- Configuration → Access tokens: named, scoped (group read/write), expiring (≤365 d), shown once,
stored SHA-256 only, every use logged by name. Bearer fhp_… on the web surface only; /api/v1 refuses it.
- Route table = the code's single source (web/routes.go), pinned to ServeHTTP's switch; session-only:
secrets shown/minted, deletes/resets, password, tokens.
- R-952 closed: /api/v1 route table names each caller, pinned to the switch; no-credential refusal test.
- Fail-open fixed: an empty operator password served the UI open (main skipped RequireAuth). Live hub never open.
- 05 §17, 04 §6.2, 13, 09 §3 251; register 155→157 (+R-1054, R-1055, R-1056, −R-952); STATUS.
- website: prowlarr-logo.svg (byte copy from felhom.eu-media) — the site gate refused every push.
Not deployed — waits for the operator's yes.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
- 15-media-library.md §10: what the box does on each drive event, per app, with the measured call; the guards
that ARE needed and the ones that are NOT (K1: nothing lost while a drive is gone).
- Evidence K4 (dead-drive check: mountinfo `shutdown`, stat unreliable), K5 (restart), K6 (unclaimed Plex),
K7 (old Sonarr/Radarr repair on the bench), K8 (hub received the drive-return events and mailed none), K9 (files identical).
- nightly-rotation.md runs scripts/https_only_check.py first every night; scripts/CHANGELOG.md entry.
- STATUS, CONTEXT (decisions 244-246), REPORT-night-2026-10-14.md.
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
Another session filed R-1033 (Security & access, P2, plain http on the public
names) in 6e0643f6 while this session was working; I minted mine against the
register as it stood before that, rebased onto it without re-checking, and the
push put two R-1033 rows in OPEN-ITEMS.md — register_shape_gate red on main.
Theirs landed first and keeps the number. The apps-page-lag row (Apps & catalog,
P3) is now R-1036, with the references in the website CHANGELOG, STATUS.md and
REPORT-seo-felho-tarhely-2026-10-14.md moved with it. Register and site gates
green again. This clone's pre-push hook is unarmed (core.hooksPath unset), which
is why nothing refused the push locally; said so in the report.
Search Console (3 months, read 2026-10-14): 48 impressions, 1 click, average
position 73.6; the top query is „felhő tárhely" (19). No page on the site used
the phrase — Google was showing the home page by accident.
New pair /sajat-felho-tarhely + /en/own-cloud-storage: what cloud storage is and
the three ways to have one; what to do when the Google or iCloud storage is full
(the free clean-up first, linked to Google's and Apple's own help; the paid
options second); a five-year cost table; where the data sits; who should NOT
choose this; the closed test. Registered in site_gates.py TWINS/URL/SHELL, both
URLs in sitemap.xml (22 -> 24). FAQPage JSON-LD derived from the visible text.
Prices each read 2026-10-14 on the provider's own Hungarian page, with the URLs
and the date in an HTML comment and a visible „Árak" line: Google AI Plus (2 TB)
— Google One's 2 TB plan — 35 990 Ft/év (behind the „Éves" toggle; a plain fetch
sees only the monthly 3 590 Ft), iCloud+ 2 TB 4 490 Ft/hó, Microsoft 365 Családi
(2 TB shared, no longer 1 TB per person) 46 499 Ft/év.
Felhom's own cost follows what the site already said (operator ruling): machine
and install one-off, power, off-site storage monthly by volume, operation
OPTIONAL, no fee during the closed test. Power is stated as an idle measurement
(nyugalmi állapotban 7-9 W, ~75 kWh/év, from audits/night-power-2026-10-13) and
the page says a year with daytime use is more; no daytime figure and no
electricity tariff are given, because neither is measured or sourced.
FAQ corrected (both languages, JSON-LD re-derived): the cost answer carried
unsourced, undated prices and summed Spotify and a password manager into a
storage comparison; and the page contradicted itself on electricity („havi
néhány ezer forint" vs „évi 5.000–15.000 Ft"). App count 60 -> 62 in the four
places that were stale.
Three defects found on the rendered page and fixed: a .vs-row link fell back to
the browser-default blue (contrast 1.99 -> 7.17); 24px of horizontal scroll at
390px because .method-pros li is a nowrap flex row and the new items contain
links (each item's content wrapped in one span); .info-card and .method-pros
were scoped to the pages that first used them. site.css ?v=31 on all 26 pages.
The shared .content-section padding was NOT changed — it is identical on every
page; the new page only lacked the alt-bg alternation, and now has it.
R-1033 the apps page lags the catalog by two apps (plant-it, wger); R-1034 gate
17 checks the FAQ JSON-LD on two hard-coded pages only; R-1035 the SEO result,
with dated checks on 2026-11-11 and 2026-12-09.
Docs 02/05/07/13 and capability F12 (PROVEN-LIVE); the audit's C and D sections; R-1020 (the
duration reads 0) and R-1021 (the hub build builds a stale checkout) filed; STATUS one screen.
Register 133 -> 140 (this session: opened 2, closed 1; another session added 6). Both plugs ON.
Report: REPORT-immich-repair-2026-10-14.md.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
Read-back: live sizing-data.json?v=4 byte-equal to the commit; the presets keep their verdicts,
Immich alone on 8 GB still tight; only the set without Immich changed. Spike B2 on 9202:
POST /api/assets/jobs regenerate-thumbnail rebuilt exactly the 10 broken assets (1.55 s, 5.3 s CPU),
0 of the other 20 photos' 40 files rewritten (control: all rewrote 40 of 40); an empty file maps to
its asset by the first 36 characters of its name. Immich removed through the product, no leftovers.
Register 134 -> 133 (opened 0, closed 1). STATUS D9/D10 ruled.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
demo-hp 12:06:52 UTC, 1.53 GB written: at boot the dead task was judged dead, the partial and its .tmp
removed by the root helper, the next backup finished (5.65 GB), host root back below its pre-cut use.
Orphan thin device 4 repaired first (operator B2 - A); R-1012 P2 -> P3, detection stays open.
Delivered by signed jobs to Tester 1 and the N100 (probe 71/71, real sudo checked). Controller 0.310.0
everywhere after the operator cleared the per-customer floors. Register 134 -> 134 (opened 4, closed 4).
Report: REPORT-power-cut-fixes-2026-10-14.md. Both plugs ON.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
noindex and the robots Disallow lines removed; both URLs in the sitemap with their hreflang pair; the pair
moves from UNLISTED to TWINS in site_gates.py. The explaining sentence's base figure was already the drawn
box's base; a test now pins it (red-proved).
A household ticks apps and sees, for an 8, 16 and 32 GB box: fits well / fits, but
tight / does not fit, the totals, and the apps that burst on CPU. One rule in
assets/sizing.js, every number from assets/sizing-data.json (built by
scripts/build_sizing_web.py from the 2026-10-13 N100 measurement; test: 7 cases,
red-proofed). Unlisted: noindex, robots Disallow, not in the sitemap, linked from
nowhere — site_gates.py gate 25 enforces it (UNLISTED twin pairs keep every twin
check). SIZING.md §5 corrected: the 8 GB line contradicted its own x1.5 rule; guest
sizes 4.0/11.4/27.4 GB with the measured 612 MiB MemTotal shortfall. R-993 gains the
fact that the installer accepts a host below any minimum.
Measured on demo-felhom (N100, 16 GB): 61 apps deployed and removed through the
product, sampled every 5 s; heavy apps with one real action (Immich 200 photos,
Jellyfin transcode, Paperless OCR, Nextcloud 500 MB, ...). sizing.json for the
estimator (tools/build_sizing.py), SIZING.md with the proposed minimum machine,
METHOD.md. Power is RAPL CPU-package only (no meter). R-993 asks the operator to
approve the minimum machine; R-994 lists catalog limits/requests that are too low;
R-995 records leftover unnamed volumes after removal. R-231's dated check measured:
dooplex-backup.service success, journal green.
The catalog published SABnzbd and NZBGet today (app-catalog 8ee687e). Here:
- two cards in the media category on both language sets, each with the project's own logo and
each saying IN BOLD that a paid Usenet subscription is the household's own
- the published count 60 -> 62 everywhere it is stated; the category badges are derived from
the cards now (media read 15 with 17 cards, otthon/home read 14 with 16 — both stale)
- documentation/audits/usenet-2026-10-12/: both bench runs, both box steps and verdicts, the
nine defects with their measurements, what a missing provider left unmeasured, the teardown
- R-988 closed (moved to CLOSED-ITEMS in this commit); R-989 filed: the drill-catalog route of
09 §6.5 cannot be followed — that repo is private and no box has catalog credentials, so the
templates were staged in the box's own catalog cache instead
- walk.app_env: a SECRET field in app.yaml is stored ENC:, so that helper returns ciphertext —
the docstring says so now, measured the hard way
- STATUS.md and REPORT-usenet-2026-10-12.md
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y
Read-only. fetch.py (polite, 5 s apart, 34 pages, all 200), parse.py (own text only; four parser
defects found by the controls and fixed), build.py + spotcheck.py (stdlib). tags.csv holds post
numbers and tags only - no username, author id, salt or post text in git. FINDINGS.md (2,908 posts,
195 people, 82 beginner threads in 7 clusters), FELHOM.md (catalog gap, hardware fit, 15 website
questions, objections, ten ranked recommendations), METHOD.md (controls, spot-check: role and
hardware below 85 % after two rounds, the table-driving splits 92.5 % and 97.3 %), REPORT.md.
R-990: operator rules on the recommendations. R-991: no buyer-readable hardware floor.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
Read-only. fetch.py + tables.py (stdlib), TABLE.md (45 charts, % of
respondents), FELHOM.md (apps, features, reasons, hardware, trends, ten
ranked recommendations), METHOD.md (hashes, counts, matching, MIT licence,
limits). Survey files are not committed. One register row (R-989) and one
STATUS line ask the operator to rule on the recommendations.
The catalog published qBittorrent and Transmission today (app-catalog 9081a47). Here:
- two cards in the media category on both language sets, each with the project's own logo,
each saying what a closed peer port costs (slower swarms, no incoming peers)
- the published count 58 -> 60 on every page that states it, FAQ JSON-LD with its visible twin
- documentation/audits/qbittorrent-2026-10-12/: both bench runs, both box walks and verdicts,
verify-fixes.json, teardown-newapps.json, and the README brought to its final state
- the 2026-09-30 walk harness: a `type: path` deploy field is filled with the drive ROOT —
the controller refuses a path inside a drive (409), so the walker could not install any app
with a drive field at all
- R-988: the Usenet pair (SABnzbd, NZBGet), operator request, not started
- STATUS.md and REPORT-newapps-2026-10-12.md
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y
A page-by-page review of the live site (1440px and 390px) found six defects and
two editorial questions. The operator answered three questions; the answers and
the evidence are in REPORT-review-2026-10-12.md.
Fixed:
- The contact form showed its consent error before any submit, on both pages:
#privacyError sits outside any .form-group and the hide rule was scoped to
.form-group. Scoped to the page. Checked: load (none) -> submit unticked
(shown) -> tick (gone), with no message sent.
- The consent checkbox is the site's own control now: 24px box, keyboard focus
ring, and a second <label for="privacy"> at 44x44 round it for touch.
- The contact page promised a reply within 24 hours while /feltetelek 1.1 §4
promises no reply time. Now 1-2 days usually, and no promise during the test.
- sitemap.xml was missing /szolgaltatasok and /en/services: 18 -> 20 URLs.
- The pre-shell mobile-menu script still ran on 20 pages and logged
"[mobile-menu] Missing elements" on every one. Removed.
- The sidebar's tester button was btn-outline while the hero's was btn-primary.
- The home page's "Mit tud a doboz ma?" was three bare links; each card now
carries 2-3 of the services page's own items, word for word.
- A plain Facebook link in the footer of all 22 pages. No script, widget or
pixel: the only external hosts any page refers to are still felhom.eu and
stats.felhom.eu.
Voice (operator ruling: "I" everywhere a person speaks): contact, tester and FAQ
pages in both languages, and the home and services pages that repeat the same
promises. An inclusive "we" (you and I, talking) stays plural, and the legal
texts are untouched. Each FAQ answer exists twice (JSON-LD + visible) and gate 18
holds them equal - it caught the five answers whose markup split the sentence.
Hero clip rebuilt: Immich first, so the poster is a wall of real photographs;
the Jellyfin scene starts after the demo's library wall (eleven pieces of poster
art whose licence cannot be quoted from a first-party source); 1.3s of blank
screen cut from the OnlyOffice scene. The film that plays, Caminandes 3:
Llamigos, is CC BY per Blender's own video platform ("licence": {"id": 1,
"label": "Attribution"}) - NOT public domain as website/CHANGELOG.md said
yesterday. That sentence is corrected in place and the film is credited under
the hero caption.
New gate 24: sitemap.xml lists every public page once, with its twin's hreflang
pair, and lists nothing else. Decoy: site/sitemap-missing-page, the exact shape
the reviewer found by hand.
site.css ?v=30; hero clip and poster ?v=2.
- 09 §3: the decision sheet S1-S38, the operator's words quoted where they differ (S1, S2, S8, S32, S37)
- closed: R-831 R-870 R-698 R-327 R-230 R-719 R-352 R-526 R-770 R-771 R-913 R-290 R-209a R-769 R-616 R-884, and R-243 (dated check: the mail fired 2026-10-11 16:13:51Z, hub log agrees)
- R-698: the known limit written in 07 §6.6; new row R-933 (mirror supported catalog images, P3)
- R-327: capability-map row BUILT; stands claim re-titled and moved to built; page re-rendered
- R-913: the customer Cloudflare token recipe in day0-install A.1; 01 §7 points at it
- R-884: read only - ArgoCD Synced, live Deployment equals git
- R-887 dated check NOT met (4 lost jobs 10-10/11); re-dated 2026-10-19 after the S21 change
- 22 open rows carry their ruling; STATUS: the sheet is ANSWERED
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
The operator recorded the six scenes and ruled on their length: use them whole,
"they had been cut as I liked them". Jellyfin, Tandoor, OnlyOffice, Immich,
RomM, Paperless, 0.6s crossfades, 36.6s looping at 904x556.
- hero-clip.mp4 (1 134 KB) + hero-clip.webm (1 295 KB) + hero-poster.webp
(53 KB), one set for both languages: the recordings are the same on / and /en/.
- The hero <video> sits in the frame's cut-out hole at z-index 1, the frame above
it at 2. No autoplay attribute: the page's script starts it when the hero is on
screen, pauses it when it leaves, and never starts it under
prefers-reduced-motion. With JS off the poster stays.
- make_hero_clip.py reads each scene's own length (ffprobe) instead of cutting
every one to a fixed window, and the xfade offsets count from the running sum
minus one fade per transition already made.
- site.css ?v=26 on all 22 pages.
NOT verified: playback in this workstation's Chrome, whose media pipeline loads
nothing at all today (a 1 KB generated WAV blob stalls the same way, with no
error) - which rules the clip out as the cause. Geometry, layering and the
poster frame were verified in the browser.
Jellyfin, Paperless and RomM were filmed on those projects' own public demo
sites; the films in the Jellyfin scene are public-domain prints.
Reported from his own screens. Five defects, two design.
1. THE CATEGORY ANCHORS WERE DEAD - all 100 of them. The sidebar's five app-category
links pointed at #fajlkezeles-irodai and friends; the ids are #fajlkezeles and
friends. The sidebar is copied into every page, so one wrong fragment was wrong
twenty times, and a dead fragment raises no error anywhere: the browser stays put.
New gate 23 resolves every in-site #fragment against the page it names (360 today).
It convicted two more on its first run: the home page's four hero tiles pointed at
/alkalmazasok#immich, which no page had ever carried, and the FAQ's contact button
pointed at a home-page section that had moved out. Every app card now carries its
slug as an id - taken from the card's own logo file, which gate 21 already ties to
the catalog, so the ids cannot drift from it silently.
Decoy site/dead-fragment puts the operator's own bug back and the gate convicts.
2. SZOLGALTATASOK IS A PAGE: /szolgaltatasok + /en/services, registered in TWINS, URL
and SHELL. The ten capability items moved VERBATIM out of the home page; the home
keeps the promise sentence, the three group names as links and a button, and is 345
Hungarian / 434 English words shorter. The .caps rules stopped being .page-index-
scoped, because the block now lives on a page with a different body class.
3. THE HOME HEADLINE is back in the hero column beside the picture, two lines with the
second in --blue-bright at clamp(2.1rem, 4.4vw, 3.2rem). M3 had moved it into
.page-header - the INNER pages' heading - so it shrank to 2.1rem and the domain
badge was stranded beside it.
4. THE HERO PICTURE is the real dashboard in a laptop. The frame is the operator's own
supplied render; the screen is dashboard-start-{hu,en}.webp composited into it, so a
visitor sees a real box's Launcher rather than a drawing of one - the supplied
screens are AI-drawn and misspell app names. 57 KB, named dashboard-laptop-<lang>
so gate 19 holds it to the page's language.
5. .page-lede HAD NO CSS AT ALL on 16 pages: a bare paragraph, full width of the
content column, hard against the box beneath it. 760px measure, centred over the
box, air beneath; left-aligned on /szolgaltatasok, which has no centred box.
6. THE SIDEBAR LOGO: the wordmark shipped at 0.67x the mark's width where the real
lockup (assets/logo.png, measured: mark 492px wide, wordmark 631px) has it at 1.28x.
Mark 112px, wordmark 25px tall, 28px less vertical padding.
7. SCROLLBARS are the page's own now. The first attempt missed the viewport's: it is
painted from <html>, and a `body.shell ::-webkit-...` rule only reaches scrollers
inside the page.
Also: the two Latin font subsets are preloaded. With font-display: swap the page
reflowed after first paint - measured at 1339px on /alkalmazasok#media.
Checked at 390px and 1440px on all 21 pages: no sideways scrolling, footer inside the
content column everywhere, drawer opens with all 13 items. site.css?v=24.
The two defects the operator found on his own phone are fixed and live since
5aeb36b5; this is what pins them so they cannot come back silently.
site_gates.py gate 22 parses site.css and shell.css into
(media context, selector, declarations) and fails on any property site.css
declares on a selector shell.css also styles that nothing overrides - neither
shell.css itself nor a `.shell ...`-scoped reset. site.css loads first, so
"later wins" is per PROPERTY, not per rule. Today: 689 site rules vs 119 shell
rules, 9 shared selectors, 0 leaks. .hamburger-box / .hamburger-line are an
explicit allow-list with the reason beside them.
It is media-aware precisely because the check it replaces was not. The STOP-1
leak diff excluded @media blocks and reported "exactly six" leaking
declarations; the real number is forty, and the worst of them
(@media (max-width: 900px) .nav-links { position: fixed; right: -100% })
parked the drawer's menu off-canvas and shipped.
Two decoys in test_gate_decoys.py, both the exact shape that went live, both
seen to convict:
site/shell-css-leak-in-media the body:not(.shell) scope taken back off that
one rule - the gate names the media query, the
selector and `right: -280px`
site/footer-outside-main <main> closed early on gyik.html - gate 3b's line
They plant and restore BYTES, with the anchor translated to the file's own line
ending: these files are CRLF in a Windows worktree and LF in a Linux one, and
replace_in's text-mode round trip would have rewritten a whole file on one side.
Also: CHANGELOG entries for both areas, the M3 report corrected where it quoted
its own wrong "exactly six", and one plain-language STATUS line.
Records what shipped, the two operator decisions as answered, what the website and
the controller now share and how a change flows between them, and the five faults
that measurement caught before the switch rather than after.
head-before.json / head-after.json are kept as the evidence that the switch changed
no SEO-bearing tag: the only difference across 19 pages is the dash substitution
inside the two FAQ pages' JSON-LD.
Every document that described the biography as a home-page section would now be
wrong, so each is corrected rather than left:
ki-all-mogotte.md gains 'Where it ended up' with the operator's reasoning, the
rejected /rolam option, and why the home page keeps a trace
AUDIT.md lever 2 carries a dated revision note (the audit itself is a
record of what was found, so it is annotated, not rewritten)
PREFLIGHT.md re-measured on the deployed page after the move:
1440: 6 780 -> 6 385 px (42% shorter than the old page)
390: 10 865 -> 10 145 px (49% shorter, 23.6 -> 12.0 screens)
sections 10 -> 9, layout families 10 -> 9, still no repeat
eyebrow allowance 4 -> 3, still 0 used
website/CHANGELOG the live change, with the layout bug that the deployed page
revealed and the markup did not
REPORT + STATUS what is live vs what is still waiting on the operator
The numbers moved because a whole section left the page; leaving the old ones in
place would have been a quiet overclaim in the other direction.
REPORT-redesign-2026-10-10.md (not REPORT.md: that file belongs to the kernel
night session de4a8d20 and is overwritten per session).
NEXT.md - the other pages in order with what each needs, and the traps:
teszteles/en/testing first (the destination of every CTA, newest page)
gyik/en/faq second, with the warning that gate 17 requires the FAQPage JSON-LD
to EQUAL the visible answers, so every copy edit there is a two-place edit
technologiak third ("Ipari szintu megoldasok" is the exact language the home
page just removed)
alkalmazasok is BLOCKED on R-929 - prose 58, page 59 cards, catalog 60
adatkezeles/feltetelek are reviewed legal texts; a dash sweep there needs the
operator's word separately and is not ours to take
It also records the per-page em-dash count: 300 across 19 pages, the preview
being the only page at zero.
STATUS.md - the operator's one screen, in plain language: the preview is waiting
on him, the two fixes that DID go live, and the two new decisions (R-931 the
missing compression, R-929 the app count).
website/CHANGELOG.md - the footer sweep and R-930, both with their measurements
and with the scope stated rather than implied.
Register 127 -> 129 (R-930, R-931 opened; none closed).
Records what your screenshots turned up: the per-page scoping that left the
tester pages unstyled, the site-wide missing base link rule (which also
affected gyik/technologiak/biztonsagimentes), the sitemap BOM, and the
correction that nobody is testing today so all five places are open.
OUTREACH.md: a personal message, a Facebook group post with a shorter variant,
a forum post, and a table of 15 places with the rules quoted where they are
published. Nothing was posted and no group was joined; the group data was read
from each group's public About page on 2026-10-10.
The rules that matter, measured rather than assumed: Magyar Linux Felhasznalok
(11970, public) has no advertising ban and Felhom is on topic; DIY Smart Home
forbids ads and names an e-mail route; HUP forbids unlicensed advertising; the
prohardver family forbids "tagok, vasarlok gyujtese ... felhivas" without the
operator's permission, which is literally what recruiting testers is.
R-929 (P4): the website's prose says 58 apps, the apps page renders 59 cards,
the catalog holds 60 template directories. Gate 15 cannot catch it because it
compares the two language sets to each other, never to the catalog. Not fixed
here - it needs the catalog skill's exclusion rules. The campaign posts say 58,
matching every prose claim on the site.
The operator was asked at the end, as the brief said, and ruled: keep Monica
out. R-927 opened and closed in the same session, with the measurements and the
sentence worth keeping — an app is not added because a gap exists, it is added
because the app can be kept. Register 137 -> 138: 2 opened, 1 closed.
Also in here: the two small things seen and not filed (remove leaves hold-logs
in the stack directory, with no secret in it; the catalog clone's pre-push hook
is unarmed, so the gates were run by hand before the commit and by CI after).
The catalogue side is app-catalog-felhom.eu b7f0f7c. Here: the evidence, the
website, the register and the operator's view.
Website
- Two cards in the Otthon & Eletmod / Home & Lifestyle section of BOTH apps
pages, with assets: grocy-logo.svg is grocy's own icon with its single fill
made white like the other logos, lubelogger-logo.png is the app's own icon
with its dark background dropped and the mark made white (the rule
SparkyFitness's PNG follows), and six screenshots of each app's own UI with a
household's own data, taken headless on the bench from the published template.
- The app count moved 56 -> 58 in 15 places per language set, both languages,
and the open-source tile 49 -> 51. Checked by asking the same patterns for the
new number afterwards. marketing/facebook/COPY.md still says 56 and is NOT
changed: the post it carries is already scheduled.
Evidence
- documentation/audits/new-apps-2026-10-10/ — FIT.md (checklist group 0 for all
three, with the Hungarian-UI column), the bench and box transcripts, the
memory samples, the screenshots and the gate runs.
Register: 137 -> 139 rows, 2 opened, 0 closed.
- R-926 after a remove-keeping-backups and restore, nobody has checked what the
app page shows for an after_install app's generated password. Measured here:
LubeLogger is safe (its login is derived from the environment at every start,
the new password signs in, the data is back); grocy's install password still
signs in from the restored database but the deployed environment no longer
carries ADMIN_PASSWORD at all. Seven apps are in the class.
- R-927 Monica, stopped at checklist 0.2 with the measurements, waiting on the
operator.
Gate scripts: the same console trap in nineteen of them and in repo_gates.py
itself, where it ABORTED THE WHOLE RUNNER at the first gate — printing a
non-ASCII character on this workstation's cp1250 console raised
UnicodeEncodeError before the gate had decided anything, and reuse_refs_check.py
died while printing a NOTE. All now reconfigure their own streams. Red-proof
that the remaining script-test failures are not mine: test_due_checks_gate.py
fails the same 5 of 42 with the change reverted.
PART A -- the poster. documentation/architecture/felhom-system-poster.html
(307 KB). Secret scan first: ZERO IPv4, zero PEM blocks, zero ssh keys, zero
Bearer. The one EAA... match is base64 inside an embedded "mime":"font/woff2"
blob, not a Facebook token. "token"/"secret"/"password" appear 11 times and
every one is a NAME ("6. ep0 read token", "the hub seal key"); the poster
itself says "Names only; no secret values". All five long base64 blobs are
declared assets: 1 image/png, 3 text/javascript, 1 font/woff2.
It renders with NO network: the source mentions cdn.jsdelivr.net and Google
Fonts, but the loaded requests are only the HTML plus blob:/data: URLs -- the
bundler inlined everything. Measured, not assumed, and it matters: this is a
disaster-recovery document, so needing the internet to draw would be a defect.
No console errors.
The operator's three Claude Design fixes are all present: (a) no "WG" badge,
WireGuard only for the tunnel, no badge on the ep0-copy tile; (b) the box ->
ep0 arrow reads "encrypted on the box, sent through WireGuard"; (c) "Known
gaps" holds two items and NOT the household-keys sentence, which is now a
neutral "By design" note under the ep0 household namespace.
ONE FACT ON IT WAS WRONG. The felhom.eu tile said "served from DooPlex through
Cloudflare". It is not: Cloudflare is DNS only and the traffic goes direct --
measured this morning for the privacy notice, which states exactly that. The
poster would have contradicted a published page. Fixed in place (a label):
"served from DooPlex, Cloudflare DNS only". The first wording overflowed the
fixed-size tile, so it was shortened to fit and the evidence lives in the
facts file instead -- checked by re-rendering, not by hoping.
PART B -- the facts and the rule. DESIGN-PROMPT-...md is renamed
felhom-system-poster.facts.md (one home per fact), with the three fixes folded
in as explicit instructions so a regeneration cannot undo them, plus a new
"Badges" section saying a "WG" chip must never come back.
New rule, section 6 "The system poster stays true", added IDENTICALLY to all
five copies of unprompted-work.md (the four repos and the workspace root on
DooPlex; verified identical by diff before and after) and to
PROMPT-TEMPLATE.md's end-of-session checklist as a FIFTH coupled artifact.
scripts/poster_facts_gate.py WARNS when the facts file has a newer commit than
the poster. It never fails a push, deliberately: a refresh needs Claude Design
and the operator, --no-verify is forbidden here, so a blocking gate would leave
deleting it as the only way out. It compares COMMIT times, not mtimes, because
a checkout rewrites mtimes and every fresh clone would shout.
RED-PROOF -- and it found a real bug in the gate. The first run warned
correctly but exited 1: a single non-ASCII character in its own warning raised
UnicodeEncodeError on this cp1250 console. A gate whose entire contract is
"never fails a push" was failing pushes. Fixed (ASCII output + an encode
guard), and the decoy now asserts BOTH the warning and exit 0. Three branches
proven: facts newer -> warns, rc 0; poster newer -> quiet, rc 0; poster
missing -> "could not tell", rc 2, not a false all-clear.
The decoy itself was seen to fail, twice, on Linux (the suite needs fcntl and
cannot run on Windows): breaking the warning gives STALE_WARNS=False, and
making it exit 1 gives RC_STALE=1. All 80 felhom.eu decoys behave.
PART C -- do box reports pass through Cloudflare? NO. Two channels. DNS from
PUBLIC resolvers (not DooPlex's own, which answers the LAN address):
hub.felhom.eu is a CNAME to dooplex.hopto.org -> 37.191.56.193, not a
Cloudflare address, and no cf-ray comes back. The manifest: an ordinary k3s
Ingress, Cloudflare named only in a DNS setup comment. THE CONTROL that makes
the negative mean something: iso.felhom.eu resolves to 172.67.x / 104.21.x,
real Cloudflare addresses -- so the method does detect proxying.
So nothing is added to the Cloudflare row: the hub path does not touch it.
06-offsite-connectivity.md section 1 claimed the public edge is a
Cloudflare-Tunnel and "DooPlex has no public IP" -- both untrue today. Kept
and marked STALE with the measurement rather than rewritten, because that
paragraph is the reason ep0 exists and the argument needs its premise visible.
total-loss-of-dooplex.md's "today a CNAME to dooplex.hopto.org" is confirmed
correct.
Register: 137 before, 137 after, 0 opened, 0 closed -- every finding here was
small and fixed in the session.
admin