OS updates guest fast lane: records — 11 §8.1 BUILT, 03 cloudflared corrected, 07 §6.1 OS leg, 00 PARTIAL, monthly runbook infra pins, golden 0.291.0 record + vouch, register 331 -> 333 (R-837/838/726/843 closed; R-840/841/842/844/845 opened), STATUS, report

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-04 11:41:50 +02:00
parent e55b2ceb63
commit e78726314e
25 changed files with 1573 additions and 18 deletions
@@ -55,6 +55,23 @@ summary names each app DONE or STOPPED with its reason. Order: database/redis li
 **Monthly cost (measured 2026-10-01):** see "What it cost" below. linuxserver images (bookstack, radarr, sonarr,
 code-server) are rebuilt upstream weekly under the same tag, so most months they come up.

+## 4a. Infrastructure pins (R-838, 2026-10-04)
+
+The box's three built-in containers — traefik, cloudflared, filebrowser — are pinned in
+`felhom-controller/controller/internal/infra/infra.go` (`TraefikImage`, `CloudflaredImage`, `FileBrowserImage`). They are
+**not** catalog templates, so `retest-floating.py` never sees them. Each month:
+
+```bash
+cd felhom-controller/controller && python3 scripts/check-infra-pins.py   # exit 1 = at least one BEHIND (report only)
+```
+
+For each BEHIND pin: read the upstream release notes between the pinned and the newest version (same channel:
+traefik v3.x, cloudflared YYYY.M.P, filebrowser N.N.N-stable — never a beta), name any breaking change against what we
+configure, raise the constant, release the controller, prove it on 9202 then on both demo boxes (the containers are
+recreated within ~20 s of the new controller starting: traefik/cloudflared by the base-infra bring-up, filebrowser by
+the start-up mount sync), and time the public gap through the tunnel. Measured 2026-10-04: ≤ 19.6 s on demo-hp, ≤ 14.7 s
+on demo-felhom, counting the controller's own restart (`audits/os-guest-lane-2026-10-04/partF/`).
+
 ## 5. Teardown (three layers, stated)

 Machine: 9202 back on the live catalog (`repoint.py restore`), apps the run installed are removed by it. Host: `pct