02 "Logins and folders" [DESIGN]: an infra stack is part of the box on the app page; one login answer per
installed app (catalog app_info.login_kind); FileBrowser's new-password press (its CLI, server stopped);
"Fájlok ↗" and the per-drive media folders, a folder with no source is text. Register 176 -> 179.
STATUS: look at FileBrowser, RomM and Plex on demo-hp; say yes for the N100's press; decision D10 (R-1102).
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
A fresh one-disk install (512 GB VM, installer 1.33.0, agent 0.158.1 + golden 0.318.0 vouched): data volume 100 GiB, data
area 213 GiB registered as the default drive with no press, Jellyfin with no extra step, nothing of the area in a whole-box
copy; partitions formatted and used; the honest backup offer on a VM; /mnt/sys_drive never offered (no box had it).
16 §13 build B status; capability map D15; poster facts (drawing needs a refresh, STATUS); the backup page HU+EN now that
it is true; REPORT-storage-identity-buildB-2026-10-16.md.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
Measured four boxes, the hub's five host reports, every catalog image's registry size and one whole-box copy's
thin-pool use. Proposal: mp0 50/100/130 GiB, reserve max(16 GiB, 10 %) capped at 48 GiB -> the internal place
about 42/182/590/1,510 GB for 256 GB/512 GB/1 TB/2 TB. STATUS D10 asks for the operator's ok.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
The operator ruled D1-D6 as recommended. Build A shipped (agent v0.157.0, controller v0.317.0 MinAgent 0.157.0,
hub v0.154.0): live on Tester 1 (unknown/vm, the "cannot check" notice, copies made not counted), demo-hp and
the N100 (proven, different, unchanged). NAS notice and the no-drive sentence are unit-proven only.
STATUS: D10 removed; vouch agent 0.157.0 and rule on R-1082 added. Poster: the Tier-2 line, text only.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
0.316.3 joins 0.315.0 in the row rather than becoming a near-duplicate of it: same cause shape (a
guard that was not on the path the work takes), same consequence (a published tag whose content is
not what its number says), same answer (leave it; a version number is pushed once, including one
CC spoiled). The root fix — build.sh refusing a dirty or unpushed tree — is named in the row.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y
The guard that makes a version number unrepeatable went into controller/build.sh in the repo. The
documented release command runs $FELHOM_ROOT/build/felhom-controller/build.sh — a SEPARATE COPY
taken 2026-07-18, with no guard. So the first thing I did with the new refusal, running it against
a real existing tag to prove it fires, rebuilt and re-pushed 0.315.0 a fourth time, now carrying
v0.316.0's code (8887343011d6 -> b809201841f7).
The root cause is the copy, and it is fixed: the build directory's build.sh is a symlink to the
repo's, the stale copy is kept beside it as build.sh.stale-copy-2026-07-18, and the refusal was
then proven to fire from the documented path. Every build this session printed porcelain=0 first,
so nothing else was built from a tree that was not clean.
No box is affected — nothing runs 0.315.0, the floor is 0.314.0, the button offers the highest tag,
and demo-hp 9201 is on 0.316.2. What remains is a tag whose content no longer matches its name, and
the row says plainly that pushing the old content back would be a fifth push of one number.
R-1080's evidence line is corrected in the same commit: it cited "the registry's current digest",
which my own re-push made stale an hour later.
Apps & catalog header corrected 15 -> 16; its own sub-counts already added to 16.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y
02-controller-module-map.md "The app page" gains the layout rules [DESIGN] — one column of one
width, a section is a hairline not a card, a box means something (blue = the app is waiting for
you, amber = something is risky, nothing else), the hero is not a box, and a success is not a
banner. Plus the asset-tag rule: every shell's stylesheet address is derived from the BUILD, not
the version, because the origin sends no validator and a cached copy can therefore only expire or
be addressed differently.
09-update-architecture.md gains §0 [DESIGN]: a version number is pushed once. It belongs at the TOP
of that document because everything below it compares versions — the floor moves a box by comparing
a number, the button offers the highest tag, and a box re-pulls a tag only when the tag changes.
Two images under one number is therefore not untidiness; it is a box running the wrong code that
can never be told.
R-1080 filed and closed: 0.315.0 was pushed three times from three different commits. Closed rather
than left open because no box is stranded — exactly one guest ran it and it ran the registry's
current digest, and the floor was 0.314.0 so nothing else could have taken it.
audits/app-page-2026-10-15b/P0/ carries the measurement and its honest caveat: the stale Cloudflare
object is no longer reproducible, because the first probe of the session forced its revalidation.
What is shown is every precondition, the proof an aged entry existed (cf-cache-status EXPIRED), and
the elimination of the only other candidate. The six stylesheet bodies are reduced to their sizes,
sha256s and rule counts — one 99 KB file does not need six copies in git to make the point.
.claude/rules/unprompted-work.md item 6, all four versioned copies: a version number is pushed once,
stated as a FACT about what the build now enforces rather than as a new rule.
STATUS: the operator's one look, through the public address.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y
Spike (read-only probe, tools/physdisk_probe.py): the agent-side walk (partition -> disk, dm/LVM
slaves, loop -> backing file) names the right physical disk for one-disk boxes, two disks, two
partitions of one disk and a pass-through USB bridge; inside a VM (Tester 1) every disk is "unknown".
Today's agent lists whole disks only and calls an empty partition table "data-bearing"; the
controller's Tier-2 "different disk" is st_dev. sys_drive is a folder of mp0 (backup=1), so the
design gives one-disk boxes a separate internal data place outside the whole-guest copy instead.
Draft only; waits on the operator's rulings D1-D6 (16 section 12). 07 section 6.1's stale mp1 cell
corrected. Register 163 -> 169. Scratch loop disk and Tester 1 scratch disk removed.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
On demo-hp: OMV 8.5.11-1 + openmediavault-kvm 8.3.4 in a VM, every OMV step done in its web pages
(headless browser). Public ISO 1.29.0 on the whole passed NVMe, BIOS firmware, bound and claimed as
throwaway customer Tester4, Vaultwarden + Jellyfin, local backups, two OMV restarts (clean guest
shutdown, AutoStart back in 1 min 52 s). Guest memory 7,863 MiB of 12 GiB.
Traps for the guide: the bridge changes OMV's IP; the plugin boots the disk first (wipe the NVMe);
the host-disk list offers OMV's own disk. Rows: one-disk Jellyfin refusal (R-1068), virtio disk not
formattable (R-1069), tunnel-less OS-update alarm (R-1070), NAS films for Jellyfin (R-1071, operator),
mixed formal/informal backup text (R-1072), no SMART in a VM (R-1073, operator). Register 157 -> 163.
Everything removed; Tester 1 back ONLINE. Customer Tester4 waits for the operator's delete.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
02-controller-module-map.md gains "The app page" under web/: the URL map, why the default tab is
RENDERED at the bare URL and not redirected to, why the tabs are links and not panels, the
302-never-301 rule for the old /stacks/{name}/... GETs and the untouched POSTs, the after-start
registry (and why its actions are Go, never catalog data), and the guide's checked_version gate.
Each marked [DESIGN]. There was no document covering the app page at all, which is why the six-page
sprawl and the "Vissza goes to the list" behaviour were never called wrong — R-1066, filed and
closed by the same change.
10-localisation.md §7 gains the guide block, including the one exception it has to state out loud:
guide sections and FAQ entries are matched BY INDEX, the only lists in the copy model that are,
because a section's title is the thing being translated and so there is no key to match on. Safe
only because the copy gate requires equal counts AND the fallback stays field by field.
R-1067 (P4, BLOCKED): the catalog still carries pi_compatible: and nothing reads it. Left on
purpose — a box on 0.314.0 would show "csak x86" on every app — and gated on the fleet floor
reaching 0.315.0.
STATUS.md: one line asking the operator to look at the new app page on demo-hp, and the controller
version line.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y
- 09 §3 decision 254 (operator decisions 240/243 written down); target-selection: a "lived-in" tier, Tier 0 = demo-hp
alone; nodes.md role + drive; 11-os-updates ring 0 wording; CLAUDE.md + docs.md: the diary.
- documentation/lived-in/n100.md (new diary); audits/n100-lived-in-2026-10-15/ (state, drive read, Part C capture sets,
installs, wiring, stranger probes, demo-hp clean-up, the operator's SHEET.md).
- Register: R-1062 (the split, operator decides), R-1063 (decommission half-state on an agent refusal), R-1064 (path
removal silent about cross-drive copies), R-1065 (a claimed Plex gets no libraries until a wiring run).
- demo-hp: /mnt/sizing-bench removed through the dashboard; the hub shows demo-hp OK (14:56 UTC).
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
- audits/prowlarr-2026-10-15/box9201: Sonarr then Prowlarr — no link until „Bekötés most"; Radarr after Prowlarr —
linked by itself ~60 s later; Prowlarr's connection test 200 for both, its sync command completed; all removed
keeping data. The first run's key-quoting defect in the tool is recorded and fixed.
- R-1058 (Apps & catalog, P3): the wiring does not start when Prowlarr itself comes up.
- R-1048 closed (CLOSED-ITEMS). STATUS, CONTEXT. REPORT-release-rule-prowlarr-2026-10-15.md.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
- documentation/audits/prowlarr-2026-10-15/: bench (update test proven, C3 failed as it must, soak 7.6 %,
volume-persistence CLEAN, official-image check), 9202 runs 1-3 (run 1's bump emptied the drill .felhom.yml — a
test-tool bug, fixed; run 3 re-proved the step and backup -> remove -> restore with the full template), tools.
- website: a Prowlarr card on both apps pages; every stated count 62 -> 63, the media group 19 -> 20; sizing.json +
sizing-data.json carry Prowlarr (41/44 MB, onboarding), the sizing test and SIZING.md table moved to 63 apps.
- OPEN-ITEMS: R-1057 (a restore of a removed gated app returns without the gate, even from a backup made before the
setup — measured on 9202); R-1036 notes the count and that wger/plant-it are hidden/abandoned.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
- Configuration → Access tokens: named, scoped (group read/write), expiring (≤365 d), shown once,
stored SHA-256 only, every use logged by name. Bearer fhp_… on the web surface only; /api/v1 refuses it.
- Route table = the code's single source (web/routes.go), pinned to ServeHTTP's switch; session-only:
secrets shown/minted, deletes/resets, password, tokens.
- R-952 closed: /api/v1 route table names each caller, pinned to the switch; no-credential refusal test.
- Fail-open fixed: an empty operator password served the UI open (main skipped RequireAuth). Live hub never open.
- 05 §17, 04 §6.2, 13, 09 §3 251; register 155→157 (+R-1054, R-1055, R-1056, −R-952); STATUS.
- website: prowlarr-logo.svg (byte copy from felhom.eu-media) — the site gate refused every push.
Not deployed — waits for the operator's yes.
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
admin