answers 2026-10-12 Part B: the four DooPlex changes live and read back; R-886 + R-211 closed (112 -> 110)

- S21 / R-887: runner fetch_timeout 30s, Gitea Ingress 2 rps per address (homelab-manifests ad8618f); WATCHING to 2026-10-19
- S22 / R-886: Alertmanager fsGroup 65534; a test silence survived a pod restart (4168451) - closed
- S23 / R-211: Prometheus config-reloader; two automatic reloads, no manual POST (ab40c7b, test e70e0f1/78d4be4) - closed
- S20 / R-231: backup scripts in homelab-ansible/roles/dooplex_backup, installed from git (fdd324b); VERIFY 2026-10-13
- evidence: documentation/audits/answers-2026-10-12/s2{0,1,2,3}-*.txt

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/CLOSED-ITEMS.md

@@ -32,6 +32,8 @@ The full text of the rows below: `git show 25ab47eeaa:documentation/backlog/OPEN
 
 | Row | What | Closed | Evidence |
 |---|---|---|---|
+| **R-886** | **DooPlex's Alertmanager cannot write its own state since the Longhorn restart of 2026-10-05 13:20Z** (P3) | CLOSED 2026-10-12 — **fixed on DooPlex** (operator yes in chat; S22, `09` §3 decision 217): Alertmanager pod `fsGroup: 65534` (homelab-manifests `4168451`, resource-only sync). Volume now `0:65534 drwxrwsr-x`; a test silence survived a pod delete (old pod `…98z2l` → new `…28rrq`, `GET /api/v2/silences` = active), then expired by amtool; `nflog` and `silences` files now written. | `s22-alertmanager-silence.txt` |
+| **R-211** | **Prometheus has no config-reloader — a rules change reaches the pod and is never read** (P3) | CLOSED 2026-10-12 — **fixed on DooPlex** (operator yes in chat; S23, `09` §3 decision 218): `config-reloader` sidecar (configmap-reload v0.15.0, by digest; homelab-manifests `ab40c7b`). Proven twice with no manual reload: a rule-comment change (`e70e0f1`) and its removal (`78d4be4`) each reached Prometheus ~35–40 s after a ConfigMap-only sync („successfully triggered reload" + „Completed loading of configuration file"); 56 rules `ok`. | `s23-prometheus-reloader.txt` |
 | **R-243** | **A box in the R-241 state silently stops backing up off-site, and NO ALARM OF ANY KIND FIRES.** (P2) | CLOSED 2026-10-12 — **the alarm fired on time.** The `offsite_escrow_pending` mail for Tester-2 reached the operator mailbox 2026-10-11 16:13:51Z (the first sweep after the 7-day line, ~16:06Z); the running hub logged „Operator email sent for Tester-2/offsite_escrow_pending" at the same second. Two channels. | hub v0.144.0+ (`b119301c`); `r243-escrow-pending-mail.txt` |
 | **R-831** | **The Hetzner storage API token (`HETZNER_TOKEN`, the storage project's token in `Secret/storagebox`) was printed into the 2026-10-03 session transcript** (P3) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S2, `09` §3 decision 197): **A — accept.** The Hetzner storage token stays valid. | the ruling |
 | **R-870** | **Tester 1's two Cloudflare credentials — the zone API token (`infrastructure.cf_api_token`) and the tunnel token (`infrastructure.cf_tunnel_token`) of the hub's `customer_configs` row `tester-1` — were printed into the 2026-10-04 night session's transcript** (P3) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S3, `09` §3 decision 198): **accepted**; rotate when Tester 1 is retired. | the ruling |