Register: my R-1033 renumbered to R-1036 (id collision with the http row)

Another session filed R-1033 (Security & access, P2, plain http on the public
names) in 6e0643f6 while this session was working; I minted mine against the
register as it stood before that, rebased onto it without re-checking, and the
push put two R-1033 rows in OPEN-ITEMS.md — register_shape_gate red on main.

Theirs landed first and keeps the number. The apps-page-lag row (Apps & catalog,
P3) is now R-1036, with the references in the website CHANGELOG, STATUS.md and
REPORT-seo-felho-tarhely-2026-10-14.md moved with it. Register and site gates
green again. This clone's pre-push hook is unarmed (core.hooksPath unset), which
is why nothing refused the push locally; said so in the report.

REPORT-seo-felho-tarhely-2026-10-14.md

@@ -47,7 +47,7 @@ now say the measured figure.
 |---|---|---|
 | How does the page show Felhom's cost? | Reuse what the site already says | Machine one-off, install one-off, power (measured), off-site storage monthly by volume, **operation optional**, no fee during the closed test. The reviewer's own option (a) would have read as a **mandatory** monthly fee and contradicted `index.html` („ha kéred, az üzemeltetést") and the FAQ („opcionális"). |
 | The English twin | Build it in the same commit | `/en/own-cloud-storage`, registered as a `TWINS` pair. |
-| The app count | 62 everywhere, file the lag | Four „60" spots corrected; `plant-it` and `wger` filed as **R-1033**. |
+| The app count | 62 everywhere, file the lag | Four „60" spots corrected; `plant-it` and `wger` filed as **R-1036**. |
 
 ### The „what do I keep if I stop paying?" check you asked for
 
@@ -163,10 +163,10 @@ golden.
 |---|---|
 | rows before | 151 |
 | rows after | **154** |
-| opened | 3 (R-1033, R-1034, R-1035) |
+| opened | 3 (R-1036, R-1034, R-1035) |
 | closed | 0 |
 
-- **R-1033** (Apps & catalog, P3) — the apps page lags the catalog by two apps (`plant-it`, `wger`;
+- **R-1036** (Apps & catalog, P3) — the apps page lags the catalog by two apps (`plant-it`, `wger`;
   assets already present, cards never written). The site now says 62, which is what it renders; the
   catalog holds 64.
 - **R-1034** (Process & tooling, P3) — **gate 17 scans two pages by a hard-coded list**, so the
@@ -176,6 +176,8 @@ golden.
 
 **DUE-CHECKS added:** `R-1035 | 2026-11-11` and `R-1035 | 2026-12-09`.
 
+**An id collision I caused and fixed, stated because it briefly broke `main`.** I minted my ids against the register as it stood when I started. While I was working, another session pushed its own **R-1033** (Security & access, P2 — boxes answering their public names over plain `http://`). I rebased onto that commit without re-checking the id, so the push that followed put **two R-1033 rows** in the register and turned `register_shape_gate` red on `main`. Caught on the read-back immediately after the push, not by the gate — **this clone's pre-push hook is unarmed** (`core.hooksPath` unset), so nothing stopped it locally. Theirs landed first and keeps the number; mine became **R-1036**, and commit `a2ca6eb4` was followed by the fix. **The lesson, which is not about this row:** an id minted before a rebase is a stale id, and the only safe moment to mint one is after the last fetch. CI would also have caught it, by mail, some minutes later.
+
 **Fixed without a row** (the size rule): the four stale „60" app counts; the FAQ's internal
 electricity contradiction; the three rendering defects in §4.
 

STATUS.md

@@ -12,7 +12,7 @@
 - A real power cut on demo-hp: it started by itself after all 8 cuts of the night (with the BIOS set), every app back in ~4 min; stale and recovered mails true and paired.
 - A page for people searching „felhő tárhely" is live (/sajat-felho-tarhely, /en/own-cloud-storage): what cloud storage is, what to do when Google or iCloud fills up, a five-year cost table with prices read 2026-10-14, and who should NOT buy this.
 - The machine estimator is public (/gepigeny, /en/sizing), with figures from two machines (N100 and HP t740; raised only, 2026-10-14).
-- 64 apps in the catalog, the Usenet and torrent clients included (the website lists 62 of them — R-1033). OS updates, the kernel lane too, run at night.
+- 64 apps in the catalog, the Usenet and torrent clients included (the website lists 62 of them — R-1036). OS updates, the kernel lane too, run at night.
 - The hub is closed again after the 2026-10-12 security review; one box cannot read another's data.
 
 ## What is broken

documentation/backlog/OPEN-ITEMS.md

@@ -140,7 +140,7 @@ stopping line that lies.
 | **R-1024** | Apps & catalog | P3 | **Links for the media apps: Sonarr and Radarr connected to the download apps and to a drive by the box.** Measured calls and answer shapes: `audits/media-all-drives-2026-10-14/``tools/wire.py` + `C-wire-run2.txt`. Facts the code needs: the API key can be SET at install (`SONARR__AUTH__APIKEY`/`RADARR__AUTH__APIKEY`, measured 200/401); qBittorrent needs automatic torrent management on, or a category's folder is ignored; a Transmission entry must clear the default category („Cannot use Category and Directory”); Transmission's one incomplete folder must be off; a show with no tag gets no download app when every entry is tagged; the OnlyOffice revoke-on-stop rule (`lifecycle.go:10-13`) must NOT apply (it would delete the download entries at every restart). | **OPEN** — filed 2026-10-14 | R-1023 | Build with R-1023 | CC |
 | **R-1028** | Apps & catalog | P3 | **Plex's claim code can run out during the install, and the box cannot recover it.** plex.tv's code lives 4 minutes from the moment the household copies it; the clock covers the wizard, the image pull (`plexinc/pms-docker` is 351 MB, measured) and the first start. Plex reads `PLEX_CLAIM` only on its first run, and the field is `locked_after_deploy` — so a late code leaves an unclaimed server and the only way back is remove + install again. Reported by the operator during the 2026-10-14 test; on Tester 1's line the pull+start took 8.5 s and the claim worked (`audits/media-all-drives-2026-10-14/``G-auth/G3-plex-claim.txt`), so it bites on a slow line or a slow hand. | **READY** — filed 2026-10-14 | — | Pull the image BEFORE asking for the code (or ask for it on a step after the pull), and give the household a „claim again” action that sets the code on the running server (Plex's `/myplex/claim?token=` call) | CC |
 | **R-1029** | Apps & catalog | P3 | **Plex's folder picker shows the drives as identical „media” folders.** With one bind per drive at the same path (`/mnt/felhom-drives/<drive>/userdata/media`), the leaf of every library folder is `media`; the drive's name sits two levels up, so in Plex's picker the household sees several folders all called „media” (reported by the operator during the 2026-10-14 test on Tester 1). It conflicts with `15` §2 reason 2 (the same path everywhere). | **READY** — filed 2026-10-14 | the layout decision (STATUS D9) | Decide in `15` §2: the players (`:ro`, never linked) may get a readable path per drive (e.g. `/media/<drive label>`) without breaking the hardlink rule, which binds only the download/library apps | CC |
-| **R-1033** | Apps & catalog | P3 | **The apps page lags the catalog by two apps.** `app-catalog-felhom.eu/templates/` holds **64** apps; `/alkalmazasok` and `/en/apps` render **63** cards, one of which (`filebrowser`) is built in and not a catalog template — so **62 catalog apps are listed**. Missing: **`plant-it`** and **`wger`**, both in the catalog since 2026-10-06/08. Their website assets are ALREADY present (`plant-it-logo.svg` + 3 screenshots, `wger-logo.png` + 3 screenshots, renamed to the catalog slug by `a3507761`, 2026-10-08) — only the cards were never written, so this is not a new-asset job. Found 2026-10-14 while reconciling the app count for the „felhő tárhely” page, where four places said **60** and the rest said **62**. **Done in that session:** every stated count on the site set to **62** (`index.html`, `szolgaltatasok.html`, `en/services.html` were 60), which is what the apps page actually shows — so no visitor can count the cards and find the number wrong. **62 is still not the catalog's number.** **To close:** write the two cards on both apps pages (gate 15 keeps the two pages' app sets equal, so they move together), then raise every stated count 62 → 64 in the same commit. **The operator chose this split at the 2026-10-14 STOP** over doing it inside the SEO change. | **OPEN** | — | write the `plant-it` + `wger` cards on both apps pages, then 62 → 64 everywhere, one commit | CC |
+| **R-1036** | Apps & catalog | P3 | **The apps page lags the catalog by two apps.** `app-catalog-felhom.eu/templates/` holds **64** apps; `/alkalmazasok` and `/en/apps` render **63** cards, one of which (`filebrowser`) is built in and not a catalog template — so **62 catalog apps are listed**. Missing: **`plant-it`** and **`wger`**, both in the catalog since 2026-10-06/08. Their website assets are ALREADY present (`plant-it-logo.svg` + 3 screenshots, `wger-logo.png` + 3 screenshots, renamed to the catalog slug by `a3507761`, 2026-10-08) — only the cards were never written, so this is not a new-asset job. Found 2026-10-14 while reconciling the app count for the „felhő tárhely” page, where four places said **60** and the rest said **62**. **Done in that session:** every stated count on the site set to **62** (`index.html`, `szolgaltatasok.html`, `en/services.html` were 60), which is what the apps page actually shows — so no visitor can count the cards and find the number wrong. **62 is still not the catalog's number.** **To close:** write the two cards on both apps pages (gate 15 keeps the two pages' app sets equal, so they move together), then raise every stated count 62 → 64 in the same commit. **The operator chose this split at the 2026-10-14 STOP** over doing it inside the SEO change. | **OPEN** | — | write the `plant-it` + `wger` cards on both apps pages, then 62 → 64 everywhere, one commit | CC |
 | **R-76** | Apps & catalog | P4 | **FileBrowser-created folders break the setgid chain, and a drop-zone's mode is not stable** **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-26, size S, roadmap state `idea (surfaced by the R-75 spike, 2026-07-26)`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** **2026-10-06 night: not a catalog fix** — the setgid chain is set by the controller's FileBrowser setup; a controller row. | — | Two related findings from `audits/SPIKE-catalog-data-paths-2026-07-26.md` P3/P5, both **pre-existing** and deliberately left alone by that spike. **(a)** FileBrowser Quantum 1.3.3 creates files `0644` and folders `0755` and does **not** propagate the setgid bit — even though the entrypoint wrapper's `umask 002` really is in effect (`/proc/1/status` `Umask: 0002`). Group inheritance itself works (a file uploaded into a 2775 group-100 dir landed group 100, not the process gid 1000), so the convention's *group* half holds and only its *mode* half is lost. The consequence is proven with a control: inside a UI-created `0755` folder a gid-1000 process's file landed group **1000**, while the identical write into the 2775 parent landed group **100**. So **any folder a customer creates through FileBrowser breaks the shared-group chain one level down.** Latent today — every userdata-touching catalog app that declares an identity declares uid/gid **1000**, the same uid FileBrowser runs as, so owner permissions mask it; it bites the day a content app runs as a different non-root uid with gid 1000. The comment at `infra/infra.go:156` is right that the image ignores `-e UMASK` but does not say t | CC |
 | **R-707** | Apps & catalog | P4 | **[P2] 37 apps still start with a login a stranger can take (`09` §3 decision 45).** Audit of all 53 apps: `app-catalog-felhom.eu/FIRST-ADMIN.md` (class, fix route, status, measured or read). Open: **3 hard-coded defaults** — calibre-web (`admin / admin123`, measured working on demo-hp and 9202; its own `cps.py -s` route needs a generated password WITH a special character — our generator is letters+digits, a controller change), mealie (`changeme@example.com / MyPassword`), wger (`admin / adminadmin`); **34 open first-run screens** (the first visitor creates the admin: actualbudget, adventurelog, audiobookshelf, calcom, docmost, emby, ghost, gitea, gramps-web, home-assistant, homebox, immich, jellyfin, komga, n8n, navidrome, opengist, outline, papra, plant-it, radarr, rallly, recipe-importer, romm, seerr, sonarr, sparkyfitness, tandoor, termix, uptime-kuma, vikunja, wanderer, wishlist, zipline). **Stale notes:** romm's `default_creds` `admin / admin` answers 401 on demo-hp (like a wrong password) — the page now warns with a login that does not exist; zipline's looks stale too. **Measured on demo-hp 2026-09-28 (read-only):** bookstack's default still logs in on the INSTALLED app (the fix is for new installs; the page now warns). Each fix: route (a) env or (b) the app's own CLI/API via `after_install:`, proven on 9202 with the default failing and the generated password working; route (c) a page sentence. Several sessions (operator, 2026-09-28). **2026-09-29 (controller v0.280.0, catalog `d0e7e2e`):** every class-3 app fixed — mealie, wger, calibre-web by `after_install` (calibre-web with the new `password:24:special`), proven on 9202 fresh installs (`audits/login-gate-2026-09-29/D/`); the setup gate (decision 46, spike PASSED) built and live on immich, n8n, audiobookshelf (probes measured) and uptime-kuma (button) (`…/C/`); romm's and zipline's stale notes removed. **Left: 30 class-4 apps** — gate each (probe measured on 9202 where one exists — 11 upstream candidates listed in `…/B/B-VERDICT.md` §3; the button otherwise). **2026-09-29 afternoon (controller v0.281.0, catalog `6faf432`):** 28 more class-4 apps gated — 32 of 34 — each proven on 9202 (`audits/gate-rollout-2026-09-29/`B): stranger → gate page / 401, household reached the first-setup screen, the gate opened (9 by a measured probe, the rest by the press), the app answered after. seerr, outline, rallly: gated, their opening needs a media server / e-mail (not proven). **Left:** wanderer (R-714); plant-it is not installable. | **NARROWED** (2026-10-03 triage: the row's verdict was finished, but it names open work no other row carries — seerr, outline and rallly are gated, but the gate OPENING is not proven (needs a media server / e-mail)) — **CLOSED — 2026-09-29 (the rest → R-714)** | — | — | CC |
 | **R-905** | Apps & catalog | P4 | **wger's collected style files (283 MB) go into every wger backup, though the app rebuilds them at every start.** Since R-762's fix (`DJANGO_DEBUG=False` + `collectstatic`, catalog `cf1ed43`) the static files sit in a named volume that the backup legs copy like data (measured 283 MB, `audits/design-build-2026-10-06/`); `collectstatic` regenerates them, so they are rebuildable bytes in every Tier-1 unit, Tier-2 copy and off-site snapshot. wger is `lifecycle: hidden` and no box runs it (hub read 2026-10-08). Options to weigh: a non-backed-up volume class for regenerable data, or an anonymous volume. Found by the R-762 helpers 2026-10-08. | **OPEN — needs a design before wger is shown** | — | Design the „regenerable volume" exclusion (catalog + controller backup legs) | CC |

website/CHANGELOG.md

@@ -1,4 +1,4 @@
-## 2026-10-14 — a new page for people who search „felhő tárhely” (R-1033, R-1034, R-1035)
+## 2026-10-14 — a new page for people who search „felhő tárhely” (R-1036, R-1034, R-1035)
 
 **Why:** Search Console (3 months, read by the operator 2026-10-14) showed 48 impressions, 1 click, average
 position 73.6; the top query was „felhő tárhely” (19). **No page on the site used the phrase** — it appeared 0
@@ -32,7 +32,7 @@ sources and the power provenance: `documentation/audits/seo-2026-10-14/BASELINE.
   Ft"; both now read the measured annual figure.
 - **App count:** `index.html`, `szolgaltatasok.html` and `en/services.html` said **60**, the rest said **62**.
   All now **62**, which is what the apps page actually renders. The catalog holds **64** — `plant-it` and `wger`
-  have website assets but no cards (**R-1033**).
+  have website assets but no cards (**R-1036**).
 - **Links in** (not in the sidebar menu): the home page's „Miért a sajátod?" comparison row, the backup page's
   off-site card, and the FAQ cost answer — each in both languages.
 - **Three defects found on the rendered page and fixed:**