rehearsal 2026-10-20: B10 ten stuck points; capability map A15 updated (still PARTIAL: R-1192); clock tool for #7/#8/#10

documentation/audits/rehearsal-2026-10-20/A6-plan/order.md

@@ -50,7 +50,7 @@ the filler goes to a share with Felhőmentés OFF and is deleted before the nigh
 #10 three days off (+#15 inside it), #1 power cut mid install, #14 kept data, #11 if an update exists (none expected —
 the catalog is frozen). Reason: the clock scenarios move the box's time and would spoil the first night's record.
 
-## Amendment 2026-10-20 20:40 UTC — before any post-night scenario ran
+## Amendment 2026-10-20 20:27 UTC — before any post-night scenario ran
 
 - **#1 and #14 ran before the night** (20:00–20:14), not after it: they do not move the clock, so they could not spoil
   the night's record, and the morning is short. Their results are in `B6-failures/s1-…` and `s14-…`. The drawn order of

documentation/audits/rehearsal-2026-10-20/B10-stuck/README.md

@@ -0,0 +1,21 @@
+# B10 — the ten places a household gets stuck (rehearsal 2026-10-20)
+
+Ranked by what it costs a real family: lost data or a dead box first, then lost time, then confusion.
+Each point names what the family SAW, what it would do next, and the record (register row or B9 word).
+
+| # | where | what the family saw | what a family would do | cost on the day | record |
+|---|---|---|---|---|---|
+| 1 | first afternoon, normal use | the dashboard and every app stopped answering, twice, ~1 h and ~35 min; a relapse after each return | wait, then pull the plug (the only thing that brought it back) | ~2 h of a dead box; two hard power cuts | R-1192 (P1) |
+| 2 | bind page | a „tulajdonosi jelmondat" (owner passphrase) they do not have; two wrong tries of five used | phone Felhom; wait | 2 h 4 min waiting for the operator (09:57 → 12:01) | intervention 1; W4 |
+| 3 | a power cut during a full off-site restore | the app runs again, on the BACKUP's older data, while the page says only „megszakadt — indítsd el újra" | believe the app is fine, or start the restore again over newer data | newer data gone, unnoticed | R-1195 (P2) |
+| 4 | drive pulled during uploads | each upload was confirmed; after the drive came back the last files were 0 bytes or missing; nothing said so | find out weeks later | silent loss of the last seconds of uploads | R-1196 (P3) |
+| 5 | mail | the family's notification page shows disk-warning, drive-disconnected and backup-failed mails ON; on the day the family received one alarm mail in all; the operator received the rest | not know anything is wrong | every warning of the day missed | R-1199 (P2), R-1193 |
+| 6 | family card | „Ödön" and „Írisz" refused: „A név 1–32 karakter: kisbetű, szám, pont…" | guess „odon"; some will give up | minutes; a bad first impression | W12 |
+| 7 | new drive (storage init) | a required „Csatlakoztatási név * /mnt/…" field, empty; the button silently did nothing | press again; give up | the 200 GB disk unused until someone helps | W13 |
+| 8 | sharing („Megosztás") | „A megosztási szolgáltatás előkészítése folyamatban…" for ever — it waits for a share password the page never asks for | wait; ask for help | no shared folder until found | W21 |
+| 9 | errors in English | a failed restore, a failed off-site run, a failed install all show raw technical English („offbox backup immich: exit status 1…", „starting stack rallly: exit code 1…") | cannot tell what broke or what to do | a call to support each time | W22, W25, s1/s6/s5 READMEs |
+| 10 | wrong „Első lépések" | Mealie's steps name the wrong address (mealie.… while the app is at recipes.…); Paperless says log in as „admin" while the family chose its own name; Vaultwarden says sign-up is closed while the family opened it | follow the steps, fail, think the app is broken | minutes per app; trust lost | W17–W19 |
+
+Close behind (not in the ten): the download link that does not look like a link (W2); the second disk never offered as
+the backup place (R-1198); Jellyfin refused for memory with no help choosing what to remove (W20); the recovery-code
+page full of operator words (W10); Actual Budget wholly in English (W23).

documentation/audits/rehearsal-2026-10-20/tools/clockctl.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# clockctl.sh — B6 #7/#8/#10: move the rehearsal VM's clock from OUTSIDE (rehearsal 2026-10-20).
+# The VM's own clock only; demo-hp's clock is never touched. Runs from DooPlex, acts on demo-hp.
+#   clockctl.sh ntp-off            drop NTP (UDP 123) and NTS-KE (TCP 4460) leaving the VM's tap (positive control: counters)
+#   clockctl.sh ntp-on             remove that table
+#   clockctl.sh counters           show the drop counters
+#   clockctl.sh boot <UTC-ISO>     clean shutdown, set the VM's RTC start date (UTC), start
+#   clockctl.sh boot-real          clean shutdown, remove the start date, start
+#   clockctl.sh stop               clean shutdown only (box „off")
+#   clockctl.sh boxtime            the box's own clock, read from its HTTP Date header (a different channel than the RTC setting)
+set -euo pipefail
+VM=${VM:-9320}; TAP=tap${VM}i0; TBL=rh1020ntp; IP=${BOX_IP:-192.168.0.133}; HOSTH=${BOX_HOST:-felhom.tester4.test}
+down() {
+  ssh demo-hp "LC_ALL=C qm shutdown $VM --timeout 300 || LC_ALL=C qm stop $VM"
+  echo "down $(date -u +%T)"
+}
+case "$1" in
+  ntp-off)
+    ssh demo-hp "nft add table bridge $TBL && nft add chain bridge $TBL c1 '{ type filter hook forward priority 0; }' && \
+      nft add rule bridge $TBL c1 iifname $TAP udp dport 123 counter drop && \
+      nft add rule bridge $TBL c1 iifname $TAP tcp dport 4460 counter drop && nft list table bridge $TBL"; echo "ntp off $(date -u +%T)";;
+  ntp-on) ssh demo-hp "nft delete table bridge $TBL"; echo "ntp on $(date -u +%T)";;
+  counters) ssh demo-hp "nft list table bridge $TBL | grep counter";;
+  boot) down; ssh demo-hp "LC_ALL=C qm set $VM --startdate $2 && LC_ALL=C qm start $VM"; echo "started with RTC $2 at real $(date -u +%T)";;
+  boot-real) down; ssh demo-hp "LC_ALL=C qm set $VM --delete startdate && LC_ALL=C qm start $VM"; echo "started with real RTC at $(date -u +%T)";;
+  stop) down;;
+  boxtime) echo "real $(date -u +%FT%TZ) box $(curl -sk -m 10 -D - -o /dev/null -H "Host: $HOSTH" https://$IP/api/health | tr -d '\r' | sed -n 's/^[Dd]ate: //p')";;
+  *) echo "usage: $0 ntp-off|ntp-on|counters|boot <UTC-ISO>|boot-real|stop|boxtime" >&2; exit 1;;
+esac