STATUS, report, register (R-691 closed live, R-704..R-706), Part E + D2 evidence

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -1,42 +1,30 @@
 # STATUS — what works, what's broken, what's next
 
-**Updated 2026-09-27 evening. Both demo boxes run controller 0.276.0 and host agent 0.137.0. Hub 0.125.0.**
+**Updated 2026-09-28 afternoon. Both demo boxes run controller 0.278.0 and host agent 0.137.0. Hub 0.125.0. New installs get golden 0.276.0 with agent 0.137.0.**
 
 **Decisions I took on my own** (you may reverse each):
-1. **paperless-ngx goes to PostgreSQL 18, tandoor to 17.** Each follows what its own makers ship. paperless's makers use 18. tandoor's use 16, and 17 is the newest its framework supports.
-2. **The file browser reads nextcloud's kept folder by joining its group.** Nothing on your disk changes. The folder stays read-only in the view.
+1. **claper goes to PostgreSQL 17, calcom to 18.** Each follows what its own makers run: claper's makers use 15, so 17 (no disk-layout change); calcom's makers use 18.
+2. **calcom gets 1536 MB of memory instead of 768 MB.** At 768 MB it was killed at every start, so it could never run. At 1536 MB its own use peaked at about half.
 
 **What I did, and it worked.**
-- **A backup now always says truthfully which version its data belongs to.** Before, the label changed to "new version" minutes after an update, while the data inside stayed old. A restore in that window broke docmost: its database would not start. Now the backup keeps the old version's settings next to the old data. I tested it on the scratch box: docmost came back whole at the old version, and the normal update brought it forward again.
-- **The box tested this by itself in the night.** It updated docmost's database at 02:15. Two minutes later the backup kept the matching old settings. The restore the next morning worked.
-- **Two more apps move to a new database version: paperless-ngx and tandoor.** Each was tested twice: on a throwaway test machine and on the scratch box through the normal update. Every account came back.
-- **adventurelog moves to its new version.** It keeps its world-map download. If that file was cut off, the box sets it aside and downloads it again. Tested both ways.
-- **The HP box's restore test now tests real backups of guests that exist**, not the golden template file and not an old backup of a deleted guest (two more small agent releases, each found when I checked the box).
-- **Small fixes:** the file browser no longer re-creates an empty kept folder; the "Kept data" name follows the box's language; after a load, the app page no longer shows a password that does not work.
-
-**Evening follow-up (controller 0.276.0).**
-- **Fixed: moving an app to another drive made the box forget which version the app must run.** The app then took the newest version at its next start, and skipped the tested steps. Found by reading the code, not on a box. Tested in code only: no test box has two drives.
-- **Fixed: after a restore, the box forgot the old database copy, so it stayed on disk forever.** A restore now keeps that note, and also keeps whether you had the app switched on.
-- **Seen in the night: the scratch box deleted paperless's old database copy by itself**, after a backup made by the new database version. This is correct.
-- **Found in the night: the HP box's full-guest restore test can never run.** It now picks the right backup, but the disk has 21 GiB free and the test needs 31 GiB. It refuses safely every 6 hours. Filed, with three options; nothing decided.
-- **Not built: "Use my kept data" from the off-site copy.** It would be a new way to put data back, and no test box has an off-site copy to prove it on.
+- **The weekly golden is built and vouched** (0.276.0, with host agent 0.137.0). A test install in the throwaway machine came up on it with the right versions. The test customer is removed from the hub.
+- **"Use my kept data" can now load the database from the off-site copy.** Proven on the HP box: the page named "the off-site copy, 2026-09-28 15:40", the app came back with its account and its files.
+- **The first real restore from the off-site copy worked.** Account back, a later change gone (as it must be), same version.
+- **Two more apps can move to a new database version: claper and calcom.** Each passed the throwaway test machine and the scratch box.
+- **One more fix (controller 0.278.0): a "stopped" mark from an app's earlier install no longer sticks to a new install.** On the HP box such a mark from 13 September made the backup skip a freshly installed app. That app had no real backup at all. This is my second controller release today; the rules say one. It blocked the off-site proof, and nothing in the product could clear the mark.
+- **The HP box's night:** the database step ran, paperless moved to PostgreSQL 18 by itself (all rows equal), then the full-system backup ran. Nothing had to wait for anything.
 
 **What broke, or is not done.**
-- **Found and fixed today: an app installed minutes ago could be updated with no backup of its database.** The update trusted a backup that held only the app's settings. Now it backs up first.
-- **"Use my kept data" still cannot load from the off-site copy.** Filed.
-- **The file-browser group fix is tested in code only.** No nextcloud kept folder existed on the scratch box.
-- **A backup stores the name of each app version, not the app itself.** If a maker deletes an old version, a restore of it cannot start. Today all 42 versions the catalog names still exist. Filed with options; nothing decided.
+- **claper creates an admin account with the public password "claper" on every install.** Anyone who knows that could log in. No box runs claper now. I did not change it; you choose the fix (below).
+- **The HP box's full-system restore test still cannot run.** Freeing space gave 26.6 GB; it needs 31 GB. It refuses safely, and the hub sees each refusal.
+- **The demo-felhom box's off-site step of last night is not readable** (today's upgrades erased the logs). Not a fault seen; just not read.
+- **Small gaps filed:** removing an app with its backups leaves its 1 GB off-site check copy; there is no button to run the whole night now.
 
-**Rows.** 3 opened, 6 closed. The list went from 339 to 336. Evening and night: 2 opened, 1 closed; now 337.
-
-**Decision for you — D4: when the only backup holds data of an older app version, what does a restore bring back?**
-- **A — the older version with its own data; then the normal update climbs, one tested step at a time (I recommend this, and it is built).** Cost: after the restore the app runs an older version for a night or until someone presses Update. The page says so.
-- **B — restore into a temporary copy, update it there, then move the data in.** Cost: a new mechanism on customer data, and double the disk space during the restore. Same end state as A.
-- **If you do nothing:** A stays in force. Nobody is blocked.
+**Rows.** 5 opened, 2 closed. The list went from 337 to 342 rows.
 
 **What needs you.**
-1. **D4** above.
-2. **The weekly golden bake is due** (last one a week ago, 21 controller releases behind). The brief said no golden, so I renewed the waiver for 7 days only (to 4 October). If you do nothing, the checks go red again on 4 October and nothing can be pushed to felhom.eu until a bake or a new waiver.
-3. **Vouch agent 0.137.0** for new installs (hub → Configs → Day-0 artifacts). If you do nothing, new boxes install 0.134.0 and get the newer one only by a signed update.
-4. **The image-copy question** (a maker deletes an old version): keep as is, or copy installed versions into our registry. If you do nothing, nothing changes.
-5. **From before:** Peti's box in the Claude project text; Cloudflare leftovers of Peti's domain; the old Storage Box `PBS-storage-1`. If you do nothing, they stay as they are.
+1. **The claper admin password:** (A) remove claper from the catalog until it is fixed (I recommend this), or (B) have the box change that password after install. If you do nothing, a new claper install keeps the public password.
+2. **The HP box's restore test:** (A) let the test use the big NVMe disk (I recommend this; it has 880 GB free), or (B) accept that this small box cannot test it. If you do nothing, it refuses every 6 hours.
+3. **D4** (what a restore brings back when the backup is older): A stays in force. Nobody is blocked.
+4. **The image-copy question** (a maker deletes an old version): if you do nothing, nothing changes.
+5. **From before:** Peti's box in the project text; Peti's Cloudflare leftovers; the old Storage Box. If you do nothing, they stay.