2026-10-26 release run: hub 0.171.0, agent 0.166.0 (vouched), controller 0.344.0 (global floor 09:07:47 UTC), catalog 73c165d, golden 0.344.0 (baked, vouched; a fresh install came up on 0.344.0); the golden waiver removed — the gate is green on the golden. Rows: 9 closed (R-1278, R-1280–R-1283, R-1286–R-1289), R-1285 back to OPEN, R-1294 and R-1295 filed; STATUS, CONTEXT, evidence (scanned, 0 hits).

documentation/backlog/CLOSED-ITEMS.md

@@ -26,6 +26,20 @@
 
 ---
 
+## 2026-10-26 — the attended release run: hub 0.171.0, agent 0.166.0, controller 0.344.0, catalog `73c165d` (full text of the rows: `git show 6efb4760:documentation/backlog/OPEN-ITEMS.md`)
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-1287** | **A D47 set-aside mails the operator as „🔴 tester-1: 1 of 1 apps failed to back up (backup run)" — no backup failed; the body says the right thing („its backup belonged to an earlier install … SET ASIDE whole").** (P3) | CLOSED 2026-10-26 — hub v0.171.0 (live 07:58Z): a set-aside on Tester 1 mailed „⚠️ tester-1: a backup of an earlier install was set aside — nothing failed (tandoor)", Severity warning; the hub logged „holds only set-aside legs — sent as warning (R-1287)"; control: the 10-25 mails of the same event read „🔴 … 1 of 1 apps failed" (two channels: hub log + mailbox) | `audits/release-monday-2026-10-26/``r1287-setaside/hub-and-mail.txt` |
+| **R-1289** | **The hub's „newest controller the fleet reported" can be a dev build that no box runs: `semver.Compare` returns 0 (equal) for any version with a suffix, so „0.343.0-dev.r1251a" — once read first — beats nothing and is never beaten.** (P4) | CLOSED 2026-10-26 — hub v0.171.0: the operator's agent vouch (10:04:55 CET) logged „golden 0.331.0 unchanged (behind the fleet's 0.344.0 …)" — a release version, while last night's `0.344.0-rc.3` reports are in the same table; the hub's `semver.Valid` refuses an `-rc`/`-dev` suffix (probed) | hub log 2026-10-26 10:04:55; `hub/internal/web/floor_ui_test.go` TestR1289_* |
+| **R-1280** | **A signed operation's window has no maximum length — cap it at 24 h (D44 #22).** (P3) | CLOSED 2026-10-26 — agent v0.166.0 (vouched 10:04:55 CET): on demo-hp a 25 h signed job was REJECTED („op validity window too long … 25h0m0s", executor not called) and a 30 min one ran; `felhom-opsign -ttl 25h` refuses (rc 2), 24 h accepted | `audits/release-monday-2026-10-26/``agent-0166/boxes.txt` |
+| **R-1281** | **Every app container can reach FileBrowser directly; the only guard is the secret header name — take FileBrowser off the app networks (D44 #23).** (P2) | CLOSED 2026-10-26 — controller v0.344.0 (global floor 09:07:47Z): on all three test boxes FileBrowser sits only on `felhom-filebrowser` + `felhom-files`; from qBittorrent/Sonarr/Radarr/Prowlarr a forged household header → 000 with a working control (same curl → controller 404, traefik 301); the household's dashboard → pass → cookie → listing 200, no cookie 401 (Tester 1); OnlyOffice linked: joined `felhom-files`, both directions answer, the editor config 200 names `http://filebrowser:80/api/resources/download` and the OnlyOffice container fetched it 200; Paperless → FileBrowser 000. Method: endpoint level (the editor drawing in a browser is the operator's click-through) | `audits/release-monday-2026-10-26/``r1281/` |
+| **R-1282** | **The „Később" 03:30 media restart is forgotten by a controller restart — store the due time (D44 #24).** (P3) | CLOSED 2026-10-26 — controller v0.344.0, Tester 1: „Később" stored 2026-10-27T02:30:00Z; after `docker restart felhom-controller` the start-up line „kept from before the restart: 2026-10-27T02:30:00Z (R-1282)" and settings.json still holds it (two channels; the status API shows `later_at` only on a box with media apps — Tester 1 has none, so that reading was the instrument's miss) | `audits/release-monday-2026-10-26/``r1282/tester-1-later.txt` |
+| **R-1278** | **A volume app's reinstall does not offer its kept backup.** (P3) | CLOSED 2026-10-26 — controller v0.344.0, Tester 1 (throwaway Tandoor): the install page with nothing kept → no hint; with a kept backup → the hint, `data-kept-backups=1`, the restore-page link; after the clean-up → no hint again | `audits/release-monday-2026-10-26/``r1278/` |
+| **R-1286** | **demo-hp's kimai has been HELD since 2026-10-14 09:06Z („held after a failed restore whose rollback also failed") and no row names it.** (P4) | CLOSED 2026-10-26 — controller v0.344.0 carries `holdWhy` (each hold reason its own sentence); D51 = Start lifted Kimai's crash-loop hold (06:57:03Z), healthy since, 0 restarts; its `install_id` was written 07:01:55Z; demo-hp 12/12 apps carry one after the update | this row's 2026-10-26 entries; demo-hp app.yaml |
+| **R-1288** | **After the household restores an earlier install's set-aside copy, the next backup sets the REINSTALL's own unit aside too — a second kept copy on the restore page and a second operator alarm.** (P4) | CLOSED 2026-10-26 — released in controller v0.344.0 (the code proven live on the night's rig with rc.2: one set-aside mail only, `audits/night-2026-10-25/rig/r1288-live.txt`); the D47 count after the update: 0 set aside on all three boxes | `audits/night-2026-10-25/rig/r1288-live.txt` |
+| **R-1283** | **MeTube's downloads are excluded from every backup — make them `optional` (D44 #25).** (P3) | CLOSED 2026-10-26 — catalog `73c165d` pushed (operator yes): MeTube's `media/metube` is `optional`, the download-binds gate allows it by a named ruling (decoys green); Tester 1 synced at once („catalog moved cd0cf48fabd4 -> 73c165d60f63 … frissítve: metube", class optional on the box); the second-drive copy carrying a video was proven on the drill rig (`audits/night-2026-10-25/rig/r1283-live.txt`) | `audits/release-monday-2026-10-26/``r1283-catalog-sync.txt` |
+
 ## 2026-10-26 — R-1183 measured (full text of the row: `git show b00d5c61:documentation/backlog/OPEN-ITEMS.md`)
 
 | Row | What | Closed | Evidence |