morning after: R-889 delivered (controller v0.299.0, df's percent read back), R-776/R-613 proven on 9202 and live, R-585/R-621 delivered; ten operator questions on one page in STATUS; report (164 -> 150; 0 opened, 14 closed)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -1,11 +1,32 @@
 # STATUS — what works, what's broken, what's next
 
-**Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop, off at night) was offline again; nothing was
-sent to it.**
+**Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
 
-**Updated 2026-10-06 06:00 (the burn-down night): every box of ours healthy on hub 0.138.0, agent 0.148.0, controller
-0.298.0. The open-items list is at 164 (was 199). Morning note: `documentation/audits/night-burndown-2026-10-05/MORNING-NOTE.md`;
-report: `REPORT-burndown3-2026-10-06.md`.**
+**Updated 2026-10-06 09:00: every box of ours healthy on hub 0.138.0, agent 0.148.0, controller 0.299.0; installer 1.32.0
+is public. The open-items list is at 150. Report: `REPORT-morning-after-2026-10-06.md`.**
+
+## This morning (2026-10-06): your two answers done; the list at 150
+
+- **Installer 1.32.0 is published.** The public script reads 1.32.0 and is byte-identical to its tag.
+- **The box shows the real disk use** (the number `df` gives). demo-hp's SSD went from 21 % to 23 %, the same as `df`.
+  Alarm levels are unchanged, so a full disk alarms a little earlier. Released as controller 0.299.0 to all three boxes.
+- **The four waiting app fixes passed on the scratch box and are live** (visitor addresses for kimai, zipline, vikunja,
+  nextcloud; nextcloud's health check). Each was tested against a control.
+
+## Ten questions for you — answer „all as picked", or name the ones you want differently
+
+| # | Question | Option A | Option B | If you decide nothing | My pick |
+|---|---|---|---|---|---|
+| 1 | **R-444** — Should the boxes trim their customer guests' disks once a week, so deleted data stops filling the disk pool? | Yes: one new admin permission (`pct fstrim`), weekly, outside the night, measured once on demo-hp first | No: leave it; the pool keeps space nobody uses | Nothing changes; a full pool can one day stop every guest on that box | **A** |
+| 2 | **R-99** — Should broken leftovers of aborted backups be deleted on the backup server? | Yes, by hand, by a runbook, when one is seen | No: they are detected, harmless, and do not affect what is kept | They stay; one small leftover per aborted upload | **B** |
+| 3 | **R-618** — May an app update count Docker's own „healthy" as proof that the new version works? | No: keep our own check only | Yes: Docker's healthy can end a wait early | Nothing changes (A) | **A** |
+| 4 | **R-645** — When you lift a held update by hand, how do we stop the night backup from saving the broken version over the good copy? | The night backup skips an app whose saved version is not what it runs | Lifting a hold by hand is refused; you use „Undo" instead | The good copy can be overwritten within seconds of a hand lift | **A** |
+| 5 | **R-856** — After a crash restart, should app mails wait longer (about 15 minutes), so the household gets one message, not three? | Yes: a longer quiet time after a crash boot (two repositories change) | No: close it; one crash can send several true mails | Several mails after a crash, as now | **A** |
+| 6 | **R-747** — Should mealie's app page tell the household that five wrong logins lock the account for 1–2 hours? | Yes: one sentence on the page | No | A locked household does not know why or for how long | **A** |
+| 7 | **R-734** — Should the update test ignore small marker files an app rewrites at every start (immich)? | Yes: a per-app list of such files, each with a reason | No: keep marking it; immich updates then need a fresh full copy first | immich's night update is skipped where no fresh copy exists | **A** |
+| 8 | **R-624** — May the update test hold an app's admin password to create test data in apps that refuse strangers (vaultwarden, zipline)? | Yes, on the test bench only | No: write down that these apps are tested by hand | No change; those two apps stay hand-tested | **B** |
+| 9 | **R-502** — May a slow check that starts Docker containers run on DooPlex (the ISO's first-boot test)? | Yes, in full runs only (never on every push), with a clear „not checked" when Docker is missing | No: it stays a hand step of each ISO release | It stays a hand step; it can be forgotten | **B** |
+| 10 | **R-774** — Should Karakeep's page say that its phone app sends crash reports to its makers? | Yes: one sentence on the page | No | The household is not told | **A** |
 
 ## Tonight (2026-10-06): the list at 164
 
@@ -14,7 +35,7 @@ hub 0.138.0 (secrets in the hub database are sealed; checked on a copy: none rea
 files), controller 0.298.0 and a new install image 0.298.0. The app catalog was updated. Six small decisions were taken
 by CC unattended (`09` §3 decisions 131–136); each can be reversed.
 
-**Needs you (none urgent; if you do nothing, each stays as it is):**
+**Needs you (none urgent; if you do nothing, each stays as it is):** *(items 1 and 2 answered 2026-10-06 07:45 and done; item 3 is the table above)*
 1. **Publish installer 1.32.0?** Nine uninstall/pre-flight fixes wait on `main`. If nothing: new installs keep the old
    installer. Pick: yes.
 2. **R-889 — the disk percentage** reads ~5 points low (not `df`'s formula), so fill alarms come late. Pick: use `df`'s