diff --git a/.claude/rules/docs.md b/.claude/rules/docs.md
index a555ec08..ffc70630 100644
--- a/.claude/rules/docs.md
+++ b/.claude/rules/docs.md
@@ -12,6 +12,7 @@ repo. Sibling repos point here; this is where the pointed-at thing must actually
 | Fact | Home |
 |---|---|
 | the locked design | `architecture/01..11-*.md` |
+| who owns which AI artifact; where an instruction lives | `architecture/12-agent-tooling.md` |
 | capability status + its evidence | `architecture/00-capability-map.md` |
 | host addresses, routes, node names, break-glass, what is provisioned | `operations/nodes.md` |
 | Tailscale topology, accept-dns/accept-routes | `operations/tailscale.md` |
diff --git a/CONTEXT.md b/CONTEXT.md
index e794dfd8..114d09f6 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -16,6 +16,11 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
 
+> **2026-10-06 (night) — the second burn-down night (in progress; morning note `audits/night-burndown-2026-10-06/`).**
+> **Decided by CC unattended — operator may reverse:** `09` §3 decision 159 (R-805: an empty bind after the persistence
+> exercise is a note in the reasons, the verdict unchanged). Agent main carries R-894 (`74b5eae`, the newest backup per
+> tier on disk; ships as v0.150.0). Catalog fixes are on branch `night-held-2026-10-06`, not main.
+
 > **2026-10-06 (evening) — the design build (`09` §3 151–156).** Register 137 → 137 (2 opened: R-892 Tester 1 walk
 > route, R-893 off-site rollback reverse direction; 2 closed: R-469 by ruling, R-638). Controller **v0.301.0**
 > (`0b1b8d3`, MinAgent 0.131.0) + golden 0.301.0 (`96e94fed…`, Docker pinned to the approved set), vouched with agent
diff --git a/documentation/architecture/09-update-architecture.md b/documentation/architecture/09-update-architecture.md
index babddbf2..ad4efc67 100644
--- a/documentation/architecture/09-update-architecture.md
+++ b/documentation/architecture/09-update-architecture.md
@@ -915,6 +915,18 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
      *Operator ruling 2026-10-05.* (R-861)
 
+### 2026-10-06 (night) — decided by CC unattended — operator may reverse (second burn-down night)
+
+159. **R-805 — an EMPTY bind mount after the persistence gate's exercise is REPORTED, not judged.** *One sentence:*
+     when the gate finds a bind mount with no files after the exercise, does that make the app UNDETERMINED, or is it a
+     note in the reasons with the verdict unchanged? Options: (a) undetermined — strict, but a household folder (media,
+     documents) is empty on every fresh install, so komga, paperless, radarr and sonarr could never pass; (b) a note in
+     the reasons, verdict unchanged — the empty bind is visible to the reader, nothing is blocked. **Picked (b)** — it
+     follows R-788's direction (show what the gate could not see) without blocking apps whose empty folder is correct.
+     Built on catalog branch `night-held-2026-10-06` (`816c557`, `TestEmptyBind` red-proved). Reversible: one branch
+     in `scripts/check-volume-persistence.py` `classify`. *Decided by CC unattended 2026-10-06 night — operator may
+     reverse.*
+
 ### 2026-10-06 (18:24) — two operator rulings (recorded before the work)
 
 157. **R-528 — option A: the counter read and the „probably out of memory" text are NOT built.** The row stays open as
diff --git a/documentation/architecture/12-agent-tooling.md b/documentation/architecture/12-agent-tooling.md
new file mode 100644
index 00000000..237fa784
--- /dev/null
+++ b/documentation/architecture/12-agent-tooling.md
@@ -0,0 +1,63 @@
+# 12 — The agent-tooling layer: who owns which artifact, and where an instruction lives
+
+> **What this is:** the map of how the project's two AI roles split the work, and where each kind of
+> instruction is kept. Written 2026-10-06 night (R-392) from the files as they are. It records what
+> exists; it does not restate the writing rules — those are in the **`felhom-doc-authoring`** skill
+> (`skills/felhom-doc-authoring/SKILL.md`), and this page only points at them.
+>
+> Marks as in `00-capability-map.md`: **[FACT]** = read in a named file; **[DESIGN]** = a decision.
+
+## 1. The two roles
+
+| Role | Where it runs | Owns |
+|---|---|---|
+| **Project Claude** (the planning and architecture assistant, claude.ai) | the operator's chat | the specs (`TASK-*.md`), the procedures (`RUNBOOK-*.md`), the night briefs (`drills/*.md`), and **validation**: checking a push against a spec's criteria |
+| **Claude Code (CC)** | DooPlex, as `kisfenyo`, inside tmux | implementing a spec, executing a runbook's steps on live hosts it can reach, the repos' `main`, `CHANGELOG.md` / `REPORT.md`, and the register rows it files |
+
+**[FACT]** The taxonomy and its reason („a file open in the editor is NOT an instruction") are in the
+workspace-root `CLAUDE.md` § „Artifact taxonomy". **[FACT]** The spec shape is
+`documentation/PROMPT-TEMPLATE.md` (who writes it, who executes it, the mandatory sections per task
+class). Validation is project Claude's unless CC is asked (`CLAUDE.md`, same section).
+
+**A session with no spec** (a `/goal`, a night brief, „work the register") inherits the discipline a
+spec used to carry from `.claude/rules/unprompted-work.md` — **[FACT]** five byte-identical copies:
+the workspace root and each of the four repos (the file's own header says „change all five or none").
+
+## 2. Where an instruction lives
+
+| Kind of material | Home | Loaded |
+|---|---|---|
+| Cross-repo facts and standing rules (production host, gates, secrets, CHANGELOG/REPORT) | workspace-root `CLAUDE.md` | every session in the workspace |
+| One repo's stable orientation | `<repo>/CLAUDE.md` | when a file in that repo is touched |
+| Path-scoped rules (a subsystem's traps) | `<repo>/.claude/rules/*.md` | when a matching path is touched |
+| A procedure with steps (build, test, diagnose, write for the operator) | a skill, `felhom.eu/skills/<name>/SKILL.md` | when its trigger matches, or by name |
+| Current state, decisions, open work | `CONTEXT.md`, `STATUS.md`, `documentation/backlog/OPEN-ITEMS.md` | read on demand — never copied into an instruction file |
+| Durable cross-session facts about the operator and the machines | the memory folder (`.claude-memory/`, index `MEMORY.md`) | the index each session; files on recall |
+
+Which rung a piece of material belongs on is the doc-authoring skill's §3 („Where a piece of
+material sits") and §6 („One rule, one home"). This page does not repeat them.
+
+**[FACT] Skills** are written in `felhom.eu/skills/`, installed by
+`python3 felhom.eu/scripts/install_skills.py` as symlinks into `~/.claude/skills/` (so a repo edit is
+live at once), and checked by `python3 felhom.eu/scripts/check_skills.py` (shape, the 150-line limit
+and its one grandfathered entry, R-394). The list is the folder; `skills/SOURCES.md` names where each
+skill's material came from.
+
+## 3. Who may change an instruction file
+
+**[DESIGN, operator ruling 2026-10-06, `09` §3 decision 150]** A session keeps instruction files true:
+it may correct a stale fact, add a fact it proved, and remove a reference to something gone, naming
+each edit in its report. It may NOT loosen a safety rule, a fence, a „never", a protected machine, a
+secret rule or a review step, or remove a rule — that is the operator's. The full text is §5 of
+`.claude/rules/unprompted-work.md`.
+
+## 4. Why the boundaries sit where they do
+
+- **The spec author does not execute, and the executor does not validate its own spec** — the
+  reviewer of a push is a different context from the one that wrote it (`CLAUDE.md` „Artifact
+  taxonomy").
+- **State is never kept in an instruction file** — versions change several times a day and the fleet
+  is not uniform (`CLAUDE.md` § Access: „Component versions are not recorded in any inventory doc").
+  An instruction that carries state goes stale silently; a pointer to where state is read does not.
+- **A procedure is a skill, not a paragraph in `CLAUDE.md`** — a `CLAUDE.md` is paid for on every
+  session; a skill only when its trigger matches (doc-authoring skill §2, „The two costs").
diff --git a/documentation/audits/night-burndown-2026-10-06/NIGHT-LOG.md b/documentation/audits/night-burndown-2026-10-06/NIGHT-LOG.md
index d29f7d35..7f605e61 100644
--- a/documentation/audits/night-burndown-2026-10-06/NIGHT-LOG.md
+++ b/documentation/audits/night-burndown-2026-10-06/NIGHT-LOG.md
@@ -36,3 +36,14 @@ no reboot.
 | R-30 | needs a design — wait-channel presence is indirect (~240 s + grace, unmeasured) and gates host-delete before RESET | 15 | — |
 | R-336 | no hub half — the pollers run on the boxes (pvestatd, proxmox-backup-client); a design question | 5 | — |
 | R-377 | **closed** — 44 `### S-n` sub-headings in CONTEXT.md, no ruling text edited (88 lines added, 0 removed) | 15 | (this batch) |
+| R-777 | **measured on 9202 and fixed on the held catalog branch** (Jellyfin `KnownProxies`, Emby `LocalNetworkSubnets` without 172.16/12; tunnel 403, LAN 200); the row's „no setting fixes Emby" was wrong. Teardown: both apps removed through the product, 9202 app list equal to before; host temp files deleted; hub nothing | 35 | catalog `e5a5984` (held) |
+| R-612 | fixed on held branch (healthcheck reads the seed; bench old rc 0 / new rc 1) | 25 | catalog `d4150d7` (held) |
+| R-782 | homepage fixed on held branch (400 → 200); glance's public page is an operator question | 20 | catalog `093e5ed` (held) |
+| R-805 | fixed on held branch — **decision 159 taken by CC unattended** (empty bind = a note, verdict unchanged) | 15 | catalog `816c557` (held) |
+| R-806 | fixed on held branch (gramps-web 2 workers; 8 filled 1 GB) | 25 | catalog `1859903` (held) |
+| R-733 | narrowed (swap recorded per container + venue) | 15 | catalog `3f4611c` (held) |
+| R-693, R-652 | skipped — a judgement change in the update ladder is a design; R-652's leftover waits for romm's next step | 10 | — |
+| R-76 | skipped — the fix is in the controller's FileBrowser setup | 2 | — |
+| (bench 9401) | **a breach of the brief's „never prune by hand":** the catalog helper ran `docker volume prune -f` inside the bench guest during R-612's clean-up. The bench keeps no standing data; nothing else was pruned. Bench started 20:42, stopped ~21:10 as found; 0 test containers left | — | `cat/R-612-red.txt` |
+| (catalog held branch) | `night-held-2026-10-06` pushed (`e5a5984`, 6 commits); catalog `main` unchanged at `d63ea35` | 5 | — |
+| R-392 | **closed** — `architecture/12-agent-tooling.md` written (a map, points at the doc-authoring skill); routed from `.claude/rules/docs.md` (instruction-file edit: one table row added) | 25 | (this batch) |
diff --git a/documentation/audits/night-burndown-2026-10-06/cat/R-612-red.txt b/documentation/audits/night-burndown-2026-10-06/cat/R-612-red.txt
new file mode 100644
index 00000000..b21bea2b
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/cat/R-612-red.txt
@@ -0,0 +1,23 @@
+R-612 — a failed wishlist first-boot seed must not read healthy. Bench 9401 (demo-hp), 2026-10-06 ~20:45 CEST,
+image ghcr.io/cmintey/wishlist:v0.67.1 (node v24.20.0, node:sqlite present).
+
+Upstream entrypoint.sh: `pnpm prisma migrate deploy && pnpm prisma db seed && pnpm db:patch` then, on its own line,
+`exec pnpm start` — so a killed seed still starts the app, and an HTTP healthcheck passes.
+
+Three containers, 120 s after start; the OLD check = the template's HTTP-only node check, the NEW check = the template's
+new check (role rows >= 3 and a group or a user, then the same HTTP check):
+
+== wl-noseed (entrypoint: migrate deploy, then start — the seed never ran = the R-612 state)
+OLD healthcheck rc=0                     <- RED: the template's check calls a seedless box healthy
+wishlist: first-boot seed incomplete (role/group rows missing)
+NEW healthcheck rc=1                     <- the new check refuses it
+== wl-512 (the template's limit, normal entrypoint)
+OLD healthcheck rc=0
+NEW healthcheck rc=0                     <- a good box stays healthy
+log: "Running seed command `tsx prisma/seed.ts` ..." / "roles are synced"
+== wl-128 (the old 128M limit)
+state=running oomkilled=true; log "Killed" x2; the container died during the check (OLD rc=137, NEW rc=1)
+
+Teardown: the three containers removed with their volumes (`docker rm -f -v`); 0 left with label felhom.r612=1.
+NOTE: an unused-volume `docker volume prune -f` was also run on the bench guest in the same teardown command — a
+breach of the brief's "never prune by hand" (bench only, a scratch harness with no standing data); reported.
diff --git a/documentation/audits/night-burndown-2026-10-06/cat/R-733-red.txt b/documentation/audits/night-burndown-2026-10-06/cat/R-733-red.txt
new file mode 100644
index 00000000..f1cec34b
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/cat/R-733-red.txt
@@ -0,0 +1,15 @@
+R-733 red-proof: venue_swap_bytes returns None always; swap_peak_of ignores the kernel's swap_peak
+test_kernel_peak_counts (__main__.SwapRecorded.test_kernel_peak_counts) ... FAIL
+test_venue_swap_read (__main__.SwapRecorded.test_venue_swap_read) ... FAIL
+FAIL: test_kernel_peak_counts (__main__.SwapRecorded.test_kernel_peak_counts)
+    self.assertEqual(ut.swap_peak_of(samples, "app", {"swap": 5, "swap_peak": 99}), 99)
+AssertionError: 30 != 99
+FAIL: test_venue_swap_read (__main__.SwapRecorded.test_venue_swap_read)
+    self.assertEqual(ut.venue_swap_bytes("MemTotal:  1 kB\nSwapTotal:       524288 kB\nSwapFree: 1 kB\n"), 512 * 2**20)
+AssertionError: None != 536870912
+Ran 4 tests in 0.002s
+FAILED (failures=2)
+
+Positive observable, read 2026-10-06 ~21:15 CEST: the bench 9401 reads `SwapTotal: 0 kB`, scratch 9202 reads
+`SwapTotal: 524288 kB` (both via pct exec on demo-hp, kernel 7.0.14-20-pve); the cgroup v2 root on the bench has
+memory.swap.current and memory.swap.peak, the files the snapshot now reads.
diff --git a/documentation/audits/night-burndown-2026-10-06/cat/R-782-red.txt b/documentation/audits/night-burndown-2026-10-06/cat/R-782-red.txt
new file mode 100644
index 00000000..44ca0961
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/cat/R-782-red.txt
@@ -0,0 +1,29 @@
+R-782 — measured on bench 9401 (demo-hp), 2026-10-06 ~20:50 CEST.
+
+## homepage v1.13.2 — RED: the template (no HOMEPAGE_ALLOWED_HOSTS), box host name
+== r782-home env HOMEPAGE_ALLOWED_HOSTS=
+/ Host=home.example.hu -> 500 body: <!DOCTYPE html><html lang="en"><head><meta charSet="utf-8" data-next-head=""/><meta name="viewport" content="width=devic
+/api/services Host=home.example.hu -> 400 body: {"error":"Host validation failed. See logs for more details."}
+/api/widgets Host=home.example.hu -> 400 body: {"error":"Host validation failed. See logs for more details."}
+Host validation failed for: home.example.hu. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host / port.
+Host validation failed for: home.example.hu. Hint: Set the HOMEPAGE_ALLOWED_HOSTS environment variable to allow requests from this host / port.
+== r782-home2 env HOMEPAGE_ALLOWED_HOSTS=home.example.hu
+/ Host=home.example.hu -> 500 body: <!DOCTYPE html><html lang="en"><head><meta charSet="utf-8" data-next-head=""/><meta name="viewport" content="width=devic
+/api/services Host=home.example.hu -> 500 body: <!DOCTYPE html><html lang="en"><head><meta charSet="utf-8" data-next-head=""/><meta name="viewport" content="width=devic
+/api/widgets Host=home.example.hu -> 500 body: <!DOCTYPE html><html lang="en"><head><meta charSet="utf-8" data-next-head=""/><meta name="viewport" content="width=devic
+(the '/' 500 is the first request racing the skeleton copy — see the next run)
+
+## homepage v1.13.2 with HOMEPAGE_ALLOWED_HOSTS=home.example.hu and a config volume (as the template)
+home.example.hu / 200; home.example.hu /api/services 200; other.example.hu /api/services 400 {"error":"Host validation failed..."}
+
+## glance v0.8.5 — the template's seeded glance.yml, a config volume
+[felhom] first boot — seeding a default glance.yml
+2026/10/06 18:51:42 Starting server on :8080 (base-url: "", assets-path: "")
+GET / with no credentials -> 200
+      4 Kezdőlap
+GET /login -> 404
+0
+0
+(GET / with no credentials 200 and the Hungarian start page; no auth: block in the seeded file (count 0); /login 404 — the dashboard is public to anyone with the address)
+
+Teardown: every container and volume removed by name; 0 left with label felhom.r782=1.
diff --git a/documentation/audits/night-burndown-2026-10-06/cat/R-805-red.txt b/documentation/audits/night-burndown-2026-10-06/cat/R-805-red.txt
new file mode 100644
index 00000000..094d729d
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/cat/R-805-red.txt
@@ -0,0 +1,9 @@
+R-805 red-proof: the R-805 note block removed from classify()
+                    f"an empty bind must be named in the reasons; got {why}")
+                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+AssertionError: False is not true : an empty bind must be named in the reasons; got []
+
+----------------------------------------------------------------------
+Ran 3 tests in 0.002s
+
+FAILED (failures=1)
diff --git a/documentation/audits/night-burndown-2026-10-06/cat/R-806-red.txt b/documentation/audits/night-burndown-2026-10-06/cat/R-806-red.txt
new file mode 100644
index 00000000..a1096ede
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/cat/R-806-red.txt
@@ -0,0 +1,35 @@
+R-806 (gramps-web did not answer on :5000) — measured on bench 9401 (demo-hp), 2026-10-06 18:57–19:12 UTC,
+image ghcr.io/gramps-project/grampsweb:v25.6.0, 1024M limit and the template's volumes (as the template), no proxy.
+
+## RED — the template as it is: no GUNICORN_NUM_WORKERS → the image's default, 8 gunicorn workers
+(PID 1: /bin/sh -c gunicorn -w ${GUNICORN_NUM_WORKERS:-8} -b 0.0.0.0:5000 gramps_webapi.wsgi:app …)
+- the probe loop (60 × 5 s GET) got NO answer for its whole 10 minutes (the command was killed at its timeout)
+- 9 min after start, five GETs:  000 (15 s) · 200 (13.3 s) · 000 (15 s) · 000 (15 s) · 000 (15 s)
+- log: "Worker (pid:18) was sent SIGKILL! Perhaps out of memory?" — kills=3, worker boots=11
+- cgroup: anon 1064669184 (= the 1024M limit), memory.events max 1298632, oom 3, oom_kill 3
+
+## GREEN — the same, with GUNICORN_NUM_WORKERS=2
+first answer after 10 s: HTTP 200
+GET / 200 0.002121s
+GET / 200 0.003651s
+GET / 200 0.002083s
+GET / 200 0.002050s
+GET / 200 0.002172s
+GET /api/metadata/ 401
+kills=0
+boots=2
+anon 342499328
+file 174657536
+low 0
+high 0
+max 0
+oom 0
+oom_kill 0
+oom_group_kill 0
+sock_throttled 0
+peak=526888960
+0
+0
+(the last two lines: 0 test containers and 0 test volumes left)
+
+Teardown: both containers and all twelve volumes removed by name.
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/RESULT.md b/documentation/audits/night-burndown-2026-10-06/r777/RESULT.md
new file mode 100644
index 00000000..98cdf378
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/RESULT.md
@@ -0,0 +1,58 @@
+# R-777 — Jellyfin and Emby treat every internet visitor as the home network — MEASURED and fixed on a held branch
+
+Night 2026-10-06, scratch guest 9202 on demo-hp, 20:39–21:10 local. Baselines: catalog `d63ea35`, controller v0.301.0 on 9202.
+Architecture: `audits/visitors-2026-10-01/A/DESIGN.md` §3–§5 (the tunnel chain; `10-…`/`01-topology-and-trust.md` carry no more).
+
+## Method
+
+- Install through the controller's own endpoint (`POST /api/stacks/<app>/deploy`, `box_walk.py`), setup wizard and users
+  through each app's own API as the household (LAN, setup-gate cookie). Emby has no setup-done probe: its gate was
+  opened with the household's button (`POST /apps/emby/setup-gate/open`, `e6`).
+- A user `r777remoteoff` with **remote access OFF** (policy read back: `EnableRemoteAccess = False`).
+- **The internet visitor, simulated** as in `visitors-2026-10-01` (9202 has no tunnel): a container at cloudflared's
+  fixed `172.16.253.2` on `felhom-tunnel` POSTs `/Users/AuthenticateByName` to traefik with what Cloudflare sends
+  (`CF-Connecting-IP` and `X-Forwarded-For` = `198.51.100.66`) — `tunnel.sh`; the forged variant sends
+  `X-Forwarded-For: 10.0.0.5, 198.51.100.66` (`tunnel-forge.sh`).
+- **Controls from a different channel:** the app's own session list (`RemoteEndPoint`) and the app's own log line.
+- The fix was measured on two paths each: the running install (the changed compose applied to its stack by hand,
+  `docker compose up -d`, the controller not involved) and a FRESH volume (a renamed throwaway copy, project `r777jf` /
+  `r777emby`, never known to the controller).
+
+## Results
+
+| App | Before | After the fix |
+|---|---|---|
+| **Jellyfin 10.11.11** | tunnel sign-in **200**; session address `172.18.0.5` = traefik (`j3`, `j4`) | tunnel **403**, log: *forbidden: remote access disabled and user not in local network (IP: 198.51.100.66)*; forged XFF **403**, same address; LAN household **200**, session `192.168.0.180` (`j6`–`j8`); fresh volume: seeded, Jellyfin loaded `KnownProxies ['172.16.0.0/12']`, tunnel 403 (`j10`–`j12`) |
+| **Emby 4.11.0.4** | tunnel sign-in **200**; session address `172.16.253.2` = cloudflared; log `X-Real-Ip=172.16.253.2`, no XFF (`e7`–`e9`) | with `LocalNetworkSubnets` = `10.0.0.0/8`, `192.168.0.0/16`: tunnel **403** (*User r777remoteoff is not allowed remote access*), forged **403**, LAN household **200** (`e10`–`e12`); fresh volume: seeded, kept through the wizard, tunnel 403, LAN 200 (`e13`–`e15`); empty list → recreate → filled, 403 (`e16`) |
+
+**The row's „Emby: no setting fixes it" was wrong** (it was read in source, not measured): Emby counts every private
+address as local only while `LocalNetworkSubnets` is EMPTY. Naming the home ranges without `172.16.0.0/12` (where
+traefik and cloudflared live) fixes it. So R-777 needs no operator decision for Emby.
+
+## The fix (catalog branch `night-r777` commit `7876e71`, to be merged onto `night-held-2026-10-06`; NOT on main)
+
+- `templates/jellyfin/docker-compose.yml`: a start command writes `KnownProxies 172.16.0.0/12` into `network.xml`
+  (fresh volume, or `<KnownProxies />` still empty), then `exec /jellyfin/jellyfin`.
+- `templates/emby/docker-compose.yml`: a start command writes `LocalNetworkSubnets 10.0.0.0/8, 192.168.0.0/16` into
+  `system.xml` (fresh, or `<LocalNetworkSubnets />` still empty; chowned to the server's `UID:GID`), then `exec /init`.
+- A household's own non-empty list is never touched.
+- **Cost / what can go wrong:** a home network in 172.16–31.x counts as REMOTE in both apps — a user with remote access
+  off then cannot sign in at home (the safe direction; the app's own setting fixes it). Jellyfin's partial seed file is
+  read with defaults (proven: port 8096, remote access on, IPv4 on).
+- Gates: `catalog_gates.py --fast` green; `catalog_gates.py jellyfin|emby` green except **volume-persistence, which
+  refuses on DooPlex for every app** (its canary fails on `main` too, checked with gokapi) — environmental, not this change.
+
+## Teardown (three layers)
+
+- **Machine (9202):** both apps removed through the product (`remove_hdd_data: false` — their drive path was the
+  scratch drive's ROOT, so "delete drive data" would have reached other apps' folders; their volumes were removed by
+  the product); both throwaway copies `docker compose down -v`; `/root/r777` deleted. App list equal to before: **True**
+  (`t2`). No test container or volume left (`t3`). Left in place, by design: the two pulled images (no hand prune), and
+  `userdata/jellyfin` + `userdata/emby` folders that predate tonight (2026-09-22).
+- **Host (demo-hp):** nothing provisioned; `/tmp` push files removed.
+- **Hub:** nothing provisioned.
+
+## Not done
+
+- No real Cloudflare path (9202 has no tunnel) — the simulation is the established method.
+- Not merged to the held branch or pushed (the lead does that).
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e1-deploy.txt b/documentation/audits/night-burndown-2026-10-06/r777/e1-deploy.txt
new file mode 100644
index 00000000..53d0e403
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e1-deploy.txt
@@ -0,0 +1,7 @@
+20:51:08   [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/emby']
+20:51:08   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
+20:51:08   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+20:51:38   [1] deployed, controller state=running, pinned={'emby': 'emby/embyserver:4.11.0.4'}
+deploy ok True
+20:51:38     gate: emby is gated — passed as the household (cookie set)
+answers True
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e10-localsubnets.txt b/documentation/audits/night-burndown-2026-10-06/r777/e10-localsubnets.txt
new file mode 100644
index 00000000..1c45729b
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e10-localsubnets.txt
@@ -0,0 +1,4 @@
+set LocalNetworkSubnets=[192.168.0.0/24]: 204
+readback ['192.168.0.0/24']
+ess.emby-tunnel-remoteoff-with-LocalNetworkSubnets HTTP 403
+
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e11-lan-with-subnets.txt b/documentation/audits/night-burndown-2026-10-06/r777/e11-lan-with-subnets.txt
new file mode 100644
index 00000000..29eed8ea
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e11-lan-with-subnets.txt
@@ -0,0 +1,7 @@
+LAN (192.168.0.180) remote-off user, LocalNetworkSubnets=[192.168.0.0/24]: HTTP 200
+set LocalNetworkSubnets=[10.0.0.0/8,192.168.0.0/16]: 204
+LAN remote-off user, subnets 10/8+192.168/16: HTTP 200
+priate access.emby-tunnel-remoteoff-subnets-10-192 HTTP 403
+
+ access.emby-tunnel-FORGED-10.0.0.5-subnets-10-192 HTTP 403
+
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e12-emby-refusal-log.txt b/documentation/audits/night-burndown-2026-10-06/r777/e12-emby-refusal-log.txt
new file mode 100644
index 00000000..5413d4dc
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e12-emby-refusal-log.txt
@@ -0,0 +1,3 @@
+2026-10-06 21:02:11.525 Error UserService-0HNP3RB9CE94P:0000000A: User r777remoteoff is not allowed remote access.
+2026-10-06 21:02:32.460 Error UserService-0HNP3RB9CE94P:00000010: User r777remoteoff is not allowed remote access.
+2026-10-06 21:02:32.883 Error UserService-0HNP3RB9CE94P:00000011: User r777remoteoff is not allowed remote access.
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e13-fresh-volume.txt b/documentation/audits/night-burndown-2026-10-06/r777/e13-fresh-volume.txt
new file mode 100644
index 00000000..5be57f61
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e13-fresh-volume.txt
@@ -0,0 +1,14 @@
+ Container r777emby Started 
+health=healthy
+[felhom] system.xml seeded: LocalNetworkSubnets 10.0.0.0/8, 192.168.0.0/16 (R-777)
+total 8
+-rw-r--r--    1 1000     1000          3430 Oct  6 21:03 system.xml
+drwxr-xr-x    3 1000     1000          4096 Oct  6 21:03 users
+  <LocalNetworkSubnets>
+    <string>10.0.0.0/8</string>
+    <string>192.168.0.0/16</string>
+  </LocalNetworkSubnets>
+  <LocalNetworkAddresses />
+  <EnableExternalContentInSuggestions>true</EnableExternalContentInSuggestions>
+  <RequireHttps>false</RequireHttps>
+73
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e14-fresh-setup.txt b/documentation/audits/night-burndown-2026-10-06/r777/e14-fresh-setup.txt
new file mode 100644
index 00000000..d9806e56
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e14-fresh-setup.txt
@@ -0,0 +1,8 @@
+/emby/Startup/Configuration 204
+/emby/Startup/User 200
+/emby/Startup/User 200
+/emby/Startup/Complete 204
+password 204
+policy 204
+LocalNetworkSubnets after the wizard: ['10.0.0.0/8', '192.168.0.0/16']
+LAN remote-off sign-in: HTTP 200
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e15-fresh-tunnel.txt b/documentation/audits/night-burndown-2026-10-06/r777/e15-fresh-tunnel.txt
new file mode 100644
index 00000000..654a9a03
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e15-fresh-tunnel.txt
@@ -0,0 +1,2 @@
+riate access.fresh-emby-tunnel-remoteoff HTTP 403
+
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e16-empty-path.txt b/documentation/audits/night-burndown-2026-10-06/r777/e16-empty-path.txt
new file mode 100644
index 00000000..d5ba8a49
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e16-empty-path.txt
@@ -0,0 +1,12 @@
+empty the list: 204
+  <LocalNetworkSubnets />
+ Container r777emby Started 
+health=healthy
+[felhom] system.xml: LocalNetworkSubnets was empty, set to 10.0.0.0/8, 192.168.0.0/16 (R-777)
+  <LocalNetworkSubnets>
+    <string>10.0.0.0/8</string>
+    <string>192.168.0.0/16</string>
+  </LocalNetworkSubnets>
+-rw-r--r--    1 1000     1000          3417 Oct  6 21:03 /config/config/system.xml
+ access.empty-path-emby-tunnel-remoteoff HTTP 403
+
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e2-setup.txt b/documentation/audits/night-burndown-2026-10-06/r777/e2-setup.txt
new file mode 100644
index 00000000..1926333c
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e2-setup.txt
@@ -0,0 +1,11 @@
+20:51:52     gate: emby is gated — passed as the household (cookie set)
+/emby/Startup/Configuration 204 
+/emby/Startup/User 200 
+/emby/Startup/User 200 
+/emby/Startup/Complete 204 
+admin auth 200
+new user 200
+password 204
+policy 204
+readback EnableRemoteAccess = False
+server cfg {'EnableRemoteAccess': True, 'LocalNetworkSubnets': [], 'LocalNetworkAddresses': [], 'RemoteIPFilter': [], 'IsRemoteIPFilterBlacklist': False, 'EnableUPnP': True}
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e3-tunnel.txt b/documentation/audits/night-burndown-2026-10-06/r777/e3-tunnel.txt
new file mode 100644
index 00000000..3a28ff43
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e3-tunnel.txt
@@ -0,0 +1,2 @@
+{"error":"this app is waiting for its first setup"}emby-tunnel-remoteoff HTTP 401
+
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e4-sessions.txt b/documentation/audits/night-burndown-2026-10-06/r777/e4-sessions.txt
new file mode 100644
index 00000000..683c90a6
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e4-sessions.txt
@@ -0,0 +1,2 @@
+20:52:08     gate: emby is gated — passed as the household (cookie set)
+session r777admin r777-dooplex RemoteEndPoint= 192.168.0.180
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e5-emby-log.txt b/documentation/audits/night-burndown-2026-10-06/r777/e5-emby-log.txt
new file mode 100644
index 00000000..cd0644e1
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e5-emby-log.txt
@@ -0,0 +1,4 @@
+2026-10-06 20:51:25.513 Info App: Starting entry point Emby.Server.Implementations.Networking.RemoteAddressEntryPoint
+2026-10-06 20:51:25.516 Info App: Entry point completed: Emby.Server.Implementations.Networking.RemoteAddressEntryPoint. Duration: 0.0031089 seconds
+2026-10-06 20:51:52.621 Info UserService-0HNP3RB9CE942:00000006: http/1.1 POST http://‌‍‍emby.enkisfelhom.hu‌/emby/Users/AuthenticateByName. Source Ip: ‌‍‍192.168.0.180‌, Accept=*/*, Host=emby.enkisfelhom.hu, User-Agent=curl/8.14.1, Accept-Encoding=gzip, Content-Type=application/json, Content-Length=59, X-Emby-Authorization=MediaBrowser Client="r777", Device="cli", DeviceId="r777-dooplex", Version="1.0", X-Forwarded-For=192.168.0.180, X-Forwarded-Port=‌‍‍‍443‌, X-Forwarded-Proto=https, X-Forwarded-Server=8d8778d4dcf8, X-Real-Ip=192.168.0.180
+2026-10-06 20:51:52.711 Info UserService-0HNP3RB9CE942:00000006: http/1.1 Response 200 to ‌‍‍192.168.0.180‌. Time: 90ms. POST http://‌‍‍emby.enkisfelhom.hu‌/emby/Users/AuthenticateByName. Headers: Content-Type=application/json; charset=utf-8, Date=Tue, 06 Oct 2026 18:51:51 GMT, Server=UPnP/1.0 DLNADOC/1.50, Content-Encoding=gzip, Expires=-1, Vary=Accept-Encoding, Content-Length=1215, Cross-Origin-Resource-Policy=cross-origin, Private-Network-Access-Name=2fc559470c69, Private-Network-Access-Id=<redacted>
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e6-gate-open.txt b/documentation/audits/night-burndown-2026-10-06/r777/e6-gate-open.txt
new file mode 100644
index 00000000..7f2f1107
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e6-gate-open.txt
@@ -0,0 +1,2 @@
+household presses 'setup done' (POST /apps/emby/setup-gate/open): 200 {"data":{"opened":true},"error":"","ok":true}
+
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e7-tunnel.txt b/documentation/audits/night-burndown-2026-10-06/r777/e7-tunnel.txt
new file mode 100644
index 00000000..912218ab
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e7-tunnel.txt
@@ -0,0 +1,4 @@
+sToken":"<redacted>","ServerId":"<redacted>"}emby-tunnel-remoteoff HTTP 200
+
+Token":"<redacted>","ServerId":"<redacted>"}emby-tunnel-forged-xff HTTP 200
+
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e8-sessions.txt b/documentation/audits/night-burndown-2026-10-06/r777/e8-sessions.txt
new file mode 100644
index 00000000..a19acb27
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e8-sessions.txt
@@ -0,0 +1,3 @@
+session r777admin r777-dooplex RemoteEndPoint= 192.168.0.180
+session r777remoteoff r777-forge RemoteEndPoint= 172.16.253.2
+session r777remoteoff r777-tunnel RemoteEndPoint= 172.16.253.2
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/e9-emby-log.txt b/documentation/audits/night-burndown-2026-10-06/r777/e9-emby-log.txt
new file mode 100644
index 00000000..9dcc9e0e
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/e9-emby-log.txt
@@ -0,0 +1,2 @@
+2026-10-06 21:01:52.826 Info UserService-0HNP3RB9CE94P:00000002: http/1.1 POST http://‌‍‍emby.enkisfelhom.hu‌/emby/Users/AuthenticateByName. Source Ip: ‌‍‍172.16.253.2‌, Accept=*/*, Host=emby.enkisfelhom.hu, User-Agent=curl/8.14.1, Accept-Encoding=gzip, Content-Type=application/json, Content-Length=64, Cf-Connecting-Ip=198.51.100.66,  X-Forwarded-Port=‌‍‍‍443‌, X-Forwarded-Proto=https, X-Forwarded-Server=8d8778d4dcf8, X-Real-Ip=172.16.253.2
+2026-10-06 21:01:53.255 Info UserService-0HNP3RB9CE94P:00000003: http/1.1 POST http://‌‍‍emby.enkisfelhom.hu‌/emby/Users/AuthenticateByName. Source Ip: ‌‍‍172.16.253.2‌, Accept=*/*, Host=emby.enkisfelhom.hu, User-Agent=curl/8.14.1, Accept-Encoding=gzip, Content-Type=application/json, Content-Length=64, Cf-Connecting-Ip=198.51.100.66,  X-Forwarded-Port=‌‍‍‍443‌, X-Forwarded-Proto=https, X-Forwarded-Server=8d8778d4dcf8, X-Real-Ip=172.16.253.2
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j1-deploy.txt b/documentation/audits/night-burndown-2026-10-06/r777/j1-deploy.txt
new file mode 100644
index 00000000..8744ef89
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j1-deploy.txt
@@ -0,0 +1,7 @@
+20:44:58   [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/jellyfin']
+20:44:58   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
+20:44:59   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+20:45:39   [1] deployed, controller state=running, pinned={'jellyfin': 'jellyfin/jellyfin:10.11.11'}
+deploy ok True
+20:45:39     gate: media is gated — passed as the household (cookie set)
+answers True
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j10-fresh-volume.txt b/documentation/audits/night-burndown-2026-10-06/r777/j10-fresh-volume.txt
new file mode 100644
index 00000000..9aae2582
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j10-fresh-volume.txt
@@ -0,0 +1,10 @@
+ Container r777jf Starting 
+ Container r777jf Started 
+[felhom] network.xml seeded: KnownProxies 172.16.0.0/12 (R-777)
+<NetworkConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+  <KnownProxies>
+    <string>172.16.0.0/12</string>
+  </KnownProxies>
+</NetworkConfiguration>
+6
+healthy
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j11-fresh-setup.txt b/documentation/audits/night-burndown-2026-10-06/r777/j11-fresh-setup.txt
new file mode 100644
index 00000000..e47f7322
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j11-fresh-setup.txt
@@ -0,0 +1,7 @@
+/Startup/Configuration 204
+/Startup/User 200
+/Startup/User 204
+/Startup/RemoteAccess 204
+/Startup/Complete 204
+policy 204
+network cfg as Jellyfin loaded it: {'KnownProxies': ['172.16.0.0/12'], 'EnableRemoteAccess': True, 'InternalHttpPort': 8096, 'LocalNetworkSubnets': [], 'EnableIPv4': True, 'AutoDiscovery': True}
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j12-fresh-tunnel.txt b/documentation/audits/night-burndown-2026-10-06/r777/j12-fresh-tunnel.txt
new file mode 100644
index 00000000..1a4e24ce
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j12-fresh-tunnel.txt
@@ -0,0 +1,4 @@
+Error processing request.fresh-jellyfin-tunnel-remoteoff HTTP 403
+
+[20:50:47] [INF] [11] Jellyfin.Server.Implementations.Users.UserManager: Authentication request for r777remoteoff forbidden: remote access disabled and user not in local network (IP: 198.51.100.66).
+[20:50:47] [ERR] [11] Jellyfin.Api.Middleware.ExceptionMiddleware: Error processing request: [198.51.100.66] Forbidden. URL POST /Users/AuthenticateByName.
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j13-fresh-teardown.txt b/documentation/audits/night-burndown-2026-10-06/r777/j13-fresh-teardown.txt
new file mode 100644
index 00000000..099ff624
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j13-fresh-teardown.txt
@@ -0,0 +1,5 @@
+ Volume r777jf_jellyfin_config Removing 
+ Volume r777jf_jellyfin_cache Removed 
+ Volume r777jf_jellyfin_config Removed 
+0
+0
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j2-setup.txt b/documentation/audits/night-burndown-2026-10-06/r777/j2-setup.txt
new file mode 100644
index 00000000..67297a30
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j2-setup.txt
@@ -0,0 +1,11 @@
+20:45:57     gate: media is gated — passed as the household (cookie set)
+cfg 204
+getuser 200
+user 204
+remote 204
+complete 204
+admin auth 200
+new user 200
+policy 204
+readback EnableRemoteAccess = False
+network cfg 200 {'KnownProxies': [], 'LocalNetworkSubnets': [], 'LocalNetworkAddresses': [], 'EnableRemoteAccess': True, 'RemoteIPFilter': []}
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j3-jellyfin-log-before-fix.txt b/documentation/audits/night-burndown-2026-10-06/r777/j3-jellyfin-log-before-fix.txt
new file mode 100644
index 00000000..092b6255
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j3-jellyfin-log-before-fix.txt
@@ -0,0 +1,2 @@
+[20:46:22] [INF] [16] Jellyfin.Server.Implementations.Users.UserManager: Authentication request for r777remoteoff has succeeded.
+[20:46:22] [INF] [16] Emby.Server.Implementations.Session.SessionManager: Current/Max sessions for user r777remoteoff: 0/0
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j3-tunnel-before-fix.txt b/documentation/audits/night-burndown-2026-10-06/r777/j3-tunnel-before-fix.txt
new file mode 100644
index 00000000..1bd9a24d
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j3-tunnel-before-fix.txt
@@ -0,0 +1 @@
+jellyfin-tunnel-remoteoff HTTP 200
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j4-sessions-before-fix.txt b/documentation/audits/night-burndown-2026-10-06/r777/j4-sessions-before-fix.txt
new file mode 100644
index 00000000..8b3b4107
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j4-sessions-before-fix.txt
@@ -0,0 +1,2 @@
+r777remoteoff r777-tunnel RemoteEndPoint= 172.18.0.5 IsActive= True
+r777admin r777-dooplex RemoteEndPoint= 172.18.0.5 IsActive= True
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j5-fix-applied-existing.txt b/documentation/audits/night-burndown-2026-10-06/r777/j5-fix-applied-existing.txt
new file mode 100644
index 00000000..98a37ca8
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j5-fix-applied-existing.txt
@@ -0,0 +1,8 @@
+ Container jellyfin Recreated 
+ Container jellyfin Starting 
+ Container jellyfin Started 
+[felhom] network.xml: KnownProxies was empty, set to 172.16.0.0/12 (R-777)
+  <KnownProxies><string>172.16.0.0/12</string></KnownProxies>
+  <IgnoreVirtualInterfaces>true</IgnoreVirtualInterfaces>
+  <VirtualInterfaceNames>
+healthy
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j6-tunnel-after-fix.txt b/documentation/audits/night-burndown-2026-10-06/r777/j6-tunnel-after-fix.txt
new file mode 100644
index 00000000..e37f3dfc
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j6-tunnel-after-fix.txt
@@ -0,0 +1,3 @@
+Error processing request.jellyfin-tunnel-remoteoff-AFTER-FIX HTTP 403
+
+Error processing request.jellyfin-tunnel-FORGED-XFF-AFTER-FIX HTTP 403
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j7-lan-after-fix.txt b/documentation/audits/night-burndown-2026-10-06/r777/j7-lan-after-fix.txt
new file mode 100644
index 00000000..10956605
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j7-lan-after-fix.txt
@@ -0,0 +1,2 @@
+LAN (DooPlex 192.168.0.180 -> 9202:443) remote-off user sign-in: HTTP 200
+session r777admin r777-dooplex RemoteEndPoint= 192.168.0.180
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j8-jellyfin-log-after-fix.txt b/documentation/audits/night-burndown-2026-10-06/r777/j8-jellyfin-log-after-fix.txt
new file mode 100644
index 00000000..88d29380
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j8-jellyfin-log-after-fix.txt
@@ -0,0 +1,8 @@
+[20:48:23] [INF] [10] Jellyfin.Server.Implementations.Users.UserManager: Authentication request for r777remoteoff forbidden: remote access disabled and user not in local network (IP: 198.51.100.66).
+[20:48:23] [ERR] [10] Jellyfin.Api.Middleware.ExceptionMiddleware: Error processing request: [198.51.100.66] Forbidden. URL POST /Users/AuthenticateByName.
+[20:48:23] [INF] [10] Jellyfin.Server.Implementations.Users.UserManager: Authentication request for r777remoteoff forbidden: remote access disabled and user not in local network (IP: 198.51.100.66).
+[20:48:23] [ERR] [10] Jellyfin.Api.Middleware.ExceptionMiddleware: Error processing request: [198.51.100.66] Forbidden. URL POST /Users/AuthenticateByName.
+[20:48:24] [INF] [13] Jellyfin.Server.Implementations.Users.UserManager: Authentication request for r777remoteoff has succeeded.
+[20:48:24] [INF] [13] Emby.Server.Implementations.Session.SessionManager: Current/Max sessions for user r777remoteoff: 0/0
+[20:48:25] [INF] [13] Jellyfin.Server.Implementations.Users.UserManager: Authentication request for r777admin has succeeded.
+[20:48:25] [INF] [13] Emby.Server.Implementations.Session.SessionManager: Current/Max sessions for user r777admin: 0/0
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/j9-remove.txt b/documentation/audits/night-burndown-2026-10-06/r777/j9-remove.txt
new file mode 100644
index 00000000..7f01f7a4
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/j9-remove.txt
@@ -0,0 +1,5 @@
+20:48:48 stop 200
+20:49:20 remove (keep drive data — HDD_PATH is the drive root) 200 {'ok': True, 'data': {'removed': 'jellyfin', 'volumes_removed': ['jellyfin_jellyfin_cache', 'jellyfin_jellyfin_config'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'userdata_kept': ['/mnt/fel
+/opt/docker/stacks/jellyfin
+
+deployed: False
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/t1-copy-teardown.txt b/documentation/audits/night-burndown-2026-10-06/r777/t1-copy-teardown.txt
new file mode 100644
index 00000000..4fb2a7bd
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/t1-copy-teardown.txt
@@ -0,0 +1,2 @@
+ Volume r777emby_emby_config Removing 
+ Volume r777emby_emby_config Removed 
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/t2-remove-emby.txt b/documentation/audits/night-burndown-2026-10-06/r777/t2-remove-emby.txt
new file mode 100644
index 00000000..0945771a
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/t2-remove-emby.txt
@@ -0,0 +1,4 @@
+21:04:22 stop 200
+21:04:54 remove (keep drive data — HDD_PATH is the drive root) 200 {"ok": true, "data": {"removed": "emby", "volumes_removed": ["emby_emby_config"], "hdd_paths_removed": [], "hdd_paths_preserved": [], "userdata_kept": ["/mnt/felhom-drives/scratch_hdd/userdata/media (480K)"], "backup_paths_removed": ["/mnt/felhom-drives/scratch_hdd/backups/primary/emby (28K)"], "ver
+deployed: False
+app list equal to before: True
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/t3-guest-after.txt b/documentation/audits/night-burndown-2026-10-06/r777/t3-guest-after.txt
new file mode 100644
index 00000000..679a2a38
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/t3-guest-after.txt
@@ -0,0 +1,4 @@
+ls: cannot access '/root/r777': No such file or directory
+felhom-controller filebrowser paperless-postgres paperless-redis paperless-webserver traefik 
+no-test-volumes
+traefik 
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/tunnel-forge.sh b/documentation/audits/night-burndown-2026-10-06/r777/tunnel-forge.sh
new file mode 100644
index 00000000..c7d3b18a
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/tunnel-forge.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# as tunnel.sh, but the stranger forged X-Forwarded-For: 10.0.0.5 — Cloudflare APPENDS the real visitor, so the chain is "10.0.0.5, 198.51.100.66"
+SUB=$1; P=$2; LABEL=$3; IMG=$4
+H="$SUB.enkisfelhom.hu"
+docker run --rm -i --network felhom-tunnel --ip 172.16.253.2 --entrypoint curl "$IMG" -sk --max-time 20 \
+  --resolve "$H:443:172.16.253.3" -o /dev/stderr -w "$LABEL HTTP %{http_code}\n" \
+  -H 'CF-Connecting-IP: 198.51.100.66' -H 'X-Forwarded-For: 10.0.0.5, 198.51.100.66' -H 'X-Forwarded-Proto: https' \
+  -H 'Content-Type: application/json' -H 'X-Emby-Authorization: MediaBrowser Client="r777", Device="cli", DeviceId="r777-forge", Version="1.0"' \
+  -X POST --data-binary @- "https://$H$P"
diff --git a/documentation/audits/night-burndown-2026-10-06/r777/tunnel.sh b/documentation/audits/night-burndown-2026-10-06/r777/tunnel.sh
new file mode 100644
index 00000000..aa80f929
--- /dev/null
+++ b/documentation/audits/night-burndown-2026-10-06/r777/tunnel.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+# tunnel.sh <sub> <path> <json-body> <label> — a POST from 172.16.253.2 (cloudflared's fixed address) to traefik, as Cloudflare sends it:
+# CF-Connecting-IP + X-Forwarded-For = the visitor 198.51.100.66, X-Forwarded-Proto https. Body from stdin of this script's caller.
+SUB=$1; P=$2; LABEL=$3; IMG=$4
+H="$SUB.enkisfelhom.hu"
+docker run --rm -i --network felhom-tunnel --ip 172.16.253.2 --entrypoint curl "$IMG" -sk --max-time 20 \
+  --resolve "$H:443:172.16.253.3" -o /dev/stderr -w "$LABEL HTTP %{http_code}\n" \
+  -H 'CF-Connecting-IP: 198.51.100.66' -H 'X-Forwarded-For: 198.51.100.66' -H 'X-Forwarded-Proto: https' \
+  -H 'Content-Type: application/json' -H 'X-Emby-Authorization: MediaBrowser Client="r777", Device="cli", DeviceId="r777-tunnel", Version="1.0"' \
+  -X POST --data-binary @- "https://$H$P"
diff --git a/documentation/backlog/CLOSED-ITEMS.md b/documentation/backlog/CLOSED-ITEMS.md
index b3b88f79..ef883d96 100644
--- a/documentation/backlog/CLOSED-ITEMS.md
+++ b/documentation/backlog/CLOSED-ITEMS.md
@@ -32,6 +32,7 @@ The full text of every row below: `git show e866a66b56:documentation/backlog/OPE
 
 | Row | What | Closed | Evidence |
 |---|---|---|---|
+| **R-392** | **No architecture document covers the two-AI workflow.** (P4) — full text `git show 93b942f136:documentation/backlog/OPEN-ITEMS.md` | CLOSED 2026-10-06 night — WRITTEN | `documentation/architecture/12-agent-tooling.md`: the two roles and what each owns, where each kind of instruction lives, who may change an instruction file (decision 150), and why the boundaries sit where they do; it points at the doc-authoring skill and does not restate it. Routed from `.claude/rules/docs.md`. |
 | **R-377** | **`CONTEXT.md`'s standing rulings are 188 KB in one section with no sub-headings, and that is why nobody reads them.** (P4) | CLOSED 2026-10-06 night — DONE AS THE ROW SAID | 44 `### S-n (date)` sub-headings added above the rulings in `CONTEXT.md` § Standing rulings; no ruling's text edited, reordered or compressed (the diff is 88 added lines, 0 removed). Five ids are used twice in the log (S-11..S-15) — kept as written, the log is never edited. |
 
 ## 2026-10-06 (evening) — the design build
diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md
index 3b97cd10..bf533bcd 100644
--- a/documentation/backlog/OPEN-ITEMS.md
+++ b/documentation/backlog/OPEN-ITEMS.md
@@ -127,10 +127,10 @@ stopping line that lies.
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
 | **R-562** | Apps & catalog | P3 | **[P3-LOW] Dates and sizes are not formatted for any locale — and the Hungarian pages disagree with themselves.** FOUND 2026-09-17 by the i18n inventory §2.8: the two template date layouts differ (`2006. 01. 02. 15:04` Hungarian vs `2006-01-02 15:04` ISO); 10 layout literals in `internal/web` Go and 25 elsewhere pick formats ad hoc; sizes print a decimal POINT (`%.1f GB`, 4 helpers) where Hungarian uses a comma; `timeAgo`/`nextRunLabel`/`pruneLabel` produce Hungarian words outside the three converted pages. Not changed by v0.247.0 (Hungarian bytes are frozen by the parity rule). **Fix shape:** one date and one size formatter per language in `internal/i18n`, the Hungarian output deliberately changed in ONE reviewed release with the parity fixtures re-captured for that release only and the change named in its CHANGELOG. Needs an operator word on the Hungarian format (comma, date style). | **READY - rank P3-LOW; owner: CC** **2026-10-06 night: not started — the row needs the operator's word on the Hungarian format (decimal comma, date style) before any code.** | — | — | CC |
-| **R-612** | Apps & catalog | P3 | **[P1-HIGH] `wishlist` cannot be signed up to on a fresh Felhom install, the deploy reports SUCCESS, and the error the customer sees is a LIE.** MEASURED 2026-09-21 on guest 9202 while seeding for the power-cut drill. The image's first-boot `pnpm prisma db seed` is **`Killed` — OOM at the catalog's `mem_limit: 128M`**. Without it the `Role` and `Group` rows are absent, so **every** signup fails. **The message the user is shown is `User with username or email already exists`** while the container log says the real cause: `FOREIGN KEY constraint violated`. A household would conclude the account already exists and try to recover a password that was never created. **The controller reports the app running and HEALTHY throughout, and the deploy reported successful** — so nothing on the box says anything is wrong. Repaired on the scratch guest only, to unblock seeding: memory raised to 512 M, the image's own seed re-run, memory put back to 128 M. **The catalog was NOT changed** — the fix is a memory-limit question for the catalog and is deliberately left to a session that can measure the real ceiling rather than guess it. **Needs: the actual peak RSS of that seed, then a `mem_limit` that clears it, plus a check that the seed's failure is not silent.** **— FIXED 2026-09-23 night (catalog `a5a729a`): 512M.** Measured on the bench: the seed peaks at 312–345M and was OOM-killed at 128M on every run (kernel `oom_kill` 3); running, the app sits at ~115M (90 % of the old limit alone). On 9202 at 128M the kill came AFTER the Role/Group rows this time, so the sign-up lie did NOT reproduce — the kill is timing-dependent, the fault is memory (the brief's claim held). At 512M the seed completes (`The seed command has been executed`), and wishlist then moved v0.66.0 → v0.67.1 with its test record. **Still open:** a failed first-boot seed is invisible to the box — nothing reads the seed's exit. | **READY — P3, narrowed to making a failed seed visible; owner: CC (catalog)** **Re-ranked 2026-10-03: P1->P3: the memory fix shipped (catalog a5a729a); only the silent-seed detection remains.** | — | — | CC |
+| **R-612** | Apps & catalog | P3 | **[P1-HIGH] `wishlist` cannot be signed up to on a fresh Felhom install, the deploy reports SUCCESS, and the error the customer sees is a LIE.** MEASURED 2026-09-21 on guest 9202 while seeding for the power-cut drill. The image's first-boot `pnpm prisma db seed` is **`Killed` — OOM at the catalog's `mem_limit: 128M`**. Without it the `Role` and `Group` rows are absent, so **every** signup fails. **The message the user is shown is `User with username or email already exists`** while the container log says the real cause: `FOREIGN KEY constraint violated`. A household would conclude the account already exists and try to recover a password that was never created. **The controller reports the app running and HEALTHY throughout, and the deploy reported successful** — so nothing on the box says anything is wrong. Repaired on the scratch guest only, to unblock seeding: memory raised to 512 M, the image's own seed re-run, memory put back to 128 M. **The catalog was NOT changed** — the fix is a memory-limit question for the catalog and is deliberately left to a session that can measure the real ceiling rather than guess it. **Needs: the actual peak RSS of that seed, then a `mem_limit` that clears it, plus a check that the seed's failure is not silent.** **— FIXED 2026-09-23 night (catalog `a5a729a`): 512M.** Measured on the bench: the seed peaks at 312–345M and was OOM-killed at 128M on every run (kernel `oom_kill` 3); running, the app sits at ~115M (90 % of the old limit alone). On 9202 at 128M the kill came AFTER the Role/Group rows this time, so the sign-up lie did NOT reproduce — the kill is timing-dependent, the fault is memory (the brief's claim held). At 512M the seed completes (`The seed command has been executed`), and wishlist then moved v0.66.0 → v0.67.1 with its test record. **Still open:** a failed first-boot seed is invisible to the box — nothing reads the seed's exit. | **READY — P3, narrowed to making a failed seed visible; owner: CC (catalog)** **Re-ranked 2026-10-03: P1->P3: the memory fix shipped (catalog a5a729a); only the silent-seed detection remains.** **2026-10-06 night: fixed on catalog branch `night-held-2026-10-06`** (`d4150d7`) — the healthcheck needs the role rows and a group or user (node:sqlite, read-only); bench: seedless DB old check rc 0, new rc 1; seeded both rc 0 (`audits/night-burndown-2026-10-06/cat/R-612-red.txt`). Reaches main after the read-back. | — | — | CC |
 | **R-676** | Apps & catalog | P3 | **[P3-LOW] Watch: immich's first start restarted 12 times — decision 28's crash-loop stop (6 in 10 min) would stop it.** From the 2026-09-17 chaos night (DB connection dropped during the first-start geocoding import on a 6 GB guest; it did not recover that night). No healthy app in any drill evidence restarts on a first start (1831 samples, 40 live containers), so the threshold stands; this row exists so the first immich install under v0.269.x is watched. `audits/night-2026-09-24/A3/40-first-start-restarts.txt` **2026-09-25 night (read from source, v0.271.0): a DEPLOY's first start is NOT covered by decision 28's suppression** — `Deploying` clears when `compose up -d` returns (`deploy.go` "Clear deploying flag"), and `ObserveUnhealthy` then samples the app; an automatic update's step, verify and undo ARE covered (`Updating`, pinned by `TestD28_NoCrashLoopStopDuringAnAutomaticStep`). So a first start that restarts ≥ 6 times in 10 min is stopped — which R-676 already accepts for a broken first start; a healthy slow first start would be stopped too. **-- 2026-09-30: the first-start restarts are explained.** immich's first-start geodata import OOM-kills its database at 512M on a guest with no swap (R-732, measured: 61–104 kills); the 2026-09-17 chaos-night case (DB connection dropped during the import on a 6 GB guest) fits it. Fixed in the catalog (`56c4888`, 768M). The watch itself (decision 28 on a DEPLOY's first start) is unchanged. | **OPEN — P3; owner: CC (watch)** | — | — | CC |
 | **R-762** | Apps & catalog | P3 | **[P2-MEDIUM] wger serves no CSS or JavaScript and no uploaded photo: every static file and every `/media/` file answers 404.** MEASURED 2026-10-01 on 9202 (drill catalog, the live template `82fff32`, wger 2.7), found by checklist rows 1.7 and 2.8: the login page links `/static/css/workout-manager.css`, `/static/bootstrap-compiled.css` — both 404 through traefik; the static root inside the container is empty (4 KB). A progress photo posted to `/api/v2/gallery/` answered 201 and the file is on the media volume, but `GET /media/gallery/…png` answers 404 signed in, without a session, and straight at the app inside the container. **Cause, read in the image:** the entrypoint runs `collectstatic` only when `DJANGO_DEBUG == "False"` and the template sets no `DJANGO_DEBUG`; and wger serves `/media/` only in development (`urls.py:393` „served like this during development only”) — upstream's production setup puts nginx in front for `/static` and `/media`. So the household gets an unstyled app and photos that never show. The same lines stand since the template was written (the 2026-09-29 template too). Not checked: whether any box runs wger (on 2026-09-30 none reported to the hub). **Needs:** `DJANGO_DEBUG=False` (collectstatic) and something that serves `/static` + `/media` (upstream's nginx sidecar, or the gunicorn switch of R-755 plus a static server), proven on the bench and on 9202 with a page that loads its CSS and a photo read back. Owner decides together with R-755 (same server question). `audits/new-app-checklist-2026-10-01/C/C8-signup-guest-media-static.txt`, `C/C4-seed-photo-size.txt` **-- 2026-10-01 (operator):** wger is `lifecycle: hidden` until this and its twin are fixed (catalog `55b8c8a`; read back on 9202: not on the app list, mealie control present). **Merged 2026-10-05 from R-755 (duplicate):** `templates/wger/docker-compose.yml` still sets no `WGER_USE_GUNICORN` — the gunicorn switch is the same server question. **-- 2026-10-06 (afternoon), measured again on 9202 (live template, wger 2.7):** `/static/css/workout-manager.css` 404 straight at the app, `/home/wger/static` 4 KB, settings `DEBUG False`; the image has gunicorn but no whitenoise and runs Django's `runserver` (no `WGER_USE_GUNICORN`, R-755). So `DJANGO_DEBUG=False` alone would collect the files and still serve none: the fix needs a server for `/static` + `/media` (a second container) — medium, not taken. `audits/r890-instructions-2026-10-06/C/wger.txt`. | **READY — rank P2-MEDIUM; owner: CC (catalog)** **Re-ranked 2026-10-03: P2→P3: wger is hidden from installs and no box runs it; needed only before it is offered again.** **2026-10-06: NARROWED — the files are served.** Catalog `cf1ed43`: `DJANGO_DEBUG=False` + a `wger-files` nginx serving `/static` and `/media`, a definition step proven on the bench (harness v5) and on 9202 (photo 404 → 200, CSS 404 → 200). **What remains is R-755's merged half:** wger still runs Django's `runserver`; upstream's gunicorn runs 3 workers, which do not fit wger's 384 MB — a memory decision and a new proof. Known cost of the fix: the collected static files are 283 MB in a named volume, in every backup of wger. Ready to show? Its files and sign-up are fixed and proven; the server question is open — `audits/design-build-2026-10-06/`F/. | — | Decide the gunicorn worker count against the memory limit, prove it on both venues; then the operator decides whether wger is shown. If nothing: wger stays hidden | CC |
-| **R-76** | Apps & catalog | P4 | **FileBrowser-created folders break the setgid chain, and a drop-zone's mode is not stable** **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-26, size S, roadmap state `idea (surfaced by the R-75 spike, 2026-07-26)`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** | — | Two related findings from `audits/SPIKE-catalog-data-paths-2026-07-26.md` P3/P5, both **pre-existing** and deliberately left alone by that spike. **(a)** FileBrowser Quantum 1.3.3 creates files `0644` and folders `0755` and does **not** propagate the setgid bit — even though the entrypoint wrapper's `umask 002` really is in effect (`/proc/1/status` `Umask: 0002`). Group inheritance itself works (a file uploaded into a 2775 group-100 dir landed group 100, not the process gid 1000), so the convention's *group* half holds and only its *mode* half is lost. The consequence is proven with a control: inside a UI-created `0755` folder a gid-1000 process's file landed group **1000**, while the identical write into the 2775 parent landed group **100**. So **any folder a customer creates through FileBrowser breaks the shared-group chain one level down.** Latent today — every userdata-touching catalog app that declares an identity declares uid/gid **1000**, the same uid FileBrowser runs as, so owner permissions mask it; it bites the day a content app runs as a different non-root uid with gid 1000. The comment at `infra/infra.go:156` is right that the image ignores `-e UMASK` but does not say t | CC |
+| **R-76** | Apps & catalog | P4 | **FileBrowser-created folders break the setgid chain, and a drop-zone's mode is not stable** **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-26, size S, roadmap state `idea (surfaced by the R-75 spike, 2026-07-26)`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** **2026-10-06 night: not a catalog fix** — the setgid chain is set by the controller's FileBrowser setup; a controller row. | — | Two related findings from `audits/SPIKE-catalog-data-paths-2026-07-26.md` P3/P5, both **pre-existing** and deliberately left alone by that spike. **(a)** FileBrowser Quantum 1.3.3 creates files `0644` and folders `0755` and does **not** propagate the setgid bit — even though the entrypoint wrapper's `umask 002` really is in effect (`/proc/1/status` `Umask: 0002`). Group inheritance itself works (a file uploaded into a 2775 group-100 dir landed group 100, not the process gid 1000), so the convention's *group* half holds and only its *mode* half is lost. The consequence is proven with a control: inside a UI-created `0755` folder a gid-1000 process's file landed group **1000**, while the identical write into the 2775 parent landed group **100**. So **any folder a customer creates through FileBrowser breaks the shared-group chain one level down.** Latent today — every userdata-touching catalog app that declares an identity declares uid/gid **1000**, the same uid FileBrowser runs as, so owner permissions mask it; it bites the day a content app runs as a different non-root uid with gid 1000. The comment at `infra/infra.go:156` is right that the image ignores `-e UMASK` but does not say t | CC |
 | **R-577** | Apps & catalog | P4 | **[P3-LOW] A guest SHARE visitor has no way to pick a language, and the household's setting is the wrong default for them.** FOUND 2026-09-18 by localisation slice 2 release C (R-557, controller v0.254.0): every other page a person can reach now carries a language globe — the dashboard (the household's setting), and the sign-in and claim pages (the visitor's own cookie). The two guest share pages (`launcher_shared`, `launcher_share_password`) deliberately do NOT, and `TestGuestSharePagesHaveNoGlobe` pins that so it stays a decision rather than an oversight. **Why it is the operator's and not CC's:** a share visitor is a stranger the household sent a link to, and what language they are shown is a promise the SHARE FEATURE makes, not an implementation detail. The `felhom_lang` cookie already built would fit them exactly (display-only, their own browser, never the household's setting). **Fix shape, if the operator says yes:** add `{{template "lang_globe" .}}` to both shells with the anonymous form, and one render case per page per language. | **READY - rank P3-LOW; owner: operator (the decision), CC (the change)** **Re-ranked 2026-10-03: P3->P4: feature decision for the operator; Hungarian default works today.** | — | — | operator |
 | **R-707** | Apps & catalog | P4 | **[P2] 37 apps still start with a login a stranger can take (`09` §3 decision 45).** Audit of all 53 apps: `app-catalog-felhom.eu/FIRST-ADMIN.md` (class, fix route, status, measured or read). Open: **3 hard-coded defaults** — calibre-web (`admin / admin123`, measured working on demo-hp and 9202; its own `cps.py -s` route needs a generated password WITH a special character — our generator is letters+digits, a controller change), mealie (`changeme@example.com / MyPassword`), wger (`admin / adminadmin`); **34 open first-run screens** (the first visitor creates the admin: actualbudget, adventurelog, audiobookshelf, calcom, docmost, emby, ghost, gitea, gramps-web, home-assistant, homebox, immich, jellyfin, komga, n8n, navidrome, opengist, outline, papra, plant-it, radarr, rallly, recipe-importer, romm, seerr, sonarr, sparkyfitness, tandoor, termix, uptime-kuma, vikunja, wanderer, wishlist, zipline). **Stale notes:** romm's `default_creds` `admin / admin` answers 401 on demo-hp (like a wrong password) — the page now warns with a login that does not exist; zipline's looks stale too. **Measured on demo-hp 2026-09-28 (read-only):** bookstack's default still logs in on the INSTALLED app (the fix is for new installs; the page now warns). Each fix: route (a) env or (b) the app's own CLI/API via `after_install:`, proven on 9202 with the default failing and the generated password working; route (c) a page sentence. Several sessions (operator, 2026-09-28). **2026-09-29 (controller v0.280.0, catalog `d0e7e2e`):** every class-3 app fixed — mealie, wger, calibre-web by `after_install` (calibre-web with the new `password:24:special`), proven on 9202 fresh installs (`audits/login-gate-2026-09-29/D/`); the setup gate (decision 46, spike PASSED) built and live on immich, n8n, audiobookshelf (probes measured) and uptime-kuma (button) (`…/C/`); romm's and zipline's stale notes removed. **Left: 30 class-4 apps** — gate each (probe measured on 9202 where one exists — 11 upstream candidates listed in `…/B/B-VERDICT.md` §3; the button otherwise). **2026-09-29 afternoon (controller v0.281.0, catalog `6faf432`):** 28 more class-4 apps gated — 32 of 34 — each proven on 9202 (`audits/gate-rollout-2026-09-29/`B): stranger → gate page / 401, household reached the first-setup screen, the gate opened (9 by a measured probe, the rest by the press), the app answered after. seerr, outline, rallly: gated, their opening needs a media server / e-mail (not proven). **Left:** wanderer (R-714); plant-it is not installable. | **NARROWED** (2026-10-03 triage: the row's verdict was finished, but it names open work no other row carries — seerr, outline and rallly are gated, but the gate OPENING is not proven (needs a media server / e-mail)) — **CLOSED — 2026-09-29 (the rest → R-714)** | — | — | CC |
 | **R-769** | Apps & catalog | P4 | **[P3-LOW] Pinchflat is not built: upstream is paused (no release in 2026, last push 2025-12-16) and its last release has no image tag.** READ 2026-10-01: ghcr's newest version tag `v2025.6.6`, `latest` amd64 only; runs as root by default; an unanswered 30 GB yt-dlp memory report (#866); third parties call it unmaintained (community-scripts #15968). Forks with images exist (Pinchflat-NGX, MorganKryze). **Needs:** the operator's word on a fork (a new upstream), after the YouTube sentence (R-767). `audits/new-apps-2026-10-01/FIT.md` | **WAITING-ON-OPERATOR — rank P3-LOW; owner: operator** **Re-ranked 2026-10-03: P3→P4: a new-app idea waiting on a decision.** | — | — | operator |
@@ -201,7 +201,7 @@ stopping line that lies.
 
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
-| **R-777** | Security & access | P2 | **[P2-MEDIUM] Emby and Jellyfin treat every internet visitor as being on the LAN — users with "remote access" off can sign in from the internet, IP filters and remote limits are skipped.** READ in source (`audits/visitors-2026-10-01/A/sweep/sweep-1.md`, `sweep-2.md`), not measured live: Jellyfin with `KnownProxies` empty uses the TCP peer (traefik, private) → "LAN"; Emby reads the leftmost XFF (its chain is now removed by the R-753 reset, so it sees cloudflared's private address → "LAN", as before). True before R-753 too; R-753 neither caused nor fixed it. **Needs:** measure on 9202 (a user with remote access off, through the simulated tunnel); Jellyfin: `KnownProxies` `172.16.0.0/12` in `network.xml` (no env — an `after_install` or a seed file); Emby: no setting fixes it (its `LocalNetworkSubnets` still counts private ranges) — a page sentence or a decision. | **READY — rank P2-MEDIUM; owner: CC (measure), operator (Emby route)** | — | — | CC + operator |
+| **R-777** | Security & access | P2 | **[P2-MEDIUM] Emby and Jellyfin treat every internet visitor as being on the LAN — users with "remote access" off can sign in from the internet, IP filters and remote limits are skipped.** READ in source (`audits/visitors-2026-10-01/A/sweep/sweep-1.md`, `sweep-2.md`), not measured live: Jellyfin with `KnownProxies` empty uses the TCP peer (traefik, private) → "LAN"; Emby reads the leftmost XFF (its chain is now removed by the R-753 reset, so it sees cloudflared's private address → "LAN", as before). True before R-753 too; R-753 neither caused nor fixed it. **Needs:** measure on 9202 (a user with remote access off, through the simulated tunnel); Jellyfin: `KnownProxies` `172.16.0.0/12` in `network.xml` (no env — an `after_install` or a seed file); Emby: no setting fixes it (its `LocalNetworkSubnets` still counts private ranges) — a page sentence or a decision. | **READY — rank P2-MEDIUM; owner: CC (measure), operator (Emby route)** **2026-10-06 night: MEASURED on 9202 through the simulated tunnel, and fixed on the held catalog branch `night-held-2026-10-06` (`e5a5984`).** A remote-access-OFF user signed in from the internet on both apps (200): Jellyfin saw traefik `172.18.0.5`, Emby saw cloudflared `172.16.253.2`. Fix: Jellyfin `KnownProxies 172.16.0.0/12` in `network.xml`; Emby `LocalNetworkSubnets 10.0.0.0/8, 192.168.0.0/16` in `system.xml`; both seeded at start, only on a fresh volume or into an empty list. After: tunnel 403 (Jellyfin logs the visitor `198.51.100.66`), forged XFF 403, LAN household 200. **The row's „no setting fixes Emby" was wrong** (read in source, never measured) — no operator route needed. Cost: a 172.16–31.x home LAN counts as remote. Closes when merged to main and synced. `audits/night-burndown-2026-10-06/r777/RESULT.md` | — | — | CC + operator |
 | **R-861** | Security & access | P2 | **The agent's sudoers lets the agent user reach root without the operator key, so "root-minimized" (`03` §3) overstates it and the root-owned trust files (decision 93, the bundle's R17) are defence in depth, not a boundary.** READ 2026-10-04 from `felhom-agent/configs/felhom-agent.sudoers` (not exploited): `FELHOM_GUESTHOOK` installs `/tmp/felhom-guest-hook-*.sh` as a hookscript Proxmox runs as root at guest start, and `pct reboot` is granted; `FELHOM_INTERMEDIARY` installs a script + a systemd unit that run as root at boot; `FELHOM_ESCROW` runs `/usr/local/bin/felhom-agent` as root, and `FELHOM_SELFUPDATE apply` accepts a sha the agent itself passes. A compromised agent PROCESS is therefore root on its host. Fix direction: each of the four becomes a root-owned wrapper that checks its own input (fixed content or a signature), like `felhom-os-apply`; delivered by the config bundle. `11` §5.4.2, `03` §11. | **NARROWED 2026-10-05 — FIXED agent v0.146.1 for every root path found (nine, not four), delivered to demo-hp, demo-felhom and Tester 1 by a step bundle (R-880); live on both demo boxes: `sudo -l` 93/93 (64 commands allowed, 29 attacks refused — 23 of them allowed before), capability probe 67/67, a staged unit over /etc/sudoers.d refused. Design `03` §3.1, decision 122. LEFT, each named there: (a) the controller-swap image ref is guest-scoped (a compromised agent can run a chosen pinned-registry image in the guest); (b) the felhom-op SSH key is hub-delivered, not signed (felhom-op's sudo is scoped, not root); (c) the escrow ceremony hands the agent R by design (the box's PBS key). Tester 2: not delivered (offline).** **2026-10-06 night: design written** (`audits/night-burndown-2026-10-06/design-R-861.md`). Correction: (a) is not "pinned-registry" — the `tee` content is unchecked by sudo, so any image from any registry runs in the guest with the docker socket (`03` §3.1 corrected). Pick: (a) close before the first paying customer (a `felhom-priv-apply controller-image` verb; ~1–2 h, rides the bundle); (b) and (c) accept for the first customers. Waits for the operator. | — | the operator decides whether (a)–(c) are accepted or need work before the first paying customer | CC |
 | **R-132** | Security & access | P3 | **`curl -w '%{redirect_url}'` reconstructs the request URL WITH its basic-auth credential** — so a `-u ":$HUB_PW"` call that never put the password in a URL still printed it **Merged 2026-10-05 from R-350 (duplicate):** (1) 2026-08-20 occurrence: POST /configuration/artifacts answers 303; leak lives only in the CC transcript under ~/.claude/projects/ on DooPlex, not in git/evidence (checked then). (2) `-v` and `--libcurl` also re-render the credential, not only %{redirect_url}; confirm redirects with %{http_code} + follow-up GET. (3) Rotation path: hub /configuration form (current_password/new_password/confirm_password); DB override wins over ConfigMap (break-glass); CC can rotate file-to-file without printing (operator-present-one-time-secrets) if asked. | **WAITING-ON-OPERATOR** — **ACTION: rotate `HUB_PW`** **Folded R-580 2026-10-03** (the same `curl -w %{redirect_url}` credential echo, seen again 2026-09-18). | — | Happened on 2026-07-31 while red-proofing the R-120 gate: the hub operator password was written to the session transcript by the write-out format, not by the request. `-u` is safe; the *reporting* was not. Rule: read the redirect from `-D -` and grep `^Location:`, never `%{redirect_url}`, on any authenticated call. Rotate the hub password (`/configuration` → Login password; ConfigMap `auth.password_hash` is the reset path) and update `~/.config/credentials` | Viktor |
 | **R-137** | Security & access | P3 | **Cloudflare geo-WAF rules are zone-scoped and non-namespaced — four cross-tenant faults.** `globalRuleDesc = "[felhom-geo] Global"` (`waf.go:18`) is one literal description per ZONE; `appRuleDescPrefix` keys by app name with no customer (`waf.go:21`); `BuildGlobalExpression` has no positive hostname scoping (`waf.go:241`); `applyDiff` deletes every `[felhom-geo]` rule not in THIS box's desired set (`geosync.go:320`) | READY (M) — **blocks shared-zone onboarding** | — | With two customers in one zone: they overwrite each other's Global rule forever; one customer's country policy applies zone-wide; per-app rules collide by name; and disabling the feature for one (or the hub's `RemoveGeoRules`) wipes them all. Interim mitigation, no code: keep geo-restriction OFF for every shared-zone customer. Fix = namespace descriptions by `customer_id` + add `http.host ends_with "<domain>"` to both expressions — a TWO-REPO change (controller + hub `RemoveGeoRules`). Same audit §5.1 | CC |
@@ -211,7 +211,7 @@ stopping line that lies.
 | **R-616** | Security & access | P3 | **[P3-LOW] The catalog credentials are stored in PLAINTEXT in the box's catalog clone and are printed by an ordinary `git remote -v`.** FOUND 2026-09-21 on guest 9202 while pointing it at a private drill catalog. `Syncer.buildRepoURL` injects `username:token` into the HTTPS URL, and `git clone` persists that URL as the clone's `origin`, so `<data>/catalog-cache/.git/config` holds the token in the clear and **any** diagnostic that prints the remote leaks it — which is what happened in this session's own transcript, and is the same shape as R-580 (`curl -w '%{redirect_url}'`). `maskRepoURL` exists and is used for the LOG lines, so the masking intent is already there; the stored remote is the half that was missed. **INERT ON THE FLEET TODAY** — the live catalog is public and `git.token` is empty on every real box — which is exactly why it should be fixed before it is not: the day the catalog goes private, every box carries a readable credential and every support session that runs `git remote -v` prints it. **Fix shape:** store the remote WITHOUT credentials and supply them per-fetch (a credential helper, `http.extraHeader`, or `GIT_ASKPASS`), and a test asserting the clone's stored `origin` contains no `@`. **Operator action from tonight, unrelated to the fix:** the Gitea `admin` token used for the drill repo was printed by that command and must be rotated. Evidence: `audits/update-night-2026-09-21/05-9202-follows-drill.txt` (redacted). | **READY — rank P3-LOW; owner: CC (controller); one operator action (rotate the Gitea admin token)** **2026-10-05 (burn-down night): FIXED on controller `main`** (`28a5203`; the catalog clone stores no credentials; the token is supplied per fetch; R-615's repo comparison ignores credentials on both sides, so a token never re-clones (`TestR616_TokenSetSameRepoNoRecloneOriginClean`) and a credentialed origin is cleaned at the next pull. The operator's Gitea admin token rotation (the row's second half) is still owed). Ships with the next controller release; close after delivery. **2026-10-06: DELIVERED** in controller v0.298.0 (the clone stores no credentials). Left: the operator's Gitea admin token rotation. | — | — | CC + operator |
 | **R-717** | Security & access | P3 | **[P3-LOW] opengist and wishlist keep their sign-up switch only in their own database — the box closes them with the address block alone.** MEASURED 2026-09-29: opengist `disable-signup` is an admin-panel setting (no env, no CLI); wishlist `system_config.enableSignup` (Prisma). Their blocks are case-insensitive and refused every trick shape (`audits/signup-lock-2026-09-29/B/`). **Fix direction:** an `after_setup` command that sets the database value (wishlist: a Node/Prisma one-liner; opengist: needs its sqlite with the app stopped). **-- 2026-10-06 (afternoon): NEEDS A DESIGN.** The controller's `after_setup` command form runs only when the lock is SET (`internal/stacks/after_setup.go` `applyNativeLock`, `lock && len(spec.Command) > 0`); the household's 15-minute window lifts only the env form. A database switch closed by a command would stay closed through the window, so the household could not let a family member sign up. Needs a lift command (an `open` twin) in the controller first. | **OPEN — P3; owner: CC** **2026-10-06: NARROWED to opengist.** Controller v0.301.0 gives `after_setup` an `open_command`; **wishlist uses it, proven live on 9202** (after the setup the switch read closed and a stranger got 401 "invite only"; inside the window open and a family member signed up, users 1 → 2; at the window's end the close ran again 10 s later, a stranger 401, users stayed 2) — `audits/design-build-2026-10-06/`E/. **Opengist cannot:** its container has no sqlite tool and no script runtime, and its CLI has no settings command; it keeps the address block alone. | — | Opengist only: needs a way to write its setting (a helper container in the template, or an upstream CLI/env switch) — a design. If nothing: opengist stays closed by the address block alone | CC |
 | **R-775** | Security & access | P3 | **[P2-MEDIUM] Grimmory: a stranger's 5 wrong sign-ins lock EVERY visitor out of the web login for 15 minutes — so Grimmory was not published.** MEASURED 2026-10-01 on 9202 (drill catalog, v3.4.1, through traefik): after 5 wrong tries for `admin` every further sign-in answered 429 — the household's right password AND a different name — and stayed 429 for 10+ minutes of retries. Read in the jar: `AuthRateLimitService` — Caffeine `expireAfterWrite(ofMinutes(15))`, `MAX_ATTEMPTS 5`, keys `login:ip:` and `login:user:`; Spring `forward-headers-strategy: native` takes the address from X-Forwarded-For, and behind the tunnel every visitor is the tunnel container's address (R-753) — the wger shape (R-752), with no setting to change it. Everything else in the checklist passed (bench + box step v3.4.1 → v3.5.0, gate by its own probe, OPDS through traefik); two smaller findings for the publishing session: on a reinstall over the first install's kept books, a new upload was saved to the drive but not added to the library (`box/grimmory/reinstall-c1.txt`, not investigated); and the remove + restore round trip (2.5) cannot be shown on 9202 for a drive app — its backup lives on the scratch drive, which is not a registered drive (R-756). The template waits in `audits/new-apps-2026-10-01/wip/grimmory/`. **Needs (operator):** (A) publish with a sentence on the page that wrong guesses by others can lock the login for 15 minutes (MEASURED: during the lock an e-reader's OPDS feed still answered 200 with its own login, wrong 401 — `box/grimmory/opds-under-lock.txt`), or (B) wait until the box passes each visitor's real address (R-753). `audits/new-apps-2026-10-01/box/grimmory/throttle.txt` **-- 2026-10-01 (evening):** option B's precondition SHIPPED (controller v0.286.1, R-753): Grimmory's Tomcat RemoteIpValve walks from the right and counts `172.16.0.0/12` as a proxy (READ in source, Spring Boot 4.1.1 — not yet measured with Grimmory's own lock), so `login:ip:` becomes per visitor; `login:user:` still lets a stranger lock the public name `admin` 15 min. A third route was spiked and passed: Grimmory behind the permanent family gate with its e-reader paths excepted (R-780). Recommendation: publish behind the family gate if R-780 is built; otherwise B with a measured 3.6. **UPDATE 2026-10-02 — NARROWED, Grimmory PUBLISHED behind the family gate:** a stranger cannot reach Grimmory's web sign-in at all (6 tries through the simulated tunnel: the gate's 401, then the household signs in 200 — `audits/family-gate-2026-10-02/A/items.txt`), and the e-reader exceptions keep Grimmory's own login. The 2.5 round trip now WORKS on 9202 (`audits/family-gate-2026-10-02/B/box/life.txt`). **What is left:** a family member past the gate can still lock a NAME (the admin's) for 15 minutes with 5 wrong tries — hard-coded in Grimmory; and the reinstall-over-kept-books finding (`new-apps-2026-10-01/box/grimmory/reinstall-c1.txt`) is still not investigated. | **WATCHING — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P2→P3: Grimmory is now behind the family gate; only a family member can still lock a name.** | — | — | CC |
-| **R-782** | Security & access | P3 | **[P3-LOW] Two side observations of the R-753 sweep, inferred, not measured:** glance's seeded `glance.yml` has no `auth:` block (the dashboard is public to anyone with the address), and homepage's `/api/*` refuses a Host not in `HOMEPAGE_ALLOWED_HOSTS`, which the template does not set (widgets may 400). **Needs:** measure both on 9202; glance: decide whether a public link dashboard is intended (the setup gate does not cover it after setup). | **READY — rank P3-LOW; owner: CC (catalog)** | — | — | CC |
+| **R-782** | Security & access | P3 | **[P3-LOW] Two side observations of the R-753 sweep, inferred, not measured:** glance's seeded `glance.yml` has no `auth:` block (the dashboard is public to anyone with the address), and homepage's `/api/*` refuses a Host not in `HOMEPAGE_ALLOWED_HOSTS`, which the template does not set (widgets may 400). **Needs:** measure both on 9202; glance: decide whether a public link dashboard is intended (the setup gate does not cover it after setup). | **READY — rank P3-LOW; owner: CC (catalog)** **2026-10-06 night: homepage fixed on catalog branch `night-held-2026-10-06`** (`093e5ed`): `HOMEPAGE_ALLOWED_HOSTS=${SUBDOMAIN}.${DOMAIN}`; bench: `/api/services` 400 → 200. Glance measured: public (`GET /` 200 with no login, no auth block, `/login` 404) — whether it gets a login is the operator's question; the row stays open for it (`cat/R-782-red.txt`). | — | — | CC |
 | **R-831** | Security & access | P3 | **The Hetzner storage API token (`HETZNER_TOKEN`, the storage project's token in `Secret/storagebox`) was printed into the 2026-10-03 session transcript** — CC read the gitignored `manifests/storagebox.secret.yaml` and its redaction pattern missed the quoted value. It can create, reset and delete Storage Box sub-accounts. Not rotated by the operator's choice (decision 73). **Rotation, whenever chosen (3 steps):** create a new token in the storage project in the Hetzner console → patch `Secret/storagebox` key `HETZNER_TOKEN` in `felhom-system` and `kubectl rollout restart deployment/hub` → delete the old token in the console. Rule for sessions: never print a file that holds secrets — read the one field needed. | **WAITING-ON-OPERATOR — rotation is his call** **Not rotated by the operator's rulings (2026-10-04 „keep using the current one"; 2026-10-05 option B) — restated 2026-10-05 18:23; the steps stay here.** | — | rotate when chosen | operator |
 | **R-870** | Security & access | P3 | **Tester 1's two Cloudflare credentials — the zone API token (`infrastructure.cf_api_token`) and the tunnel token (`infrastructure.cf_tunnel_token`) of the hub's `customer_configs` row `tester-1` — were printed into the 2026-10-04 night session's transcript** (not into any file): a read-only query selected `substr(config_json,1,400)`, and both values sit in the first 400 characters. Tester 1 is CC's disposable test customer (`enkicsifelhom.hu`). **Not rotated, by the operator's ruling of 2026-10-05 06:49 (option B).** **Rotation, whenever chosen (3 steps):** in the Cloudflare dashboard create a new API token for the `enkicsifelhom.hu` zone with the same permissions and refresh the Tester 1 tunnel's token (Zero Trust → Networks → Tunnels → the tunnel → refresh token) → hub → Configs → `tester-1` → Edit → the two Cloudflare fields → Save, then confirm on the box that cloudflared reconnected (`docker ps` health `healthy`) → delete the old API token. Rule for sessions (as R-831): never select a whole config row — name the fields, and never `config_json` without `json_extract` of a non-secret field. | **WAITING-ON-OPERATOR — rotation is his call (ruled: not now)** **Not rotated by the operator's rulings (2026-10-04 „keep using the current one"; 2026-10-05 option B) — restated 2026-10-05 18:23; the steps stay here.** | — | rotate when chosen | operator |
 | **R-525** | Security & access | P4 | **[P3-LOW] FileBrowser has its own login; putting it behind the dashboard session (traefik forwardAuth or Quantum proxy auth) is a new mechanism nobody has measured.** Filed 2026-09-15 by the P1-fixes task (B.5). R-513 closed the default-password hole with a generated password; a household still has two logins. **What it needs:** a spike on a scratch guest — forwardAuth to the controller session, and what FileBrowser Quantum does with a trusted header. | **READY — rank P3-LOW; owner: CC (spike)** **Re-ranked 2026-10-03: P3->P4: comfort feature needing a new unmeasured mechanism; the default password hole is closed.** | — | — | CC |
@@ -278,11 +278,11 @@ stopping line that lies.
 | **R-89** | Business & legal | P4 | Retention as a per-customer **commercial** policy on the hub | READY (increment 2) | — | Policy object + reconciler → ep0 prune job; keep box tokens write-only | CC |
 | **R-794** | Business & legal | P4 | **[P3-LOW] redis 7.4 (RSALv2 / SSPL, not OSI) runs as a private cache in seven apps: dawarich, docmost, immich, nextcloud, outline, paperless-ngx, romm.** READ 2026-10-02 (`audits/licences-2026-10-02/TABLE.md`). Read as permitted (a private cache only its app uses is not Redis offered as a service — inferred). Valkey (BSD-3) or redis 8 (AGPL option) removes the question. **Needs:** a ladder step per app to valkey or redis 8, through the harness — no hurry. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: the row itself says no hurry; usage read as permitted.** | — | — | CC |
 
-## Process & tooling — 22 rows (P3 2, P4 20)
+## Process & tooling — 21 rows (P3 2, P4 19)
 
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
-| **R-733** | Process & tooling | P3 | **[P3-LOW] The test bench has NO swap and the boxes have 512 MiB — so a box proof can pass on swap where the bench fails, and nobody records whether a customer guest has swap.** MEASURED 2026-09-30 (R-732): immich's first start was OOM-killed 61–104 times on the bench (swap 0) and passed on 9202 by swapping ~108 MB; the bench given 512 MiB swap passed too. demo-hp 9201, 9202 and demo-felhom 9201 all read `swap: 512`; the golden's guest config is not recorded in its bake evidence, so a customer guest's swap is NOT measured. The harness's memory watch judges `anon` against the limit and never reads `memory.swap.current`. **Needs:** the golden's `swap` read and recorded; the box walk and the harness report `memory.swap.peak` beside `anon`; a decision whether proofs run with swap off (the stricter venue, as R-732's fix was proven). | **READY — rank P3-LOW; owner: CC (harness + golden evidence)** | — | — | CC |
+| **R-733** | Process & tooling | P3 | **[P3-LOW] The test bench has NO swap and the boxes have 512 MiB — so a box proof can pass on swap where the bench fails, and nobody records whether a customer guest has swap.** MEASURED 2026-09-30 (R-732): immich's first start was OOM-killed 61–104 times on the bench (swap 0) and passed on 9202 by swapping ~108 MB; the bench given 512 MiB swap passed too. demo-hp 9201, 9202 and demo-felhom 9201 all read `swap: 512`; the golden's guest config is not recorded in its bake evidence, so a customer guest's swap is NOT measured. The harness's memory watch judges `anon` against the limit and never reads `memory.swap.current`. **Needs:** the golden's `swap` read and recorded; the box walk and the harness report `memory.swap.peak` beside `anon`; a decision whether proofs run with swap off (the stricter venue, as R-732's fix was proven). | **READY — rank P3-LOW; owner: CC (harness + golden evidence)** **2026-10-06 night: NARROWED** — the harness records each container's `swap_peak` and the venue's swap (catalog branch `night-held-2026-10-06`, `3f4611c`; SwapRecorded red-proved; bench SwapTotal 0 kB, 9202 524288 kB). LEFT: the golden's swap in its bake evidence, the box walk's record, and whether proofs run with swap off. | — | — | CC |
 | **R-887** | Process & tooling | P3 | **Some CI jobs are never run, and Gitea fails them ~10–13 minutes later with no log.** Seen 2026-10-05: felhom.eu job 1361 (commit `1122b5c`) and felhom-controller job 1357 (`114ff27`): every step reads `failure`, including the first fetch, the log API answers `file does not exist`, and the runner pod's log has no `task` line for them (its task ids are job id + 1). A re-run through the API ran the controller job normally (success in 32 s) but the felhom.eu job was again never picked up and failed after ~12 min. The runner pod (`gitea-system/act-runner`, image `felhom-act-runner:0.1.0`) had restarted 5 times ~142 min earlier, around the Longhorn instance-manager restart (R-882). Suspected, NOT measured: a stale runner registration claims jobs it never runs — the session's Gitea token cannot list runners (`read:admin` scope). Consequence: a red CI verdict that is not about the code, and **no failure mail** (the alarm step never runs either), so only the pull check sees it. **CORRECTED 2026-10-05 18:21 (operator's screenshot of Gitea → Site Administration → Runners): ONE runner only — ID 2, `felhom-gates-runner`, v0.6.1, label `felhom-gates`, Idle, last online „now". There is no old registration; the stale-registration guess (this row's first text and the reviewer's) was WRONG.** **RE-DIAGNOSED 2026-10-05 (round 2), from the logs that survive:** (1) **„lost in a runner restart" does NOT fit** — the runner pod last restarted 13:24:42Z (`restartCount 5`, all around the 13:20Z Longhorn restart), the lost attempts started 1.5–2.5 h later. (2) **FOUR attempts were lost, not two:** controller job 1357 (start 15:05:41Z → failed 15:18:38Z), felhom.eu job 1359 (15:15:37 → 15:28:38 — the previous session blamed that one on the BusyBox fault; the runner never ran it), job 1361 (15:33:21 → 15:43:38) and its API re-run (15:46:48 → 15:58:38). None has a `task` line in the runner log; every one was failed at a :38-second mark on a 5-minute step, 10–13 min after it was handed out — **the shape of Gitea's periodic „zombie task" stop** (a task assigned to a runner that never reports is failed after ~10 min; no log exists because none was written). (3) The runner's task ids are NOT job id + 1 (the controller re-run was task 1363). (4) **Gitea's own log for the window is gone** — the pod log starts 16:16:32Z (rotated), so the assignment side cannot be read. **Likely mechanism, NOT proven:** the runner's fetch-task request timed out on its side after Gitea had already assigned the task, so the task was orphaned. In that same hour this session polled Gitea's jobs API hard (15 pages every 15 s per wait loop) and Gitea logged „slow" requests — a plausible load cause, and the session's own. Mitigation taken: the session's CI waiter now polls once a minute. **Nothing changed on DooPlex.** **MECHANISM SEEN 2026-10-05 17:15–17:28Z, with Gitea's own log (round 2):** catalog run 1368 (`4828dc7`) — 17:15:14 the job is marked started; 17:15:16 `router: slow POST /api/actions/runner.v1.RunnerService/FetchTask for 10.42.0.42 (the runner), elapsed 3192ms`, then `UpdateRepoRunsNumbers … context canceled` and `GetActionWorkflow: EOF` — **the runner abandoned its fetch after Gitea had assigned the task**; the runner log has no line for task 1371; 17:28:39 `actions/clear_tasks.go:174 stopTasks() [W] Cannot transfer logs of task 1371` — Gitea's zombie-task stop. **The load at that minute:** an outside crawler (216.73.216.78) walking commit pages and `archive/*.tar.gz`, and THIS session's CI waiter, whose 15-page job listings took 13–31 s each. An API re-run passed in 7 s. **Done in-session:** the waiter now asks `GET …/actions/runs?head_sha=<sha>` once a minute (1 s). **Not done (DooPlex, the operator's):** the runner's fetch timeout and Gitea's exposure to the crawler. | **OPEN** **DATED CHECK 2026-10-12 (DUE-CHECKS):** if no job was lost since 2026-10-05 16:00Z (no completed job whose runner log has no `task` line / whose log API answers `file does not exist`), close. **NIGHT WATCH 2026-10-05/06 (burn-down night): 2 jobs lost of ~30 runs** — felhom.eu run 1384 (`4aa4d837`, 21:23→21:33Z, no log) and felhom-controller run 1401 (`c67b26be`, 00:45→00:58Z, no log); each re-run once through the API and each passed (2 m 05 s, 57 s). The night's waiter made one filtered call a minute. So the 2026-10-12 close condition („no job lost since 2026-10-05 16:00Z") is already NOT met. `audits/night-burndown-2026-10-05/r887-lost-jobs.txt`. | — | Operator: decide whether to raise the act-runner fetch timeout and/or rate-limit the public Gitea pages the crawler walks; meanwhile re-run a lost job via `POST /repos/admin/<repo>/actions/runs/<id>/rerun`. Keep the 2026-10-12 check | operator |
 | **R-892** | Process & tooling | P4 | **The update test's box walk cannot reach the Tester 1 box, so decision 149's admin seed there cannot be used.** `app-catalog-felhom.eu/scripts/box_walk.py` drives guests only on demo-hp (its `HP`, `ssh` + `pct exec`) and reaches the app by the guest's LAN address. Read 2026-10-06 (evening): the Tester 1 box (hub host `tester-1-d70be4`) has no SSH alias in DooPlex's `~/.ssh/config` and no entry in `operations/nodes.md`. **Corrected 2026-10-06 18:24 (`09` §3 decision 158):** its Proxmox host IS known — it runs as **VM 341 on the HP box** (`ssh hp`), recorded in `audits/catchup-2026-10-05/tester1/vm341-was-stopped.txt`; the session that filed this did not find that file. Not a 30-minute fix: it needs the box's location and an operator-approved route first. | **OPEN — filed 2026-10-06** **2026-10-06 18:24: operator ruling — yes, CC may reach it by SSH (decision 158).** **2026-10-06 (night): the route is BUILT in the box walk** (catalog `d63ea35`: `TARGET=tester-1`, `ssh -J demo-hp root@192.168.0.154`, guest 9201, `felhom.enkicsifelhom.hu`; `BOX_ADMIN_SEED_GUESTS` has it) and the identity is matched (the agent's report `host.node=felhom` = VM 341's certificate; the guest answers its domain 200, demo-hp's 404). **Blocked:** DooPlex's key is not authorized on VM 341 (`Permission denied (publickey,password)`); the VM has no guest agent and a disk edit needs a VM stop (a reboot, not allowed); fetching its vaulted password from the hub was refused by the session's permission check. `audits/readback-2026-10-07/` **2026-10-06 20:27 (night brief §3): still blocked** — the operator ran `ssh-copy-id` at 20:20, but it copied the key of the operator's own SSH agent; this shell has no agent, and DooPlex's two keys (`id_rsa`, `id_ed25519`) are still refused, direct and through demo-hp (`audits/night-burndown-2026-10-06/s3/`). The fix: run `ssh-copy-id -i ~/.ssh/id_ed25519.pub root@192.168.0.154` from DooPlex as kisfenyo. | DooPlex's key on VM 341 | Operator: authorize DooPlex's public key on VM 341 (one line in `/root/.ssh/authorized_keys`, from its console), or allow CC to read the vaulted password; then prove one step there | operator |
 | **R-206** | Process & tooling | P4 | **The build-cache cap and the weekly prune exist only as a hand-edited `/etc/docker/daemon.json` on DooPlex — not in Ansible, so a rebuild loses them.** The `node_housekeeping` role must also carry the prune, which today it is forbidden to run | **READY (M) — NEW 2026-08-05** | — | **The spike validated the recipe; this row builds it.** Three parts. **(a) Template `/etc/docker/daemon.json`** with the **`policy` array** form — **the flat form (`{"gc":{"reservedSpace":…}}`) is SILENTLY IGNORED**, measured: the daemon starts, logs nothing, and `docker buildx inspect` still reports the built-in defaults. **The oracle is `docker buildx inspect`, never `dockerd --validate`** — the validator returned `configuration OK` for a bogus key AND for the config that then **crashed the daemon** (`filter` takes one value per policy entry, not an array; `error initializing buildkit: filters expect only one value`). **(b) Narrow the role's Docker ban** (`node-housekeeping.sh.j2:10-14`) to permit exactly `docker builder prune -af` and nothing else — the ban's stated premise ("Docker here runs only unrelated jarr-* dev containers") is obsolete: the growth is Felhom Go build cache. **The measured prune is SYNCHRONOUS** (150.35 GB back at t+0, two consecutive polls <1 MB apart within 60 s) — **unlike containerd's image GC, so it needs no `settle_imagefs` equivalent**, but it MUST measure the filesystem rather than trust the command: `prune` claimed **156.9 GB** and the filesystem returned **150.35 GB**, the 6.5 GB gap being layers still shared with images. **(c) A restart-safety note in the role:** a bad `daemon.json` takes the daemon down AND leaves the `unless-stopped` dev containers stopped — they needed a manual `docker start` — so the role must restart-and-verify, not validate-and-assume. Recipe + every measurement: `audits/SPIKE-dooplex-buildcache-2026-08-05.md` | CC |
@@ -291,18 +291,17 @@ stopping line that lies.
 | **R-288** | Process & tooling | P4 | **The capability map is too long to be read, and that is why it stops being true.** `architecture/00-capability-map.md` is **134 642 bytes / 19 456 words across 99 table rows in only 159 lines** — because the rows ARE the length. Measured, longest first: the unaided-recovery-journey row is **3 024 words**, the offsite-password-recovery row **1 087**, the unattended-restore-proof row **971**, the app/guest-network-failure row **904**. That single longest row is a novella of nested corrections, each appended rather than resolved. Its own verification stamp reads **2026-07-16 against evidence corpus @ felhom.eu tip `4b18cc5`** (line 23) — three weeks stale, which is the measurable consequence: nobody re-reads a row they cannot finish. **This is the project's memory, so restructuring it is surgery and wants daylight** — filed, deliberately not attempted in the 2026-08-09 session. **What the shape should probably be:** one line of status per capability plus a dated evidence pointer, with the argument moved to the audit it came from | **READY (M) — NEW 2026-08-09** | — | Do not fold this into another session; it needs its own. **SECOND CONCRETE COST, 2026-08-10 — and it is a different failure mode from the first.** An *execution record* — 33 package deletions on the operator's rule — was undiscoverable for two days because it lives **inside the row about the Configuration page being slow**. Two sessions searched for it: one reported "no register row records a package prune", the other exhausted the Gitea logs, the activity feed and the schema before concluding it might be unestablishable. It was in `OPEN-ITEMS.md` the whole time. **The first cost (2026-08-09) was two records that looked contradictory and were not; this one is a record that could not be found at all.** Illegibility now has two measured costs and they are different in kind: prose rows make claims ambiguous, and rows-about-other-things make facts unfindable. **The rule this earns is in CONTEXT.md: a record that lives inside a row about something else has not been recorded** | Viktor |
 | **R-290** | Process & tooling | P4 | **Most capability-map rows that back a green dot cite no evidence document at all — measured, 20 of 28 probed.** The page's *Walked* means *"done end to end on real hardware, evidence on file"*. Extracting the evidence column for the 28 rows behind the page's claims found a `tests/` or `audits/` path in **8**; the other 20 carry prose only. **Consequence, applied this session:** of 32 claims the page drew as Walked, **12 were downgraded to Built** because no walk document exists for them — `install.installer-by-tag`, `use.lifecycle`, `drives.enrol`, `drives.migrate`, `backup.tier1`, `backup.whole-machine`, `backup.restore-proof`, `fault.selfheal`, `fault.operator-email`, `fail.drive-filling`, `fail.lost-recovery-code`, `fail.hub-down`. **This is not a claim that those twelve are false** — several are near-certainly fine — it is a claim that nothing on file distinguishes them from an opinion, which is exactly what the status word promises. **The gate now enforces it going forward:** `scripts/check_stands.py` fails on `status: walked` with no `evidence:` source. **What is owed:** either a walk document per row, or an honest demotion in the map itself (the map is the source; the dataset only follows it) | **READY (M) — NEW 2026-08-09** | R-288 | The dataset was corrected; **the capability map itself still says PROVEN-LIVE for these rows** and is the thing to fix | Viktor |
 | **R-327** | Process & tooling | P4 | **The standing picture still describes a defect that has been fixed twice over.** Found by the first run of `unproven.py` (R-326), which is the argument for having built it. `where-felhom-stands.yaml`'s `claim.code-naming` is `status: partial` and its title reads *"The same word is used for two different secrets across three surfaces; the email points at a page a rebuilt machine does not show"* — **both halves of which are now false.** The box side shipped 2026-08-10 (R-295), the hub half and the page-naming fix on 2026-08-13 (R-295 hub, new `reenroll` mail kind), and the third near-homograph on 2026-08-13 (R-323). **NOT MOVED BY THIS SESSION, deliberately and by the dataset's own rule:** *"A status may not be RAISED here — if the evidence supports a stronger status than the capability map records, the MAP changes first and this file follows it."* Raising it here would be the exact inversion the file's header forbids, and the map edit is a separate judgement about what "walked" means for a naming change that no customer has yet met | **READY (S) — NEW 2026-08-13, RANK 4** | R-295, R-323, R-326 | Decide the capability-map status for the naming arc, then let the dataset follow it. **Note the honest difficulty: no customer has typed „Tulajdonosi jelmondat” yet**, so `walked` would be an over-claim; `built` is probably right, and the title needs rewriting either way because it describes a defect rather than a capability | operator + CC |
-| **R-392** | Process & tooling | P4 | **No architecture document covers the two-AI workflow.** `documentation/architecture/` holds eight documents and **all eight cover the product** — topology, host agent, control-plane authorization, hub, off-site connectivity, backup, controller modules, capability map. Nothing records how the Claude.ai / Claude Code split works, what each side owns, how skills and `.claude/rules/` are scoped, or why. **The absence was found by trying to fill the template field, not by a survey:** the task that added the five process skills (2026-08-25) had to name an owning architecture document and could not, and the template requires that be recorded rather than passed over. The exposure today is low — the split is stable and both sides work — but it lives entirely in the operator's head and in chat, which is precisely the shape of a commitment nothing enforces. | **OPEN — LOW** | — | Write one architecture document for the agent-tooling layer: which AI owns which artifact class (`TASK-*.md`, `RUNBOOK-*.md`, validation), how skills are scoped and installed, what belongs in a `CLAUDE.md` versus a skill versus a rules file, and the reasoning for each boundary. **The rules themselves already exist** in `skills/felhom-doc-authoring/SKILL.md`; what is missing is the map of who owns what. Do not restate the doc-authoring rules there — point at that skill. | CC |
 | **R-394** | Process & tooling | P4 | **`felhom-build-deploy/SKILL.md` is 179 lines, over the 150-line limit its own repo now enforces.** Found 2026-08-25 by `scripts/check_skills.py` on its first run — the over-length was discovered BY the new checker, on the day the limit was written down, which is the checker working as intended. **It is not edited and not trimmed here:** the task that introduced the limit explicitly scoped the four pre-existing skills out, and trimming a build-and-deploy skill without exercising its commands is how a wrong command ships to a live host. **It is a named single-entry exception in `GRANDFATHERED` in `scripts/check_skills.py`, printed as a WARN on every run**, so it cannot fade; a NEW skill over the limit is convicted normally, and growing the set requires editing that file in a commit with a row to name. **The rationale for the limit** — attention thins across the excess, so the lines that matter are not the ones that survive — is in `skills/felhom-doc-authoring/SKILL.md` §5. | **OPEN — LOW** | — | Trim `felhom-build-deploy/SKILL.md` under 150 lines in a session that can VERIFY the commands it keeps, then delete its `GRANDFATHERED` entry in the same commit. The likely trim is the per-artifact command blocks moving behind a pointer to the runbooks, keeping the gotchas inline — but that is a judgement for a session with a build to run, not a line-count exercise. | CC |
 | **R-421** | Process & tooling | P4 | **THE CLASS: an instrument that matches a LABEL rather than the fact it names — five instances, every one found by accident.** R-410 (a `mkdir` turned the release gate green), R-400 (seven debug controls answering nothing), R-378 (a status word inside a sentence), R-419 (a phrase inside prose, including prose saying the marker was ABSENT), R-94 (a test comparing a constant to itself). **The gates are the machinery that enforces everything else in this project, and they were the one part nothing had ever checked.** The 2026-09-01 decoy sweep read all 29 scripts and fooled **16**. Ten were fixed the same day; four remain with rows (R-422..R-425); six could not be given a plausible decoy and are named. **The shapes, so the next one is cheap to recognise:** (1) name-for-fact — it matches a path or directory NAME while the fact lives inside the file; (2) substring-for-field — it matches a token anywhere in a body instead of in the field that carries it; (3) declaration-for-reachability — it checks a thing is declared, not that it RESOLVES; (4) constant-for-measurement — it compares a value against itself. **The single largest cause was mundane:** eight gates set their SCOPE with `os.listdir` (one level), so every one was green and correct today and would have gone blind the moment anyone added a subdirectory. `decoy_coverage_gate.py` now refuses a new gate that ships without a decoy. | **OPEN — the class row; it stays open as the place the next instance is recorded** | — | — | CC |
 | **R-507** | Process & tooling | P4 | **[P3-LOW] The proof-install harness cannot drive the graphical installer, so a release's graphical entry is proven only up to its password screen.** MEASURED 2026-09-14 on VM 332 (ISO 1.27.0): `qm sendkey 332 tab` did not move focus (both password copies landed in one field), `mouse_move 1237 772` + `mouse_button 1` did not move the cursor or press Next, while `alt-n` did advance a page. The TUI entry is fully drivable. The gate's "proof install on BOTH menu entries" was met for 1.26.1 (by a person) and not for 1.27.x. **Fix shape:** measure QEMU `input-send-event` with absolute coordinates, or a VNC client on DooPlex; until then a release's graphical proof is an operator click-through. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: release-test tooling; an operator click-through covers it.** | — | — | CC |
 | **R-579** | Process & tooling | P4 | **[P3-LOW] Five page shells loaded `style.css` with NO cache-buster, so a browser holding an older copy kept being served CSS that did not know about the newest UI.** FOUND 2026-09-18 by the operator's screenshot of the v0.254.0 language globe: it rendered as a bare, unstyled `<details>` — a stray triangle and two plain words outside the card — because `login.html`, `claim.html`, `recovery.html`, `launcher_shared.html` and `launcher_share_password.html` requested `/static/style.css` with no `?v=`, while `layout.html` has used `?v={{.Version}}` since v0.166.0. **`.Version` was also absent from three of those five data maps.** FIXED AND CLOSED in the same session (controller v0.255.0): the parameter on all five, and `Version` set once in `executeTemplateLang` so a new shell cannot miss it; `TestGlobeOnAnonymousShells` now refuses an absent or EMPTY `?v=`. **The general form, which is the part worth keeping: a template that loads a versioned asset WITHOUT its version is invisible to every test that reads markup — the markup is correct and the browser fetches the wrong file.** A gate over "every stylesheet/script link in a template carries `?v=`" would catch the class; not built, because 8 first-boot-wizard templates would fail it and R-554 deletes them. | **DEFERRED** (2026-10-03 triage: the row's verdict was finished, but it names open work no other row carries — the gate "every stylesheet/script link carries `?v=`" was deliberately not built until R-554 deletes the old wizard; nothing else owns it) — **CLOSED 2026-09-18 - controller v0.255.0** | — | — | CC |
 | **R-652** | Process & tooling | P4 | **[P3-LOW] The memory watch counted the kernel's file cache as the app's memory.** MEASURED 2026-09-23 night on the bench: nextcloud 34.0.4 read **100 %** of its 1 GiB and immich's PostgreSQL **100 %**, each with **0** kernel `oom_kill`s — `memory.peak` includes page cache, which the kernel drops before it kills anything. Under the watch as built (R-635 follow-up) both would be marked `memory_tight`, and the gate would demand a raised `mem_limit` — a customer-box capacity figure — for cache. **Done the same night (09 §3 decision 22, CC — operator may reverse):** the watch samples the app's own memory (`anon` of `memory.stat`) every 15 s; the mark and the ladder's `memory_peak_pct` read it where measured; the cgroup peak stays beside it (`memory_cgroup_peak_pct`). **Open:** romm's backfilled entry carries M1's 80.9 % cgroup peak (measured before the anon sample existed) — re-measure it on its next step; and decide whether an app whose anon is low but whose cgroup stays pinned at its limit (cache thrash) should be marked at all. Evidence: `audits/night-2026-09-23/apps/nextcloud/bench-1024M/`, `apps/immich/bench-noanon/`. | **READY — P3; owner: CC (catalog harness)** **Re-ranked 2026-10-03: P3→P4: the main fix is done; what is left is harness tuning, no household meets it.** | — | — | CC |
-| **R-693** | Process & tooling | P4 | **[P3-LOW] The memory watch marks a Node app `memory_tight` at any limit — its heap sizes itself from the limit.** Measured 2026-09-25 on the bench (docmost 0.96.0, harness v4): the app's own memory (`anon`) peaked at **349 MB of 384 MB (90.9 %)**, then, with the limit raised to 512 MB, at **431 MB of 512 MB (80.4 %)** — 0 OOM kills and 0 restarts in both 10-minute watches (~12 000 requests each). So the mark (decision 22's "does not fit the memory") fires for an app that fits, and the gate's remedy (raise the limit) cannot clear it. docmost moved with the limit raised to 512 MB (decision 39). **Needs:** a basis that tells growth-to-fill from pressure (e.g. kills/restarts plus a GC-pressure signal, or a second watch at a higher limit showing the peak scales), or a per-app `memory_scales_with_limit` fact. `audits/night-2026-09-26/C/bench-run1/`, `…/bench-run2/` | **OPEN — P3; owner: CC** **Re-ranked 2026-10-03: P3→P4: a harness judgement problem; no household meets it.** | — | — | CC |
+| **R-693** | Process & tooling | P4 | **[P3-LOW] The memory watch marks a Node app `memory_tight` at any limit — its heap sizes itself from the limit.** Measured 2026-09-25 on the bench (docmost 0.96.0, harness v4): the app's own memory (`anon`) peaked at **349 MB of 384 MB (90.9 %)**, then, with the limit raised to 512 MB, at **431 MB of 512 MB (80.4 %)** — 0 OOM kills and 0 restarts in both 10-minute watches (~12 000 requests each). So the mark (decision 22's "does not fit the memory") fires for an app that fits, and the gate's remedy (raise the limit) cannot clear it. docmost moved with the limit raised to 512 MB (decision 39). **Needs:** a basis that tells growth-to-fill from pressure (e.g. kills/restarts plus a GC-pressure signal, or a second watch at a higher limit showing the peak scales), or a per-app `memory_scales_with_limit` fact. `audits/night-2026-09-26/C/bench-run1/`, `…/bench-run2/` | **OPEN — P3; owner: CC** **Re-ranked 2026-10-03: P3→P4: a harness judgement problem; no household meets it.** **2026-10-06 night: skipped — a design:** changing when an update is marked „memory tight" changes what the update ladder records and accepts; the row offers options. | — | — | CC |
 | **R-739** | Process & tooling | P4 | **[P3-LOW] The test bench cannot run wanderer at all: its web server calls the database at the PUBLIC name `https://<SUBDOMAIN_DB>.<domain>`, which the bench has no name or TLS for.** MEASURED 2026-09-30 (more-night-apps brief, Part B): on bench 9401 the catalog template (v0.20.0) came up `wanderer-db` healthy, `wanderer-search` healthy, `wanderer` **unhealthy** for 12 min, every page 500 („Error 0: Something went wrong"); `PUBLIC_POCKETBASE_URL=https://hike-db.gate.invalid`. So the harness can only ever answer `inconclusive` at FROM for wanderer, never about an update. Its step `v0.20.0 → v0.21.0` (web + db) and meilisearch `v1.36 → v1.54` stay untested; **the brief's question — does the search index survive meilisearch's move or is it rebuilt — is NOT measured.** **Needs:** a bench venue that gives the stack the DB name (an `extra_hosts` + plain-http override in the bench's render only, stated in the verdict), or wanderer proven on the box venue alone with the operator's word. `audits/more-night-apps-2026-09-30/B/wanderer-probe.txt` **-- 2026-09-30 late: the bench CAN run wanderer now** — `upgrade-test.py` `BENCH_ENV_OVERRIDES` points `PUBLIC_POCKETBASE_URL` at the database container on the bench only (the only address the web image reads, measured in v0.20.0 and v0.21.0), recorded in every verdict: web 200, sign-up (`PUT /api/v1/user`) 200, login 200. **The meilisearch question, answered:** v1.54.2 REFUSES v1.36's database („Your database version (1.36.0) is incompatible”); with `MEILI_UPGRADE_DB=true` it upgrades in place and all three indexes (actors, lists, trails) are there — so wanderer's step needs that switch in the template first. Not done: a fixture (creating a list answered PocketBase's „Failed to create record” — likely a rule for unverified users), whether a household's record survives in the index, the step itself. `audits/night-rulings-2026-09-30/` | **NARROWED — the bench runs it; the step needs a fixture and `MEILI_UPGRADE_DB`; owner: CC** **Re-ranked 2026-10-03: P3→P4: test bench coverage; the template switch and fixture are tooling work.** | — | — | CC |
 | **R-759** | Process & tooling | P4 | **[P3-LOW] wger's onboarding record (the checklist pilot) keeps rows open that no other row owns.** 2026-10-01, `app-catalog-felhom.eu/onboarding/wger.md`: **2.5** no backup → remove → restore → read back of wger exists — the box has no per-app backup press outside an Update (R-648) and wger has no newer step to carry one; **3.7** changing the password and adding a family member not measured, and the template has no `add_people` text; **6.3** no forced-fail undo for wger; **8.2** the app page not read on 9202 this session; **9.1** the runtime volume-persistence gate not re-run (last CLEAN 2026-08-02). The other open rows have their own: 1.5 (R-755), 1.7/2.8 (R-762), 3.4 (R-763), 7.1 (R-764). wger is exempt from the onboarding gate (published before the checklist), so nothing blocks; this row is what keeps the record honest. **Needs:** the five measured on 9202 — 2.5 and 6.3 ride wger's next ladder step (the update's backing-up phase is the per-app backup). `audits/new-app-checklist-2026-10-01/` | **READY — rank P3-LOW; owner: CC (catalog)** **Re-ranked 2026-10-03: P3→P4: record-keeping for a hidden app; nothing blocks.** | — | — | CC |
 | **R-786** | Process & tooling | P4 | **[P3-LOW] SparkyFitness's onboarding record has six open rows** (`app-catalog-felhom.eu/onboarding/sparkyfitness.md`): 0.5 runtime internet (food search providers), 0.7 the phone app's sign-in route through traefik, 1.6 the env names the server reads, 1.7 the entrypoint read, 5.4 a second memory watch at another limit, 8.3 no logo/screenshots on felhom.eu (404). Everything else measured this session (bench + 9202). **Needs:** each row measured, or n/a with a reason. | **READY — rank P3-LOW; owner: CC (catalog)** **Re-ranked 2026-10-03: P3→P4: onboarding record completeness; no household meets it directly.** | — | — | CC |
-| **R-805** | Process & tooling | P4 | **[P3-LOW] The volume-persistence gate judges an empty NAMED volume (R-788) but not an empty BIND mount.** MEASURED 2026-10-02 (`audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md`): Grimmory's `/app/data` bind held 0 files and read CLEAN (its state is in MariaDB); komga, paperless-ngx, radarr and sonarr also carry empty binds that are not judged. **Needs:** decide whether an empty bind after the exercise is UNDETERMINED like a named volume, with a decoy. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: a test-gate rule; no household meets it.** | — | — | CC |
-| **R-806** | Process & tooling | P4 | **[P3-LOW] The gate's GET exercise speaks plain http to an HTTPS backend (crafty-controller :8443), and gramps-web did not answer on :5000.** MEASURED 2026-10-02 (`audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md`): both reached data only through their fixture seed. **Needs:** read the `loadbalancer.server.scheme` label (upgrade_boxport already does); find why gramps-web's first GET got no answer. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: a test-gate defect; no household meets it.** **NARROWED 2026-10-05 (app-catalog `4828dc7`): the harness GET now uses the traefik scheme label (https + -k for crafty-controller). LEFT: gramps-web :5000 not answering — a live look on a box.** | — | — | CC |
+| **R-805** | Process & tooling | P4 | **[P3-LOW] The volume-persistence gate judges an empty NAMED volume (R-788) but not an empty BIND mount.** MEASURED 2026-10-02 (`audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md`): Grimmory's `/app/data` bind held 0 files and read CLEAN (its state is in MariaDB); komga, paperless-ngx, radarr and sonarr also carry empty binds that are not judged. **Needs:** decide whether an empty bind after the exercise is UNDETERMINED like a named volume, with a decoy. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: a test-gate rule; no household meets it.** **2026-10-06 night: fixed on catalog branch `night-held-2026-10-06`** (`816c557`) — an empty bind is a NOTE in the reasons, the verdict unchanged (`09` §3 decision 159, decided by CC unattended — operator may reverse); `TestEmptyBind` red-proved (`cat/R-805-red.txt`). Closes when the branch reaches main. | — | — | CC |
+| **R-806** | Process & tooling | P4 | **[P3-LOW] The gate's GET exercise speaks plain http to an HTTPS backend (crafty-controller :8443), and gramps-web did not answer on :5000.** MEASURED 2026-10-02 (`audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md`): both reached data only through their fixture seed. **Needs:** read the `loadbalancer.server.scheme` label (upgrade_boxport already does); find why gramps-web's first GET got no answer. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: a test-gate defect; no household meets it.** **NARROWED 2026-10-05 (app-catalog `4828dc7`): the harness GET now uses the traefik scheme label (https + -k for crafty-controller). LEFT: gramps-web :5000 not answering — a live look on a box.** **2026-10-06 night: the :5000 silence is measured and fixed on catalog branch `night-held-2026-10-06`** (`1859903`): the image's default 8 gunicorn workers filled the 1024M limit (anon at limit, oom_kill 3, 4/5 GETs timed out); `GUNICORN_NUM_WORKERS=2` → first answer 10 s, ~2 ms, anon 342 MB, 0 kills (`cat/R-806-red.txt`). Closes when delivered. | — | — | CC |
 | **R-807** | Process & tooling | P4 | **[P3-LOW] 13 apps stay UNDETERMINED because their seeds write only to the database, so their upload / media / cache / redis volumes stay empty.** MEASURED 2026-10-02 (`audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md`): claper, crafty-controller, dawarich (redis), docmost, gramps-web, immich (ML cache), outline (+redis), sparkyfitness, tandoor, vikunja, wger, wishlist, zipline — plus plex (no seed route: a plex.tv claim token) and wanderer (no fixture; unhealthy under the gate). None is BROKEN: nothing was written outside a preserved folder. **Needs:** per app, a seed that uploads one file (or the volume named n/a with a reason: a redis cache, an ML model cache). | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: test coverage; nothing was found broken.** | — | — | CC |
 
 <!-- DUE-CHECKS-BEGIN — machine-readable. Parsed by scripts/due_checks_gate.py.