night 2026-10-22: the seven 15:47 rulings in effect or ready (D6, D8 live; D21 waits for controller 0.340.0; D3/D5 website patch; D4 two patches); data-loss candidates proven/fixed/filed; R-1214 cause + capped copy proven on 9202; R-1204 alarm built; repos-private read; STATUS morning list + D29/D30/D31; CONTEXT; 03/05/07/09; rows 178 -> 180 (opened R-1218..R-1222, closed R-206, R-992, R-1207)

documentation/backlog/CLOSED-ITEMS.md

@@ -26,6 +26,14 @@
 
 ---
 
+## 2026-10-22 night — the seven decisions put into effect (full text of the rows: `git show 1100a344:documentation/backlog/OPEN-ITEMS.md`)
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-206** | **The build-cache cap and the weekly prune exist only as a hand-edited `/etc/docker/daemon.json` on DooPlex — not in Ansible, so a rebuild loses them.** (P4) | CLOSED 2026-10-22 night — D8 ruled (operator 15:47: DooPlex Docker settings from git plus a weekly build-cache prune) and installed: homelab-manifests `b35ba83`, role `docker_daemon` with a `docker-buildcache-prune` service + timer (Sun 23:30, `docker builder prune --force --filter until=168h`, never `-a`, with `docker system df` before and after). The live `daemon.json` was identical, so no Docker restart (dockerd up since 2026-08-05); timer next run 2026-10-25 23:30. Part (b) — loosening the housekeeping ban — was not needed: the prune lives in its own role and unit. | homelab-manifests `b35ba83` CHANGELOG |
+| **R-992** | **The drill-catalog route that `09` §6.5 documents cannot be followed: `admin/app-catalog-drill` is PRIVATE and no box has catalog credentials.** (P3) | CLOSED 2026-10-22 night — D6 ruled (operator 15:47: a read-only login for the scratch box's drill catalog). Gitea user `drill-reader` (not admin), read collaborator on `admin/app-catalog-drill`, token scope `read:repository`, kept in `sec`. Proven: the token reads the drill repo (200); write 403; push 403; the other private repos 404; 9202 cloned the drill catalog with it and returned to the live catalog with the credential kept. `09` §6.5 updated. | `audits/night-2026-10-22/P2-D6/01-token-limits.txt` |
+| **R-1207** | **A host with no (or too little) swap gets nothing from the guest swap fix (R-1192), and the agent never adds host swap.** (P2) | CLOSED 2026-10-22 night — DECIDED, D27 = report only (operator 15:47): the agent's WARN, the hub's `host_swap_short` (D28 = A) and the install-page sentence tell; the agent adds no swap and the installer refuses nobody. Reopens at the first BYO box with too little host swap. | `audits/night-2026-10-21/P2-noswap/` |
+
 ## 2026-10-22 day — the mail list and the swap rule (full text: R-1216 `git show 25dae2f5:documentation/backlog/OPEN-ITEMS.md`; R-1199's original row `git show 115f15c8:documentation/backlog/OPEN-ITEMS.md` — its reopened text of 2026-10-22 was never committed, and its substance is the Closed cell below)
 
 | Row | What | Closed | Evidence |

documentation/backlog/STATUS-HISTORY.md

@@ -7,6 +7,20 @@ Moved here byte for byte on 2026-10-14 (night session), newest first, so that `S
 
 ## Moved from STATUS on 2026-10-22
 
+**Updated 2026-10-22 (day).** A rebuilt box no longer overwrites the family's saved mail list (hub 0.165.0, controller 0.339.0); demo-felhom's own list, replaced this morning, is back. The swap warning now fires only when a machine has clearly too little swap (your D28 = A).
+
+**Decided 2026-10-22 15:47 — „all picks”** (the operator; each ruling is in its row, and in CONTEXT.md): D3 = change the wording now (R-985); D4 = root SSH from the LAN by key only, the console password stays (R-982); D5 = approve the minimum machine (R-991); D6 = a read-only login for the scratch box's drill catalog (R-992, closed); D8 = DooPlex Docker settings from git plus a weekly build-cache prune (R-206, closed); D21 = B (R-49); D27 = report only (R-1207, closed). The rows as they stood:
+
+| # | Row | Question | Pick (why) | The other option costs | If you do nothing | Blocked |
+|---|---|---|---|---|---|---|
+| D27 | R-1207 | A host with no swap gets nothing from the swap fix, and the agent never adds swap. Add host swap automatically (BYO too), or refuse an 8 GB host without swap at install? | **Report only for now** (our installer gives 7.75 GB, and Tester 2's laptop used our installer; the alarm and the install-page sentence now tell you) — decide after the first BYO box | Add it: the agent changes a disk its owner set up; refuse: a BYO household cannot start | a no-swap host can still freeze; you get the alarm | — |
+| D21 | R-49 | Immich's off-site copy: leave out only the AI model files now (B), or also the raw database folder and Immich's own backups (A)? | **B now** (−62 %, no new risk); A's other parts after their proof | A: −92 %, but it needs a restore path we have never run | every Immich box sends about 12 times its real data off-site each night | — |
+| D8 | R-206 | Install DooPlex's Docker settings from git (Docker restarts once), with a weekly build-cache prune? | **Yes, in a quiet window** (a rebuilt DooPlex then keeps the settings) | No: the live settings stay hand-made, and a rebuild loses them | git and the host can drift apart | — |
+| D6 | R-992 | The scratch box cannot read the private drill catalog: give it a read-only login, or make that copy public? | **A read-only login** (the drill catalog stays private) | Public copy: anyone can read the drill catalog | every new-app test needs staging by hand | new-app tests |
+| D5 | R-991 | Approve the minimum machine: x86-64, 4 cores, 8 GB RAM, 256 GB SSD (recommended: 16 GB, 512 GB)? | **Approve** (measured on the N100 with 61 apps) — the 8 GB freeze of 2026-10-20 is fixed by agent 0.162.0 (11 h soak on a fresh 8 GB box, no freeze) | Change it: one edit | no hardware page; a buyer with a Raspberry Pi can still download the installer | the hardware page |
+| D4 | R-982 | Stop root SSH with a password from the household network (key only)? | **Yes — key only** (the password stays for the console) | Keep it: anyone on the household network can try the password | the host keeps accepting root password logins from the LAN | — |
+| D3 | R-985 | Our „zero-knowledge" wording is stronger than the product: change the wording, or remove the operator's root reach to the key? | **Change the wording now**; look again after the first sale | Remove the reach: a design change to break-glass | the website promises more than the product does | the website text |
+
 **Updated 2026-10-22 (morning, your yeses).** Released: controller 0.338.0 (global floor), agent 0.162.0 (on the 3 test boxes), hub 0.164.0, installer 1.30.0 and the website download button. The new host-swap check warns on boxes bigger than 8 GB; that is too strict (decide D28).
 
 **Decided 2026-10-22 11:42 — D28 = A** (the operator): | D28 | R-1216 | The host-swap check warns when host swap is below the guests' whole swap. A 16 GB box with the installer's 8 GB swap trips it, but the soak used 2.7 GB. Loosen it to „below what the installer gives"? | **Loosen it (A)** (no mail for a healthy box; 938 MB still warns) | Keep (B): you get a mail per big box, and the install page tells such a household to call us | demo-hp and demo-felhom stay flagged; one mail each, already sent | — |