-1278, controller `fbec5cb`, unreleased]:** the install page now says so for an app not installed — „the new install starts empty; load the backup afterwards on the Restore page" — with a link (set-aside and removed-app units counted).
 
 ### 8.2e A restore whose app does not start is never „success" [DESIGN, R-1270, 2026-10-25 — controller `b680db8` + fix A; D49 = A (operator 2026-10-25); released in controller 0.343.0]
 

documentation/architecture/08-alarm-ladder.md

@@ -591,6 +591,15 @@ normal use; work it does not explain is the sign of a hacked app. Numbers and me
    start-up check puts it back; the 50 % rule waits while a record exists. Measured on demo-hp with a real seed (10
    Mbit/s to DooPlex's qBittorrent): refused `not-quiet` without the hold; with it the uplink fell to 0.02–0.16 Mbit/s,
    94.2 Mbit/s measured, the app held 56.8 s and back to 1 249 280 B/s exactly (`audits/dooplex-alarms-2026-10-24/`).
+   **[DESIGN — R-1261, 2026-10-25 night; controller `a79a292`, unreleased]:** EVERY running seeder is held (qBittorrent
+   and Transmission — one left seeding kept the test refused `not-quiet` every time); all records first
+   (`upwatch.line_test_holds`), then the apps; a record whose app was removed while held is dropped (it used to stop the
+   50 % rule for good); qBittorrent's hold names its slot (`up_limit` / `alt_up_limit` through `app/preferences` —
+   `transfer/uploadLimit` follows the CURRENT speed mode, measured on 5.2.4), so the household's switch to the
+   alternative speed during the test never leaves 1 KiB/s behind. **[FACT]** the night's rig (BYO VM, agent 0.165.0,
+   rc.1, two seeders to 9202's qBittorrent): with a mode switch mid-test both limits came back, the test refused
+   (the switch let qBittorrent upload); without, both held (qBittorrent in its alternative slot), 94.8 Mbit/s measured,
+   both limits back exactly (`audits/night-2026-10-25/rig/hold-watch*.txt`).
    While the box owns it, qBittorrent's page says: „A qBittorrent
    feltöltése legfeljebb N Mbit/s, hogy a családi internet gyors maradjon. A qBittorrentben átállíthatod."
 6. **Limits, stated:** *(added 2026-10-24, review round 2: ANY viewer explains any amount of upload, so a hacked app can send freely while one real playback runs — `upwatch/watch.go:275,299`; R-1262)*; an attacker who knows the check can make the app's API lie — a per-container ceiling (`tc` from

documentation/architecture/11-os-updates.md

@@ -79,7 +79,11 @@ boxes installed. Nobody keeps a hand-written list.
   **[DESIGN, operator ruling D43 = A, 2026-10-24 — committed agent `c8d3c17`, unreleased]** The host's root-key-only sshd
   drop-in (D4, R-982) is an APPLIANCE-only file of the config bundle: written only when the root-owned install record
   says `appliance`; on a `byo` record nothing is written and a copy the bundle wrote earlier (this path, our first line)
-  is removed; a box whose record proves nothing is left as it is (R-1257).
+  is removed; a box whose record proves nothing is left as it is (R-1257). **[FACT] 2026-10-25 (BYO test host, agent
+  0.164.0 → 0.165.0):** the removal came one bundle LATE — the bundle that brings the new wrapper is planned by the OLD
+  one (R-1285). **[DESIGN — R-1285, agent `abcc1e6`, unreleased]:** right after every bundle install the agent asks the
+  wrapper now on disk for a policy pass (`mode: "bundle-policy"`), which removes our appliance-only files from a BYO
+  record (no signature: it only removes a file we wrote; a failing `sshd -t` puts it back).
 - **The Proxmox MAJOR upgrade** (PVE 9 → 10). It is a later step of its own, drilled first (R-808 item 5).
 - **`cloudflared` and the other infrastructure images** (traefik, filebrowser). **[FACT] (C8)** They are containers in
   the guest, pinned in the controller (`internal/infra/infra.go:26`: `cloudflare/cloudflared:2026.6.0`, since

documentation/architecture/13-threat-model.md

@@ -84,7 +84,13 @@ directly; the only guard is that the header NAME is a per-box secret, which trae
 client request and sets only for a browser holding the dashboard's files pass
 (`felhom-controller/controller/internal/infra/filebrowser_sso.go:15-22`, `internal/web/files_sso.go`). The name file's
 creation race was fixed by review round 2 (controller `b01bb4b`). The pick: FileBrowser joins only the network traefik uses, so no app
-container reaches it directly. Not built yet.
+container reaches it directly. **Built 2026-10-25 night (controller `7ea942a`, unreleased):** a network of its own for
+the route, `felhom-files` — traefik is on it, the CHECKED FileBrowser joins it by id after R-1126's default-login check,
+and FileBrowser leaves traefik-public; OnlyOffice joins it while — and only while — its FileBrowser link is on (it
+fetches and saves documents at `http://filebrowser:80`), the one stated exception. **[FACT] measured on the night's rig:**
+before, from the qBittorrent and Transmission containers the forged header as the household user got the drive's
+listing (200); after, no answer (`000`); the household's „Fájlok ↗" walk still gets 200 through traefik
+(`audits/night-2026-10-25/rig/r1281-*.txt`).
 
 ## 6. What we accept (do not re-report)
 

documentation/architecture/15-media-library.md

@@ -169,8 +169,10 @@ download (R-1019). *(Fixed since: catalog `c50adfc` marks the download and watch
 `app-catalog-felhom.eu/templates/transmission/.felhom.yml:46-51`; noted 2026-10-24.)* **[DESIGN — the operator picked a code change 2026-10-25 (D44); row R-1283]:** the same commit also
 marks the download folders of NZBGet, SABnzbd and MeTube `excluded` (`templates/{nzbget,sabnzbd,metube}/.felhom.yml`).
 NZBGet and SABnzbd stay excluded (their files can be fetched again). The pick for MeTube: `optional`, so the
-second-drive copy carries it and the off-site copy does not — a MeTube video can be gone from its source site. Not
-built yet. **[DESIGN]** The per-drive media bind is declared `excluded` for every media app — the family's
+second-drive copy carries it and the off-site copy does not — a MeTube video can be gone from its source site.
+**Built in the DRILL catalog 2026-10-25 night (`app-catalog-drill` `6733764`, not live):** `class: optional`, and the
+download-binds gate allows `optional` only for an app named with its ruling (`OPTIONAL_BY_RULING`); mandatory and
+unlisted stay refused. The live push is the operator's (the Monday list). **[DESIGN]** The per-drive media bind is declared `excluded` for every media app — the family's
 media is no single app's data; whether the library gets its own household-level backup is a separate decision.
 
 ## 8. Removal and export assume one drive per app
@@ -275,7 +277,9 @@ returns** (G7f).
 **[DESIGN — the operator picked a code change 2026-10-25 (D44); row R-1282]:** the „Később"
 03:30 media restart is an IN-MEMORY timer — a controller restart forgets it and only the notice stays
 (`internal/web/media_events.go` `handleMediaRestart`, `time.AfterFunc`). The pick: the controller stores the due
-time and runs the restart after a restart of its own. Not built yet.
+time and runs the restart after a restart of its own. **Built 2026-10-25 night (controller `b5863a9`, unreleased):**
+`settings.media_restart_later_at`; at start `ResumeMediaLater` re-arms it, runs it at once when it passed while the
+controller was down, and clears it once it ran.
 
 **[DESIGN — confirmed by the operator 2026-10-25 (D44 = all picks, R-1265)]:** the Sonarr/Radarr API key is READ from
 `/config/config.xml`; the „set at install" option §6 calls cleaner was not built (`internal/mediawire/mediawire.go:336-345`).