- Configuration → Access tokens: named, scoped (group read/write), expiring (≤365 d), shown once,
stored SHA-256 only, every use logged by name. Bearer fhp_… on the web surface only; /api/v1 refuses it.
- Route table = the code's single source (web/routes.go), pinned to ServeHTTP's switch; session-only:
secrets shown/minted, deletes/resets, password, tokens.
- R-952 closed: /api/v1 route table names each caller, pinned to the switch; no-credential refusal test.
- Fail-open fixed: an empty operator password served the UI open (main skipped RequireAuth). Live hub never open.
- 05 §17, 04 §6.2, 13, 09 §3 251; register 155→157 (+R-1054, R-1055, R-1056, −R-952); STATUS.
- website: prowlarr-logo.svg (byte copy from felhom.eu-media) — the site gate refused every push.
Not deployed — waits for the operator's yes.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
- 15-media-library.md §10: what the box does on each drive event, per app, with the measured call; the guards
that ARE needed and the ones that are NOT (K1: nothing lost while a drive is gone).
- Evidence K4 (dead-drive check: mountinfo `shutdown`, stat unreliable), K5 (restart), K6 (unclaimed Plex),
K7 (old Sonarr/Radarr repair on the bench), K8 (hub received the drive-return events and mailed none), K9 (files identical).
- nightly-rotation.md runs scripts/https_only_check.py first every night; scripts/CHANGELOG.md entry.
- STATUS, CONTEXT (decisions 244-246), REPORT-night-2026-10-14.md.
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
Fetch, pull --ff-only, then refuse unless clean and HEAD == origin/main; the
commit label is read after the pull. Test with a stub docker: 6 cases; the
old script gets 5 wrong. Evidence for the catalog gate unclean-boot-images.
The 2 TB yearly figure sits behind a JS toggle, so a plain fetch sees only the
monthly 3 590 Ft; the screenshot is what a re-check has to compare against, and
Google's tier branding (Google AI Plus) has already changed once. Live read-back
recorded: 12 requests on two hosts, no horizontal scroll at 390px, JSON-LD equal
to the visible text, console clean.
Search Console (3 months, read 2026-10-14): 48 impressions, 1 click, average
position 73.6; the top query is „felhő tárhely" (19). No page on the site used
the phrase — Google was showing the home page by accident.
New pair /sajat-felho-tarhely + /en/own-cloud-storage: what cloud storage is and
the three ways to have one; what to do when the Google or iCloud storage is full
(the free clean-up first, linked to Google's and Apple's own help; the paid
options second); a five-year cost table; where the data sits; who should NOT
choose this; the closed test. Registered in site_gates.py TWINS/URL/SHELL, both
URLs in sitemap.xml (22 -> 24). FAQPage JSON-LD derived from the visible text.
Prices each read 2026-10-14 on the provider's own Hungarian page, with the URLs
and the date in an HTML comment and a visible „Árak" line: Google AI Plus (2 TB)
— Google One's 2 TB plan — 35 990 Ft/év (behind the „Éves" toggle; a plain fetch
sees only the monthly 3 590 Ft), iCloud+ 2 TB 4 490 Ft/hó, Microsoft 365 Családi
(2 TB shared, no longer 1 TB per person) 46 499 Ft/év.
Felhom's own cost follows what the site already said (operator ruling): machine
and install one-off, power, off-site storage monthly by volume, operation
OPTIONAL, no fee during the closed test. Power is stated as an idle measurement
(nyugalmi állapotban 7-9 W, ~75 kWh/év, from audits/night-power-2026-10-13) and
the page says a year with daytime use is more; no daytime figure and no
electricity tariff are given, because neither is measured or sourced.
FAQ corrected (both languages, JSON-LD re-derived): the cost answer carried
unsourced, undated prices and summed Spotify and a password manager into a
storage comparison; and the page contradicted itself on electricity („havi
néhány ezer forint" vs „évi 5.000–15.000 Ft"). App count 60 -> 62 in the four
places that were stale.
Three defects found on the rendered page and fixed: a .vs-row link fell back to
the browser-default blue (contrast 1.99 -> 7.17); 24px of horizontal scroll at
390px because .method-pros li is a nowrap flex row and the new items contain
links (each item's content wrapped in one span); .info-card and .method-pros
were scoped to the pages that first used them. site.css ?v=31 on all 26 pages.
The shared .content-section padding was NOT changed — it is identical on every
page; the new page only lacked the alt-bg alternation, and now has it.
R-1033 the apps page lags the catalog by two apps (plant-it, wger); R-1034 gate
17 checks the FAQ JSON-LD on two hard-coded pages only; R-1035 the SEO result,
with dated checks on 2026-11-11 and 2026-12-09.
Docs 02/05/07/13 and capability F12 (PROVEN-LIVE); the audit's C and D sections; R-1020 (the
duration reads 0) and R-1021 (the hub build builds a stale checkout) filed; STATUS one screen.
Register 133 -> 140 (this session: opened 2, closed 1; another session added 6). Both plugs ON.
Report: REPORT-immich-repair-2026-10-14.md.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
Two test drives enrolled through the dashboard; no test media in any backup tier (A6, three proofs); Tester 1 follows a
credential-free local mirror of the drill catalog (R-992 worked around a third way). The live-fix task may start.
The operator's half of the repair after an unclean boot (controller 0.311.0): counts only, never a
file name; warning mails, info is recorded. Registered in allowedEventTypes and operatorOnlyEvents in
the same commit, plus the per-app cooldown list; tests pin the pair, a household that enabled the type
gets nothing, and the counts line (red-proofed). Decision 236 (operator, 2026-10-14): the box asks
Immich through Immich's own job queue. R-1007 updated; the scripts' run on 9202 added as evidence.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
On 9202, Immich v3.2.4, admin made through the setup gate as a household. A1 (immich-admin) has no
job command. A2 (scoped key: asset.update + job.create) repairs the admin's photos only — a family
member's photo is refused. A3 (nightly missing thumbnails) reads only the database. A4 (the same job
on Immich's own queue, added with its own bullmq) repaired 5 assets of both users in 1.08 s with 0
of 50 controls touched, and found a lost original in 0.44 s. Scan of 20,000 files: 0.29 s.
Decision page for the operator (Part B). Immich removed through the product.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
Read-back: live sizing-data.json?v=4 byte-equal to the commit; the presets keep their verdicts,
Immich alone on 8 GB still tight; only the set without Immich changed. Spike B2 on 9202:
POST /api/assets/jobs regenerate-thumbnail rebuilt exactly the 10 broken assets (1.55 s, 5.3 s CPU),
0 of the other 20 photos' 40 files rewritten (control: all rewrote 40 of 40); an empty file maps to
its asset by the first 36 characters of its name. Immich removed through the product, no leftovers.
Register 134 -> 133 (opened 0, closed 1). STATUS D9/D10 ruled.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
sizing.json + sizing-data.json rebuilt (23 figures up, none down; the checksum chain matches,
build_sizing_web --check OK). The household set without Immich on 8 GB: fits well -> fits, but
tight (2,731 x 1.5 = 4,096.5 > 4,096). Presets keep their verdicts. SIZING.md section 5 table,
bullets and memory table from the rule, plus the dated line; the per-app table re-rendered.
Test expectations moved with the rule. Lede, meta and method note name both machines. Data ?v=4.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
The second machine's figures (sizing-check-2026-10-14/hp-figures.json, HP t740, used basis): each
typical/peak becomes the higher of the two; nothing goes down; every raised figure is named in
raised_by_hp. The patch from sizing-check-2026-10-14/raise-only-source.patch, unchanged. Data rebuilt
in the next commit.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
demo-hp 12:06:52 UTC, 1.53 GB written: at boot the dead task was judged dead, the partial and its .tmp
removed by the root helper, the next backup finished (5.65 GB), host root back below its pre-cut use.
Orphan thin device 4 repaired first (operator B2 - A); R-1012 P2 -> P3, detection stays open.
Delivered by signed jobs to Tester 1 and the N100 (probe 71/71, real sudo checked). Controller 0.310.0
everywhere after the operator cleared the per-customer floors. Register 134 -> 134 (opened 4, closed 4).
Report: REPORT-power-cut-fixes-2026-10-14.md. Both plugs ON.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
plugswitch.py refuses 'off' unless 20 s of readings show the N100 is already off (standby + 1 W,
no ping); 7 tests, each check red-proofed. By hand: guest shutdown 12 s, host off, 0.0 W; the hub
stayed silent and 'ONLINE' for 18 min; plug off/on did not start the N100, its power button did
(dashboard in 42 s). Wall figures into SIZING.md 4 and sizing.json power (8.5 / 20.7 / 0.0 W).
scripts/bench/plugmeter.py prints watts/mA/V/kWh as CSV from the Tuya plug on the LAN
(default) or from Home Assistant on demo-hp's guest. 10-minute side by side and a
3-minute control in documentation/audits/plugmeter-2026-10-13/: Home Assistant alone
did not move for 3 minutes, so the LAN reader is the measurement source.
No key, device id or token in the repo; secrets scan 0 hits with a positive control.
Each category is a native <details>, closed at first, with an 'n selected' count;
a preset opens what it ticks. A sticky memory bar (0-64 GB, marks 8/16/24/32/48/64+):
solid fill = smallest box memory where the selection fits well, thin mark = where it
fits, but tight; one line names the box to buy. minBoxGb() inverts guestMib() by
bisection on it, so the rule is still written once. Box sizes 12/24/48/64 added;
tests cover seven sizes and the inverse (red-proofed); SIZING.md table gains 24 GB.
A household ticks apps and sees, for an 8, 16 and 32 GB box: fits well / fits, but
tight / does not fit, the totals, and the apps that burst on CPU. One rule in
assets/sizing.js, every number from assets/sizing-data.json (built by
scripts/build_sizing_web.py from the 2026-10-13 N100 measurement; test: 7 cases,
red-proofed). Unlisted: noindex, robots Disallow, not in the sitemap, linked from
nowhere — site_gates.py gate 25 enforces it (UNLISTED twin pairs keep every twin
check). SIZING.md §5 corrected: the 8 GB line contradicted its own x1.5 rule; guest
sizes 4.0/11.4/27.4 GB with the measured 612 MiB MemTotal shortfall. R-993 gains the
fact that the installer accepts a host below any minimum.
Measured on demo-felhom (N100, 16 GB): 61 apps deployed and removed through the
product, sampled every 5 s; heavy apps with one real action (Immich 200 photos,
Jellyfin transcode, Paperless OCR, Nextcloud 500 MB, ...). sizing.json for the
estimator (tools/build_sizing.py), SIZING.md with the proposed minimum machine,
METHOD.md. Power is RAPL CPU-package only (no meter). R-993 asks the operator to
approve the minimum machine; R-994 lists catalog limits/requests that are too low;
R-995 records leftover unnamed volumes after removal. R-231's dated check measured:
dooplex-backup.service success, journal green.
The catalog published SABnzbd and NZBGet today (app-catalog 8ee687e). Here:
- two cards in the media category on both language sets, each with the project's own logo and
each saying IN BOLD that a paid Usenet subscription is the household's own
- the published count 60 -> 62 everywhere it is stated; the category badges are derived from
the cards now (media read 15 with 17 cards, otthon/home read 14 with 16 — both stale)
- documentation/audits/usenet-2026-10-12/: both bench runs, both box steps and verdicts, the
nine defects with their measurements, what a missing provider left unmeasured, the teardown
- R-988 closed (moved to CLOSED-ITEMS in this commit); R-989 filed: the drill-catalog route of
09 §6.5 cannot be followed — that repo is private and no box has catalog credentials, so the
templates were staged in the box's own catalog cache instead
- walk.app_env: a SECRET field in app.yaml is stored ENC:, so that helper returns ciphertext —
the docstring says so now, measured the hard way
- STATUS.md and REPORT-usenet-2026-10-12.md
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y
Read-only. fetch.py (polite, 5 s apart, 34 pages, all 200), parse.py (own text only; four parser
defects found by the controls and fixed), build.py + spotcheck.py (stdlib). tags.csv holds post
numbers and tags only - no username, author id, salt or post text in git. FINDINGS.md (2,908 posts,
195 people, 82 beginner threads in 7 clusters), FELHOM.md (catalog gap, hardware fit, 15 website
questions, objections, ten ranked recommendations), METHOD.md (controls, spot-check: role and
hardware below 85 % after two rounds, the table-driving splits 92.5 % and 97.3 %), REPORT.md.
R-990: operator rules on the recommendations. R-991: no buyer-readable hardware floor.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
Read-only. fetch.py + tables.py (stdlib), TABLE.md (45 charts, % of
respondents), FELHOM.md (apps, features, reasons, hardware, trends, ten
ranked recommendations), METHOD.md (hashes, counts, matching, MIT licence,
limits). Survey files are not committed. One register row (R-989) and one
STATUS line ask the operator to rule on the recommendations.
The catalog published qBittorrent and Transmission today (app-catalog 9081a47). Here:
- two cards in the media category on both language sets, each with the project's own logo,
each saying what a closed peer port costs (slower swarms, no incoming peers)
- the published count 58 -> 60 on every page that states it, FAQ JSON-LD with its visible twin
- documentation/audits/qbittorrent-2026-10-12/: both bench runs, both box walks and verdicts,
verify-fixes.json, teardown-newapps.json, and the README brought to its final state
- the 2026-09-30 walk harness: a `type: path` deploy field is filled with the drive ROOT —
the controller refuses a path inside a drive (409), so the walker could not install any app
with a drive field at all
- R-988: the Usenet pair (SABnzbd, NZBGet), operator request, not started
- STATUS.md and REPORT-newapps-2026-10-12.md
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y
The arr stack had no download client: radarr/sonarr/seerr decide what to fetch
and hand it to one, and there was none. Both templates are written and measured
on the bench (LXC 9401) and on 9202 through the product. Neither is published -
the onboarding records are not complete and the gate refuses a template without
one.
Found by measuring, each fixed:
- qBittorrent was unreachable on its own public name: WebUI\ServerDomains takes
SEMICOLONS; a comma list answers 401 Invalid Host header to everything.
Undocumented upstream; measured four ways through the app's own API.
- Both clients asked the household's router to open a port (qBittorrent
UPnP/NAT-PMP ON, Transmission port-forwarding-enabled true). The box opens no
port at home. qBittorrent ignores the seeded Session\UseUPnP=false at first
start but honours the same setting through its API, so it goes through
after_install: ON at 17:21:51, OFF at 17:21:56.
- Transmission could never go healthy (401 on every path, curl -f exit 22).
- Transmission's host whitelist refused its own healthcheck.
- The apparent lock-out was a measurement artefact: with stranger and household
on two different addresses, the stranger is banned and the household signs in
at the same instant (204). qBittorrent reads the real visitor address.
Downloads work with no inbound port, measured: 34 seeds / 4 MB/s (qBittorrent),
48 peers (Transmission), both complete, port confirmed closed.
9202 is back on the live catalog with both apps removed; bench 9401 stopped as
found; the live catalog's main untouched.
admin