Media folder fix: B-1 (classes, export, remove), B-2/B-3 bench evidence, Part A (who runs the apps); 09 §3 decisions 242-243 (D9 = A with a limit; the N100 waits); 15 §2 ruled

documentation/architecture/09-update-architecture.md

@@ -915,6 +915,18 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
      *Operator ruling 2026-10-05.* (R-861)
 
+### 2026-10-14 (evening, ~21:20) — the media folders and the N100 (recorded before the work; the media-folder-fix brief)
+
+242. **D9 = A, with a limit.** The media apps keep today's `media` folder — nothing on a drive moves. Sonarr and Radarr
+     see the drive's whole `media` folder (they must: download and library on ONE mount, or every import is a full
+     copy); **the download clients (qBittorrent, Transmission) see only their own download folder**, so they can never
+     write into the family's photos, music or books. Every app sees a file at the same path as on the box.
+     Not chosen: B — a separate video folder (a one-time move on every box with files). *Operator ruling 2026-10-14.*
+     (`15-media-library.md` §2; R-1014)
+243. **The N100 lived-in setup waits until the all-drives build has been tested on the Tester 1 rig.** Until then the
+     N100 stays Tier 0 and is not fenced (it may host a second test rig). This replaces decision 240's timing.
+     *Operator ruling 2026-10-14.*
+
 ### 2026-10-14 (afternoon) — media apps on every drive (recorded before the work; the media-all-drives brief)
 
 237. **Media apps see every drive.** Each media app (`15-media-library.md` §3) binds every enrolled drive's media

documentation/architecture/15-media-library.md

@@ -5,7 +5,7 @@
 > learn. **No document covered this before 2026-10-14** — itself a finding: the four templates were written one by one
 > and never tested together (R-1014). Rulings: `09` §3 decisions 237–241. Measured on Tester 1:
 > `audits/media-all-drives-2026-10-14/`. Marks as in `01`: **[DESIGN]** a decision or proposal; **[FACT]** read in a
-> named file or measured. **Status: DRAFT** — measured end to end on Tester 1; the operator's layout decision (§2, STATUS D9) is open.
+> named file or measured. **Status: DRAFT** — measured end to end on Tester 1; the layout of §2 is RULED (decision 242) and live for one drive.
 
 ## 1. The problem
 
@@ -41,16 +41,23 @@ The four reasons:
 **[FACT, and a correction of the brief]** `media/` is not photo-free: the skeleton puts `photos`, `books`,
 `audiobooks`, `music`, `comics`, `podcasts` there too (`appbackup/userdata.go` + the catalog-derived set), and Immich,
 calibre-web, audiobookshelf and navidrome use them. With reason 1, a download app needs ONE mount that holds both its
-download folder and the libraries — so binding `media/tv` and `media/torrents` separately brings EXDEV back. **Open
+download folder and the libraries — so binding `media/tv` and `media/torrents` separately brings EXDEV back.
-question for the operator (two options):**
 
-- **A — bind `media/` whole, rw for the download apps.** Simple; measured working. Cost: qBittorrent, Transmission,
+**RULED 2026-10-14 (`09` §3 decision 242, D9 = A with a limit) — this table replaces every earlier shape:**
-  Sonarr and Radarr can write into the family's photos and music folders.
+
-- **B — move the video library into its own folder** (e.g. `userdata/video/{tv,movies,torrents,transmission}`) and bind
+| App | Bind (rw unless noted), the SAME path inside the container as on the box | Sees |
-  only that. Download apps never see photos. Cost: a one-time move on boxes that already have files there, and every
+|---|---|---|
-  template and skeleton entry changes.
+| Sonarr, Radarr | `${USERDATA_PATH}/media` | the whole `media` folder — it must: download and library on ONE mount (S1) |
-- **CC recommends B** for the build: the download apps are the internet-facing ones, and „the box cannot touch your
+| qBittorrent | `${USERDATA_PATH}/media/torrents` (+ the same folder as `/downloads`, for torrents added before 2026-10-14) | only its download folder |
-  photos" is a promise worth one move. A is fine for the Tester 1 rig.
+| Transmission | `${USERDATA_PATH}/media/transmission` (+ `/downloads` likewise; `/watch` = `media/transmission/watch`) | only its download folder |
+| Plex, Jellyfin, Emby | unchanged: `${USERDATA_PATH}/media:/media:ro` | they move with the all-drives build |
+
+The hardlink is made by Sonarr/Radarr in their own container, where both folders are one mount; the client reports
+`…/media/torrents/<name>` and Sonarr finds exactly that path. The download clients cannot reach `media/photos` (B-3,
+measured: the path does not exist in their containers). Sonarr/Radarr's bind is declared `excluded` in their backup
+block — unlisted it would be MANDATORY, every tier, off-site included (B-1, measured with the production classifier).
+Built in the live catalog 2026-10-14 (`audits/media-folder-fix-2026-10-14/`); the all-drives build adds one such bind
+per drive at the same paths, so nothing installed now is redone.
 
 ## 3. Which apps are „media apps" [DESIGN, proposal]
 

documentation/audits/media-folder-fix-2026-10-14/B-volume-persistence.txt

@@ -0,0 +1,14 @@
+self-testing the prober (both directions)…
+  prober flags the R-156 signature and clears a correct template — trustworthy
+jellyfin             CLEAN         
+plex                 UNDETERMINED  plex: declared volume /transcode is EMPTY after the exercise — the app was not shown to write where the template preserves it
+qbittorrent          CLEAN         qbittorrent: writable-layer writes at /srv/felhom-gate/hdd/userdata/media (path suggests state, no database signature — judgement needed): ['torrents'
+radarr               CLEAN         
+sonarr               CLEAN         
+transmission         CLEAN         transmission: bind /watch is EMPTY after the exercise — not judged (a household folder may be empty on a fresh install); if this app keeps STATE there
+
+UNDETERMINED — NOT a pass. The question was not answered for these:
+  plex: plex: declared volume /transcode is EMPTY after the exercise — the app was not shown to write where the template preserves it
+
+5 clean · 0 broken · 1 undetermined (of 6 in scope)
+INCOMPLETE — no broken template among those decided, but 1 were never decided. This is not a clean bill of health.

documentation/audits/media-folder-fix-2026-10-14/B1-classes-export-remove.txt

@@ -0,0 +1,98 @@
+# B-1 — the production code (felhom-controller main 9b95e8e) over the templates; namespace root = one enrolled drive
+## TODAY (live catalog main 8f5ad8a)
+== <live>/sonarr  backup-block=true hasClassification=true
+   bind userdata/media/tv ro=false class="excluded" origin=explicit
+   bind userdata/downloads ro=false class="excluded" origin=explicit
+   tier secondary captures: []
+   tier offsite   captures: []
+   export: mandatory=[] optional(default in)=[] excluded(default out)=[downloads media/tv]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <live>/sonarr/docker-compose.yml
+   export mounts (ExportDataMounts): [/mnt/felhom-drives/hdd_1/userdata]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <live>/sonarr/docker-compose.yml
+   removal with „delete data” deletes (ParseComposeHDDMounts): []
+   userdata folders the removal names as kept: [/mnt/felhom-drives/hdd_1/userdata/media/tv /mnt/felhom-drives/hdd_1/userdata/downloads]
+== <live>/radarr  backup-block=true hasClassification=true
+   bind userdata/media/movies ro=false class="excluded" origin=explicit
+   bind userdata/downloads ro=false class="excluded" origin=explicit
+   tier secondary captures: []
+   tier offsite   captures: []
+   export: mandatory=[] optional(default in)=[] excluded(default out)=[downloads media/movies]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <live>/radarr/docker-compose.yml
+   export mounts (ExportDataMounts): [/mnt/felhom-drives/hdd_1/userdata]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <live>/radarr/docker-compose.yml
+   removal with „delete data” deletes (ParseComposeHDDMounts): []
+   userdata folders the removal names as kept: [/mnt/felhom-drives/hdd_1/userdata/media/movies /mnt/felhom-drives/hdd_1/userdata/downloads]
+== <live>/qbittorrent  backup-block=true hasClassification=true
+   bind userdata/media/torrents ro=false class="optional" origin=explicit
+   tier secondary captures: [media/torrents(optional)]
+   tier offsite   captures: []
+   export: mandatory=[] optional(default in)=[media/torrents] excluded(default out)=[]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <live>/qbittorrent/docker-compose.yml
+   export mounts (ExportDataMounts): [/mnt/felhom-drives/hdd_1/userdata]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <live>/qbittorrent/docker-compose.yml
+   removal with „delete data” deletes (ParseComposeHDDMounts): []
+   userdata folders the removal names as kept: [/mnt/felhom-drives/hdd_1/userdata/media/torrents]
+== <live>/transmission  backup-block=true hasClassification=true
+   bind userdata/media/transmission ro=false class="optional" origin=explicit
+   bind userdata/media/transmission/watch ro=false class="mandatory" origin=default_writable
+   tier secondary captures: [media/transmission(optional)]
+   tier offsite   captures: [media/transmission/watch(mandatory)]
+   export: mandatory=[media/transmission/watch] optional(default in)=[media/transmission] excluded(default out)=[]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <live>/transmission/docker-compose.yml
+   export mounts (ExportDataMounts): [/mnt/felhom-drives/hdd_1/userdata]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <live>/transmission/docker-compose.yml
+   removal with „delete data” deletes (ParseComposeHDDMounts): []
+   userdata folders the removal names as kept: [/mnt/felhom-drives/hdd_1/userdata/media/transmission /mnt/felhom-drives/hdd_1/userdata/media/transmission/watch]
+
+## CANDIDATE (the §2 shape)
+== <candidate>/sonarr  backup-block=true hasClassification=true
+   bind userdata/media ro=false class="excluded" origin=explicit
+   tier secondary captures: []
+   tier offsite   captures: []
+   export: mandatory=[] optional(default in)=[] excluded(default out)=[media]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <candidate>/sonarr/docker-compose.yml
+   export mounts (ExportDataMounts): [/mnt/felhom-drives/hdd_1/userdata]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <candidate>/sonarr/docker-compose.yml
+   removal with „delete data” deletes (ParseComposeHDDMounts): []
+   userdata folders the removal names as kept: [/mnt/felhom-drives/hdd_1/userdata/media]
+== <candidate>/radarr  backup-block=true hasClassification=true
+   bind userdata/media ro=false class="excluded" origin=explicit
+   tier secondary captures: []
+   tier offsite   captures: []
+   export: mandatory=[] optional(default in)=[] excluded(default out)=[media]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <candidate>/radarr/docker-compose.yml
+   export mounts (ExportDataMounts): [/mnt/felhom-drives/hdd_1/userdata]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <candidate>/radarr/docker-compose.yml
+   removal with „delete data” deletes (ParseComposeHDDMounts): []
+   userdata folders the removal names as kept: [/mnt/felhom-drives/hdd_1/userdata/media]
+== <candidate>/qbittorrent  backup-block=true hasClassification=true
+   bind userdata/media/torrents ro=false class="optional" origin=explicit
+   tier secondary captures: [media/torrents(optional)]
+   tier offsite   captures: []
+   export: mandatory=[] optional(default in)=[media/torrents] excluded(default out)=[]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <candidate>/qbittorrent/docker-compose.yml
+   export mounts (ExportDataMounts): [/mnt/felhom-drives/hdd_1/userdata]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <candidate>/qbittorrent/docker-compose.yml
+   removal with „delete data” deletes (ParseComposeHDDMounts): []
+   userdata folders the removal names as kept: [/mnt/felhom-drives/hdd_1/userdata/media/torrents]
+== <candidate>/transmission  backup-block=true hasClassification=true
+   bind userdata/media/transmission ro=false class="optional" origin=explicit
+   bind userdata/media/transmission/watch ro=false class="optional" origin=explicit
+   tier secondary captures: [media/transmission(optional)]
+   tier offsite   captures: []
+   export: mandatory=[] optional(default in)=[media/transmission media/transmission/watch] excluded(default out)=[]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <candidate>/transmission/docker-compose.yml
+   export mounts (ExportDataMounts): [/mnt/felhom-drives/hdd_1/userdata]
+2026/10/14 21:15:15 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for <candidate>/transmission/docker-compose.yml
+   removal with „delete data” deletes (ParseComposeHDDMounts): []
+   userdata folders the removal names as kept: [/mnt/felhom-drives/hdd_1/userdata/media/transmission /mnt/felhom-drives/hdd_1/userdata/media/transmission/watch]
+
+## CONTROL (decoy): the candidate Sonarr bind with its backup entry REMOVED (a backup block that does not list it)
+== <decoy>/sonarr-unlisted  backup-block=true hasClassification=true
+   bind userdata/media ro=false class="mandatory" origin=default_writable
+   tier secondary captures: [media(mandatory)]
+   tier offsite   captures: [media(mandatory)]
+   export: mandatory=[media] optional(default in)=[] excluded(default out)=[]
+   export mounts (ExportDataMounts): [/mnt/felhom-drives/hdd_1/userdata]
+   removal with „delete data” deletes (ParseComposeHDDMounts): []
+   userdata folders the removal names as kept: [/mnt/felhom-drives/hdd_1/userdata/media]

documentation/audits/media-folder-fix-2026-10-14/B2-B3-qbittorrent.txt

@@ -0,0 +1,27 @@
+== 1. install from TODAY's template
+  container: healthy /srv/b2/userdata/media/torrents->/downloads /var/lib/docker/volumes/b2qbt_qbittorrent_config/_data->/config 
+   default save path: /downloads
+{"added_torrent_ids":["a5801fa9a8beb3f047303e352844db8898570758"],"failure_count":0,"pending_count":0,"success_count":1}
+   torrent b2-old state= stalledUP progress= 1 save_path= /downloads
+== 2. update to the NEW template (same volume)
+  container: healthy /srv/b2/userdata/media/torrents->/srv/b2/userdata/media/torrents /srv/b2/userdata/media/torrents->/downloads /var/lib/docker/volumes/b2qbt_qbittorrent_config/_data->/config 
+   entrypoint said: [felhom] default save path moved from /downloads to /srv/b2/userdata/media/torrents 
+   default save path now: /srv/b2/userdata/media/torrents | temp: /srv/b2/userdata/media/torrents/.temp
+   the OLD torrent after the update:
+   torrent b2-old state= stalledUP progress= 1 save_path= /downloads
+{"added_torrent_ids":["496bc2c1261736321d710aeca0e4c7c88a8bf946"],"failure_count":0,"pending_count":0,"success_count":1}
+   a NEW torrent (no save path given):
+   torrent b2-new state= stalledUP progress= 1 save_path= /srv/b2/userdata/media/torrents
+== 3. B-3 from inside the container
+   ls of the media folder path:
+     torrents
+   ls of the photos folder:
+     ls: /srv/b2/userdata/media/photos: No such file or directory
+   write into the photos path:
+     rc=0
+   on the BOX, the photos folder after that: family.jpg 
+   and the container's own copy of that path is on: overlay
+== 4. a FRESH install of the new template
+  container: healthy /srv/b2/userdata/media/torrents->/srv/b2/userdata/media/torrents /srv/b2/userdata/media/torrents->/downloads /var/lib/docker/volumes/b2qbt_qbittorrent_config/_data->/config 
+   default save path: /srv/b2/userdata/media/torrents | temp: /srv/b2/userdata/media/torrents/.temp
+== cleaned up: 0 container(s), 0 volume(s)

documentation/audits/media-folder-fix-2026-10-14/B2-B3-transmission.txt

@@ -0,0 +1,24 @@
+== 1. install from TODAY's template
+  container: healthy /var/lib/docker/volumes/b2tr_transmission_config/_data->/config /srv/b2t/userdata/media/transmission->/downloads /srv/b2t/userdata/media/transmission/watch->/watch 
+   session: {'download-dir': '/downloads/complete', 'incomplete-dir': '/downloads/incomplete'}
+{"arguments":{"torrent-added":{"hashString":"01268661fcc63db754b6f6fcafb0b49c182b8a42","id":1,"name":"b2-old"}},"result":"success"}
+   torrent b2-old status= seeding done= 1.0 dir= /downloads/complete error= ''
+== 2. update to the NEW template (same volume)
+  container: healthy /srv/b2t/userdata/media/transmission->/srv/b2t/userdata/media/transmission /srv/b2t/userdata/media/transmission->/downloads /srv/b2t/userdata/media/transmission/watch->/watch /var/lib/docker/volumes/b2tr_transmission_config/_data->/config 
+   session: {'download-dir': '/srv/b2t/userdata/media/transmission/complete', 'incomplete-dir': '/srv/b2t/userdata/media/transmission/incomplete'}
+   the OLD torrent after the update:
+   torrent b2-old status= seeding done= 1.0 dir= /downloads/complete error= ''
+{"arguments":{"torrent-added":{"hashString":"b4dbeccdc89f6297bceaac75a89d07ad13e7f553","id":2,"name":"b2-new"}},"result":"success"}
+   a NEW torrent (no folder given):
+   torrent b2-new status= seeding done= 1.0 dir= /srv/b2t/userdata/media/transmission/complete error= ''
+== 3. B-3 from inside the container
+   ls of the media folder path:
+     transmission
+   ls of the photos folder:
+     ls: cannot access '/srv/b2t/userdata/media/photos': No such file or directory
+   write into the photos path: rc=0 on overlay
+   on the BOX, the photos folder after that: family.jpg 
+== 4. a FRESH install of the new template
+  container: healthy /srv/b2t/userdata/media/transmission->/srv/b2t/userdata/media/transmission /var/lib/docker/volumes/b2tr_transmission_config/_data->/config /srv/b2t/userdata/media/transmission->/downloads /srv/b2t/userdata/media/transmission/watch->/watch 
+   session: {'download-dir': '/srv/b2t/userdata/media/transmission/complete', 'incomplete-dir': '/srv/b2t/userdata/media/transmission/incomplete'}
+== cleaned up: 0 container(s), 0 volume(s)

documentation/audits/media-folder-fix-2026-10-14/B2-sonarr-radarr.txt

@@ -0,0 +1,19 @@
+== sonarr (fresh, new template): healthy /srv/b2sonarr/userdata/media->/srv/b2sonarr/userdata/media /var/lib/docker/volumes/b2sonarr_sonarr_config/_data->/config 
+   log: [felhom] first start - AuthenticationRequired=Enabled seeded
+   config.xml: <AuthenticationRequired>Enabled <AuthenticationMethod>None  ApiKey present: 1
+   what the first-admin form reads (GET /api/v3/config/host): authenticationRequired= enabled authenticationMethod= none
+   /initialize.json from another container, no sign-in: 200, apiKey in it: 1
+   hardlink inside the one mount:
+     /srv/b2sonarr/userdata/media/torrents/f.mkv links=2 inode=2228262
+     /srv/b2sonarr/userdata/media/tv/f.mkv links=2 inode=2228262
+   existing install restarted: seeded again? 0 line(s) (1 = only the first start); AuthenticationRequired now: DisabledForLocalAddresses
+== radarr (fresh, new template): healthy /srv/b2radarr/userdata/media->/srv/b2radarr/userdata/media /var/lib/docker/volumes/b2radarr_radarr_config/_data->/config 
+   log: [felhom] first start - AuthenticationRequired=Enabled seeded
+   config.xml: <AuthenticationRequired>Enabled <AuthenticationMethod>None  ApiKey present: 1
+   what the first-admin form reads (GET /api/v3/config/host): authenticationRequired= enabled authenticationMethod= none
+   /initialize.json from another container, no sign-in: 200, apiKey in it: 1
+   hardlink inside the one mount:
+     /srv/b2radarr/userdata/media/torrents/f.mkv links=2 inode=2228262
+     /srv/b2radarr/userdata/media/movies/f.mkv links=2 inode=2228262
+   existing install restarted: seeded again? 0 line(s) (1 = only the first start); AuthenticationRequired now: DisabledForLocalAddresses
+== cleaned up: 0 container(s)