night fixes 2026-10-05: System page read after demo-hp's facts caught up (R-853 delay, ~17 min)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -16,6 +16,26 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
 
+> **2026-10-05 (day) — the night's fixes (controller v0.294.0, agent v0.144.0 + v0.144.1, golden 0.294.0 vouched with agent
+> 0.144.1, min_agent 0.131.0).** Rulings 100–103 (`09` §3: Tester 1's CF tokens NOT rotated → R-870; A1 by day on demo-hp
+> only, with the operator's go; Tester 2 is a laptop off at night; re-sign Tester 2 only if online — it never was).
+> CC decisions 104–108, *operator may reverse*: guard "young" = keep-daily CALENDAR days (`offbox_window.go`, built from
+> `keepDaily`/`keepWeekly`/`keepMonthly`); `dockerexec.BeginImageWork`/`TryImageCleanup` for every pulling compose verb;
+> the wrapper's kept report copy (`report-<run>-<layer>-apply.json`) + `Leg.SendUnsentLoop` (5 min) + `pass.lock`; the
+> selftest's saved block (`os-update-block.json`); a second agent release. Closed R-95, R-863..R-869. Opened R-870..R-876
+> (R-871 the operator's decision: a box off at night; **R-876 P2: after a mid-update crash the wrapper's repair misses
+> dpkg's update journal — fix next**). Floors: demo-hp, demo-felhom, tester-1 at 0.294.0 (MinAgent 0.131.0); global
+> unchanged. Report: `REPORT-night-fixes-2026-10-05.md`.
+
+> **2026-10-04 (night) — R-840 BUILT (agent v0.143.0, hub v0.133.0, installer 1.31.0), R-859 + R-860 FIXED (hub v0.133.0,
+> controller v0.293.0), golden 0.293.0 vouched, drill-r50 removed.** The config bundle (`11` §5.4.2): one table of 22
+> root paths in `felhom-os-apply`; signed `agent_config_update`; the trust root never a bundle path; installer installs the
+> same bundle; a pre-0.143.0 box needs `scripts/felhom-bundle-bootstrap.sh` once (demo boxes done; Tester 2 = R-862,
+> operator). Test approvals (`11` §5.3.1): marked, cancelled at a start without the override (4 cancelled 18:20 UTC; the
+> operator's Docker approval kept — CC decision). Docker socket self-heal: controller exits after 60 s of refusals.
+> Floors: demo customers 0.293.0, global 0.292.0 (Tester 2 not moved). Tester 2: signed agent_update to 0.143.0 queued.
+> R-861 opened (the agent sudoers is root-equivalent). Report: `REPORT-r840-config-bundle-2026-10-04.md`.
+
 > **2026-10-04 (~18:49) — rulings 96–99 (the R-840 / Tester 2 brief), recorded before the work.** `09` §3: **96** build
 > R-840 now (option A, a signed config bundle; replaces 82); **97** Tester 2 may receive only the signed agent update,
 > the bundle by the route and the one-time live-restore reload (~19:05: the operator will install the bootstrap file by

REPORT-night-fixes-2026-10-05.md

@@ -0,0 +1,81 @@
+# REPORT — the night's fixes, the power cut by day, a box that is off at night (2026-10-05)
+
+Brief: "fix what the 2026-10-04 night found …" (operator, 2026-10-05). Evidence: `documentation/audits/night-fixes-2026-10-05/`.
+Architecture read before the claims: `07-backup-architecture.md` (§6.1, the Tier-3 row), `11-os-updates.md` (§5.4.1, §8),
+`09` §3 (decisions 53, 68–74, 81, 86), `audits/offsite-append-only-2026-10-03/DESIGN.md`.
+
+## 1. The Part table
+
+| Part | State | Note |
+|---|---|---|
+| §1 rulings recorded first | **done** | `09` decisions 100–103; R-870 (tokens, like R-831); Tester 2's page in `runbooks/target-selection.md` |
+| A — clean-up guard (R-867) | **done** | controller v0.294.0; tests run restic 0.14.0's policy (proven identical to the binary); 5 red-proofs; live windows on both demo boxes with counts; R-867 and R-95 closed (DUE-CHECKS entry removed) |
+| B — image clean-up race (R-863, R-864) | **done** | one lock for every pulling compose verb; the night's shape reproduced in a test and live on 9202 (fired at minute 3, skipped, install OK first time) |
+| C — R8 real download (R-865) | **changed** | fix + tests + red-proof done. Live: the INSTALLED wrapper's measure read 12 802 456 B on demo-hp. **No R8 refusal line was produced**: it needs < 500 MB free on demo-hp's guest = 28.5 GB written into a thin pool with 18.7 GB free — it would have stopped every guest |
+| D — R-868, R-869, R-866 | **done, with a second agent release** | R-868's first fix (v0.144.0) was measured NOT to work live (broken stderr pipe); v0.144.1 fixed it and the A5 shape then delivered one `applied` report. R-866 live with the hub blackholed. R-869 test + red-proof |
+| E — power cut mid-update (A1 by day) | **done** | operator's go; crash 06:13:55 UTC, back by itself in 37 s; **the next pass failed** → R-876 (P2); by-hand repair; demo-hp left with every package current |
+| F — a box off at night (spike) | **done** | read only; `partF/FINDINGS.md`; no architecture covers it → R-871; R-872..R-874; STATUS decision A/B |
+| G — releases, golden, records | **done** | controller v0.294.0; agent v0.144.0 + v0.144.1 (decision 108); golden 0.294.0 baked + vouched (gate OK); `07`, `11`, `00`, `09` updated |
+
+## 2. Claims in the brief that turned out wrong (or only partly true)
+
+1. **"The policy's constants can drive the guard's line"** — true, and done — but with a cost the brief did not name: a
+   line derived from keep-daily (calendar days) can no longer catch a past-dated gap-fill that steers a 7–8-day-old
+   keep, which the 8-day line caught while refusing every honest window. Past-dated fakes can never make the policy drop
+   a snapshot inside the last keep-daily calendar days, so the line now catches only the skew-window shape. The rest is
+   R-822's residual, bounded by the cap and the hub's count check (decision 104).
+2. **"The same race exists in the update and restore paths"** — the update path: NO, it was already guarded (no pass
+   while any app is updating, since v0.284). The restore and undo paths: exposed in principle (they pull inside
+   `compose up`), not measured; they now hold the same lock.
+3. **"Dropping `-s` downloads nothing"** — TRUE, measured on 9202 (archive cache 10 → 10 files, versions unchanged).
+4. **"A box off at W runs nothing when it comes back"** — mostly true: the database dumps, second copy, off-site copy and
+   app updates never catch up; but the whole-guest backup DOES catch up (48 h safety valve, about every 2 days for an
+   evening-only box), and the OS leg follows it by day under the `night` label.
+5. **"The night A5 showed the wrapper finished"** (R-868's premise, and v0.144.0's design) — the packages were installed,
+   but the wrapper process itself died on its first log line after the agent's death. Found only by running it live.
+6. Part E: "the next pass must repair dpkg first and finish" — it does NOT (R-876).
+
+## 3. What was proven, with numbers
+
+- **Part A.** Tests: the measured shape (7 d + 5 s → allowed), 60 nights × 3 apps with two same-day manual runs across a
+  month boundary (never refused, ≥ 45 removed), weekly windows, the skew-window fake (refused), the lab's 13 future fakes
+  (refused). Red-proofs: 8-day line back → 3 fail; each refusal dropped → its test fails. Lab: restic 0.14.0 binary vs
+  the test simulation over 92 snapshots: identical 72 removals. **Live:** demo-felhom 15 snapshots, predicted removals
+  `92e49f62`, `343d57a5` → window 5 removed exactly those (16 → 14 incl. the run's new one); demo-hp 136 snapshots,
+  predicted 18 → window 6 removed exactly those (145 → 127). Hub rows `pruned`, no event, no mail, key audit 0 findings.
+- **Part B.** Live on 9202: controller start 05:28:35, install 05:31:15, clean-up 05:31:36 "skipped — … pulling images
+  now", BookStack deployed 05:31:54 (35.5 s), retry 05:33:36 ran (0 deleted). Teardown through the product verified.
+- **Part C.** `download_bytes = 12802456 B` from the installed wrapper on demo-hp (was 0).
+- **Part D.** R-866: `block=SAVED(2026-10-05T05:23:26Z; hub unreachable: … connect: invalid argument)`. R-868 (v0.144.1):
+  killed 06:04:00, wrapper `DONE upgraded=13`, kept copy, hub report id 63 `applied` (13) at 06:09:05, once.
+- **Part E.** See `11` §8.4: back in 37 s; apps healthy within 4 min; household saw one timeline line; one operator mail
+  `os_update_failed` (true); next pass FAILED (R-876); after `dpkg --configure -a` the pass installed 12; the guest's
+  package list equals the pre-test one (279 lines). The first crash attempt did not fire (my watcher's pattern missed
+  apt's dpkg call; the pass installed normally) — rolled back again and repeated.
+- **Part F.** `audits/night-fixes-2026-10-05/partF/FINDINGS.md`; two claims re-checked in source by me.
+
+## 4. Rows
+
+Register before **341**, after **340**. Closed (8): R-95, R-863, R-864, R-865, R-866, R-867, R-868, R-869. Opened (7):
+R-870 (tokens, operator), R-871 (a box off at night — the operator's decision), R-872 (P2, no missed-backup alarm for a
+box down at 05:00), R-873 (nightly "cannot be reached" mail), R-874 (restore-test never runs on short sessions),
+R-875 (P4, kept-report reason text), **R-876 (P2, the repair misses dpkg's update journal)**. STATUS updated.
+`unproven.py --summary`: unchanged — 55 claims, 35 not walked (no number moved).
+
+## 5. Teardown, three layers
+
+- **Machines:** 9202: BookStack removed through the product (no container, stack dir, volume); controller 0.294.0 (set by
+  hand, allowed there). demo-hp 9201: every package current, list identical to before; my scripts and logs in `/root`
+  removed after copying. The bake VM: CT 9100 destroyed, token shredded, reverted to `virgin`, qemu gone.
+- **Hosts:** the blackhole routes on felhom-pve removed (in the same script). Nothing provisioned.
+- **Hub:** two one-shot clean-up grants (consumed); floors for demo-hp, demo-felhom, tester-1 → 0.294.0; artifacts
+  vouched (agent 0.144.1, golden 0.294.0, min_agent 0.131.0); 12 signed jobs (3× agent 0.144.0, 3× bundle 0.144.0,
+  3× agent 0.144.1, 3× bundle 0.144.1). Tester 2: read only, nothing sent (offline all session).
+- Scratch secrets (hub password, hub key, controller password, deploy secrets) shredded at the end.
+
+## 6. Notes
+
+- The hub pod log prints a customer's e-mail address in "Customer email sent to …" lines (seen by the Part F helper; not
+  recorded anywhere).
+- demo-hp's System page read "no running customer guest" / "unknown" for several minutes after the crash although the
+  guest ran — R-853 (facts late after a boot), not a new defect.

REPORT-r840-config-bundle-2026-10-04.md

@@ -0,0 +1,137 @@
+# REPORT — the config bundle (R-840), test approvals (R-859), the Docker-socket self-heal (R-860), Tester 2, drill-r50
+
+2026-10-04, evening–night. Brief: "a signed route that brings an installed box's root-owned parts up to date (R-840)…".
+Architecture read first: `11-os-updates.md` (§5.3, §5.4, §5.8, §5.9, §8), `03-host-agent.md` (§3, §4, §11),
+`04-control-plane-authorization.md` (§3), `07-backup-architecture.md` (§6.4). Evidence: `documentation/audits/r840-config-bundle-2026-10-04/`.
+
+## The Part table
+
+| Part | Result | Why / what changed |
+|---|---|---|
+| A — what Tester 2 has | **done (read through the hub; no route to the box)** | The brief's timestamp reasoning was wrong (UTC vs local). Tester 2 has installer 1.30.0, agent 0.142.0, the crash guard armed, `live-restore` on, Docker 29.8.2, the re-made golden. It lacks only the R-858 wrapper fix. |
+| A — the `felhom-pbs` warning | **done: not a fault** | By design (R-723): a new box's first-hour tier skip is recorded, never mailed; the tier came 7 min later and backed up at 16:31 UTC. No row. |
+| B — the bundle route | **done, live on both demo boxes** | Agent 0.143.0 (bundle mode in `felhom-os-apply`, signed `agent_config_update`), hub 0.133.0, installer 1.31.0. Changed: the installer is NOT the self-update wrapper (it cannot do it); a one-time bootstrap is needed on older boxes. |
+| C — Tester 2 | **act 1 sent, NOT delivered (box offline since 18:06 UTC); act 2 waits for the operator; act 3 not needed** | Act 1: queued 18:35 UTC — see "Part C" below. Act 2 needs the one by-hand bootstrap (R-862, the operator's tunnel). Act 3: `live-restore` is already on. |
+| D — test approvals end | **done, live** | Hub 0.133.0 cancelled the 4 test approvals of 2026-10-04 at start (18:20 UTC). Changed: the operator's own Docker button approval was not backfilled (CC decision). |
+| E — self-heal after any Docker restart | **done, live (9202 + demo-hp)** | Controller 0.293.0. Changed: only a `docker.socket` restart breaks it; a dockerd crash or `systemctl restart docker` does not. |
+| F — new installs start with the approved fixes | **built; tonight's golden carries none** | `build-golden.sh` 3.2.0 `GOLDEN_GUEST_PKGS`. No guest release is in force tonight (the test one was cancelled), so the golden keeps the template (49 Debian updates pending for the next real approval). |
+| G — drill-r50 | **done** | Deleted through the product (operator's yes: it touched ep0). On ep0: its PBS namespace did not exist; its WireGuard peer left (5 → 4 peers pushed). |
+| H — release, golden, records | **done** | Agent 0.143.0, controller 0.293.0, hub 0.133.0, installer 1.31.0, golden 0.293.0 baked + vouched. Floor 0.293.0 for the two demo customers only (Tester 2 untouched). |
+
+## Claims in the brief that turned out wrong
+
+1. **The timestamp reasoning about Tester 2 (§1).** Tester 2 was bound at **16:06 UTC = 18:06 local**; the releases were
+   compared in local time. At 18:06 local, installer 1.30.0 (17:36), agent 0.142.0 (vouched ~17:49) and the re-made golden
+   (17:48) were all current. Measured (hub records): agent **0.142.0**, crash guard **armed** (`kernel.panic` 10), `live-restore`
+   **on**, Docker **29.8.2**; the wrapper reports a facts mode (so it is not "old"). Only agent 0.142.1's R-858 wrapper fix is
+   missing — and the root files of 0.142.0 equal 0.143.0's in every file but `felhom-os-apply`.
+2. **"The felhom-pbs warning is a fault."** It is the designed first-hour behaviour (R-723): recorded, not mailed.
+3. **"The self-update wrapper can install a bundle safely."** It cannot: it is a fixed sh script that swaps one binary. The
+   bundle is installed by `felhom-os-apply` (already reachable through the agent's sudoers line). And **no** existing root
+   helper can install the first bundle on an older box — one by-hand bootstrap per older box (done on both demo boxes).
+4. **"A restart of an existing container picks up the new socket."** True — measured twice (controller exit → restart policy;
+   `docker restart traefik`): both came back on the current inode, same container ids.
+5. **"dockerd restarts on its own … the box shows DOWN until a person acts."** Only when the socket FILE is re-created
+   (`docker.socket` restart, i.e. a docker-ce upgrade or by hand). A dockerd crash or `systemctl restart docker` keeps it (measured).
+6. **Act 3 for Tester 2 (`live-restore` reload)** is not needed: it is already on (from the golden).
+
+## Part A — Tester 2, read back (hub records; CC has no route to the box)
+
+| Item | Brief expected | Measured | Source |
+|---|---|---|---|
+| bound / enrolled | 16:06 (read as local) | 16:06:27 UTC bind, 16:07:04 UTC host | `appliance_registrations`, `hosts` |
+| installer | 1.29.0 | **1.30.0** (the crash guard is installed — only 1.30.0 does that) | host report `system.facts.host.crash_guard` |
+| agent | 0.141.1 | **0.142.0** | `/hosts` |
+| PBS wrapper sha | — | `104db0a4…` = every release's | host report `wrapper_sha256` |
+| `felhom-os-apply` | old (no facts, no Docker) | 0.142.0's (it answers the facts mode) | facts present |
+| sudoers | — | not readable from the hub; 0.142.0's file equals 0.143.0's (tag diff); capability probe all ok | `/hosts/Tester-2-be8404` |
+| crash guard / `kernel.panic` | absent / 0 | **armed / 10** | facts |
+| operator-signers | absent | not readable from the hub; installer 1.30.0 writes it | inference |
+| `live-restore` / Docker | off / unpinned | **on / 29.8.2** | facts |
+| golden | first 0.292.0 bake | the re-bake (live-restore + 29.8.2) | facts |
+| OS releases installed | TEST-approved | guest `os-guest-20261004-123933` (49 pkgs, 16:24) and host `os-host-20261004-124133` (106, 16:25), both approved "auto" 1.5 h after first seen = the TEST wait | `os_reports`, `os_releases` |
+
+## Part C — Tester 2, what happened
+
+- **Act 1** (signed `agent_update` to 0.143.0): queued 18:35 UTC, **not delivered** — Tester 2 stopped reporting at
+  18:06 UTC (host 18:05:48, controller 18:06:24). It was also silent 17:13–18:05 UTC, and its controller started at
+  18:06:20 UTC, so the box restarted or was switched on in between. CC sent Tester 2 nothing before 18:35 UTC; the cause
+  is outside this work (power, network, or the tester). The job expires 19:20 UTC; if Tester 2 returns later, it is
+  refused as expired (harmless) and must be re-signed.
+- **Act 2** (bundle): waits for the operator's one-time bootstrap (R-862).
+- **Act 3** (`live-restore`): not needed — already on.
+- No Docker step, no reboot, no app change was sent. Read-back of the System page line: still agent 0.142.0, Root files
+  `unknown`, guard armed, `live-restore` on (last report 18:05 UTC).
+
+## Part B — the bundle
+
+Shape, checks, trust rule, bootstrap: `11` §5.4.2; runbook `runbooks/config-bundle.md`. Red-proofs: 22 of 22 wrapper rules
+(`partB/redproof.txt`), hub 6 of 6 (`partB/hub-bundle-redproof.txt`), Go executor tests. Live:
+
+| Step | Box | Result |
+|---|---|---|
+| read the box's files vs the bundle | both | 21 of 22 identical; only `felhom-os-apply` differed (`b1`) |
+| bootstrap, wrong sha | demo-hp | `STOP`, nothing changed (`b2`) |
+| bootstrap | both | the new `felhom-os-apply`, self-check ok (`b2`, `b3`) |
+| job A, wrong sha | demo-hp | refused by the agent, nothing changed (`b4`) |
+| job B, the 0.143.0 bundle | both | written 0, same 21, kept 1, self-check ok, probe 71/71 (`b4`) |
+| a bundle with one deliberate change | demo-hp | written 1 (that file), self-check ok (`b6`) |
+| its undo (the 0.143.0 bundle again) | demo-hp | written 1, the release file back (sha `b71d8698…`), probe 71/71 (`b6`) |
+| replay of job B | demo-hp | `REJECTED … replay (nonce already seen)` (`b6`) |
+| the installer's new path | demo-felhom | written 0, record `installer`, services active (`b5`) |
+
+## Part D — test approvals
+
+Marked, cancelled at start, amber, operator event, ring-1 bump; red-proofs 6 of 6 (`partD/d-redproof.txt`). Live at the
+18:20 UTC start: `os-guest-20261004-123933`, `os-20261004-091417`, `os-host-20261004-124133`, `os-host-20261004-124034`
+cancelled; one mail (three held by the cooldown); the System page lists them; the Docker release stays (`partD/d2`). The
+2026-10-04 fact and why the risk was small: `runbooks/os-updates-test-waits.md`.
+
+## Part E — the measured heal
+
+| Box | Break | Controller back | traefik back | Container ids |
+|---|---|---|---|---|
+| 9202 (controller 0.291.0, before the fix) | `systemctl restart docker.socket` | never by itself (blind 2+ min, health "healthy") | never | same |
+| 9202 (0.293.0) | same | +73 s | +104 s | same (`e7`) |
+| demo-hp 9201 (0.293.0) | same | +88 s | +120 s | 21 of 21 same (`e8`) |
+
+`systemctl restart docker` and `kill -9 dockerd`: socket inode unchanged, nothing to heal (`e1`, `e2`). Red-proof 9 of 9 (`e6`).
+
+## Part F — the first-night count
+
+Golden 0.293.0 (`documentation/tests/golden-0.293.0-2026-10-04/`): no guest release in force → template versions kept;
+**49** Debian updates pending in the baked guest, which the next REAL approval (tomorrow, after 24 h + a night) will bring.
+A ring-1 box from this golden installs **0** on its first night until then. The host: the agent's first leg already runs
+right after the first whole-guest backup (Tester 2: 17 min after enrolment, 106 host packages in 44 s) — an installer pass
+would cost ~45 s and run before any backup exists; not built.
+
+## Part G — drill-r50
+
+What the product delete touched (read first, `partG/g1`): hub rows (host, guest, reports 185, telemetry 185, the recovery
+credential, the DR recipe, the claim, an appliance registration, the WireGuard peer 10.77.0.4), ep0's PBS tenancy
+(`tenantsync.Deprovision`, namespace `drill-r50`), ep0's WireGuard peer list. No Storage Box (no off-site tier), no mail
+(no address). Asked the operator (ep0); yes. Result: `deprovision ok (existed=false)` — nothing destroyed on ep0; the peer
+left ep0 at the next push (5 → 4); `/hosts` without drill-r50; the delete preview 404s (`partG/`).
+
+## Rows
+
+Before **333**, after **334**. Closed: **R-840** (built), **R-859** (opened and closed), **R-860** (opened and closed).
+Opened: **R-861** (P2 — the agent's sudoers is root-equivalent; read, not exploited), **R-862** (P3 — Tester 2's bootstrap,
+operator). R-857 not fixed: avoided by baking under a new controller version.
+
+## Decisions taken by CC (operator may reverse)
+
+1. The one-time backfill marks only the AUTOMATIC test approvals; your Docker button approval of 2026-10-04 stays in force.
+2. The bundle alarm fires after 7 days behind (`OS_ALARM_BUNDLE_BEHIND_AFTER`).
+3. The bundle lives inside `felhom-os-apply` (no new sudoers line), not in a new tool.
+4. The controller fixes Part E (it reaches every box by the floor), not the agent (that would need a sudoers change).
+5. The demo customers' floor is 0.293.0; the global floor stays 0.292.0 so Tester 2's controller does not move this session.
+
+## Teardown
+
+- Machines: 9202 left on controller 0.293.0, working (all apps up). demo-hp and demo-felhom: agent 0.143.0, bundle 0.143.0,
+  controller 0.293.0; the test line removed again on demo-hp. Drill VM off and at `virgin`.
+- Hosts: the bootstrap script, the installer harness and the test script removed from `/root` on both demo hosts. The
+  bundles' previous copies stay in `/var/lib/felhom-os-apply/bundle-prev/` by design.
+- Hub: the registry's test version `0.143.0-r840test` deleted (204, then 404); drill-r50 removed; the scratchpad copy of
+  the hub DB deleted at the end.

STATUS.md

@@ -1,10 +1,99 @@
 # STATUS — what works, what's broken, what's next
 
-**Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
+**Ready for the first real tester (Tester-2): yes. Tester 2 is a laptop that is switched off at night (your word,
+2026-10-05) — it was offline all session; nothing was sent to it.**
 
-**Updated 2026-10-04 (late evening): the hub has a System page with every box's versions and the update buttons; Docker
-updates are built; a crashed box restarts by itself, at most twice an hour. Both demo boxes run host agent 0.142.1 and
-controller 0.292.0. Hub 0.132.0. Installer 1.30.0. New installs get golden 0.292.0 (re-made: live-restore on, Docker 29.8.2) with agent 0.142.1.**
+**Updated 2026-10-05 (day, the night's fixes): every box of ours healthy. Fixed and proven live: the off-site clean-up
+now deletes old copies (both demo boxes), a new box's first app install, the update's disk-space check, a killed
+update's lost report. The power cut in the middle of an update was tested on demo-hp with your go: the box came back by
+itself in 37 s, but the next update failed until I ran one command by hand — filed (R-876), fix next session.
+One decision for you below (a box that is off at night). Report: `REPORT-night-fixes-2026-10-05.md`.**
+
+## Today (2026-10-05, day): the night's fixes, the power cut by day, a box that is off at night
+
+**Decisions I took myself (you may reverse each — `09` decisions 104–108):**
+- The off-site clean-up's safety line is now "the last 7 calendar days" — the same number the clean-up keeps — not
+  "8 days old". It can never block an honest clean-up again.
+- The image clean-up now waits while ANY app install, update, restore or undo is downloading — not only installs.
+- A killed update keeps its report on the box until the hub has it; the agent looks for such reports every 5 minutes.
+- **A second agent release today (0.144.1)**, against "one release per repo": the first fix for the lost report was
+  proven NOT to work on demo-hp, and shipping it as it was would have been worse.
+
+**What works now (proven live):**
+- **The weekly off-site clean-up really deletes old backups.** One clean-up each by hand: demo-felhom 16 → 14, demo-hp
+  145 → 127 — exactly the backups I predicted. No error mail, the hub's count check quiet, the key files clean.
+  This also closes R-95 (the box can no longer delete its own off-site history, and clean-up now works).
+- **A new box's first app install works the first time:** the image clean-up met an install at minute 3 on the scratch
+  box, waited, and BookStack installed first try. A failed install now logs its real reason.
+- **The update's disk-space check counts the real download** (12.8 MB for 13 packages; it counted 0 before).
+- **A killed update still reports to the hub** (5 minutes later, once). The debug update runs with the hub away.
+- Controller 0.294.0 on demo-hp, demo-felhom and Tester 1 (floor per customer; Tester 2 not moved). Agent 0.144.1
+  and its root files on all three. New-install image 0.294.0 baked and approved.
+
+**Found today (filed, not fixed):**
+- **After a power cut in the middle of an update, every later update fails until someone runs one command on the box**
+  (R-876, P2). The box itself comes back fine. Until the fix: `runbooks/crash-guard.md` has the command. I fix it next.
+- A box that is off at night (below): no catch-up, no missed-backup alarm (R-872), a "server cannot be reached" mail to
+  the household every night (R-873), restore-tests never run (R-874).
+
+**Needs you:**
+
+1. **A box that is off every night (Tester 2) — what does the product promise?** Today such a box never gets its
+   nightly database backups, second copy or off-site copy; the whole-box backup runs only about every 2 days; no
+   alarm says so; the household is mailed "your server cannot be reached" every night. No design document covers it
+   (R-871).
+   - **A (my pick): a missed night runs once when the box comes back.** The database backups, the second copy and
+     the off-site copy run a few minutes after the box is on again (they take seconds to minutes; whether
+     any of them pauses an app is to be measured in the design — the whole-box backup, which does pause apps, already
+     has its own catch-up). App and system updates still
+     wait for a night. Costs: a design section and one controller release; the household may notice a busy disk for a
+     few minutes after switching on.
+   - **B: say plainly that the box must stay on at night.** The setup guide and the box's backup page say it; the
+     missed-night alarm fires after 2 nights off. Costs: wording + one alarm; a laptop household gets an alarm it
+     cannot fix except by changing habits.
+   - **If you do nothing:** Tester 2 keeps having no database or off-site backup, nobody is told, and the household
+     keeps getting the nightly "cannot be reached" mail. A restore-test alarm will fire around 2026-10-11.
+2. **Tester 2's one-time step** — unchanged from yesterday (below). If you wait, it keeps working; it just cannot get
+   new root files.
+
+**Recorded, not decisions:** Tester 1's Cloudflare tokens are NOT rotated (your ruling; R-870 has the steps).
+
+## Today (2026-10-04, night): root files for installed boxes, test approvals, Docker self-repair
+
+**Decisions I took myself (you may reverse each):**
+- The hub cancelled only the AUTOMATIC test approvals of today (guest and host fixes). Your own "Approve Docker set"
+  press stays in force. From now on every approval made during a test wait gets the test mark, button or not.
+- A box whose root files are behind the approved ones for 7 days sends you a mail.
+- The demo boxes' controller floor is 0.293.0; the fleet floor stays 0.292.0, so Tester 2's controller did not move.
+
+**What I did:**
+- **Root files for installed boxes (your ruling):** a box's root-owned files (permissions list, helper scripts, crash
+  guard) now travel as one signed package. The box checks your signature, every file and itself; on any problem it
+  puts the old files back. Proven on both demo boxes: a wrong package refused, a package with one changed line
+  installed and undone, a copied old job refused. New installs use the same package.
+- **One catch:** a box installed before tonight cannot take the FIRST package by itself; it needs one small step by
+  hand. I did it on both demo boxes. **Tester 2 needs it from you** (below).
+- **Tester 2 was not as old as the brief thought:** it was installed at 18:06 local, after the crash guard and the new
+  image. It already has the crash guard, live-restore and Docker 29.8.2. It lacks only tonight's Docker-update fix. I
+  sent it the signed agent update.
+- **Test approvals end with the test:** the hub cancelled today's 4 test approvals at its restart (you got one mail).
+  Tester 2 keeps what it installed; no further box installs them. The same fixes get a real approval after 24 h + a night.
+- **Docker self-repair:** if Docker's socket is re-created, the controller now restarts itself and the web router within
+  about 2 minutes. Proven on the scratch box and on demo-hp, no app restarted.
+- **drill-r50 is gone** from the hub. On ep0 nothing was destroyed (it had no backups there); its tunnel entry left.
+- The "felhom-pbs skipped" line on Tester 2 is normal for a new box's first hour (no mail was sent).
+- New-install image 0.293.0 baked and approved.
+
+**Needs you (nothing breaks if you wait):**
+- **Tester 2 is offline** since 20:06 local (and was off 19:13–20:05 local; it restarted in between). I sent it nothing
+  before 20:35. My agent update for it is queued but expires at 21:20 local; when the box is back I re-send it.
+  Worth asking the tester whether the box was switched off.
+- **Tester 2's one-time step** (5 minutes): connect your tunnel, `ssh -p 8822 felhom-op@10.77.0.5`, reveal the root
+  password in the hub (Hosts → Tester-2 → Console access; this writes one line on Tester 2's timeline), `su -`, then
+  run the three commands in `documentation/runbooks/config-bundle.md` ("Tester 2"). Tell me when done; I send the package.
+  If you wait: Tester 2 keeps working; it just cannot get new root files until then.
+- **Found, not fixed:** the agent's permission list is wider than "minimal": a broken-into agent could become root on
+  its own box. Worth fixing before the first paying customer.
 
 ## Today (2026-10-04, ~18:30): you found a bug — the Docker update blinded the box's controller
 

documentation/architecture/00-capability-map.md

@@ -232,7 +232,7 @@ likewise silent. Evidence: `audits/DRILL-r361-2026-08-22/evidence/06-part3-decis
 | **The hub reports LOSS OF VISIBILITY into either off-site store (not just how full it is)** | hub **v0.106.0** (R-339) | **IMPLEMENTED — deliberately NOT proven-live** | Both box checkers count consecutive failed fetch windows and emit `pbsdr_box_unreachable` / `offsite_box_unreachable` (severity `warning`) past a default 3 windows (≈30–45 min), each with a paired `*_recovered` all-clear routed via `recoveredPairedDownTypes` — required because the recoveries are severity `info`, which `severityNotifies` drops. Scopes stay customer-less (`pbsdr-box` / `pool-box`) → operator channel only. Fill logic untouched: a degraded read still drives no band transition. Evidence: `internal/monitor/box_reachability_test.go` + the cross-package wiring test in `internal/notify/`, which asserts an actual operator mail rather than a map entry. **Filed BECAUSE of a measured gap**, not a hypothesis: the 2026-08-18 ep0 outage ran 9 h 37 m with the hub silent | **The gap that remains is R-340**, and it is not small: the ep0 read is the `usage` op, which rides the LOCAL API daemon — the daemon that incident explicitly cleared — so this check would have shown GREEN for that entire outage. It closes "ep0 is unreachable as a host"; it does not close what actually happened. **No live or constructed outage has exercised the emit path**, and one cannot be manufactured against ep0 (Tier 2, protected) |
 | Secrets hygiene: bearer in k8s Secret, no secrets in git, single-quote credential store | hub v0.53, conventions | **IMPLEMENTED** | 07-13 closing bundle | |
 | Operator login password changeable from UI | hub v0.54 | **IMPLEMENTED** | 07-13 | |
-| Box operating-system security updates (Proxmox host, guest Debian, Docker engine) | agent v0.142.0, hub v0.132.0 | **PARTIAL — the GUEST and HOST Debian fast lanes and the DOCKER engine slow lane are PROVEN-LIVE (2026-10-04), with the System page, the fleet view and the alarms; the KERNEL lane is MISSING** | Guest: `audits/os-guest-lane-2026-10-04/`. Host + fleet + alarms: `audits/os-host-lane-2026-10-04/`. Docker + System page + crash guard: `audits/os-docker-crash-2026-10-04/` — live-restore on with the same container ids on every box; Docker 29.8.2 on both demo boxes; operator-approved Docker release; a signed undo and a signed ring-1 step; a replay refused; the crash guard restarted demo-hp twice and kept it off the third time. Design `architecture/11-os-updates.md` §5.8, §5.9, §8 | **No automatic undo** (guest: last night's backup; host: by-hand runbook; Docker: a signed undo job); existing boxes need the wrapper, the trust files and the guard by hand (R-840); the kernel lane (R-836); facts reach the hub late after a boot (R-853) |
+| Box operating-system security updates (Proxmox host, guest Debian, Docker engine) | agent v0.143.0, hub v0.133.0 | **PARTIAL — the GUEST and HOST Debian fast lanes and the DOCKER engine slow lane are PROVEN-LIVE (2026-10-04), with the System page, the fleet view and the alarms; the KERNEL lane is MISSING** | Guest: `audits/os-guest-lane-2026-10-04/`. Host + fleet + alarms: `audits/os-host-lane-2026-10-04/`. Docker + System page + crash guard: `audits/os-docker-crash-2026-10-04/` — live-restore on with the same container ids on every box; Docker 29.8.2 on both demo boxes; operator-approved Docker release; a signed undo and a signed ring-1 step; a replay refused; the crash guard restarted demo-hp twice and kept it off the third time. Design `architecture/11-os-updates.md` §5.8, §5.9, §8 | **No automatic undo** (guest: last night's backup; host: by-hand runbook; Docker: a signed undo job); existing boxes get root-owned files by the signed config bundle since 2026-10-04 (R-840 CLOSED; a box from before agent 0.143.0 needs one by-hand bootstrap — Tester 2: R-862; `audits/r840-config-bundle-2026-10-04/`); test approvals now end with the test (R-859); the agent's sudoers is root-equivalent (R-861); the kernel lane (R-836); facts reach the hub late after a boot (R-853). **2026-10-05 (agent v0.144.1):** R8 measures the real download (R-865); a killed pass still reports (R-868, live); the debug pass runs with the hub away (R-866, live); **a power cut mid-update was proven by day on demo-hp — the box came back by itself in 37 s, but the next pass fails until `dpkg --configure -a` is run by hand (R-876, P2, open)** — `audits/night-fixes-2026-10-05/` |
 | **An ENGLISH-SPEAKING household's first hour: download, install, pair, bind, claim, two apps** | controller **v0.259.0** + hub **v0.119.0** + ISO 1.29.0 + the whole catalog | **PROVEN-LIVE on 0.258.0 with one blocker; THE BLOCKER IS FIXED AND PROVEN, THE WALK IS NOT REPEATED** | `audits/DRILL-first-hour-en-0258-2026-09-20.md` — a fresh install 2026-09-20, one intervention (R-494), stop rule not reached. Then `audits/i18n-closing-2026-09-21/live/` — the three blockers fixed and each proven on a live box or in the operator's inbox: the claim page answers English through the real cookie path; the Backup page's tier names follow the language; and the setup mail carries **four plain-ASCII English words** where the drill's carried `képző-szkítia-ásatás`, one day apart in the same inbox. | **R-596, R-597 and R-598 are CLOSED.** What this row still does NOT claim: **the fixed journey has not been walked end to end by a stranger on a fresh install.** Three fixes proven at the endpoint are not an hour proven by a person, and this project's own rule is that fixes are not a journey (see the recovery-journey row). **Also not walked:** the recovery code (needs ep0), backup/restore/remove/power-cut (proven 2026-09-14), and the two Backup-page *warnings* themselves — guest 9201 is healthy and a healthy box renders none, so they are covered by handler render tests, not live. **Verdict: nothing known now stands between an English-speaking tester and their box — and that is a different sentence from "the walk passed".** |
 | **A deletion of a customer's off-site history is NOTICED within a day** | hub **v0.111.0** (R-431) | **IMPLEMENTED — not yet PROVEN-LIVE** | 09-01 | `hub/internal/monitor/offsite.go` — third signal beside FILL and STALENESS. **On the hub deliberately:** a detector on the box is one the deletion can silence. Alarms when the reported count falls by more than HALF and by at least 5, guarded by `StatsKnown` (R-331), the declared `State` (R-204) and run success (R-100). **Threshold reasoned, not invented:** over 12 898 reports every decrease lands on ZERO and predates `stats_known`; in the 380-report `stats_known` window there are none. **ACCEPTANCE: 9 009 real points replayed → ZERO alarms** (`offsite_r431_test.go`, fixture committed). **What PROVEN-LIVE would need and this does NOT have:** a real drop observed on a live box producing a real mail — the live firing done at ship time was driven through the hub's own path with synthetic counts, which is an end-to-end delivery proof, not a proof that a genuine deletion is caught. |
 

documentation/architecture/03-host-agent.md

@@ -644,8 +644,18 @@ buildable until then; recorded here so the front-half built in slice 7 lands rea
   /var/lib/felhom-agent/os/plan-*.json`). The agent has no `apt` grant of its own for this; every rule (no removal,
   no downgrade, no new or unlisted package, Debian origin only, the box's own customer guest only) is in the wrapper,
   red-proved per rule. The leg runs after a successful primary whole-guest backup, under the heavy-op gate.
-  **[FACT] The signed agent update does NOT carry the wrapper or the sudoers line** — only the installer installs
-  them (R-840).
+  ~~**[FACT] The signed agent update does NOT carry the wrapper or the sudoers line** — only the installer installs
+  them (R-840).~~ **[FACT, 2026-10-04, agent v0.143.0] The config bundle does:** a signed `agent_config_update` brings
+  every root-owned file (sudoers, wrappers, units) as one checked unit; `felhom-os-apply` verifies it itself, keeps the
+  previous copies and undoes on a failed self-check; the trust root (`/etc/felhom/operator-signers`, `os-trust.json`) is
+  never a bundle path. The installer installs the same bundle. A box from before 0.143.0 needs one by-hand bootstrap.
+  Design: `11` §5.4.2; runbook `runbooks/config-bundle.md`.
+- **[FACT, 2026-10-04 — R-861] "Root-minimized" overstates it.** Read from `configs/felhom-agent.sudoers`: the agent user
+  can already reach root without the operator key — `FELHOM_GUESTHOOK` installs a hookscript from `/tmp` that Proxmox
+  runs as root at guest start (and `pct reboot` is granted); `FELHOM_INTERMEDIARY` installs a script and a systemd unit
+  that run as root at boot; `FELHOM_ESCROW` runs the agent binary as root, and `FELHOM_SELFUPDATE apply` accepts a sha
+  the agent itself passes. So a compromised agent PROCESS is root on its host; the root-owned trust files (decision 93,
+  the bundle's R17) are defence in depth, not a boundary, until R-861 narrows these grants.
 - **Controller (the easy case — it's a guest).** The agent owns the controller's lifecycle,
   so the **agent updates the controller**: snapshot-before-update (free rollback, because the
   controller *is* a snapshottable guest) → pull new image → redeploy → health-check → rollback

documentation/architecture/04-control-plane-authorization.md

@@ -113,6 +113,16 @@ Proven twice: `demo-hp-bb76ea` 2026-09-15, `demo-felhom-8363b5` 2026-09-16. **Re
 sale** — at that point the key belongs behind the operator (or a hardware key, §7), and a fleet
 rollout step still has to be designed (R-530).
 
+**Who may sign a config bundle (`agent_config_update`, R-840, decision 96, 2026-10-04).** The same operational key
+(`felhom-op-1`) and the same custody: CC may sign it under the ruling above (per box, until the first paying
+customer). It is destructive-class (the agent's gate requires the operational key) AND the box's root wrapper verifies
+the signature itself against the ROOT-OWNED `/etc/felhom/operator-signers` — not the agent's config. The recovery key
+does not sign bundles. **A bundle can never change who may sign:** the signers file and `os-trust.json` are not bundle
+paths (R17); on a box with no signers file, only a job signed by the installer's pinned `felhom-op-1` is accepted, and
+the file is created with exactly that key. **Rotating a signer** (adding `felhom-op-2`, removing `felhom-op-1`) is a
+separate act, not built: it needs its own op, signed by the key being replaced (or the recovery key), with its own
+design (`11` §5.4.2).
+
 ## 4. Rotation & compromise recovery
 
 The agents pin the operator public keys. The danger: rotation must **not** flow as plain hub config,

documentation/architecture/09-update-architecture.md

@@ -741,6 +741,12 @@ its length, and both fixes cost something the household would notice — operato
     days from the box's request (R-823)**; the household (a recovery on the box) or the operator can cancel in that
     time; the hub deletes only `<repo>.orphaned-<…>`, never the live repository; every request, cancel and deletion is
     an operator event. *Operator brief 2026-10-04 (Part E).* Built hub v0.128.0 + controller v0.290.0.
+    **Note 2026-10-05 (R-867, controller v0.294.0):** the clean-up windows that feed this deletion path now remove
+    honest old copies: the guard's "young" line is keep-daily CALENDAR days (decision 104), not a fixed 8-day age that
+    sat inside the keep window. Proven live by hand the same morning: demo-felhom window 5 (16 → 14, the 2 snapshots
+    predicted), demo-hp window 6 (145 → 127, the 18 predicted); hub count check quiet, key files clean, no mail.
+    The reviewer's own error is recorded: the 2026-10-04 brief set the 8-day line and said real deletion would start
+    around 11 October; it would not have. `audits/night-fixes-2026-10-05/partA/`.
 
 ### 2026-10-04 (day) — three operator rulings (recorded before the work)
 
@@ -809,6 +815,49 @@ its length, and both fixes cost something the household would notice — operato
     1.30.0, agent 0.142.0 and the re-made golden; it lacks only agent 0.142.1's wrapper fix (R-858). *Operator ruling
     2026-10-04 ~18:49.*
 
+### 2026-10-05 (06:49) — four operator rulings (recorded before the work; the night-fixes brief)
+
+100. **Tester 1's Cloudflare tokens, shown in the 2026-10-04 night session's output, are NOT rotated** (option B) —
+     filed like R-831: R-870 holds what was shown, where, and the rotation steps. *Operator ruling 2026-10-05.*
+101. **The power cut in the middle of an OS update (night A1) runs by day, on demo-hp only**, while the operator is
+     awake to switch the box on. The crash command is allowed for demo-hp only; CC asks the operator before the crash.
+     *Operator ruling 2026-10-05.*
+102. **Tester 2's box is a laptop that is switched off at night.** It is not broken; its absence every night is the
+     input to the "box off at night" spike (R-871). Recorded on its page in `runbooks/target-selection.md`.
+     *Operator ruling 2026-10-05.*
+103. **If Tester 2 is online during the session, CC re-signs its agent update to the vouched agent** (act 1 of
+     decision 97) and reads it back. Nothing else on Tester 2; its one-time bundle step stays with the operator
+     (R-862). *Operator ruling 2026-10-05.*
+
+### 2026-10-05 (day) — decided by CC — operator may reverse (night-fixes brief)
+
+104. **What "young" means in the off-site guard (R-867).** Options: (a) an age in hours derived from keep-daily
+     (7 × 24 h minus a margin) — the margin is a guess and DST/clock shapes move it; (b) CALENDAR days, as restic
+     itself buckets a snapshot's day, compared with keep-daily — exactly the policy's own boundary. **Chosen (b)**:
+     it is the only line that provably never refuses the honest policy (the newest snapshot of any of the last N
+     calendar days is always kept by keep-daily N). Cost, recorded: the line no longer catches past-dated gap-fills
+     that steer a 7–8-day-old keep (the 8-day line did, while refusing every honest window) — that shape is R-822's
+     residual, bounded by the cap and the hub's count check. Controller v0.294.0.
+105. **Which commands hold off the image clean-up (R-863).** Options: (a) only the deploy path (the measured case);
+     (b) every compose command that can pull — `up`, `pull`, `create`, `run` — through one lock in `dockerexec`.
+     **Chosen (b)**: a restore, an undo and the FileBrowser sync pull the same way, and one lock is one place to
+     keep right. The one-time clean-up is retried every 2 minutes (at most 30 times) instead of waiting for the
+     next start, and writes its marker only after a pass that ran. Controller v0.294.0.
+106. **Where a killed pass's report waits (R-868).** Options: (a) the agent writes a "pass started" record and
+     reconstructs the outcome from the journal — brittle; (b) the ROOT wrapper writes its own report beside the plan
+     before printing it, and the agent deletes it once sent. **Chosen (b)**, with the root write hardened (the
+     directory opened O_NOFOLLOW and checked to be the agent's own, the file created O_EXCL|O_NOFOLLOW) and a
+     cross-process pass lock so a sender never takes a running pass's copy. Agent v0.144.0.
+107. **The debug OS pass with the hub away (R-866).** Options: (a) the selftest falls back to the block the daemon
+     saved, and says so; (b) a documented way to trigger the daemon's own leg. **Chosen (a).** The DAEMON does not
+     load the saved block at its own start (one line why: that would change what a box does after a restart with
+     the hub away — today it reports only, the safe direction — and no brief asked for it). Agent v0.144.0.
+108. **A second agent release in one session (v0.144.1), against "one release per repo".** Options: (a) keep
+     v0.144.0 and leave R-868 open — its fix was MEASURED not to work live (the wrapper died on a broken stderr pipe
+     before saving the report); (b) release v0.144.1 with the two live findings fixed and red-proofed. **Chosen (b)**:
+     shipping a fix proven not to work is worse than a second release; precedent decision 86. Cost: a second signed
+     agent update and bundle per box.
+
 ### 2026-10-04 (evening) — decided by CC unattended — operator may reverse (System page / Docker / crash-restart brief)
 
 90. **How does a box tell a crash boot from a clean one?** Options: (a) `pstore` — measured on demo-hp: `efi_pstore` is on,

documentation/architecture/11-os-updates.md

@@ -211,6 +211,17 @@ downloadable — but `curl`, `libcurl*` and `libssh2` were "not covered" in the
 ALREADY ran the newer version and so installed nothing. `[PROPOSAL]` step 1 reports the full installed
 `package=version` set after the run, and approval covers every version ring 0 runs healthy.
 
+### 5.3.1 Test approvals end with the test — BUILT 2026-10-04 (hub v0.133.0, R-859)  `[FACT]`
+
+An approval made while a TEST override (`OS_APPROVE_AFTER`, `OS_APPROVE_NIGHTS`, `OS_DOCKER_APPROVE_NIGHTS`) is active
+carries a `test` mark (amber on the System page). At every hub start WITHOUT an override, every test approval that no
+real approval has superseded is cancelled: never served again, ring-1 boxes bumped, one operator event
+`os_release_cancelled` each; what boxes installed stays; the ruled wait approves the same set again as a real release.
+A one-time backfill marked the AUTOMATIC approvals made under 24 h after first seen; the 2026-10-04 guest and host test
+approvals (which Tester 2 installed on its first night) were cancelled at 18:20 UTC. The operator's Docker button
+approval of that day stays in force (decided by CC unattended — operator may reverse). Runbook:
+`runbooks/os-updates-test-waits.md`. Evidence: `audits/r840-config-bundle-2026-10-04/partD/`.
+
 ### 5.4 Who runs it, and with what permission
 
 - **The agent runs every OS update**, for the host and for the guest (`pct exec`). The controller does
@@ -269,7 +280,7 @@ longer there, from `snapshot.debian.org/archive/<archive>/<snapshot>` with a tem
 | R5 | the simulation downgrades any package (the operator undo is a separate signed op, §5.6) |
 | R6 | the simulation installs a package that is neither installed nor in `allow_new` |
 | R7 | a listed version is not downloadable from the sources the installer set up or the named snapshot |
-| R8 | free space on `/` (or the guest's rootfs) is below 3× the download size, minimum 500 MB (edge case 8) |
+| R8 | free space on `/` (or the guest's rootfs) is below 3× the download size, minimum 500 MB (edge case 8). The download size is the `--print-uris` total WITHOUT `-s` (R-865, agent v0.144.0 — with `-s` it read 0 B) |
 | R9 | another apt/dpkg holds the lock, or the per-guest lane lock is held (a backup, a restore-test, C10) |
 | R10 | `layer` is `guest` and the vmid is not the box's own customer guest |
 | R11 | the plan names a package twice, or a version that is not a Debian version string |
@@ -289,6 +300,46 @@ os-apply: FAILED rc=<n> step=<download|install> — dpkg state: <dpkg --audit fi
 `restart-needed` lists processes still mapping deleted libraries (C11); `reboot-needed` is yes when that list holds
 PID 1 or `lxc-start`, or a kernel was installed.
 
+### 5.4.2 The config bundle: a box's root-owned files by a signed job — BUILT 2026-10-04 (agent v0.143.0, hub v0.133.0, installer 1.31.0, R-840)  `[FACT]`
+
+Decision 96. Before it, the signed `agent_update` replaced only the binary; wrappers, units and sudoers lines reached
+an installed box by reinstall or by hand.
+
+- **One source of truth.** `BUNDLE_FILES` in `felhom-os-apply` is the ONE table of root-owned paths (22: sudoers ×2, the
+  five wrappers, the crash guard and its units + config, the agent and rollback units, the start-limit drop-in, the mgmt
+  watchdog and its tmpfiles/units, the OOB belt's four files). `scripts/build-config-bundle.py` builds the bundle from it
+  reproducibly; `release-agent.sh` publishes it beside the binary; the hub vouches its sha with the agent (exact-name
+  lookup); the installer (1.31.0) installs it through the same code (`--install-bundle`, root only, refused through
+  sudo). A test fails on a root path the installer names that the bundle lacks.
+- **The route.** Signed `agent_config_update` {agent_version, bundle_sha256}. The agent is a courier; the root wrapper
+  re-verifies the signature against the root-owned signers file, the host binding (`os-trust.json`), the window and its
+  own nonce, then the sha, every path (R16) and every content check before the first write: `visudo -cf`, `sh/bash -n`,
+  Python compile, unit sections, no `RuntimeDirectory=` (G1), `User=felhom-agent`, `nft -c`, and that the route
+  survives (the sudoers keeps the `--plan` line; the new wrapper keeps the bundle mode). Policies: replace / if-absent
+  (`crash-guard.conf`, an operator setting) / oob (only on a box with the belt). Atomic per file, sudoers last,
+  previous copies kept (last 3). Self-check: `visudo -c`, `sudo -l -U felhom-agent` lists the route, the new wrapper's
+  `--self-check`, the self-update wrapper's usage, the crash guard's status equals `kernel.panic`; any failure puts
+  every previous copy back. A newly installed crash guard is started (`enable --now`): `kernel.panic` for this boot, no
+  reboot. Record `/etc/felhom/config-bundle.json`; the agent reports it (`system.config_bundle`, "none" when absent);
+  the facts mode adds drift (files changed by hand).
+- **The trust root is not changed by a bundle** (R17, tested). A missing signers file is created only with the
+  installer's pinned key, only after a job that key signed (pinned equal to the installer by a test). Signer rotation is
+  a later, separate act (`04` §3).
+- **Bootstrap (corrects the brief).** The self-update wrapper cannot install a bundle (fixed sh, binary-only), and no
+  signed job can write a root file on a box whose `felhom-os-apply` predates 0.143.0. Such a box needs ONE by-hand step
+  (`scripts/felhom-bundle-bootstrap.sh`: only the new `felhom-os-apply`). Done on both demo boxes; Tester 2 needs the
+  operator (`runbooks/config-bundle.md`).
+- **Visibility.** System page "Root files" column; alarm `os_config_bundle_behind` after 7 days
+  (`OS_ALARM_BUNDLE_BEHIND_AFTER`; decided by CC unattended — operator may reverse).
+- **Measured live** (`audits/r840-config-bundle-2026-10-04/partB/`): both demo boxes had every file equal to the release
+  except `felhom-os-apply`; after the bootstrap the signed bundle wrote 0 of 22 (21 same, 1 setting kept), self-check
+  ok, capability probe 71/71. demo-hp: a wrong-sha job refused (nothing changed); a bundle with one deliberate change
+  wrote exactly that file; the 0.143.0 bundle undid it; a replayed job was rejected. The installer path on demo-felhom:
+  0 written, services active. 22 of 22 wrapper rules red-proved.
+- **Not a boundary yet — R-861.** The agent's sudoers already lets the agent user reach root without the operator key
+  (a hookscript, a boot unit, the escrow self-test run as root, the self-update of its own binary). The trust-root rule
+  is defence in depth until R-861 is closed.
+
 ### 5.5 When
 
 Inside the household's night window, after the backups:
@@ -472,6 +523,13 @@ Each step returns to the operator for go or no-go.
    §8.2.
 4. **Fleet view and alarms** (§5.7). **BUILT 2026-10-04** — hub v0.131.0/v0.131.1; §8.3.
 5. **Slow lane: Docker engine.** **BUILT 2026-10-04** — agent v0.142.0, hub v0.132.0; §5.8.
+   **Root files to installed boxes (R-840): BUILT 2026-10-04** — agent v0.143.0, hub v0.133.0, installer 1.31.0; §5.4.2.
+   **Test approvals end with the test (R-859): BUILT** — hub v0.133.0; §5.3.1. **The golden carries the approved guest
+   release** (`build-golden.sh` 3.2.0 `GOLDEN_GUEST_PKGS`; golden 0.293.0 baked with none in force — 49 Debian updates
+   pending for the next real approval; the host stays with its first night's OS leg). **A host pass at install time is
+   not needed:** measured on Tester 2, the agent's first OS leg ran right after the box's FIRST whole-guest backup, 17 min
+   after enrolment (16:24/16:25 UTC: 49 guest + 106 host packages, 110 s + 44 s, healthy). An installer pass would cost
+   ~45 s and run BEFORE any whole-guest backup exists (no undo) — not built.
 6. **Slow lane: host kernel and Proxmox packages, with the reboot.**
 7. **Later:** the Proxmox major upgrade (PVE 9 → 10), drilled on ring 0 first.
 
@@ -559,6 +617,28 @@ Evidence: `audits/os-host-lane-2026-10-04/` (parts A–G).
   two weekly golden cycles, both need a person anyway.
 - **The tunnel** (R-841): `running` / `not_running` / `unknown`; `tunnel_down` after two `not_running` reports.
 
+### 8.4 The night's fixes as BUILT (2026-10-05)  `[FACT]`
+
+Agent v0.144.0 + v0.144.1 (wrapper and agent; `09` decisions 106–108). Evidence `audits/night-fixes-2026-10-05/`.
+
+- **R8 measures the real download** (R-865): `--print-uris` without `-s`; the installed wrapper read 12 802 456 B for 13
+  pending guest upgrades on demo-hp (it read 0 B before). `--print-uris` alone downloads nothing (measured on 9202).
+- **A killed pass still reports** (R-868): the wrapper writes `report-<run>-<layer>-apply.json` beside the plan before it
+  prints the report, and it survives a dead reader (a killed agent closes the stderr pipe — v0.144.0 died there,
+  measured); the agent sends a kept copy at start and every 5 minutes, then deletes it. Live: the A5 shape on demo-hp →
+  ONE `applied` report (13 packages) reached the hub 5 minutes later. A pass lock (flock) keeps the sender off a running
+  pass, also across the daemon and a selftest.
+- **The debug pass with the hub away** (R-866): the daemon saves the hub's block (`os-update-block.json`); the selftest
+  uses it when the hub is unreachable and says `block=SAVED(…)` in its header. The daemon itself does not load the saved
+  block at start (decision 107).
+- **A power cut in the middle of an update (night A1, run by day on demo-hp, decision 101):** crash at 06:13:55 UTC while
+  dpkg ran; the crash guard brought the host back in 37 s (1 unclean boot, still armed); every app healthy again within
+  4 minutes; dpkg `--audit` clean, the 13 packages split 1 new / 12 old, all `ii`. **The next pass FAILED** (`E: dpkg was
+  interrupted, you must manually run 'dpkg --configure -a'`): the repair step runs only on a non-clean `--audit`, and a
+  crash can leave only dpkg's update journal behind — **R-876 (P2, open)**. By hand: `dpkg --configure -a` in the guest
+  (runbook `crash-guard.md`), then the next pass installed the 12. Operator mail `os_update_failed` (true); no
+  household mail; the household's timeline showed "Controller elindult".
+
 ## 9. Where the rest lives
 
 - The finding: **R-812** (`backlog/OPEN-ITEMS.md`). The intention: **R-808** (`backlog/ROADMAP.md`).

documentation/audits/night-2026-10-04/ACCIDENTS.md

@@ -0,0 +1,63 @@
+# The accidents — five lines each (household saw · box did by itself · time to steady · alarm fired, true? · alarm owed, missing?)
+
+All times UTC. Evidence beside this file in `accidents/`.
+
+## A2 — Docker's socket re-created during a whole-guest backup (demo-felhom, 20:16)
+
+"Mentés most" (`POST /api/guest-backup/trigger`) at 20:16:12; the app stop began 20:16:16; `systemctl restart docker.socket`
+in the guest at 20:16:23 (socket inode 151 → 646).
+- **Household saw:** opengist (the one app stopped for the backup) down 20:16:16 → 20:17:50 (94 s); the dashboard briefly
+  unable to show app states; the timeline "Controller elindult" once. No mail.
+- **Box did by itself:** the `felhom-backup` copy finished honestly (`backup: completed`, 20:16:43 — vzdump does not use
+  the socket). The unquiesce could not restart opengist (`exit code 1`: the controller was blind). The controller's
+  socket watch exited it at 20:17:33 after 60 s of refusals (R-860), Docker restarted it on the new socket, boot
+  reconciliation restarted opengist at 20:17:50, and the controller restarted traefik onto the new socket at 20:18:05.
+  The `felhom-pbs` tier answered BUSY (the agent's heavy-op gate was held) and was deferred 15 min, as designed. Then the
+  `night` OS leg ran (20:18–20:18:56: guest, host, Docker all "nothing").
+- **Time to steady:** 102 s (20:16:23 → 20:18:05).
+- **Alarms fired:** none. True: nothing stayed broken.
+- **Alarms owed and missing:** none — the box healed within two minutes. (The failed restart at unquiesce left no event;
+  acceptable because boot reconciliation repaired it 64 s later.)
+
+## A3 — the hub out of reach (Tester 1 box, 20:26:09 → 20:56:10, 30 min)
+
+Blackhole route to the hub's address on the host and in the guest.
+- **Household saw:** nothing (the dashboard and apps go through the tunnel, not the hub).
+- **Box did by itself:** two host reports failed (22:40:49, 22:55:49 local — `hub: report failed; keeping current
+  interval`); the next one after the unblock arrived on time (21:10:49 UTC); the controller's report went through at
+  20:57:04. Missed host reports are snapshots and are not replayed — the next one replaces them. **The debug OS pass could
+  not run at all** (it fetches its plan from the hub — R-866); the daemon's own leg would use its saved plan, but the
+  20-hour gap held it back (this box's leg ran at 19:49).
+- **Time to steady:** at the first report after the unblock, 14 min 39 s (the report interval).
+- **Alarms fired:** none. True: 30 min is under the 45 min stale threshold.
+- **Alarms owed and missing:** none. The 7-day OS alarms stayed quiet.
+
+## A4 — the system disk nearly full (Tester 1 box guest, 20:24)
+
+The guest's `/` filled to 400 MB free; a one-package-set plan (bind9 ×3, Debian-Security) handed to the wrapper as the
+agent writes it.
+- **Household saw:** nothing (the disk was freed 3 minutes later; the apps live on the data volume).
+- **Box did by itself:** the wrapper refused BEFORE downloading: `REFUSED: R8 free space 419430400 B is below max(500 MB,
+  3 x download 0 B)`, exit 2, nothing installed (bind9 stayed at the old version). **But the download was measured as
+  0 B** — `apt-get -s --print-uris` prints no URIs (R-865), so only the 500 MB floor ever applies.
+- **Time to steady:** immediate (a refusal changes nothing).
+- **Alarms fired:** none (a refused debug plan reports nothing to the hub). True.
+- **Alarms owed and missing:** none for a debug run; a NIGHT leg refused by R8 reports `refused` and the stale alarm
+  fires after 7 days — not exercised.
+
+## A5 — the agent killed in the middle of a pass (demo-hp, 02:57 UTC)
+
+Six guest packages rolled back (simulated first: 0 removals); a debug pass started; when `apt-get` ran, the pass and the
+agent daemon were `kill -9`-ed (02:57:18).
+- **Household saw:** nothing.
+- **Box did by itself:** the root wrapper (its own process under sudo) finished all six packages; `dpkg --audit` clean;
+  systemd restarted the daemon in < 20 s (`NRestarts` 1; the self-update rollback did nothing — no pending update).
+- **Time to steady:** < 20 s.
+- **Alarms fired:** none. True.
+- **Alarms owed and missing:** none — but the killed pass's report never reached the hub (R-868); no duplicate report.
+
+## A1 — a power cut in the middle of an OS update (demo-hp) — NOT RUN
+
+The host crash (`echo c > /proc/sysrq-trigger` while dpkg ran) was refused by this session's permission check
+("interfere with workloads"). Not attempted another way. The six rolled-back packages were brought forward by a normal
+debug pass (applied, healthy); dpkg clean; demo-hp's guest package list equals the 21:47 baseline. Operator decision 2.

documentation/audits/night-2026-10-04/MORNING-NOTE.md

@@ -0,0 +1,105 @@
+# Morning note — the OS-update night, 2026-10-04/05
+
+## 1. Is any box off or broken right now?
+
+**No box of ours is off or broken.** At 05:20 local: demo-hp 21 of 21 apps healthy, demo-felhom 5 of 5, scratch box 9202
+6 of 6, the new Tester 1 box 9 of 9; every crash guard armed. Nothing for you to do on them.
+
+**Tester 2 is still offline** — since 20:06 local yesterday, before anything of tonight. I read it every 15–30 minutes; it
+never came back, so I sent it nothing. Worth asking the tester whether the box is switched off.
+
+**One test I could not do: A1 (a power cut in the middle of an update).** The crash command for demo-hp was refused by
+this session's permission check. I did not look for another way. demo-hp is clean (the rolled-back packages were brought
+forward again; its package list equals the evening's). Decision 2 below.
+
+## Decisions I took myself (you may reverse each)
+
+- **The undo test and accident A2 ran on demo-felhom in the evening, not after its night.** Its whole-guest backup runs
+  at ~07:45 local, after my 06:30 stop. A2's "backup now" counted as its night run (the update step ran right after it:
+  nothing to install), so the real approval of the fixes is not delayed.
+- **A5 (the agent killed mid-update) ran on demo-hp, not demo-felhom**, inside A1's allowed rollback.
+- **The new Tester 1 box stays running** (it is the returning-household box; it costs demo-hp 8 GB of memory).
+
+## Slips of mine you should know
+
+- **On demo-felhom I rolled back 8 packages by hand for A5, which tonight's rules did not allow — and apt removed 18
+  others with them, including Python and the guest's network tool.** I put every one back within a minute, before any
+  restart; the package list equals the evening's, line by line. From then on I simulated every downgrade first.
+- **My first database query printed Tester 1's Cloudflare tokens into my own session output** (not into any file).
+  Tester 1 is the test customer. Decision 1 below.
+- I did not pull the "USB stick" at the end of the Tester 1 install (the guide says to), so the box started the
+  installer again; I pulled it and it booted normally.
+
+## 2. The prediction table, with the real times (local time)
+
+| Box | Step | Predicted | Real | |
+|---|---|---|---|---|
+| all 3 | database dump | 02:30 | 02:30 (demo-hp 1 m 30 s, Tester 1 40 s, demo-felhom 1 s) | ✓ |
+| all 3 | second copy | 03:30 | 03:30 (demo-felhom: no second drive, said so) | ✓ |
+| all 3 | off-site | 04:15 | demo-hp 04:15–04:17 OK; demo-felhom 04:15 OK **+ an error mail (below)**; **Tester 1 skipped** | ✗ Tester 1 |
+| demo-hp | whole-guest backup | ~04:35–04:40 | 04:35:24–04:40:16 | ✓ |
+| demo-hp | update step (guest, host, Docker) | right after, nothing to install | 04:41:46–04:42:46, nothing in all three | ✓ |
+| demo-hp | controller self-update 04:30 | no action | no action; no overlap with the update step | ✓ |
+| demo-felhom | whole-guest backup + update step | ~07:50 | **moved: 22:16 / 22:18 by A2's "backup now"**, nothing to install | changed (my test) |
+| Tester 1 | first backup + update step | minutes after install | 21:47 backup, 21:49 update step: **0 installed** (nothing approved) | ✓ |
+| — | the 20-hour gap | skips nothing | nothing was skipped by it | ✓ |
+
+**Surprise:** Tester 1's off-site copy waited for the household's recovery code, which I had not made (a first-hour step
+I skipped). I made it at 05:07 and pressed "run now" — see 3.
+
+## 3. Decision 78 on the fresh Tester 1 box — PROVEN (by a "run now" at 05:08, not the night run)
+
+The box found the old off-site copy of earlier Tester 1 boxes (made with a key it does not have), moved it aside
+(`…felhom-repo.orphaned-20261005`, nothing deleted), started a fresh copy and saved all 3 apps in 54 s. The household's
+timeline got two lines ("orphaned", then "reset — old history kept"); you got one mail. The old copy is untouched.
+
+## 4. The ruled undo — PROVEN on demo-felhom: 48 seconds down
+
+Three packages rolled back, a whole-guest backup, an update pass forward, then the backup restored over the live guest:
+down 22:12:54 → every app healthy 22:13:42 (48 s); the three packages back at the "before" versions; no mail; the hub kept
+the box. A pass then brought them forward. There was no written way to do this — the guide is written now.
+
+## 5. The accidents
+
+- **A1 power cut mid-update (demo-hp): NOT RUN** — the crash was refused by the permission check (decision 2).
+- **A2 Docker socket re-created during a backup (demo-felhom):** the household saw one app down 94 s, nothing else.
+  The box healed itself: the backup finished honestly, the controller restarted itself after 60 s, restarted the app and
+  the web router. Steady in 102 s. No alarm, none owed.
+- **A3 the hub out of reach for 30 min (Tester 1):** the household saw nothing. Two reports failed, the next arrived on
+  time after the block. No alarm (right: under the 45-min limit). The debug update pass cannot run without the hub
+  (a gap, filed).
+- **A4 the disk nearly full (Tester 1):** refused at once with a clear reason, nothing installed. But the free-space rule
+  measures every download as 0 bytes, so only its 500 MB floor ever works (filed).
+- **A5 the agent killed mid-update (demo-hp):** the install finished anyway (the root helper runs on its own), the agent
+  restarted in under 20 s, packages clean. The hub never got that pass's report (filed). No duplicate.
+
+## 6. Every mail of the night
+
+| Mail | To | True? |
+|---|---|---|
+| Bind link, setup code (Tester 1 install) | household | true |
+| demo-felhom "off-site clean-up refused" (error, 04:15) | you | **true fact, wrong alarm** — a defect: the clean-up's guard refuses normal 7-day retention, so every weekly clean-up will refuse and mail you (filed P2) |
+| Tester 1 "off-site repository orphaned" (05:08) | you | true, expected for a returning household |
+
+No household mail besides the two install mails.
+
+## 7. Rows
+
+Register before **334**, after **341**. Opened, each before I moved on:
+- **P2** — a new box's first app install can fail: the box's one-time image clean-up deletes the image the install is
+  downloading (BookStack on Tester 1; the second press worked).
+- **P2** — the off-site clean-up guard refuses normal 7-day retention and mails an error every week; nothing is pruned.
+- **P3** — the update free-space rule always measures the download as 0 bytes.
+- **P4** ×4 — a failed install logs the start of the error and cuts the error itself; the debug update pass needs the
+  hub; a killed pass's report is lost; the move-aside log line prints an empty destination.
+
+## 8. Decisions for you
+
+1. **Rotate Tester 1's Cloudflare tokens?** They appeared in my session output (not in a file).
+   - **A (my pick): rotate them** — Tester 1 is our test customer; it costs a few minutes in Cloudflare.
+   - **B: leave them.** If you do nothing: nothing changes; the risk is that session log.
+2. **A1, the power cut mid-update — how to run it?**
+   - **A (my pick): allow it once** for demo-hp in this kind of night (a permission rule for the crash command on demo-hp
+     only), and I run it next night.
+   - **B: you press the crash yourself** next time while I watch.
+   If you do nothing: A1 stays untested; the crash guard itself was proven on 2026-10-04 by day.

documentation/audits/night-2026-10-04/PREDICTION.md

@@ -0,0 +1,48 @@
+# Prediction table — written 2026-10-04 ~21:45 CEST, BEFORE anything ran
+
+All times CEST (the controller's scheduler is Europe/Budapest). Sources: each controller's "Daily job … scheduled for"
+lines (`baseline/schedule-*.txt`), the agent journals of the last 7 nights, `11` §5.5 / §8.1, `07` §6.1.
+
+## The 20-hour gap
+
+The marker `/var/lib/felhom-agent/os/last-night-run` is written only by a `night`-trigger leg. **It does not exist on
+either demo box** (both: `No such file`): every OS run today was `debug` or signed, and the hub has no `night` report from
+either demo box (`os_reports`: only Tester 2's two). **Prediction: the gap skips nothing tonight on either box.** No
+marker to clear on demo-felhom — §1.2's "clear the marker" step is not needed (and no documented route exists to clear
+it; none was invented).
+
+## Per box
+
+| Box | Leg | Expected | Why |
+|---|---|---|---|
+| demo-hp | db-dump | 02:30 | scheduler |
+| demo-hp | tier-2 copy + fill-watch | 03:30 | scheduler |
+| demo-hp | metrics-prune | 04:00 | scheduler |
+| demo-hp | off-site | 04:15 | scheduler |
+| demo-hp | whole-guest backup (`local`) | ~04:35 → ~04:40 | last nights: 04:34:55 → 04:39:41 |
+| demo-hp | OS leg guest → host → Docker (ring 0) | ~04:40 → ~04:45, right after the backup | `AfterPrimaryBackup`; no gap marker. Guest: pending Debian fixes if any appeared since today; host: same; Docker: `select pending-docker` = nothing newer than 29.8.2 expected → "nothing". The root-owned `ring0_slow_lane` mark is ON on both demo boxes (read 21:47: `os-trust.json`), so the Docker step runs unsigned and should report "nothing". |
+| demo-hp | controller 04:30 self-update | no action | current 0.293.0 = floor 0.293.0 |
+| demo-hp | offsite-abandon-sweep / offsite-proof / offsite-integrity | 05:10 / 05:30 / 06:00 | scheduler |
+| demo-felhom | db-dump / tier-2 / off-site | 02:30 / 03:30 / 04:15 | scheduler |
+| demo-felhom | whole-guest backup (`felhom-backup`) | **~07:45–07:55** — after the 06:30 stop | last 7 nights 07:37 → 07:49, drifting +2–3 min a night |
+| demo-felhom | OS leg | after ~07:50 — **not watched** | follows the backup |
+| Tester 1 (new box) | first whole-guest backup + OS leg | **minutes after enrolment**, not at night | Tester 2 (2026-10-04): backup 14 min after enrolment, `night`-trigger OS leg right after (49 + 106 packages) |
+| Tester 1 | its first OS leg's package count | **0 guest, 0 host** — ring 1 installs only an approved release, and none is in force; it reports the pending ones (~49 guest from the golden) as "not covered" | `11` §5.3, golden 0.293.0 |
+| Tester 1 | night db-dump / tier-2 / off-site | 02:30 / 03:30 (no 2nd drive → skipped) / 04:15 | scheduler |
+| Tester 1 | off-site night one — decision 78 | 04:15: the orphaned old repository (earlier tester-1 boxes) is SET ASIDE, never deleted; a new repository started; one household line | decision 78 (controller v0.291.0) |
+| Tester 1 | whole-guest at night | not due (the install-time one is < 24 h old) | cadence |
+| Tester 1 | OS leg at night | none — the install-time leg wrote the marker < 20 h before | the gap |
+| Tester 2 | anything | offline since 18:06 UTC — nothing | hub `STALE` |
+
+## Approvals
+
+No guest or host release is in force (today's test approvals were cancelled at 18:20 UTC). The ruled rule: 24 h since
+the set was first seen AND one `night` run on EVERY ring-0 box since then. Guest set first seen 11:07 UTC, host 12:24 UTC
+(if tonight's leg installs something, the set changes and the clock restarts). demo-felhom's night run comes ~07:50, so
+**the earliest real approval is after ~11:07 UTC tomorrow**, only if neither box's set changes tonight. Docker: the
+operator's release stays; no new set expected.
+
+## Mails expected tonight
+
+None to a household from the demo boxes (a normal night). Tester 1: the household line for the off-site set-aside; the
+operator mail for it. Operator: `host_stale` / `node_stale` for Tester 2 already sent; nothing more unless it returns.

documentation/audits/night-2026-10-04/accidents/a1-not-run-forward-pass.txt

@@ -0,0 +1,15 @@
+02:58:42
+    "healthy": true,
+    "outcome": "applied",
+    "healthy": true,
+    "outcome": "nothing",
+    "healthy": true,
+    "outcome": "nothing",
+audit_rc=0
+bind9-dnsutils	1:9.20.29-1~deb13u1
+bind9-host	1:9.20.29-1~deb13u1
+bind9-libs:amd64	1:9.20.29-1~deb13u1
+libpcre2-8-0:amd64	10.46-1~deb13u3
+libssh2-1t64:amd64	1.11.1-1+deb13u2
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u3
+demo-hp guest IDENTICAL to the 21:47 baseline

documentation/audits/night-2026-10-04/accidents/a1-rollback-simulation.txt

@@ -0,0 +1,7 @@
+0 upgraded, 0 newly installed, 6 downgraded, 0 to remove and 0 not upgraded.
+Inst libpcre2-8-0 [10.46-1~deb13u3] (10.46-1~deb13u2 Debian:13.7/stable [amd64])
+Inst libxml2 [2.12.7+dfsg+really2.9.14-2.1+deb13u3] (2.12.7+dfsg+really2.9.14-2.1+deb13u1 Debian-Security:13/stable-security [amd64])
+Inst bind9-host [1:9.20.29-1~deb13u1] (1:9.20.26-1~deb13u1 Debian:13.7/stable [amd64]) []
+Inst bind9-dnsutils [1:9.20.29-1~deb13u1] (1:9.20.26-1~deb13u1 Debian:13.7/stable [amd64]) []
+Inst bind9-libs [1:9.20.29-1~deb13u1] (1:9.20.26-1~deb13u1 Debian:13.7/stable [amd64])
+Inst libssh2-1t64 [1.11.1-1+deb13u2] (1.11.1-1+deb13u1 Debian-Security:13/stable-security [amd64])

documentation/audits/night-2026-10-04/accidents/a1-rollback.txt

@@ -0,0 +1,6 @@
+0 upgraded, 0 newly installed, 6 downgraded, 0 to remove and 0 not upgraded.
+0 upgraded, 0 newly installed, 6 downgraded, 0 to remove and 0 not upgraded.
+Oct 05 04:57:23 demo-hp systemd[1]: Started felhom-agent.service - Felhom host agent (Proxmox host tier; hub control loop + PBS verify + storage watchdog).
+Oct 05 04:57:23 demo-hp felhom-agent[2031788]: time=2026-10-05T04:57:23.746+02:00 level=INFO msg="felhom-agent daemon starting" version=0.143.0 host_id=demo-hp-bb76ea hub_url=https://hub.felhom.eu int
+Oct 05 04:57:25 demo-hp felhom-agent[2031788]: time=2026-10-05T04:57:25.550+02:00 level=INFO msg="controller-supervisor: started" interval=30s confirm_sweeps=2 crashloop_max=3 crashloop_window=15m0s s
+21

documentation/audits/night-2026-10-04/accidents/a2-after.txt

@@ -0,0 +1,34 @@
+cloudflared bdbd524f10b0 Up 7 minutes (healthy)
+felhom-controller 6fed831a7b6b Up 3 minutes (healthy)
+filebrowser 6bda22106919 Up 7 minutes (healthy)
+opengist 17fc57389b52 Up 3 minutes (healthy)
+traefik ddc8abb0ce45 Up 3 minutes
+2026/10/04 20:16:14 [INFO] [web] manual whole-guest backup triggered (quiesce loop)
+2026/10/04 20:16:14 [INFO] [quiesce] manual backup requested — quiescing now
+2026/10/04 20:16:16 [INFO] [quiesce] backup due on 2 tier(s) — quiescing 1 stack(s): [opengist]
+2026/10/04 20:16:16 [INFO] [stacks] Stopping stack: opengist
+2026/10/04 20:16:16 [INFO] [quiesce] tier felhom-backup: backup job backup-9201-1791144976590222481 started — polling
+2026/10/04 20:16:33 [WARN] [sockheal] Docker refuses the socket (dial unix /var/run/docker.sock: connect: connection refused) — exiting after 1m0s of refusals so Docker restarts this controller on the current socket (R-860)
+2026/10/04 20:16:46 [INFO] [quiesce] tier felhom-backup: backup job backup-9201-1791144976590222481 done — next tier may start (app still quiesced)
+2026/10/04 20:16:46 [INFO] [quiesce] tier felhom-pbs is BUSY — the agent refused the backup because a concurrent heavy operation holds it. This is contention, NOT a failure: the tier stays due and retries in 15m0s (contended for
+2026/10/04 20:16:46 [INFO] [quiesce] unquiescing (last tier is busy — deferring to a later cycle): restarting 1 stack(s)
+2026/10/04 20:16:46 [INFO] [stacks] Starting stack: opengist
+2026/10/04 20:16:46 [ERROR] [quiesce] restart opengist: starting stack opengist: exit code 1
+2026/10/04 20:17:33 [ERROR] [sockheal] Docker has refused the socket for 1m0s (dial unix /var/run/docker.sock: connect: connection refused) — the socket file was re-created and this container holds the old one; EXITING (code 75)
+2026/10/04 20:17:35 [INFO] [quiesce] loop started (poll 5m0s, max-quiesce 30m0s)
+2026/10/04 20:17:35 [INFO] [scheduler] Daily job tier2-backup scheduled for 2026-10-05 03:30 CEST
+2026/10/04 20:17:50 [INFO] [bootrecon] boot window: fleet settled after 10s (3 identical samples 5s apart) — sweeping
+2026/10/04 20:17:50 [INFO] [bootrecon] Boot reconciliation: 1 boot-orphaned app(s) found: [opengist] — up to 2 attempt(s)
+2026/10/04 20:17:50 [INFO] [stacks] Starting stack: opengist
+2026/10/04 20:17:50 [INFO] [bootrecon] Boot reconciliation attempt 1/2: started "opengist" (took 0.5s)
+2026/10/04 20:17:50 [INFO] [bootrecon] Boot reconciliation complete: 1 app(s) recovered in 1 attempt(s): [opengist]
+2026/10/04 20:18:05 [WARN] [sockheal] traefik holds an old docker socket (inode 151, current 646) — restarting it (R-860)
+2026/10/04 20:18:05 [INFO] [sockheal] traefik restarted onto the current docker socket
+Oct 04 22:16:43 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:16:43.062+02:00 level=INFO msg="backup: completed" vmid=9201 target=felhom-backup archive=felhom-backup:backup/vzdump-lxc-9201-202
+Oct 04 22:16:43 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:16:43.062+02:00 level=INFO msg="local-api: backup job complete" vmid=9201 target=felhom-backup job=backup-9201-1791144976590222481
+Oct 04 22:18:13 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:13.063+02:00 level=INFO msg="osupdate: START" run=20261004T201813Z layer=guest vmid=9201 ring=0 trigger=night enabled=true rele
+Oct 04 22:18:26 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:26.519+02:00 level=INFO msg="osupdate: DONE" run=20261004T201813Z layer=guest vmid=9201 ring=0 trigger=night outcome=nothing he
+Oct 04 22:18:26 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:26.609+02:00 level=INFO msg="osupdate: START" run=20261004T201813Z layer=host vmid=9201 ring=0 trigger=night enabled=true relea
+Oct 04 22:18:39 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:39.682+02:00 level=INFO msg="osupdate: DONE" run=20261004T201813Z layer=host vmid=9201 ring=0 trigger=night outcome=nothing hea
+Oct 04 22:18:41 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:41.341+02:00 level=INFO msg="osupdate: START" run=20261004T201813Z layer=docker vmid=9201 ring=0 trigger=night enabled=true rel
+Oct 04 22:18:56 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:56.175+02:00 level=INFO msg="osupdate: DONE" run=20261004T201813Z layer=docker vmid=9201 ring=0 trigger=night outcome=nothing h

documentation/audits/night-2026-10-04/accidents/a2-ps-before.txt

@@ -0,0 +1,5 @@
+cloudflared bdbd524f10b0 Up 2 minutes (healthy)
+felhom-controller 6fed831a7b6b Up 2 minutes (healthy)
+filebrowser 6bda22106919 Up 2 minutes (healthy)
+opengist 2b84350e01a3 Up 2 minutes (healthy)
+traefik ddc8abb0ce45 Up 2 minutes

documentation/audits/night-2026-10-04/accidents/a2-timeline.txt

@@ -0,0 +1,30 @@
+20:16:12
+{"data":{"started":true},"ok":true}
+
+HTTP 200
+app-stop seen 20:16:17
+docker.socket restarted 20:16:23 inode=646
+20:16:41 controller_started=20:13:31 running=4
+20:16:53 controller_started=20:13:31 running=4
+20:17:04 controller_started=20:13:31 running=4
+20:17:16 controller_started=20:13:31 running=4
+20:17:27 controller_started=20:13:31 running=4
+20:17:39 controller_started=20:17:33 running=4
+20:17:51 controller_started=20:17:33 running=5
+20:18:02 controller_started=20:17:33 running=5
+20:18:14 controller_started=20:17:33 running=5
+20:18:25 controller_started=20:17:33 running=5
+20:18:37 controller_started=20:17:33 running=5
+20:18:49 controller_started=20:17:33 running=5
+20:19:00 controller_started=20:17:33 running=5
+20:19:12 controller_started=20:17:33 running=5
+20:19:23 controller_started=20:17:33 running=5
+20:19:35 controller_started=20:17:33 running=5
+20:19:46 controller_started=20:17:33 running=5
+20:19:58 controller_started=20:17:33 running=5
+20:20:09 controller_started=20:17:33 running=5
+20:20:21 controller_started=20:17:33 running=5
+20:20:32 controller_started=20:17:33 running=5
+20:20:44 controller_started=20:17:33 running=5
+20:20:55 controller_started=20:17:33 running=5
+20:21:07 controller_started=20:17:33 running=5

documentation/audits/night-2026-10-04/accidents/a3-hub-blocked.txt

@@ -0,0 +1,17 @@
+BLOCK 20:26:09
+host: 000blocked
+guest: 000blocked
+PASS 20:26:10
+selftest=os-update: desired state: hub: transport error: Get "https://hub.felhom.eu/api/v1/hosts/tester-1-d70be4/desired-state": dial tcp 192.168.0.192:443: connect: invalid argument
+PASS-END 20:26:11
+ tester-1-d70be4 Tester 1 0.143.0 9.2.2 7.0.2-6-pve ONLINE 1/1 
+ Last Report 30 min ago 
+UNBLOCK 20:56:10
+Oct 04 22:40:49 felhom felhom-agent[2492]: time=2026-10-04T22:40:49.055+02:00 level=WARN msg="hub: report failed; keeping current interval" err="hub: transport error: Post \"https://hub.felhom.eu/api/
+Oct 04 22:55:49 felhom felhom-agent[2492]: time=2026-10-04T22:55:49.082+02:00 level=WARN msg="hub: report failed; keeping current interval" err="hub: transport error: Post \"https://hub.felhom.eu/api/
+== 21:12:07
+ Last Report 1 min ago 
+2026/10/04 20:57:04 [INFO] [scheduler] Running job: hub-report
+2026/10/04 20:57:05 [INFO] [scheduler] Job hub-report completed (took 759ms)
+2026/10/04 21:12:04 [INFO] [scheduler] Running job: hub-report
+2026/10/04 21:12:05 [INFO] [scheduler] Job hub-report completed (took 841ms)

documentation/audits/night-2026-10-04/accidents/a4-diskfull.txt

@@ -0,0 +1,9 @@
+20:24:20
+/dev/mapper/pve-vm--9201--disk--0   32G   30G  400M  99% /
+os-apply: START release=a4-diskfull layer=guest:9201 lane=fast mode=apply select=listed packages=3
+os-apply: REPAIR configured=0 fixed=0
+os-apply: PLAN upgrade=3 already=0 not-installed=0 from-snapshot=0
+os-apply: REFUSED: R8 free space 419430400 B is below max(500 MB, 3 x download 0 B)
+OSAPPLY-REPORT {"health_before": {"containers": {"bookstack": {"health": "healthy", "id": "b2c5a47cecf243d921f300f2d61b634f8fab5b9f84bf0f43b7de9255c10c174f", "state": "running"}, "bookstack-db": {"health": "healthy", "id": "7ed4dde2643bf9834b33bdb4696c22604faf045bbbba67666acdb282138b7ea3", "state": 
+rc=2
+bind9-libs:amd64	1:9.20.23-1~deb13u1

documentation/audits/night-2026-10-04/accidents/a4-download-size-probe.txt

@@ -0,0 +1,4 @@
+--- as the wrapper (with -s):
+0
+--- without -s:
+3 uris, 1471812 bytes

documentation/audits/night-2026-10-04/accidents/a5-diff-vs-baseline.txt

@@ -0,0 +1,4 @@
+66a67
+> iso-codes=4.18.0-1
+211a213
+> lsb-release=12.1-1

documentation/audits/night-2026-10-04/accidents/a5-kill.txt

@@ -0,0 +1,20 @@
+daemon pid before 447632
+pass pid 2030197 start 02:56:59.583
+KILLED at 02:57:18.480: the pass + the daemon (apt-get was running)
+/root/a5.sh: line 11: 2030197 Killed                  nohup sudo -u felhom-agent /usr/local/bin/felhom-agent --config /etc/felhom-agent/agent.json --selftest=os-update -vmid 9201 > /root/a5-pass1.log 2>&1
+dpkg running after kill: 0
+   1015   41981 /usr/sbin/dnsmasq -x /run/dnsmasq/dnsmasq.pid -u dnsmasq -7 /etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new --local-service --trust-anchor=.,20326,8,2,E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D --trust-anchor=.,38696,8,2,683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16
+2030216      20 sudo -n /usr/local/sbin/felhom-os-apply --plan /var/lib/felhom-agent/os/plan-20261005T025659Z-guest-apply.json
+2030219      20 /usr/bin/python3 /usr/local/sbin/felhom-os-apply --plan /var/lib/felhom-agent/os/plan-20261005T025659Z-guest-apply.json
+2031523       2 lxc-attach -n 9201 --keep-env -- env DEBIAN_FRONTEND=noninteractive APT_LISTCHANGES_FRONTEND=none NEEDRESTART_MODE=l LC_ALL=C apt-get -y -q -o Dpkg::Options::=--force-confold -o Dpkg::Options::=--force-confdef install --only-upgrade --no-install-recommends libpcre2-8-0=10.46-1~deb13u3 libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3 bind9-host=1:9.20.29-1~deb13u1 bind9-dnsutils=1:9.20.29-1~deb13u1 bind9-libs=1:9.20.29-1~deb13u1 libssh2-1t64=1.11.1-1+deb13u2
+2031555       1 apt-get -y -q -o Dpkg::Options::=--force-confold -o Dpkg::Options::=--force-confdef install --only-upgrade --no-install-recommends libpcre2-8-0=10.46-1~deb13u3 libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3 bind9-host=1:9.20.29-1~deb13u1 bind9-dnsutils=1:9.20.29-1~deb13u1 bind9-libs=1:9.20.29-1~deb13u1 libssh2-1t64=1.11.1-1+deb13u2
+daemon pid after 2031788 state active restarts 1
+audit rc=0
+bind9-dnsutils	1:9.20.29-1~deb13u1
+bind9-host	1:9.20.29-1~deb13u1
+bind9-libs:amd64	1:9.20.29-1~deb13u1
+libpcre2-8-0:amd64	10.46-1~deb13u3
+libssh2-1t64:amd64	1.11.1-1+deb13u2
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u3
+=== felhom-agent 0.143.0 selftest=os-update vmid=9201 ring=0 enabled=true guest-release=false host-release=false appliance=true ===
+time=2026-10-05T04:56:59.730+02:00 level=INFO msg="osupdate: START" run=20261005T025659Z layer=guest vmid=9201 ring=0 trigger=debug enabled=true release=ring0-20261005T025659Z

documentation/audits/night-2026-10-04/accidents/a5-pkgs-after-repair.txt

@@ -0,0 +1,281 @@
+adduser=3.152
+apparmor=4.1.0-1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+bzip2=1.0.8-6
+ca-certificates=20250419
+containerd.io=2.3.6-1~debian.13~trixie
+coreutils=9.7-3
+cpio=2.15+dfsg-2
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus-user-session=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+distro-info-data=0.66+deb13u2
+dmidecode=3.6-2
+doc-debian=11.3+nmu1
+docker-buildx-plugin=0.37.1-1~debian.13~trixie
+docker-ce-cli=5:29.8.2-1~debian.13~trixie
+docker-ce-rootless-extras=5:29.8.2-1~debian.13~trixie
+docker-ce=5:29.8.2-1~debian.13~trixie
+docker-compose-plugin=5.6.0-1~debian.13~trixie
+dpkg=1.22.22
+e2fsprogs=1.47.2-3+b12
+fdisk=2.41.5-0+deb13u1
+file=1:5.46-5
+findutils=4.10.0-3
+gcc-14-base=14.2.0-19
+gettext-base=0.23.1-2
+git-man=1:2.47.3-0+deb13u1
+git=1:2.47.3-0+deb13u1
+grep=3.11-4
+groff-base=1.23.0-9
+gzip=1.13-1+deb13u1
+hostname=3.25
+ifupdown2=3.0.0-1.3
+ifupdown=0.8.44+deb13u1
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+iproute2=6.15.0-1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+iso-codes=4.18.0-1
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+less=668-1
+libacl1=2.3.2-2+b1
+libapparmor1=4.1.0-1
+libapt-pkg7.0=3.0.3
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcbor0.10=0.10.2-2
+libcom-err2=1.47.2-3+b12
+libcrypt1=1:4.4.38-1
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdb5.3t64=5.3.28+dfsg2-9
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libedit2=3.1-20250104-1
+libelf1t64=0.192-4
+liberror-perl=0.17030-1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfdisk1=2.41.5-0+deb13u1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfstrm0=0.6.1-1+b3
+libgcc-s1=14.2.0-19
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libgmp10=2:6.3.0+dfsg-3
+libgnutls30t64=3.8.9-3+deb13u4
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libhogweed6t64=3.10.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjson-c5=0.18+ds-1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libkmod2=34.2-2
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap-common=2.6.10+dfsg-1
+libldap2=2.6.10+dfsg-1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libncursesw6=6.5+20250216-2
+libnetfilter-conntrack3=1.1.0-1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnsl2=1.3.0-3+b3
+libnss-systemd=257.13-1~deb13u1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpcre2-8-0=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpopt0=1.19+dfsg-2
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libpsl5t64=0.21.2-1.1+b1
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libreadline8t64=8.2-6
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsepol2=3.8.1-1
+libslang2=2.3.3-5+b2
+libsmartcols1=2.41.5-0+deb13u1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstdc++6=14.2.0-19
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunistring5=1.3-2
+liburcu8t64=0.15.2-2
+libuuid1=2.41.5-0+deb13u1
+libuv1t64=1.50.0-2
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libzstd1=1.5.7+dfsg-1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsb-release=12.1-1
+lsof=4.99.4+dfsg-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netbase=6.5
+netcat-traditional=1.10-50
+nftables=1.1.3-1
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+patch=2.8-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl=5.40.1-6+deb13u1
+pigz=2.8-1
+postfix=3.10.13-0+deb13u1
+procps=2:4.0.4-9
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-certifi=2025.1.31+ds-1
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-minimal=3.13.5-1
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-urllib3=2.3.0-3+deb13u2
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+readline-common=8.2-6
+reportbug=13.2.0
+runit-helper=2.16.4
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+systemd-sysv=257.13-1~deb13u1
+systemd-timesyncd=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tar=1.35+dfsg-3.1
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wtmpdb=0.73.0-3+deb13u1
+xz-utils=5.8.1-1+deb13u1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1

documentation/audits/night-2026-10-04/accidents/a5-pkgs-final.txt

@@ -0,0 +1,279 @@
+adduser=3.152
+apparmor=4.1.0-1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+bzip2=1.0.8-6
+ca-certificates=20250419
+containerd.io=2.3.6-1~debian.13~trixie
+coreutils=9.7-3
+cpio=2.15+dfsg-2
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus-user-session=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+distro-info-data=0.66+deb13u2
+dmidecode=3.6-2
+doc-debian=11.3+nmu1
+docker-buildx-plugin=0.37.1-1~debian.13~trixie
+docker-ce-cli=5:29.8.2-1~debian.13~trixie
+docker-ce-rootless-extras=5:29.8.2-1~debian.13~trixie
+docker-ce=5:29.8.2-1~debian.13~trixie
+docker-compose-plugin=5.6.0-1~debian.13~trixie
+dpkg=1.22.22
+e2fsprogs=1.47.2-3+b12
+fdisk=2.41.5-0+deb13u1
+file=1:5.46-5
+findutils=4.10.0-3
+gcc-14-base=14.2.0-19
+gettext-base=0.23.1-2
+git-man=1:2.47.3-0+deb13u1
+git=1:2.47.3-0+deb13u1
+grep=3.11-4
+groff-base=1.23.0-9
+gzip=1.13-1+deb13u1
+hostname=3.25
+ifupdown2=3.0.0-1.3
+ifupdown=0.8.44+deb13u1
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+iproute2=6.15.0-1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+less=668-1
+libacl1=2.3.2-2+b1
+libapparmor1=4.1.0-1
+libapt-pkg7.0=3.0.3
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcbor0.10=0.10.2-2
+libcom-err2=1.47.2-3+b12
+libcrypt1=1:4.4.38-1
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdb5.3t64=5.3.28+dfsg2-9
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libedit2=3.1-20250104-1
+libelf1t64=0.192-4
+liberror-perl=0.17030-1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfdisk1=2.41.5-0+deb13u1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfstrm0=0.6.1-1+b3
+libgcc-s1=14.2.0-19
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libgmp10=2:6.3.0+dfsg-3
+libgnutls30t64=3.8.9-3+deb13u4
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libhogweed6t64=3.10.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjson-c5=0.18+ds-1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libkmod2=34.2-2
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap-common=2.6.10+dfsg-1
+libldap2=2.6.10+dfsg-1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libncursesw6=6.5+20250216-2
+libnetfilter-conntrack3=1.1.0-1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnsl2=1.3.0-3+b3
+libnss-systemd=257.13-1~deb13u1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpcre2-8-0=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpopt0=1.19+dfsg-2
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libpsl5t64=0.21.2-1.1+b1
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libreadline8t64=8.2-6
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsepol2=3.8.1-1
+libslang2=2.3.3-5+b2
+libsmartcols1=2.41.5-0+deb13u1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstdc++6=14.2.0-19
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunistring5=1.3-2
+liburcu8t64=0.15.2-2
+libuuid1=2.41.5-0+deb13u1
+libuv1t64=1.50.0-2
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libzstd1=1.5.7+dfsg-1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsof=4.99.4+dfsg-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netbase=6.5
+netcat-traditional=1.10-50
+nftables=1.1.3-1
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+patch=2.8-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl=5.40.1-6+deb13u1
+pigz=2.8-1
+postfix=3.10.13-0+deb13u1
+procps=2:4.0.4-9
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-certifi=2025.1.31+ds-1
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-minimal=3.13.5-1
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-urllib3=2.3.0-3+deb13u2
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+readline-common=8.2-6
+reportbug=13.2.0
+runit-helper=2.16.4
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+systemd-sysv=257.13-1~deb13u1
+systemd-timesyncd=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tar=1.35+dfsg-3.1
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wtmpdb=0.73.0-3+deb13u1
+xz-utils=5.8.1-1+deb13u1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1

documentation/audits/night-2026-10-04/accidents/a5-removed-by-my-rollback.txt

@@ -0,0 +1,18 @@
+2026-10-04 20:22:16 remove apt-listchanges:all 4.8 <none>
+2026-10-04 20:22:16 remove ifupdown2:all 3.0.0-1.3 <none>
+2026-10-04 20:22:16 remove reportbug:all 13.2.0 <none>
+2026-10-04 20:22:16 remove python3-reportbug:all 13.2.0 <none>
+2026-10-04 20:22:17 remove python3-requests:all 2.32.3+dfsg-5+deb13u1 <none>
+2026-10-04 20:22:17 remove python3-debian:all 1.0.1 <none>
+2026-10-04 20:22:17 remove python3-charset-normalizer:amd64 3.4.2-1 <none>
+2026-10-04 20:22:17 remove python3-idna:all 3.10-1+deb13u1 <none>
+2026-10-04 20:22:17 remove python3-apt:amd64 3.0.0 <none>
+2026-10-04 20:22:17 remove python3-debianbts:all 4.1.1 <none>
+2026-10-04 20:22:17 remove python3-certifi:all 2025.1.31+ds-1 <none>
+2026-10-04 20:22:17 remove python3-chardet:all 5.2.0+dfsg-2 <none>
+2026-10-04 20:22:17 remove python3-debconf:all 1.5.91 <none>
+2026-10-04 20:22:17 remove python3-urllib3:all 2.3.0-3+deb13u2 <none>
+2026-10-04 20:22:18 remove python3:amd64 3.13.5-1 <none>
+2026-10-04 20:22:18 remove python3-minimal:amd64 3.13.5-1 <none>
+2026-10-04 20:22:18 remove python3.13:amd64 3.13.5-2+deb13u5 <none>
+2026-10-04 20:22:18 remove python3.13-minimal:amd64 3.13.5-2+deb13u5 <none>

documentation/audits/night-2026-10-04/accidents/a5-repair-my-mistake.txt

@@ -0,0 +1,7 @@
+20:22:46
+The following packages will be upgraded:
+8 upgraded, 20 newly installed, 0 to remove and 0 not upgraded.
+20:22:56
+280
+Reading state information...
+IDENTICAL to the 21:47 baseline

documentation/audits/night-2026-10-04/accidents/a5-rollback.txt

@@ -0,0 +1 @@
+0 upgraded, 0 newly installed, 8 downgraded, 18 to remove and 0 not upgraded.

documentation/audits/night-2026-10-04/accidents/a5a1-rollback.txt

@@ -0,0 +1,3 @@
+02:56:41
+0 upgraded, 0 newly installed, 6 downgraded, 0 to remove and 0 not upgraded.
+guard armed True in_window 0

documentation/audits/night-2026-10-04/accidents/hub-events-2005-2022.txt

@@ -0,0 +1,4 @@
+(4616, 'demo-felhom', 'os_update_applied', 'info', 'System security fixes installed on the box (3 package(s)).', 'hub', '2026-10-04 20:12:09')
+(4617, 'demo-felhom', 'controller_started', 'info', 'Controller elindult (0.293.0)', 'controller', '2026-10-04 20:13:38')
+(4618, 'demo-felhom', 'os_update_applied', 'info', 'System security fixes installed on the box (3 package(s)).', 'hub', '2026-10-04 20:14:18')
+(4619, 'demo-felhom', 'controller_started', 'info', 'Controller elindult (0.293.0)', 'controller', '2026-10-04 20:17:40')

documentation/audits/night-2026-10-04/baseline/os-releases.txt

@@ -0,0 +1,11 @@
+('os-20261004-091417', 'guest', '2026-10-04 09:14:17', 'auto', 1, '2026-10-04 18:20:02')
+('os-guest-20261004-123933', 'guest', '2026-10-04 12:39:33', 'auto', 1, '2026-10-04 18:20:02')
+('os-host-20261004-124034', 'host', '2026-10-04 12:40:34', 'auto', 1, '2026-10-04 18:20:02')
+('os-host-20261004-124133', 'host', '2026-10-04 12:41:33', 'auto', 1, '2026-10-04 18:20:02')
+('os-docker-20261004-142842', 'docker', '2026-10-04 14:28:42', 'operator', 0, '')
+('e196eb8652b9b11e', '2026-10-04 14:28:42')
+('1bdef9bcf1bd39e3', '2026-10-04 14:14:57')
+('777f842b71239d88', '2026-10-04 12:38:19')
+('7708d5e0f37a2796', '2026-10-04 12:24:19')
+('6c18a3e193e79f5b', '2026-10-04 11:07:23')
+('e0c5dac127834c78', '2026-10-04 09:12:07')

documentation/audits/night-2026-10-04/baseline/pkgs-guest-demo-hp.txt

@@ -0,0 +1,279 @@
+adduser=3.152
+apparmor=4.1.0-1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+bzip2=1.0.8-6
+ca-certificates=20250419
+containerd.io=2.3.6-1~debian.13~trixie
+coreutils=9.7-3
+cpio=2.15+dfsg-2
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus-user-session=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+distro-info-data=0.66+deb13u2
+dmidecode=3.6-2
+doc-debian=11.3+nmu1
+docker-buildx-plugin=0.37.1-1~debian.13~trixie
+docker-ce-cli=5:29.8.2-1~debian.13~trixie
+docker-ce-rootless-extras=5:29.8.2-1~debian.13~trixie
+docker-ce=5:29.8.2-1~debian.13~trixie
+docker-compose-plugin=5.6.0-1~debian.13~trixie
+dpkg=1.22.22
+e2fsprogs=1.47.2-3+b12
+fdisk=2.41.5-0+deb13u1
+file=1:5.46-5
+findutils=4.10.0-3
+gcc-14-base=14.2.0-19
+gettext-base=0.23.1-2
+git-man=1:2.47.3-0+deb13u1
+git=1:2.47.3-0+deb13u1
+grep=3.11-4
+groff-base=1.23.0-9
+gzip=1.13-1+deb13u1
+hostname=3.25
+ifupdown2=3.0.0-1.3
+ifupdown=0.8.44+deb13u1
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+iproute2=6.15.0-1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+less=668-1
+libacl1=2.3.2-2+b1
+libapparmor1=4.1.0-1
+libapt-pkg7.0=3.0.3
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcbor0.10=0.10.2-2
+libcom-err2=1.47.2-3+b12
+libcrypt1=1:4.4.38-1
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdb5.3t64=5.3.28+dfsg2-9
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libedit2=3.1-20250104-1
+libelf1t64=0.192-4
+liberror-perl=0.17030-1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfdisk1=2.41.5-0+deb13u1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfstrm0=0.6.1-1+b3
+libgcc-s1=14.2.0-19
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libgmp10=2:6.3.0+dfsg-3
+libgnutls30t64=3.8.9-3+deb13u4
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libhogweed6t64=3.10.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjson-c5=0.18+ds-1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libkmod2=34.2-2
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap-common=2.6.10+dfsg-1
+libldap2=2.6.10+dfsg-1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libncursesw6=6.5+20250216-2
+libnetfilter-conntrack3=1.1.0-1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnsl2=1.3.0-3+b3
+libnss-systemd=257.13-1~deb13u1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpcre2-8-0=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpopt0=1.19+dfsg-2
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libpsl5t64=0.21.2-1.1+b1
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libreadline8t64=8.2-6
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsepol2=3.8.1-1
+libslang2=2.3.3-5+b2
+libsmartcols1=2.41.5-0+deb13u1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstdc++6=14.2.0-19
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunistring5=1.3-2
+liburcu8t64=0.15.2-2
+libuuid1=2.41.5-0+deb13u1
+libuv1t64=1.50.0-2
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libzstd1=1.5.7+dfsg-1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsof=4.99.4+dfsg-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netbase=6.5
+netcat-traditional=1.10-50
+nftables=1.1.3-1
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+patch=2.8-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl=5.40.1-6+deb13u1
+pigz=2.8-1
+postfix=3.10.13-0+deb13u1
+procps=2:4.0.4-9
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-certifi=2025.1.31+ds-1
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-minimal=3.13.5-1
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-urllib3=2.3.0-3+deb13u2
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+readline-common=8.2-6
+reportbug=13.2.0
+runit-helper=2.16.4
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+systemd-sysv=257.13-1~deb13u1
+systemd-timesyncd=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tar=1.35+dfsg-3.1
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wtmpdb=0.73.0-3+deb13u1
+xz-utils=5.8.1-1+deb13u1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1

documentation/audits/night-2026-10-04/baseline/pkgs-guest-felhom-pve.txt

@@ -0,0 +1,279 @@
+adduser=3.152
+apparmor=4.1.0-1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+bzip2=1.0.8-6
+ca-certificates=20250419
+containerd.io=2.3.6-1~debian.13~trixie
+coreutils=9.7-3
+cpio=2.15+dfsg-2
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus-user-session=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+distro-info-data=0.66+deb13u2
+dmidecode=3.6-2
+doc-debian=11.3+nmu1
+docker-buildx-plugin=0.37.1-1~debian.13~trixie
+docker-ce-cli=5:29.8.2-1~debian.13~trixie
+docker-ce-rootless-extras=5:29.8.2-1~debian.13~trixie
+docker-ce=5:29.8.2-1~debian.13~trixie
+docker-compose-plugin=5.6.0-1~debian.13~trixie
+dpkg=1.22.22
+e2fsprogs=1.47.2-3+b12
+fdisk=2.41.5-0+deb13u1
+file=1:5.46-5
+findutils=4.10.0-3
+gcc-14-base=14.2.0-19
+gettext-base=0.23.1-2
+git-man=1:2.47.3-0+deb13u1
+git=1:2.47.3-0+deb13u1
+grep=3.11-4
+groff-base=1.23.0-9
+gzip=1.13-1+deb13u1
+hostname=3.25
+ifupdown2=3.0.0-1.3
+ifupdown=0.8.44+deb13u1
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+iproute2=6.15.0-1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+less=668-1
+libacl1=2.3.2-2+b1
+libapparmor1=4.1.0-1
+libapt-pkg7.0=3.0.3
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcbor0.10=0.10.2-2
+libcom-err2=1.47.2-3+b12
+libcrypt1=1:4.4.38-1
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdb5.3t64=5.3.28+dfsg2-9
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libedit2=3.1-20250104-1
+libelf1t64=0.192-4
+liberror-perl=0.17030-1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfdisk1=2.41.5-0+deb13u1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfstrm0=0.6.1-1+b3
+libgcc-s1=14.2.0-19
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libgmp10=2:6.3.0+dfsg-3
+libgnutls30t64=3.8.9-3+deb13u4
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libhogweed6t64=3.10.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjson-c5=0.18+ds-1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libkmod2=34.2-2
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap-common=2.6.10+dfsg-1
+libldap2=2.6.10+dfsg-1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libncursesw6=6.5+20250216-2
+libnetfilter-conntrack3=1.1.0-1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnsl2=1.3.0-3+b3
+libnss-systemd=257.13-1~deb13u1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpcre2-8-0=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpopt0=1.19+dfsg-2
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libpsl5t64=0.21.2-1.1+b1
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libreadline8t64=8.2-6
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsepol2=3.8.1-1
+libslang2=2.3.3-5+b2
+libsmartcols1=2.41.5-0+deb13u1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstdc++6=14.2.0-19
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunistring5=1.3-2
+liburcu8t64=0.15.2-2
+libuuid1=2.41.5-0+deb13u1
+libuv1t64=1.50.0-2
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libzstd1=1.5.7+dfsg-1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsof=4.99.4+dfsg-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netbase=6.5
+netcat-traditional=1.10-50
+nftables=1.1.3-1
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+patch=2.8-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl=5.40.1-6+deb13u1
+pigz=2.8-1
+postfix=3.10.13-0+deb13u1
+procps=2:4.0.4-9
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-certifi=2025.1.31+ds-1
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-minimal=3.13.5-1
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-urllib3=2.3.0-3+deb13u2
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+readline-common=8.2-6
+reportbug=13.2.0
+runit-helper=2.16.4
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+systemd-sysv=257.13-1~deb13u1
+systemd-timesyncd=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tar=1.35+dfsg-3.1
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wtmpdb=0.73.0-3+deb13u1
+xz-utils=5.8.1-1+deb13u1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1

documentation/audits/night-2026-10-04/baseline/pkgs-host-demo-hp.txt

@@ -0,0 +1,747 @@
+adduser=3.152
+age=1.2.1-1+b5
+amd64-microcode=3.20250311.1
+apparmor=4.1.1-pmx1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bc=1.07.1-4
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+binutils-common=2.44-3
+binutils-x86-64-linux-gnu=2.44-3
+binutils=2.44-3
+bridge-utils=1.7.1-4+b1
+bsd-mailx=8.1.2-0.20220412cvs-1.1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+btrfs-progs=6.14-1
+busybox=1:1.37.0-6+b9
+bzip2=1.0.8-6
+ca-certificates=20250419
+ceph-common=19.2.3-pve4
+ceph-fuse=19.2.3-pve4
+chrony=4.6.1-3+deb13u1
+cifs-utils=2:7.4-1
+conntrack=1:1.4.8-2
+console-setup-linux=1.242~deb13u1
+console-setup=1.242~deb13u1
+coreutils=9.7-3
+corosync=3.1.10-pve2
+cpio=2.15+dfsg-2
+criu=4.1.1-1
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+cstream=4.0.0-1
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+dirmngr=2.4.7-21+deb13u1+b5
+distro-info-data=0.66+deb13u2
+dmeventd=2:1.02.205-2+pmx1
+dmidecode=3.6-2
+dmsetup=2:1.02.205-2+pmx1
+dns-root-data=2025080400~deb13u1
+dnsmasq-base=2.91-1+deb13u2
+dnsmasq=2.91-1+deb13u2
+doc-debian=11.3+nmu1
+dosfstools=4.2-1.2
+dpkg=1.22.22
+dracut-install=106-6
+dtach=0.9-7
+e2fsprogs=1.47.2-3+b12
+ebtables=2.0.11-6
+efibootmgr=18-2
+eject=2.41.5-0+deb13u1
+ethtool=1:6.14.2-1
+faketime=0.9.10+2024-06-05+gba9ed5b2-0.6
+fdisk=2.41.5-0+deb13u1
+fdutils=5.6-4+b1
+felhom-bootstrap=1.26.1
+file=1:5.46-5
+findutils=4.10.0-3
+fontconfig-config=2.15.0-2.3
+fontconfig=2.15.0-2.3
+fonts-dejavu-core=2.37-8
+fonts-dejavu-mono=2.37-8
+fonts-font-awesome=5.0.10+really4.7.0~dfsg-4.1
+fonts-font-logos=1.0.1-3
+frr-pythontools=10.6.1-1+pve2
+frr=10.6.1-1+pve2
+fuse3=3.17.2-3
+fuse=3.17.2-3
+gcc-14-base=14.2.0-19
+gdisk=1.0.10-2
+genisoimage=9:1.1.11-4
+gettext-base=0.23.1-2
+gnupg-l10n=2.4.7-21+deb13u1
+gnupg=2.4.7-21+deb13u1
+gnutls-bin=3.8.9-3+deb13u4
+golang-github-containers-common=0.62.2+ds1-2
+golang-github-containers-image=5.34.2-1
+gpg-agent=2.4.7-21+deb13u1+b5
+gpg=2.4.7-21+deb13u1+b5
+gpgconf=2.4.7-21+deb13u1+b5
+gpgsm=2.4.7-21+deb13u1+b5
+grep=3.11-4
+groff-base=1.23.0-9
+grub-common=2.12-9+pmx2
+grub-efi-amd64-bin=2.12-9+pmx2
+grub-efi-amd64-signed=1+2.12+9+pmx2
+grub-efi-amd64-unsigned=2.12-9+pmx2
+grub-efi-amd64=2.12-9+pmx2
+grub-pc-bin=2.12-9+pmx2
+grub2-common=2.12-9+pmx2
+gzip=1.13-1+deb13u1
+hdparm=9.65+ds-1.1
+hostname=3.25
+ifupdown2=3.3.0-1+pmx12
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+initramfs-tools-bin=0.148.4
+initramfs-tools-core=0.148.4
+initramfs-tools=0.148.4
+iproute2=6.15.0-1
+ipset=7.22-1+b1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+iso-codes=4.18.0-1
+iucode-tool=2.3.1-3
+kbd=2.7.1-2
+keyboard-configuration=1.242~deb13u1
+keyutils=1.6.3-6
+klibc-utils=2.0.14-1
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+ksm-control-daemon=1.5-1
+less=668-1
+libacl1=2.3.2-2+b1
+libaio1t64=0.3.113-8+b1
+libanyevent-http-perl=2.25-2
+libanyevent-perl=7.170-2+b7
+libapparmor1=4.1.1-pmx1
+libappconfig-perl=1.71-2.3
+libapt-pkg-perl=0.1.42
+libapt-pkg7.0=3.0.3
+libarchive13t64=3.7.4-4+deb13u1
+libasound2-data=1.2.14-1+deb13u1
+libasound2t64=1.2.14-1+deb13u1
+libassuan9=3.0.2-2
+libasyncns0=0.8-6+b5
+libatomic1=14.2.0-19
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libauthen-pam-perl=0.16-6+b4
+libavahi-client3=0.8-16
+libavahi-common-data=0.8-16
+libavahi-common3=0.8-16
+libbabeltrace1=1.5.11-4+b2
+libbinutils=2.44-3
+libblas3=3.12.1-6
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbytes-random-secure-perl=0.29-4~deb13u1
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcairo2=1.18.4-1+b1
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcares2=1.34.5-1+deb13u1
+libcbor0.10=0.10.2-2
+libcephfs2=19.2.3-pve4
+libcfg7=3.1.10-pve2
+libclass-methodmaker-perl=2.25-1
+libclone-perl=0.47-1+b1
+libcmap4=3.1.10-pve2
+libcom-err2=1.47.2-3+b12
+libcommon-sense-perl=3.75-3+b5
+libcompel1=4.1.1-1
+libconvert-asn1-perl=0.34-1
+libcorosync-common4=3.1.10-pve2
+libcpg4=3.1.10-pve2
+libcrypt-openssl-bignum-perl=0.09-2+b4
+libcrypt-openssl-random-perl=0.17-1+b1
+libcrypt-openssl-rsa-perl=0.35-1.1
+libcrypt-random-seed-perl=0.03-3
+libcrypt-ssleay-perl=0.73.06-2+b4
+libcrypt1=1:4.4.38-1
+libcryptsetup12=2:2.7.5-2
+libctf-nobfd0=2.44-3
+libctf0=2.44-3
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdatrie1=0.2.13-3+b1
+libdb5.3t64=5.3.28+dfsg2-9
+libdbi1t64=0.9.0-6.1+b1
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libdevel-cycle-perl=1.12-2
+libdevmapper-event1.02.1=2:1.02.205-2+pmx1
+libdevmapper1.02.1=2:1.02.205-2+pmx1
+libdigest-hmac-perl=1.05+dfsg-1
+libdouble-conversion3=3.3.1-1
+libdpkg-perl=1.22.22
+libdrm-amdgpu1=2.4.124-2
+libdrm-common=2.4.124-2
+libdrm-intel1=2.4.124-2
+libdrm2=2.4.124-2
+libdw1t64=0.192-4
+libedit2=3.1-20250104-1
+libefiboot1t64=38-3.1+b1
+libefivar1t64=38-3.1+b1
+libelf1t64=0.192-4
+libencode-locale-perl=1.05-3
+libepoxy0=1.5.10-2
+libevent-2.1-7t64=2.1.13-stable-1~deb13u1
+libevent-core-2.1-7t64=2.1.13-stable-1~deb13u1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfaketime=0.9.10+2024-06-05+gba9ed5b2-0.6
+libfdisk1=2.41.5-0+deb13u1
+libfdt1=1.7.2-2+b1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfile-chdir-perl=0.1008-1.2
+libfile-listing-perl=6.16-1
+libfile-readbackwards-perl=1.06-2
+libfilesys-df-perl=0.92-7+b4
+libflac14=1.5.0+ds-2
+libfontconfig1=2.15.0-2.3
+libfreetype6=2.13.3+dfsg-1+deb13u1
+libfribidi0=1.0.16-1
+libfstrm0=0.6.1-1+b3
+libfuse2t64=2.9.9-9
+libfuse3-4=3.17.2-3
+libgbm1=25.0.7-2+deb13u1
+libgcc-s1=14.2.0-19
+libgcrypt20=1.11.0-7+deb13u1
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libglib2.0-0t64=2.84.4-3~deb13u5
+libgmp10=2:6.3.0+dfsg-3
+libgnutls-dane0t64=3.8.9-3+deb13u4
+libgnutls30t64=3.8.9-3+deb13u4
+libgoogle-perftools4t64=2.16-1
+libgpg-error0=1.51-4
+libgpgme11t64=1.24.2-3
+libgprofng0=2.44-3
+libgraphite2-3=1.3.14-2+deb13u1
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libgstreamer-plugins-base1.0-0=1.26.2-1+deb13u2
+libgstreamer1.0-0=1.26.2-2
+libharfbuzz0b=10.2.0-1+deb13u1
+libhogweed6t64=3.10.1-1
+libhtml-parser-perl=3.83-2~deb13u1
+libhtml-tagset-perl=3.24-1
+libhtml-tree-perl=5.07-3
+libhttp-cookies-perl=6.11-1
+libhttp-daemon-perl=6.16-1+deb13u1
+libhttp-date-perl=6.06-1
+libhttp-message-perl=7.00-2
+libhttp-negotiate-perl=6.01-2
+libibverbs1=56.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libinih1=59-1
+libio-html-perl=1.004-3
+libio-multiplex-perl=1.16-3
+libio-socket-ssl-perl=2.089-1
+libio-stringy-perl=2.113-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libipset13t64=7.22-1+b1
+libiscsi7=1.20.0-4
+libisns0t64=0.101-1+b1
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjpeg62-turbo=1:2.1.5-4
+libjs-bootstrap5=5.3.5+dfsg-4
+libjs-extjs=7.0.0-5
+libjs-qrcodejs=1.20230525-pve1
+libjson-c5=0.18+ds-1
+libjson-glib-1.0-0=1.10.6+ds-2
+libjson-glib-1.0-common=1.10.6+ds-2
+libjson-perl=4.10000-1
+libjson-xs-perl=4.040-1~deb13u1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libklibc=2.0.14-1
+libkmod2=34.2-2
+libknet1t64=1.31-pve1
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+libksba8=1.6.7-2+b1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap2=2.6.10+dfsg-1
+libldb2=2:2.11.0+samba4.22.11+dfsg-0+deb13u1
+liblinear4=2.3.0+dfsg-5+b2
+liblinux-inotify2-perl=1:2.3-2+b3
+libllvm19=1:19.1.7-3+b1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblockfile1=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblttng-ust-common1t64=2.13.9-1
+liblttng-ust-ctl5t64=2.13.9-1
+liblttng-ust1t64=2.13.9-1
+liblua5.3-0=5.3.6-2+b4
+liblua5.4-0=5.4.7-1+b2
+liblvm2cmd2.03=2.03.31-2+pmx1
+liblwp-mediatypes-perl=6.04-2
+liblwp-protocol-https-perl=6.14-1
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+liblzo2-2=2.10-3+b1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmath-random-isaac-perl=1.004-2
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmime-base32-perl=1.303-3
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libmp3lame0=3.100-6+b3
+libmpg123-0t64=1.32.10-1+deb13u1
+libnbd0=1.22.2-1+b1
+libncurses6=6.5+20250216-2
+libncursesw6=6.5+20250216-2
+libnet-dbus-perl=1.2.0-2+b3
+libnet-dns-perl=1.56-0+deb13u1
+libnet-http-perl=6.23-1
+libnet-ip-perl=1.26-4
+libnet-ldap-perl=1:0.6800+dfsg-1
+libnet-ssleay-perl=1.94-3
+libnet-subnet-perl=1.03-2
+libnet1=1.3+dfsg-2
+libnetaddr-ip-perl=4.079+dfsg-2+b5
+libnetfilter-conntrack3=1.1.0-1
+libnetfilter-log1=1.0.2-4+b1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnfsidmap1=1:2.8.3-1
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnl-3-200=3.7.0-2
+libnl-route-3-200=3.7.0-2
+libnozzle1t64=1.31-pve1
+libnpth0t64=1.8-3
+libnsl2=1.3.0-3+b3
+libnspr4=2:4.36-1
+libnss-systemd=257.13-1~deb13u1
+libnss3=2:3.110-1+deb13u4
+libnuma1=2.0.19-1
+libnvpair3linux=2.4.2-pve1
+liboath0t64=2.6.12-1
+libogg0=1.3.5-3+b2
+libopeniscsiusr=2.1.11-1+deb13u2
+libopus0=1.5.2-2
+liborc-0.4-0t64=1:0.4.41-1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpango-1.0-0=1.56.3-1
+libpangocairo-1.0-0=1.56.3-1
+libpangoft2-1.0-0=1.56.3-1
+libpcap0.8t64=1.10.5-2
+libpci3=1:3.13.0-2
+libpciaccess0=0.17-3+b3
+libpcre2-16-0=10.46-1~deb13u3
+libpcre2-8-0=10.46-1~deb13u3
+libpcre2-posix3=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpixman-1-0=0.44.0-3
+libpng16-16t64=1.6.48-1+deb13u6
+libpopt0=1.19+dfsg-2
+libposix-strptime-perl=0.13-2+b4
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libproxmox-acme-perl=1.7.1
+libproxmox-acme-plugins=1.7.1
+libproxmox-backup-qemu0=2.0.2
+libproxmox-rs-perl=0.4.1
+libpsl5t64=0.21.2-1.1+b1
+libpulse0=17.0+dfsg1-2+b1
+libpve-access-control=9.1.1
+libpve-apiclient-perl=3.4.2
+libpve-cluster-api-perl=9.1.5
+libpve-cluster-perl=9.1.5
+libpve-common-perl=9.1.12
+libpve-guest-common-perl=6.0.3
+libpve-http-server-perl=6.0.5
+libpve-network-api-perl=1.6.5
+libpve-network-perl=1.6.5
+libpve-notify-perl=9.1.5
+libpve-rs-perl=0.15.3
+libpve-storage-perl=9.1.5
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libqb-tools=2.0.8-2+b1
+libqb100=2.0.8-2+b1
+libqrencode4=4.1.1-2
+libqt5core5t64=5.15.15+dfsg-6+deb13u1
+libqt5dbus5t64=5.15.15+dfsg-6+deb13u1
+libqt5network5t64=5.15.15+dfsg-6+deb13u1
+libquorum5=3.1.10-pve2
+librabbitmq4=0.15.0-1+deb13u2
+librados2-perl=1.5.0
+librados2=19.2.3-pve4
+libradosstriper1=19.2.3-pve4
+librbd1=19.2.3-pve4
+librdkafka1=2.8.0-1
+librdmacm1t64=56.1-1
+libreadline8t64=8.2-6
+libreiserfscore0t64=1:3.6.27-9
+librgw2=19.2.3-pve4
+librrd8t64=1.7.2-4.2+pve4
+librrds-perl=1.7.2-4.2+pve4
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsensors-config=1:3.6.2-2
+libsensors5=1:3.6.2-2
+libsepol2=3.8.1-1
+libsframe1=2.44-3
+libslang2=2.3.3-5+b2
+libslirp0=4.8.0-1+deb13u1
+libsmartcols1=2.41.5-0+deb13u1
+libsmbclient0=2:4.22.11+dfsg-0+deb13u1
+libsnappy1v5=1.2.2-1
+libsndfile1=1.2.2-2+deb13u1
+libsndio7.0=1.10.0-0.1
+libsocket6-perl=0.29-3+b4
+libspice-server1=0.15.2-1+b1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstatgrab10t64=0.92.1-1.2
+libstdc++6=14.2.0-19
+libstring-shellquote-perl=1.04-3
+libsubid5=1:4.17.4-2
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtalloc2=2:2.4.3+samba4.22.11+dfsg-0+deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtcmalloc-minimal4t64=2.16-1
+libtdb1=2:1.4.13+samba4.22.11+dfsg-0+deb13u1
+libtemplate-perl=2.27-1+b8
+libterm-readline-gnu-perl=1.46-1+b3
+libtevent0t64=2:0.16.2+samba4.22.11+dfsg-0+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libthai-data=0.1.29-2
+libthai0=0.1.29-2+b1
+libthrift-0.19.0t64=0.19.0-4+b1
+libtimedate-perl=2.3300-2
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libtpms0=0.9.7+pve2
+libtry-tiny-perl=0.32-1
+libtypes-serialiser-perl=1.01-1
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunbound8=1.26.1-0+deb13u1
+libunistring5=1.3-2
+libunwind8=1.8.1-0.1
+liburcu8t64=0.15.2-2
+liburi-perl=5.30-1
+liburing2=2.9-1
+libusb-1.0-0=2:1.0.28-1
+libusbredirparser1t64=0.15.0-1
+libuuid-perl=0.37-1
+libuuid1=2.41.5-0+deb13u1
+libuutil3linux=2.4.2-pve1
+libuv1t64=1.50.0-2
+libva-drm2=2.22.0-3
+libva2=2.22.0-3
+libvirglrenderer1=1.1.0-2
+libvorbis0a=1.3.7-3
+libvorbisenc2=1.3.7-3
+libvotequorum8=3.1.10-pve2
+libvulkan1=1.4.309.0-1
+libwayland-server0=1.23.1-3
+libwbclient0=2:4.22.11+dfsg-0+deb13u1
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libwww-perl=6.78-1
+libwww-robotrules-perl=6.02-1
+libx11-6=2:1.8.12-1
+libx11-data=2:1.8.12-1
+libx11-xcb1=2:1.8.12-1
+libxau6=1:1.0.11-1
+libxcb-dri3-0=1.17.0-2+b1
+libxcb-present0=1.17.0-2+b1
+libxcb-randr0=1.17.0-2+b1
+libxcb-render0=1.17.0-2+b1
+libxcb-shm0=1.17.0-2+b1
+libxcb-sync1=1.17.0-2+b1
+libxcb-xfixes0=1.17.0-2+b1
+libxcb1=1.17.0-2+b1
+libxdmcp6=1:1.1.5-1
+libxext6=2:1.3.4-1+b3
+libxkbcommon0=1.7.0-2
+libxml-libxml-perl=2.0207+dfsg+really+2.0134-5+deb13u1
+libxml-namespacesupport-perl=1.12-2
+libxml-parser-perl=2.47-2~deb13u1
+libxml-sax-base-perl=1.09-3
+libxml-sax-perl=1.02+dfsg-4
+libxml-twig-perl=1:3.52-3
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxrender1=1:0.9.12-1
+libxshmfence1=1.3.3-1
+libxslt1.1=1.1.35-1.2+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libyaml-0-2=0.2.5-2
+libyaml-libyaml-perl=0.903.0+ds-1
+libyang3=3.12.2-1
+libz3-4=4.13.3-1
+libzfs7linux=2.4.2-pve1
+libzpool7linux=2.4.2-pve1
+libzstd1=1.5.7+dfsg-1
+linux-base=4.12.1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsof=4.99.4+dfsg-2
+lvm2=2.03.31-2+pmx1
+lxc-pve=7.0.0-2
+lxcfs=7.0.0-pve1
+lzop=1.04-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+memtest86+=7.20-1
+mesa-libgallium=25.0.7-2+deb13u1
+mokutil=0.7.2-1
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netavark=1.14.0-2
+netbase=6.5
+netcat-traditional=1.10-50
+nfs-common=1:2.8.3-1
+nftables=1.1.3-1
+nmap-common=7.95+dfsg-3
+nmap=7.95+dfsg-3
+node-popper2=2.11.2-8
+novnc-pve=1.7.0-1
+numactl=2.0.19-1
+open-iscsi=2.1.11-1+deb13u2
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+pci.ids=0.0~2025.06.09-1
+pciutils=1:3.13.0-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl-openssl-defaults=7+b2
+perl=5.40.1-6+deb13u1
+pinentry-curses=1.3.1-2
+postfix=3.10.13-0+deb13u1
+procmail=3.24+really3.22-4
+procps=2:4.0.4-9
+proxmox-archive-keyring=4.0
+proxmox-backup-client=4.2.0-1
+proxmox-backup-file-restore=4.2.0-1
+proxmox-backup-restore-image=1.0.0
+proxmox-default-kernel=2.1.0
+proxmox-enterprise-support-keyring=1.0
+proxmox-firewall=1.2.3
+proxmox-grub=2.12-9+pmx2
+proxmox-kernel-7.0.14-20-pve-signed=7.0.14-20
+proxmox-kernel-7.0.2-6-pve-signed=7.0.2-6
+proxmox-kernel-7.0=7.0.14-20
+proxmox-kernel-helper=9.1.0+fde2
+proxmox-mail-forward=1.0.3
+proxmox-mini-journalreader=1.6
+proxmox-offline-mirror-docs=0.7.4
+proxmox-offline-mirror-helper=0.7.4
+proxmox-secure-boot-support=2.0.6
+proxmox-termproxy=2.1.0
+proxmox-ve=9.2.0
+proxmox-websocket-tunnel=1.0.0
+proxmox-widget-toolkit=5.2.2
+psmisc=23.7-2
+pve-cluster=9.1.5
+pve-container=6.1.10
+pve-docs=9.2.1
+pve-edk2-firmware-aarch64=4.2025.05-2
+pve-edk2-firmware-legacy=4.2025.05-2
+pve-edk2-firmware-ovmf=4.2025.05-2
+pve-edk2-firmware=4.2025.05-2
+pve-esxi-import-tools=1.0.1
+pve-firewall=6.0.4
+pve-firmware=3.18-3
+pve-ha-manager=5.2.4
+pve-i18n=3.7.4
+pve-lxc-syscalld=2.0.2
+pve-manager=9.2.2
+pve-nvidia-vgpu-helper=0.3.1
+pve-qemu-kvm=11.0.0-3
+pve-xtermjs=6.0.0-1
+pve-yew-mobile-gui=0.7.0
+pve-yew-mobile-i18n=3.7.4
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-autocommand=2.2.2-3
+python3-bcrypt=4.2.0-2.1+b1
+python3-ceph-argparse=19.2.3-pve4
+python3-ceph-common=19.2.3-pve4
+python3-cephfs=19.2.3-pve4
+python3-certifi=2025.1.31+ds-1
+python3-cffi-backend=1.17.1-3
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-cryptography=43.0.0-3+deb13u1
+python3-dbus=1.4.0-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-importlib-resources=6.5.2-1
+python3-inflect=7.3.1-2
+python3-jaraco.context=6.0.1-1+deb13u1
+python3-jaraco.functools=4.1.0-1
+python3-jaraco.text=4.0.0-1
+python3-minimal=3.13.5-1
+python3-more-itertools=10.7.0-1
+python3-pefile=2024.8.26-2.1
+python3-pkg-resources=78.1.1-0.1
+python3-prettytable=3.15.1-1
+python3-pyvmomi=8.0.3.0.1-1
+python3-rados=19.2.3-pve4
+python3-rbd=19.2.3-pve4
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-rgw=19.2.3-pve4
+python3-setuptools=78.1.1-0.1
+python3-six=1.17.0-1
+python3-systemd=235-1+b6
+python3-typeguard=4.4.2-1
+python3-typing-extensions=4.13.2-1
+python3-urllib3=2.3.0-3+deb13u2
+python3-virt-firmware=24.11-2
+python3-wcwidth=0.2.13+dfsg1-1
+python3-yaml=6.0.2-1+b2
+python3-zipp=3.21.0-1
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+qemu-server=9.1.15
+qrencode=4.1.1-2
+readline-common=8.2-6
+reportbug=13.2.0
+rpcbind=1.2.7-1
+rrdcached=1.7.2-4.2+pve4
+rsync=3.5.0+ds1-0+deb13u1
+runit-helper=2.16.4
+samba-common=2:4.22.11+dfsg-0+deb13u1
+samba-libs=2:4.22.11+dfsg-0+deb13u1
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+shared-mime-info=2.4-5+b2
+shim-helpers-amd64-signed=1+16.1+1+pmx1
+shim-signed-common=1.48+pmx1+16.1-1+pmx1
+shim-signed=1.48+pmx1+16.1-1+pmx1
+shim-unsigned=16.1-1+pmx1
+skopeo=1.18.0+ds1-1+b5
+smartmontools=7.5-pve2
+smbclient=2:4.22.11+dfsg-0+deb13u1
+socat=1.8.0.3-1+deb13u1
+spiceterm=3.4.2
+sqlite3=3.46.1-7+deb13u2
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+strace=6.13+ds-1
+sudo=1.9.16p2-3+deb13u2
+swtpm-libs=0.8.0+pve3
+swtpm-tools=0.8.0+pve3
+swtpm=0.8.0+pve3
+systemd-boot-efi=257.13-1~deb13u1
+systemd-boot-tools=257.13-1~deb13u1
+systemd-sysv=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tar=1.35+dfsg-3.1
+tcpdump=4.99.5-2
+thin-provisioning-tools=1.1.0-4+b1
+time=1.9-0.2
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+uidmap=1:4.17.4-2
+usbutils=1:018-2
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+virtiofsd=1.13.2-1+deb13u1
+vncterm=1.9.2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wireguard-tools=1.0.20210914-3
+wtmpdb=0.73.0-3+deb13u1
+xfsprogs=6.13.0-2+deb13u1
+xkb-data=2.42-1
+xsltproc=1.1.35-1.2+deb13u3
+xz-utils=5.8.1-1+deb13u1
+zfs-initramfs=2.4.2-pve1
+zfs-zed=2.4.2-pve1
+zfsutils-linux=2.4.2-pve1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1
+zstd=1.5.7+dfsg-1

documentation/audits/night-2026-10-04/baseline/pkgs-host-felhom-pve.txt

@@ -0,0 +1,747 @@
+adduser=3.152
+age=1.2.1-1+b5
+apparmor=4.1.1-pmx1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bc=1.07.1-4
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+binutils-common=2.44-3
+binutils-x86-64-linux-gnu=2.44-3
+binutils=2.44-3
+bridge-utils=1.7.1-4+b1
+bsd-mailx=8.1.2-0.20220412cvs-1.1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+btrfs-progs=6.14-1
+busybox=1:1.37.0-6+b9
+bzip2=1.0.8-6
+ca-certificates=20250419
+ceph-common=19.2.3-pve4
+ceph-fuse=19.2.3-pve4
+chrony=4.6.1-3+deb13u1
+cifs-utils=2:7.4-1
+conntrack=1:1.4.8-2
+console-setup-linux=1.242~deb13u1
+console-setup=1.242~deb13u1
+coreutils=9.7-3
+corosync=3.1.10-pve2
+cpio=2.15+dfsg-2
+criu=4.1.1-1
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+cstream=4.0.0-1
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+dirmngr=2.4.7-21+deb13u1+b5
+distro-info-data=0.66+deb13u2
+dmeventd=2:1.02.205-2+pmx1
+dmidecode=3.6-2
+dmsetup=2:1.02.205-2+pmx1
+dns-root-data=2025080400~deb13u1
+dnsmasq-base=2.91-1+deb13u2
+dnsmasq=2.91-1+deb13u2
+doc-debian=11.3+nmu1
+dosfstools=4.2-1.2
+dpkg=1.22.22
+dracut-install=106-6
+dtach=0.9-7
+e2fsprogs=1.47.2-3+b12
+ebtables=2.0.11-6
+efibootmgr=18-2
+eject=2.41.5-0+deb13u1
+ethtool=1:6.14.2-1
+faketime=0.9.10+2024-06-05+gba9ed5b2-0.6
+fdisk=2.41.5-0+deb13u1
+fdutils=5.6-4+b1
+file=1:5.46-5
+findutils=4.10.0-3
+fontconfig-config=2.15.0-2.3
+fontconfig=2.15.0-2.3
+fonts-dejavu-core=2.37-8
+fonts-dejavu-mono=2.37-8
+fonts-font-awesome=5.0.10+really4.7.0~dfsg-4.1
+fonts-font-logos=1.0.1-3
+frr-pythontools=10.6.1-1+pve2
+frr=10.6.1-1+pve2
+fuse3=3.17.2-3
+fuse=3.17.2-3
+gcc-14-base=14.2.0-19
+gdisk=1.0.10-2
+genisoimage=9:1.1.11-4
+gettext-base=0.23.1-2
+gnupg-l10n=2.4.7-21+deb13u1
+gnupg=2.4.7-21+deb13u1
+gnutls-bin=3.8.9-3+deb13u4
+golang-github-containers-common=0.62.2+ds1-2
+golang-github-containers-image=5.34.2-1
+gpg-agent=2.4.7-21+deb13u1+b5
+gpg=2.4.7-21+deb13u1+b5
+gpgconf=2.4.7-21+deb13u1+b5
+gpgsm=2.4.7-21+deb13u1+b5
+grep=3.11-4
+groff-base=1.23.0-9
+grub-common=2.12-9+pmx2
+grub-efi-amd64-bin=2.12-9+pmx2
+grub-efi-amd64-signed=1+2.12+9+pmx2
+grub-efi-amd64-unsigned=2.12-9+pmx2
+grub-efi-amd64=2.12-9+pmx2
+grub-pc-bin=2.12-9+pmx2
+grub2-common=2.12-9+pmx2
+gzip=1.13-1+deb13u1
+hdparm=9.65+ds-1.1
+hostname=3.25
+ifupdown2=3.3.0-1+pmx12
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+initramfs-tools-bin=0.148.4
+initramfs-tools-core=0.148.4
+initramfs-tools=0.148.4
+intel-microcode=3.20251111.1~deb13u1
+iproute2=6.15.0-1
+ipset=7.22-1+b1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+iso-codes=4.18.0-1
+iucode-tool=2.3.1-3
+kbd=2.7.1-2
+keyboard-configuration=1.242~deb13u1
+keyutils=1.6.3-6
+klibc-utils=2.0.14-1
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+ksm-control-daemon=1.5-1
+less=668-1
+libacl1=2.3.2-2+b1
+libaio1t64=0.3.113-8+b1
+libanyevent-http-perl=2.25-2
+libanyevent-perl=7.170-2+b7
+libapparmor1=4.1.1-pmx1
+libappconfig-perl=1.71-2.3
+libapt-pkg-perl=0.1.42
+libapt-pkg7.0=3.0.3
+libarchive13t64=3.7.4-4+deb13u1
+libasound2-data=1.2.14-1+deb13u1
+libasound2t64=1.2.14-1+deb13u1
+libassuan9=3.0.2-2
+libasyncns0=0.8-6+b5
+libatomic1=14.2.0-19
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libauthen-pam-perl=0.16-6+b4
+libavahi-client3=0.8-16
+libavahi-common-data=0.8-16
+libavahi-common3=0.8-16
+libbabeltrace1=1.5.11-4+b2
+libbinutils=2.44-3
+libblas3=3.12.1-6
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbytes-random-secure-perl=0.29-4~deb13u1
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcairo2=1.18.4-1+b1
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcares2=1.34.5-1+deb13u1
+libcbor0.10=0.10.2-2
+libcephfs2=19.2.3-pve4
+libcfg7=3.1.10-pve2
+libclass-methodmaker-perl=2.25-1
+libclone-perl=0.47-1+b1
+libcmap4=3.1.10-pve2
+libcom-err2=1.47.2-3+b12
+libcommon-sense-perl=3.75-3+b5
+libcompel1=4.1.1-1
+libconvert-asn1-perl=0.34-1
+libcorosync-common4=3.1.10-pve2
+libcpg4=3.1.10-pve2
+libcrypt-openssl-bignum-perl=0.09-2+b4
+libcrypt-openssl-random-perl=0.17-1+b1
+libcrypt-openssl-rsa-perl=0.35-1.1
+libcrypt-random-seed-perl=0.03-3
+libcrypt-ssleay-perl=0.73.06-2+b4
+libcrypt1=1:4.4.38-1
+libcryptsetup12=2:2.7.5-2
+libctf-nobfd0=2.44-3
+libctf0=2.44-3
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdatrie1=0.2.13-3+b1
+libdb5.3t64=5.3.28+dfsg2-9
+libdbi1t64=0.9.0-6.1+b1
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libdevel-cycle-perl=1.12-2
+libdevmapper-event1.02.1=2:1.02.205-2+pmx1
+libdevmapper1.02.1=2:1.02.205-2+pmx1
+libdigest-hmac-perl=1.05+dfsg-1
+libdouble-conversion3=3.3.1-1
+libdpkg-perl=1.22.22
+libdrm-amdgpu1=2.4.124-2
+libdrm-common=2.4.124-2
+libdrm-intel1=2.4.124-2
+libdrm2=2.4.124-2
+libdw1t64=0.192-4
+libedit2=3.1-20250104-1
+libefiboot1t64=38-3.1+b1
+libefivar1t64=38-3.1+b1
+libelf1t64=0.192-4
+libencode-locale-perl=1.05-3
+libepoxy0=1.5.10-2
+libevent-2.1-7t64=2.1.13-stable-1~deb13u1
+libevent-core-2.1-7t64=2.1.13-stable-1~deb13u1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfaketime=0.9.10+2024-06-05+gba9ed5b2-0.6
+libfdisk1=2.41.5-0+deb13u1
+libfdt1=1.7.2-2+b1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfile-chdir-perl=0.1008-1.2
+libfile-listing-perl=6.16-1
+libfile-readbackwards-perl=1.06-2
+libfilesys-df-perl=0.92-7+b4
+libflac14=1.5.0+ds-2
+libfontconfig1=2.15.0-2.3
+libfreetype6=2.13.3+dfsg-1+deb13u1
+libfribidi0=1.0.16-1
+libfstrm0=0.6.1-1+b3
+libfuse2t64=2.9.9-9
+libfuse3-4=3.17.2-3
+libgbm1=25.0.7-2+deb13u1
+libgcc-s1=14.2.0-19
+libgcrypt20=1.11.0-7+deb13u1
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libglib2.0-0t64=2.84.4-3~deb13u5
+libgmp10=2:6.3.0+dfsg-3
+libgnutls-dane0t64=3.8.9-3+deb13u4
+libgnutls30t64=3.8.9-3+deb13u4
+libgoogle-perftools4t64=2.16-1
+libgpg-error0=1.51-4
+libgpgme11t64=1.24.2-3
+libgprofng0=2.44-3
+libgraphite2-3=1.3.14-2+deb13u1
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libgstreamer-plugins-base1.0-0=1.26.2-1+deb13u2
+libgstreamer1.0-0=1.26.2-2
+libharfbuzz0b=10.2.0-1+deb13u1
+libhogweed6t64=3.10.1-1
+libhtml-parser-perl=3.83-2~deb13u1
+libhtml-tagset-perl=3.24-1
+libhtml-tree-perl=5.07-3
+libhttp-cookies-perl=6.11-1
+libhttp-daemon-perl=6.16-1+deb13u1
+libhttp-date-perl=6.06-1
+libhttp-message-perl=7.00-2
+libhttp-negotiate-perl=6.01-2
+libibverbs1=56.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libinih1=59-1
+libio-html-perl=1.004-3
+libio-multiplex-perl=1.16-3
+libio-socket-ssl-perl=2.089-1
+libio-stringy-perl=2.113-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libipset13t64=7.22-1+b1
+libiscsi7=1.20.0-4
+libisns0t64=0.101-1+b1
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjpeg62-turbo=1:2.1.5-4
+libjs-bootstrap5=5.3.5+dfsg-4
+libjs-extjs=7.0.0-5
+libjs-qrcodejs=1.20230525-pve1
+libjson-c5=0.18+ds-1
+libjson-glib-1.0-0=1.10.6+ds-2
+libjson-glib-1.0-common=1.10.6+ds-2
+libjson-perl=4.10000-1
+libjson-xs-perl=4.040-1~deb13u1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libklibc=2.0.14-1
+libkmod2=34.2-2
+libknet1t64=1.31-pve1
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+libksba8=1.6.7-2+b1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap2=2.6.10+dfsg-1
+libldb2=2:2.11.0+samba4.22.11+dfsg-0+deb13u1
+liblinear4=2.3.0+dfsg-5+b2
+liblinux-inotify2-perl=1:2.3-2+b3
+libllvm19=1:19.1.7-3+b1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblockfile1=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblttng-ust-common1t64=2.13.9-1
+liblttng-ust-ctl5t64=2.13.9-1
+liblttng-ust1t64=2.13.9-1
+liblua5.3-0=5.3.6-2+b4
+liblua5.4-0=5.4.7-1+b2
+liblvm2cmd2.03=2.03.31-2+pmx1
+liblwp-mediatypes-perl=6.04-2
+liblwp-protocol-https-perl=6.14-1
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+liblzo2-2=2.10-3+b1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmath-random-isaac-perl=1.004-2
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmime-base32-perl=1.303-3
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libmp3lame0=3.100-6+b3
+libmpg123-0t64=1.32.10-1+deb13u1
+libnbd0=1.22.2-1+b1
+libncurses6=6.5+20250216-2
+libncursesw6=6.5+20250216-2
+libnet-dbus-perl=1.2.0-2+b3
+libnet-dns-perl=1.56-0+deb13u1
+libnet-http-perl=6.23-1
+libnet-ip-perl=1.26-4
+libnet-ldap-perl=1:0.6800+dfsg-1
+libnet-ssleay-perl=1.94-3
+libnet-subnet-perl=1.03-2
+libnet1=1.3+dfsg-2
+libnetaddr-ip-perl=4.079+dfsg-2+b5
+libnetfilter-conntrack3=1.1.0-1
+libnetfilter-log1=1.0.2-4+b1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnfsidmap1=1:2.8.3-1
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnl-3-200=3.7.0-2
+libnl-route-3-200=3.7.0-2
+libnozzle1t64=1.31-pve1
+libnpth0t64=1.8-3
+libnsl2=1.3.0-3+b3
+libnspr4=2:4.36-1
+libnss-systemd=257.13-1~deb13u1
+libnss3=2:3.110-1+deb13u4
+libnuma1=2.0.19-1
+libnvpair3linux=2.4.2-pve1
+liboath0t64=2.6.12-1
+libogg0=1.3.5-3+b2
+libopeniscsiusr=2.1.11-1+deb13u2
+libopus0=1.5.2-2
+liborc-0.4-0t64=1:0.4.41-1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpango-1.0-0=1.56.3-1
+libpangocairo-1.0-0=1.56.3-1
+libpangoft2-1.0-0=1.56.3-1
+libpcap0.8t64=1.10.5-2
+libpci3=1:3.13.0-2
+libpciaccess0=0.17-3+b3
+libpcre2-16-0=10.46-1~deb13u3
+libpcre2-8-0=10.46-1~deb13u3
+libpcre2-posix3=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpixman-1-0=0.44.0-3
+libpng16-16t64=1.6.48-1+deb13u6
+libpopt0=1.19+dfsg-2
+libposix-strptime-perl=0.13-2+b4
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libproxmox-acme-perl=1.7.1
+libproxmox-acme-plugins=1.7.1
+libproxmox-backup-qemu0=2.0.2
+libproxmox-rs-perl=0.4.1
+libpsl5t64=0.21.2-1.1+b1
+libpulse0=17.0+dfsg1-2+b1
+libpve-access-control=9.1.1
+libpve-apiclient-perl=3.4.2
+libpve-cluster-api-perl=9.1.5
+libpve-cluster-perl=9.1.5
+libpve-common-perl=9.1.12
+libpve-guest-common-perl=6.0.3
+libpve-http-server-perl=6.0.5
+libpve-network-api-perl=1.6.5
+libpve-network-perl=1.6.5
+libpve-notify-perl=9.1.5
+libpve-rs-perl=0.15.3
+libpve-storage-perl=9.1.5
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libqb-tools=2.0.8-2+b1
+libqb100=2.0.8-2+b1
+libqrencode4=4.1.1-2
+libqt5core5t64=5.15.15+dfsg-6+deb13u1
+libqt5dbus5t64=5.15.15+dfsg-6+deb13u1
+libqt5network5t64=5.15.15+dfsg-6+deb13u1
+libquorum5=3.1.10-pve2
+librabbitmq4=0.15.0-1+deb13u2
+librados2-perl=1.5.0
+librados2=19.2.3-pve4
+libradosstriper1=19.2.3-pve4
+librbd1=19.2.3-pve4
+librdkafka1=2.8.0-1
+librdmacm1t64=56.1-1
+libreadline8t64=8.2-6
+libreiserfscore0t64=1:3.6.27-9
+librgw2=19.2.3-pve4
+librrd8t64=1.7.2-4.2+pve4
+librrds-perl=1.7.2-4.2+pve4
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsensors-config=1:3.6.2-2
+libsensors5=1:3.6.2-2
+libsepol2=3.8.1-1
+libsframe1=2.44-3
+libslang2=2.3.3-5+b2
+libslirp0=4.8.0-1+deb13u1
+libsmartcols1=2.41.5-0+deb13u1
+libsmbclient0=2:4.22.11+dfsg-0+deb13u1
+libsnappy1v5=1.2.2-1
+libsndfile1=1.2.2-2+deb13u1
+libsndio7.0=1.10.0-0.1
+libsocket6-perl=0.29-3+b4
+libspice-server1=0.15.2-1+b1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstatgrab10t64=0.92.1-1.2
+libstdc++6=14.2.0-19
+libstring-shellquote-perl=1.04-3
+libsubid5=1:4.17.4-2
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtalloc2=2:2.4.3+samba4.22.11+dfsg-0+deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtcmalloc-minimal4t64=2.16-1
+libtdb1=2:1.4.13+samba4.22.11+dfsg-0+deb13u1
+libtemplate-perl=2.27-1+b8
+libterm-readline-gnu-perl=1.46-1+b3
+libtevent0t64=2:0.16.2+samba4.22.11+dfsg-0+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libthai-data=0.1.29-2
+libthai0=0.1.29-2+b1
+libthrift-0.19.0t64=0.19.0-4+b1
+libtimedate-perl=2.3300-2
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libtpms0=0.9.7+pve2
+libtry-tiny-perl=0.32-1
+libtypes-serialiser-perl=1.01-1
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunbound8=1.26.1-0+deb13u1
+libunistring5=1.3-2
+libunwind8=1.8.1-0.1
+liburcu8t64=0.15.2-2
+liburi-perl=5.30-1
+liburing2=2.9-1
+libusb-1.0-0=2:1.0.28-1
+libusbredirparser1t64=0.15.0-1
+libuuid-perl=0.37-1
+libuuid1=2.41.5-0+deb13u1
+libuutil3linux=2.4.2-pve1
+libuv1t64=1.50.0-2
+libva-drm2=2.22.0-3
+libva2=2.22.0-3
+libvirglrenderer1=1.1.0-2
+libvorbis0a=1.3.7-3
+libvorbisenc2=1.3.7-3
+libvotequorum8=3.1.10-pve2
+libvulkan1=1.4.309.0-1
+libwayland-server0=1.23.1-3
+libwbclient0=2:4.22.11+dfsg-0+deb13u1
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libwww-perl=6.78-1
+libwww-robotrules-perl=6.02-1
+libx11-6=2:1.8.12-1
+libx11-data=2:1.8.12-1
+libx11-xcb1=2:1.8.12-1
+libxau6=1:1.0.11-1
+libxcb-dri3-0=1.17.0-2+b1
+libxcb-present0=1.17.0-2+b1
+libxcb-randr0=1.17.0-2+b1
+libxcb-render0=1.17.0-2+b1
+libxcb-shm0=1.17.0-2+b1
+libxcb-sync1=1.17.0-2+b1
+libxcb-xfixes0=1.17.0-2+b1
+libxcb1=1.17.0-2+b1
+libxdmcp6=1:1.1.5-1
+libxext6=2:1.3.4-1+b3
+libxkbcommon0=1.7.0-2
+libxml-libxml-perl=2.0207+dfsg+really+2.0134-5+deb13u1
+libxml-namespacesupport-perl=1.12-2
+libxml-parser-perl=2.47-2~deb13u1
+libxml-sax-base-perl=1.09-3
+libxml-sax-perl=1.02+dfsg-4
+libxml-twig-perl=1:3.52-3
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxrender1=1:0.9.12-1
+libxshmfence1=1.3.3-1
+libxslt1.1=1.1.35-1.2+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libyaml-0-2=0.2.5-2
+libyaml-libyaml-perl=0.903.0+ds-1
+libyang3=3.12.2-1
+libz3-4=4.13.3-1
+libzfs7linux=2.4.2-pve1
+libzpool7linux=2.4.2-pve1
+libzstd1=1.5.7+dfsg-1
+linux-base=4.12.1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsof=4.99.4+dfsg-2
+lvm2=2.03.31-2+pmx1
+lxc-pve=7.0.0-2
+lxcfs=7.0.0-pve1
+lzop=1.04-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+memtest86+=7.20-1
+mesa-libgallium=25.0.7-2+deb13u1
+mokutil=0.7.2-1
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netavark=1.14.0-2
+netbase=6.5
+netcat-traditional=1.10-50
+nfs-common=1:2.8.3-1
+nftables=1.1.3-1
+nmap-common=7.95+dfsg-3
+nmap=7.95+dfsg-3
+node-popper2=2.11.2-8
+novnc-pve=1.7.0-1
+numactl=2.0.19-1
+open-iscsi=2.1.11-1+deb13u2
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+pci.ids=0.0~2025.06.09-1
+pciutils=1:3.13.0-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl-openssl-defaults=7+b2
+perl=5.40.1-6+deb13u1
+pinentry-curses=1.3.1-2
+postfix=3.10.13-0+deb13u1
+procmail=3.24+really3.22-4
+procps=2:4.0.4-9
+proxmox-archive-keyring=4.0
+proxmox-backup-client=4.2.0-1
+proxmox-backup-file-restore=4.2.0-1
+proxmox-backup-restore-image=1.0.0
+proxmox-default-kernel=2.1.0
+proxmox-enterprise-support-keyring=1.0
+proxmox-firewall=1.2.3
+proxmox-first-boot=9.2.5
+proxmox-grub=2.12-9+pmx2
+proxmox-kernel-7.0.2-6-pve-signed=7.0.2-6
+proxmox-kernel-7.0=7.0.2-6
+proxmox-kernel-helper=9.1.0+fde2
+proxmox-mail-forward=1.0.3
+proxmox-mini-journalreader=1.6
+proxmox-offline-mirror-docs=0.7.4
+proxmox-offline-mirror-helper=0.7.4
+proxmox-termproxy=2.1.0
+proxmox-ve=9.2.0
+proxmox-websocket-tunnel=1.0.0
+proxmox-widget-toolkit=5.2.2
+psmisc=23.7-2
+pve-cluster=9.1.5
+pve-container=6.1.10
+pve-docs=9.2.1
+pve-edk2-firmware-aarch64=4.2025.05-2
+pve-edk2-firmware-legacy=4.2025.05-2
+pve-edk2-firmware-ovmf=4.2025.05-2
+pve-edk2-firmware=4.2025.05-2
+pve-esxi-import-tools=1.0.1
+pve-firewall=6.0.4
+pve-firmware=3.18-3
+pve-ha-manager=5.2.4
+pve-i18n=3.7.4
+pve-lxc-syscalld=2.0.2
+pve-manager=9.2.2
+pve-nvidia-vgpu-helper=0.3.1
+pve-qemu-kvm=11.0.0-3
+pve-xtermjs=6.0.0-1
+pve-yew-mobile-gui=0.7.0
+pve-yew-mobile-i18n=3.7.4
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-autocommand=2.2.2-3
+python3-bcrypt=4.2.0-2.1+b1
+python3-ceph-argparse=19.2.3-pve4
+python3-ceph-common=19.2.3-pve4
+python3-cephfs=19.2.3-pve4
+python3-certifi=2025.1.31+ds-1
+python3-cffi-backend=1.17.1-3
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-cryptography=43.0.0-3+deb13u1
+python3-dbus=1.4.0-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-importlib-resources=6.5.2-1
+python3-inflect=7.3.1-2
+python3-jaraco.context=6.0.1-1+deb13u1
+python3-jaraco.functools=4.1.0-1
+python3-jaraco.text=4.0.0-1
+python3-minimal=3.13.5-1
+python3-more-itertools=10.7.0-1
+python3-pefile=2024.8.26-2.1
+python3-pkg-resources=78.1.1-0.1
+python3-prettytable=3.15.1-1
+python3-pyvmomi=8.0.3.0.1-1
+python3-rados=19.2.3-pve4
+python3-rbd=19.2.3-pve4
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-rgw=19.2.3-pve4
+python3-setuptools=78.1.1-0.1
+python3-six=1.17.0-1
+python3-systemd=235-1+b6
+python3-typeguard=4.4.2-1
+python3-typing-extensions=4.13.2-1
+python3-urllib3=2.3.0-3+deb13u2
+python3-virt-firmware=24.11-2
+python3-wcwidth=0.2.13+dfsg1-1
+python3-yaml=6.0.2-1+b2
+python3-zipp=3.21.0-1
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+qemu-server=9.1.15
+qrencode=4.1.1-2
+readline-common=8.2-6
+reportbug=13.2.0
+rpcbind=1.2.7-1
+rrdcached=1.7.2-4.2+pve4
+rsync=3.5.0+ds1-0+deb13u1
+runit-helper=2.16.4
+samba-common=2:4.22.11+dfsg-0+deb13u1
+samba-libs=2:4.22.11+dfsg-0+deb13u1
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+shared-mime-info=2.4-5+b2
+shim-helpers-amd64-signed=1+16.1+1+pmx1
+shim-signed-common=1.48+pmx1+16.1-1+pmx1
+shim-signed=1.48+pmx1+16.1-1+pmx1
+shim-unsigned=16.1-1+pmx1
+skopeo=1.18.0+ds1-1+b5
+smartmontools=7.5-pve2
+smbclient=2:4.22.11+dfsg-0+deb13u1
+socat=1.8.0.3-1+deb13u1
+spiceterm=3.4.2
+sqlite3=3.46.1-7+deb13u2
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+strace=6.13+ds-1
+sudo=1.9.16p2-3+deb13u2
+swtpm-libs=0.8.0+pve3
+swtpm-tools=0.8.0+pve3
+swtpm=0.8.0+pve3
+systemd-boot-efi=257.13-1~deb13u1
+systemd-boot-tools=257.13-1~deb13u1
+systemd-sysv=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tailscale-archive-keyring=1.35.181
+tailscale=1.102.2
+tar=1.35+dfsg-3.1
+tcpdump=4.99.5-2
+thin-provisioning-tools=1.1.0-4+b1
+time=1.9-0.2
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+uidmap=1:4.17.4-2
+usbutils=1:018-2
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+virtiofsd=1.13.2-1+deb13u1
+vncterm=1.9.2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wireguard-tools=1.0.20210914-3
+wtmpdb=0.73.0-3+deb13u1
+xfsprogs=6.13.0-2+deb13u1
+xkb-data=2.42-1
+xsltproc=1.1.35-1.2+deb13u3
+xz-utils=5.8.1-1+deb13u1
+zfs-initramfs=2.4.2-pve1
+zfs-zed=2.4.2-pve1
+zfsutils-linux=2.4.2-pve1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1
+zstd=1.5.7+dfsg-1

documentation/audits/night-2026-10-04/baseline/schedule-demo-hp.txt

@@ -0,0 +1,24 @@
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job db-dump scheduled for 2026-10-05 02:30 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job tier2-backup scheduled for 2026-10-05 03:30 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job offbox-backup scheduled for 2026-10-05 04:15 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job offsite-abandon-sweep scheduled for 2026-10-05 05:10 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job offsite-integrity scheduled for 2026-10-05 06:00 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job offsite-proof scheduled for 2026-10-05 05:30 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job metrics-prune scheduled for 2026-10-05 04:00 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job fill-watch scheduled for 2026-10-05 03:30 CEST
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for adventurelog → /mnt/sys_drive/felhom-data/backups/primary/adventurelog (images=3, secrets-referenced=2, data_keys=1, portable-carried=2/2, withheld=0)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for bentopdf → /mnt/sys_drive/felhom-data/backups/primary/bentopdf (images=1, secrets-referenced=0, data_keys=0, portable-carried=0/0, withheld=0)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for bookstack → /mnt/sys_drive/felhom-data/backups/primary/bookstack (images=2, secrets-referenced=3, data_keys=0, portable-carried=2/2, withheld=1)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for calibre-web → /mnt/felhom-drives/hdd_1/backups/primary/calibre-web (images=1, secrets-referenced=2, data_keys=0, portable-carried=1/1, withheld=1)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for docmost → /mnt/sys_drive/felhom-data/backups/primary/docmost (images=3, secrets-referenced=2, data_keys=0, portable-carried=2/2, withheld=0)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for kimai → /mnt/sys_drive/felhom-data/backups/primary/kimai (images=2, secrets-referenced=2, data_keys=0, portable-carried=1/1, withheld=1)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for opengist → /mnt/sys_drive/felhom-data/backups/primary/opengist (images=1, secrets-referenced=0, data_keys=0, portable-carried=0/0, withheld=0)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for privatebin → /mnt/sys_drive/felhom-data/backups/primary/privatebin (images=1, secrets-referenced=0, data_keys=0, portable-carried=0/0, withheld=0)
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job db-dump scheduled for 2026-10-05 02:30 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job tier2-backup scheduled for 2026-10-05 03:30 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job offbox-backup scheduled for 2026-10-05 04:15 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job offsite-abandon-sweep scheduled for 2026-10-05 05:10 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job offsite-integrity scheduled for 2026-10-05 06:00 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job offsite-proof scheduled for 2026-10-05 05:30 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job metrics-prune scheduled for 2026-10-05 04:00 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job fill-watch scheduled for 2026-10-05 03:30 CEST

documentation/audits/night-2026-10-04/baseline/schedule-felhom-pve.txt

@@ -0,0 +1,9 @@
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job db-dump scheduled for 2026-10-05 02:30 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job tier2-backup scheduled for 2026-10-05 03:30 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job offbox-backup scheduled for 2026-10-05 04:15 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job offsite-abandon-sweep scheduled for 2026-10-05 05:10 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job offsite-integrity scheduled for 2026-10-05 06:00 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job offsite-proof scheduled for 2026-10-05 05:30 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job metrics-prune scheduled for 2026-10-05 04:00 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job fill-watch scheduled for 2026-10-05 03:30 CEST
+2026/10/04 17:52:26 [INFO] [backup] Recovery unit captured for opengist → /mnt/sys_drive/felhom-data/backups/primary/opengist (images=1, secrets-referenced=0, data_keys=0, portable-carried=0/0, withheld=0)

documentation/audits/night-2026-10-04/baseline/state-demo-hp.txt

@@ -0,0 +1,2 @@
+0.143.0 signed
+guard armed True panic 10

documentation/audits/night-2026-10-04/baseline/state-felhom-pve.txt

@@ -0,0 +1,2 @@
+0.143.0 installer
+guard armed True panic 10

documentation/audits/night-2026-10-04/baseline/system-page-1924Z.html

@@ -0,0 +1,254 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>System — Felhom Hub</title>
+    <link rel="stylesheet" href="/style.css?v=0.133.0">
+    <style>
+        .sys td, .sys th { white-space: nowrap; font-size: 0.82em; vertical-align: top; }
+        .sys .grp { border-left: 2px solid var(--border, #444); }
+        .c-warn { color: var(--warn); font-weight: 600; }
+        .c-bad { color: var(--danger, #e5534b); font-weight: 700; }
+        .sys form { display: inline; }
+        .rel-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(16rem, 1fr)); gap: 0.75rem; }
+    </style>
+</head>
+<body>
+    <svg xmlns="http://www.w3.org/2000/svg" style="display:none" aria-hidden="true">
+<symbol id="i-triangle-alert" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3" /> <path d="M12 9v4" /> <path d="M12 17h.01" /></symbol>
+<symbol id="i-check" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 6 9 17l-5-5" /></symbol>
+<symbol id="i-server" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="20" height="8" x="2" y="2" rx="2" ry="2" /> <rect width="20" height="8" x="2" y="14" rx="2" ry="2" /> <line x1="6" x2="6.01" y1="6" y2="6" /> <line x1="6" x2="6.01" y1="18" y2="18" /></symbol>
+<symbol id="i-settings" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9.671 4.136a2.34 2.34 0 0 1 4.659 0 2.34 2.34 0 0 0 3.319 1.915 2.34 2.34 0 0 1 2.33 4.033 2.34 2.34 0 0 0 0 3.831 2.34 2.34 0 0 1-2.33 4.033 2.34 2.34 0 0 0-3.319 1.915 2.34 2.34 0 0 1-4.659 0 2.34 2.34 0 0 0-3.32-1.915 2.34 2.34 0 0 1-2.33-4.033 2.34 2.34 0 0 0 0-3.831A2.34 2.34 0 0 1 6.35 6.051a2.34 2.34 0 0 0 3.319-1.915" /> <circle cx="12" cy="12" r="3" /></symbol>
+<symbol id="i-x" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 6 6 18" /> <path d="m6 6 12 12" /></symbol>
+<symbol id="i-info" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10" /> <path d="M12 16v-4" /> <path d="M12 8h.01" /></symbol>
+<symbol id="i-hard-drive" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 16h.01" /> <path d="M2.212 11.577a2 2 0 0 0-.212.896V18a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-5.527a2 2 0 0 0-.212-.896L18.55 5.11A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z" /> <path d="M21.946 12.013H2.054" /> <path d="M6 16h.01" /></symbol>
+<symbol id="i-cpu" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 20v2" /> <path d="M12 2v2" /> <path d="M17 20v2" /> <path d="M17 2v2" /> <path d="M2 12h2" /> <path d="M2 17h2" /> <path d="M2 7h2" /> <path d="M20 12h2" /> <path d="M20 17h2" /> <path d="M20 7h2" /> <path d="M7 20v2" /> <path d="M7 2v2" /> <rect x="4" y="4" width="16" height="16" rx="2" /> <rect x="8" y="8" width="8" height="8" rx="1" /></symbol>
+<symbol id="i-clock" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10" /> <path d="M12 6v6l4 2" /></symbol>
+<symbol id="i-boxes" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M2.97 12.92A2 2 0 0 0 2 14.63v3.24a2 2 0 0 0 .97 1.71l3 1.8a2 2 0 0 0 2.06 0L12 19v-5.5l-5-3-4.03 2.42Z" /> <path d="m7 16.5-4.74-2.85" /> <path d="m7 16.5 5-3" /> <path d="M7 16.5v5.17" /> <path d="M12 13.5V19l3.97 2.38a2 2 0 0 0 2.06 0l3-1.8a2 2 0 0 0 .97-1.71v-3.24a2 2 0 0 0-.97-1.71L17 10.5l-5 3Z" /> <path d="m17 16.5-5-3" /> <path d="m17 16.5 4.74-2.85" /> <path d="M17 16.5v5.17" /> <path d="M7.97 4.42A2 2 0 0 0 7 6.13v4.37l5 3 5-3V6.13a2 2 0 0 0-.97-1.71l-3-1.8a2 2 0 0 0-2.06 0l-3 1.8Z" /> <path d="M12 8 7.26 5.15" /> <path d="m12 8 4.74-2.85" /> <path d="M12 13.5V8" /></symbol>
+<symbol id="i-users" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2" /> <path d="M16 3.128a4 4 0 0 1 0 7.744" /> <path d="M22 21v-2a4 4 0 0 0-3-3.87" /> <circle cx="9" cy="7" r="4" /></symbol>
+</svg>
+    
+<script>
+
+
+function felhomConfirm(el,question,onYes){
+    if(!el||el.dataset.fcOpen)return;
+    el.dataset.fcOpen='1';
+    var wrap=document.createElement('span');wrap.className='inline-confirm';
+    var q=document.createElement('span');q.className='inline-confirm-q';q.textContent=question;
+    var yes=document.createElement('button');yes.type='button';yes.className='btn btn-sm btn-danger';yes.textContent='Igen';
+    var no=document.createElement('button');no.type='button';no.className='btn btn-sm btn-outline';no.textContent='Mégse';
+    wrap.appendChild(q);wrap.appendChild(yes);wrap.appendChild(no);
+    el.style.display='none';el.parentNode.insertBefore(wrap,el.nextSibling);
+    function close(){wrap.remove();el.style.display='';delete el.dataset.fcOpen;}
+    no.addEventListener('click',close);
+    yes.addEventListener('click',function(){close();onYes();});
+}
+document.addEventListener('click',function(e){
+    var btn=e.target.closest?e.target.closest('[data-confirm]'):null;
+    if(!btn)return;
+    e.preventDefault();
+    felhomConfirm(btn,btn.getAttribute('data-confirm'),function(){
+        var form=btn.closest('form');
+        if(form){if(form.requestSubmit)form.requestSubmit(btn);else form.submit();}
+    });
+});
+</script>
+
+    <div class="container">
+        <header>
+            <h1>Felhom <span>Hub</span></h1>
+            <nav class="nav-links">
+                <a href="/" class="nav-link">Dashboard</a>
+                <a href="/configs" class="nav-link">Customers</a>
+                <a href="/apps" class="nav-link">Apps</a>
+                <a href="/hosts" class="nav-link">Hosts</a>
+                <a href="/system" class="nav-link active">System</a>
+                <a href="/offsite" class="nav-link">Offsite</a>
+                <a href="/configuration" class="nav-link">Configuration</a>
+            </nav>
+        </header>
+
+        <h2 style="margin-bottom: 1rem;">System — versions and OS updates</h2>
+
+        
+        
+
+        <section class="card" style="margin-bottom: 1.5rem;">
+            <h3 style="margin-top: 0;">Approved releases</h3>
+            <div class="rel-grid">
+                
+                <div><strong>docker</strong>: <code>os-docker-20261004-142842</code><br>
+                    <span class="text-muted">6 packages · 2026-10-04 14:28 UTC · by operator</span>
+                    </div>
+                
+            </div>
+            
+            <h3>Cancelled approvals (last 7 days)</h3>
+            <div class="rel-grid">
+                
+                <div><strong>host</strong>: <code>os-host-20261004-124133</code><br>
+                    <span class="c-warn">cancelled 2026-10-04 18:20:02 UTC — a TEST approval</span><br>
+                    <span class="text-muted">no further box installs it; boxes that installed it keep it</span></div>
+                
+                <div><strong>host</strong>: <code>os-host-20261004-124034</code><br>
+                    <span class="c-warn">cancelled 2026-10-04 18:20:02 UTC — a TEST approval</span><br>
+                    <span class="text-muted">no further box installs it; boxes that installed it keep it</span></div>
+                
+                <div><strong>guest</strong>: <code>os-guest-20261004-123933</code><br>
+                    <span class="c-warn">cancelled 2026-10-04 18:20:02 UTC — a TEST approval</span><br>
+                    <span class="text-muted">no further box installs it; boxes that installed it keep it</span></div>
+                
+                <div><strong>guest</strong>: <code>os-20261004-091417</code><br>
+                    <span class="c-warn">cancelled 2026-10-04 18:20:02 UTC — a TEST approval</span><br>
+                    <span class="text-muted">no further box installs it; boxes that installed it keep it</span></div>
+                
+            </div>
+            
+            <h3>What ring 0 runs now</h3>
+            <div class="rel-grid">
+                
+                <div><strong>guest</strong>:
+                    272 packages, first seen 2026-10-04 11:07 UTC<br>
+                    <span class="text-muted">healthy for 8h17m0s of 24h0m0s</span>
+                    
+                </div>
+                
+                <div><strong>host</strong>:
+                    607 packages, first seen 2026-10-04 12:24 UTC<br>
+                    <span class="text-muted">healthy for 7h0m0s of 24h0m0s</span>
+                    
+                </div>
+                
+                <div><strong>docker</strong>:
+                    6 packages, first seen 2026-10-04 14:28 UTC<br>
+                    <span class="text-muted">approved as os-docker-20261004-142842</span>
+                    
+                    
+                </div>
+                
+            </div>
+            <form method="POST" action="/os/approve-now" style="margin-top: 0.8rem;">
+                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                <button type="submit" class="btn btn-sm btn-danger" data-confirm="Approve the guest and host sets ring 0 runs NOW, without the 24 h + 1 night wait? Every ring-1 box installs them at its next night run.">Approve now (guest + host)</button>
+                <span class="text-muted" style="font-size: 0.85em;">An urgent fix only — normally the hub approves after 24 h and one night.</span>
+            </form>
+        </section>
+
+        
+        <section class="card" style="padding: 0; overflow-x: auto;">
+            <table class="data-table sys">
+                <thead>
+                    <tr>
+                        <th>Box</th><th>Ring / updates</th><th>Tunnel</th>
+                        <th class="grp">Proxmox</th><th>Kernel (running)</th><th>Kernel (next boot)</th><th>Debian</th><th>Felhom release</th><th>Pending</th><th>Not covered</th><th>Held</th><th>Reboot needed</th><th>kernel.panic</th><th>Oops</th><th>Crash restarts 24 h</th><th>Crash guard</th><th title="The root-owned config bundle: sudoers, wrappers, units (R-840)">Root files</th>
+                        <th class="grp">Guest Debian</th><th>Felhom release</th><th>Pending</th><th>Restart needed</th>
+                        <th class="grp">Docker</th><th>containerd</th><th>live-restore</th><th>Docker release</th>
+                        <th class="grp">Last OS leg</th>
+                    </tr>
+                    <tr class="text-muted"><th></th><th></th><th></th><th class="grp" colspan="14">host</th><th class="grp" colspan="4">guest</th><th class="grp" colspan="4">Docker engine</th><th class="grp"></th></tr>
+                </thead>
+                <tbody>
+                    
+                    <tr>
+                        <td><a href="/hosts/Tester-2-be8404">Tester-2-be8404</a><br><span class="text-muted">Tester 2</span>
+                            </td>
+                        <td>
+                            ring 1
+                            <form method="POST" action="/os/ring/Tester-2-be8404">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="ring" value="0"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Make Tester-2-be8404 a DEMO (ring 0) box? It then installs every new fix first and takes unsigned Docker steps if its root-owned ring-0 mark allows.">→ demo</button>
+                            </form><br>
+                            updates <strong>ON</strong>
+                            <form method="POST" action="/os/enabled/Tester-2-be8404">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="on" value="0"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Switch OS updates OFF for Tester-2-be8404? It keeps reporting and installs nothing.">switch off</button>
+                                
+                            </form>
+                        </td>
+                        <td>running</td>
+                        <td class="grp ">9.2.2</td>
+                        <td>7.0.2-6-pve</td><td>7.0.2-6-pve</td><td>13.7</td>
+                        <td>os-host-20261004-124133</td><td>78</td><td>0</td>
+                        <td>none</td><td class="c-warn">since 2026-10-04</td><td>10 s</td><td>no</td>
+                        <td>0</td><td>armed</td><td class="c-warn" title="the box could not read it (agent older than v0.142.0, or the guest is down)">unknown</td>
+                        <td class="grp ">13.7</td>
+                        <td>os-guest-20261004-123933</td><td>0</td><td>7</td>
+                        <td class="grp ">29.8.2</td>
+                        <td>2.3.6-1~debian.13~trixie</td><td>on</td><td>—</td>
+                        <td class="grp " title="last successful leg: 2 h ago">2 h ago · applied · 44 s</td>
+                    </tr>
+                    
+                    <tr>
+                        <td><a href="/hosts/demo-felhom-8363b5">demo-felhom-8363b5</a><br><span class="text-muted">Demo Ügyfél</span>
+                            </td>
+                        <td>
+                            ring 0
+                            <form method="POST" action="/os/ring/demo-felhom-8363b5">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="ring" value="1"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Make demo-felhom-8363b5 a normal (ring 1) box? It then installs only approved releases.">→ normal</button>
+                                
+                            </form><br>
+                            updates <strong>ON</strong>
+                            <form method="POST" action="/os/enabled/demo-felhom-8363b5">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="on" value="0"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Switch OS updates OFF for demo-felhom-8363b5? It keeps reporting and installs nothing.">switch off</button>
+                                
+                            </form>
+                        </td>
+                        <td>running</td>
+                        <td class="grp ">9.2.2</td>
+                        <td>7.0.2-6-pve</td><td>7.0.2-6-pve</td><td>13.7</td>
+                        <td>os-host-20261004-124133</td><td>80</td><td>0</td>
+                        <td>none</td><td class="c-warn">since 2026-10-04</td><td>10 s</td><td>no</td>
+                        <td>0</td><td>armed</td><td>0.143.0</td>
+                        <td class="grp ">13.7</td>
+                        <td>os-guest-20261004-123933</td><td>0</td><td>10</td>
+                        <td class="grp ">29.8.2</td>
+                        <td>2.3.6-1~debian.13~trixie</td><td>on</td><td>os-docker-20261004-142842</td>
+                        <td class="grp " title="last successful leg: 4 h ago">4 h ago · nothing · 12 s</td>
+                    </tr>
+                    
+                    <tr>
+                        <td><a href="/hosts/demo-hp-bb76ea">demo-hp-bb76ea</a><br><span class="text-muted">Demo HP</span>
+                            </td>
+                        <td>
+                            ring 0
+                            <form method="POST" action="/os/ring/demo-hp-bb76ea">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="ring" value="1"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Make demo-hp-bb76ea a normal (ring 1) box? It then installs only approved releases.">→ normal</button>
+                                
+                            </form><br>
+                            updates <strong>ON</strong>
+                            <form method="POST" action="/os/enabled/demo-hp-bb76ea">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="on" value="0"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Switch OS updates OFF for demo-hp-bb76ea? It keeps reporting and installs nothing.">switch off</button>
+                                
+                            </form>
+                        </td>
+                        <td>running</td>
+                        <td class="grp ">9.2.2</td>
+                        <td>7.0.14-20-pve</td><td>7.0.14-20-pve</td><td>13.7</td>
+                        <td>ring0-20261004T144238Z</td><td>78</td><td>0</td>
+                        <td>none</td><td>no</td><td>10 s</td><td>no</td>
+                        <td class="c-warn">3</td><td>armed</td><td>0.143.0</td>
+                        <td class="grp ">13.7</td>
+                        <td>ring0-20261004T144238Z</td><td>6</td><td>1</td>
+                        <td class="grp ">29.8.2</td>
+                        <td>2.3.6-1~debian.13~trixie</td><td>on</td><td>r858-proof-forward</td>
+                        <td class="grp " title="last successful leg: 4 h ago">2 h ago · applied · 69 s</td>
+                    </tr>
+                    
+                </tbody>
+            </table>
+        </section>
+        <p class="text-muted" style="font-size: 0.85em;">Amber: worth a look. Red: an operator alarm fires (`08` §6.3). "unknown": the box could not read the value — never a guess.</p>
+        
+
+        <footer style="margin-top: 2rem; color: var(--text-muted); font-size: 0.8rem; text-align: center;">
+            Felhom Hub <span style="font-family: var(--font-mono)">0.133.0</span>
+        </footer>
+    </div>
+</body>
+</html>

documentation/audits/night-2026-10-04/baseline/system-page.txt

@@ -0,0 +1,96 @@
+ 
+ System — Felhom Hub 
+ Felhom Hub 
+ Dashboard 
+ Customers 
+ Apps 
+ Hosts 
+ System 
+ Offsite 
+ Configuration 
+ System — versions and OS updates 
+ Approved releases 
+ docker : os-docker-20261004-142842 
+ 6 packages · 2026-10-04 14:28 UTC · by operator 
+ Cancelled approvals (last 7 days) 
+ host : os-host-20261004-124133 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ host : os-host-20261004-124034 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ guest : os-guest-20261004-123933 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ guest : os-20261004-091417 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ What ring 0 runs now 
+ guest :
+ 272 packages, first seen 2026-10-04 11:07 UTC 
+ healthy for 8h17m0s of 24h0m0s 
+ host :
+ 607 packages, first seen 2026-10-04 12:24 UTC 
+ healthy for 7h0m0s of 24h0m0s 
+ docker :
+ 6 packages, first seen 2026-10-04 14:28 UTC 
+ approved as os-docker-20261004-142842 
+ Approve now (guest + host) 
+ An urgent fix only — normally the hub approves after 24 h and one night. 
+ Box Ring / updates Tunnel 
+ Proxmox Kernel (running) Kernel (next boot) Debian Felhom release Pending Not covered Held Reboot needed kernel.panic Oops Crash restarts 24 h Crash guard Root files 
+ Guest Debian Felhom release Pending Restart needed 
+ Docker containerd live-restore Docker release 
+ Last OS leg 
+ host guest Docker engine 
+ Tester-2-be8404 Tester 2 
+ ring 1
+ → demo 
+ updates ON 
+ switch off 
+ running 
+ 9.2.2 
+ 7.0.2-6-pve 7.0.2-6-pve 13.7 
+ os-host-20261004-124133 78 0 
+ none since 2026-10-04 10 s no 
+ 0 armed unknown 
+ 13.7 
+ os-guest-20261004-123933 0 7 
+ 29.8.2 
+ 2.3.6-1~debian.13~trixie on — 
+ 2 h ago · applied · 44 s 
+ demo-felhom-8363b5 Demo Ügyfél 
+ ring 0
+ → normal 
+ updates ON 
+ switch off 
+ running 
+ 9.2.2 
+ 7.0.2-6-pve 7.0.2-6-pve 13.7 
+ os-host-20261004-124133 80 0 
+ none since 2026-10-04 10 s no 
+ 0 armed 0.143.0 
+ 13.7 
+ os-guest-20261004-123933 0 10 
+ 29.8.2 
+ 2.3.6-1~debian.13~trixie on os-docker-20261004-142842 
+ 4 h ago · nothing · 12 s 
+ demo-hp-bb76ea Demo HP 
+ ring 0
+ → normal 
+ updates ON 
+ switch off 
+ running 
+ 9.2.2 
+ 7.0.14-20-pve 7.0.14-20-pve 13.7 
+ ring0-20261004T144238Z 78 0 
+ none no 10 s no 
+ 3 armed 0.143.0 
+ 13.7 
+ ring0-20261004T144238Z 6 1 
+ 29.8.2 
+ 2.3.6-1~debian.13~trixie on r858-proof-forward 
+ 2 h ago · applied · 69 s 
+ Amber: worth a look. Red: an operator alarm fires (`08` §6.3). "unknown": the box could not read the value — never a guess. 
+ Felhom Hub 0.133.0 
+ 

documentation/audits/night-2026-10-04/final-state.txt

@@ -0,0 +1,6 @@
+03:19:45
+ Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 -- demo-felhom-8363b5 Demo Ügyfél 0.143.0 9.2.2 7.0.2-6-pve ONLINE 1/2 -- demo-hp-bb76ea Demo HP 0.143.0 9.2.2 7.0.14-20-pve ONLINE 1/2 -- tester-1-d70be4 Tester 1 0.143.0 9.2.2 7.0.2-6-pve ONLINE 1/1 
+demo-hp: 0 not-healthy of 21 containers; guard 10
+felhom-pve: 0 not-healthy of 5 containers; guard 10
+9202: 6 containers, controller Up 9 hours (healthy)
+tester1: 9 healthy containers

documentation/audits/night-2026-10-04/night/n1-demo-hp-0030-0140.txt

@@ -0,0 +1,12 @@
+2026/10/05 00:30:00 scheduler.go:346: [INFO] [scheduler] Running job: db-dump
+2026/10/05 00:31:29 scheduler.go:363: [INFO] [scheduler] Job db-dump completed (took 1m29.61s)
+2026/10/05 01:30:00 scheduler.go:346: [INFO] [scheduler] Running job: tier2-backup
+2026/10/05 01:30:00 scheduler.go:346: [INFO] [scheduler] Running job: fill-watch
+2026/10/05 01:30:00 fillwatch.go:267: [INFO] [fillwatch] checked 3 filesystem(s), 0 unreadable/skipped, 0 notification(s); bands: all ok
+2026/10/05 01:30:00 scheduler.go:363: [INFO] [scheduler] Job fill-watch completed (took 0s)
+2026/10/05 01:30:01 tier2.go:425: [INFO] [backup] Tier 2 copied adventurelog → /mnt/felhom-drives/hdd_1/backups/secondary/adventurelog (336.4 MB, 0 leg(s), 2s)
+2026/10/05 01:30:01 tier2.go:425: [INFO] [backup] Tier 2 copied bentopdf → /mnt/felhom-drives/hdd_1/backups/secondary/bentopdf (13.6 KB, 0 leg(s), 0s)
+2026/10/05 01:30:02 tier2.go:425: [INFO] [backup] Tier 2 copied bookstack → /mnt/felhom-drives/hdd_1/backups/secondary/bookstack (159.4 MB, 0 leg(s), 1s)
+2026/10/05 01:30:02 tier2.go:425: [INFO] [backup] Tier 2 copied calibre-web → /mnt/sys_drive/felhom-data/backups/secondary/calibre-web (5.6 MB, 1 leg(s), 0s) [SSD: state-only]
+2026/10/05 01:30:02 tier2.go:425: [INFO] [backup] Tier 2 copied docmost → /mnt/felhom-drives/hdd_1/backups/secondary/docmost (83.5 MB, 0 leg(s), 0s)
+2026/10/05 01:30:03 tier2.go:425: [INFO] [backup] Tier 2 copied kimai → /mnt/felhom-drives/hdd_1/backups/secondary/kimai (173.0 MB, 0 leg(s), 1s)

documentation/audits/night-2026-10-04/night/n1-felhom-pve-0030-0140.txt

@@ -0,0 +1,9 @@
+2026/10/05 00:30:00 [INFO] [scheduler] Running job: db-dump
+2026/10/05 00:30:00 [INFO] [scheduler] Job db-dump completed (took 998ms)
+2026/10/05 01:30:00 [INFO] [scheduler] Running job: tier2-backup
+2026/10/05 01:30:00 [INFO] [scheduler] Running job: fill-watch
+2026/10/05 01:30:00 [INFO] [fillwatch] checked 2 filesystem(s), 0 unreadable/skipped, 0 notification(s); bands: all ok
+2026/10/05 01:30:00 [INFO] [scheduler] Job fill-watch completed (took 0s)
+2026/10/05 01:30:00 [INFO] [backup] Tier 2 for opengist: no off-drive target — nincs másik fizikai meghajtó — a 2. mentéshez 2. meghajtó szükséges
+2026/10/05 01:30:00 [INFO] [backup] Tier 2 run complete: 1 app(s) processed (incl. volume-only — F6)
+2026/10/05 01:30:00 [INFO] [scheduler] Job tier2-backup completed (took 6ms)

documentation/audits/night-2026-10-04/night/n1-tester1-0030-0140.txt

@@ -0,0 +1,9 @@
+2026/10/05 00:30:00 [INFO] [scheduler] Running job: db-dump
+2026/10/05 00:30:39 [INFO] [scheduler] Job db-dump completed (took 39.504s)
+2026/10/05 01:30:00 [INFO] [fillwatch] checked 3 filesystem(s), 0 unreadable/skipped, 0 notification(s); bands: all ok
+2026/10/05 01:30:00 [INFO] [scheduler] Running job: tier2-backup
+2026/10/05 01:30:00 [INFO] [backup] Tier 2 copied bookstack → /mnt/felhom-drives/adatlemez/backups/secondary/bookstack (154.2 MB, 0 leg(s), 1s)
+2026/10/05 01:30:00 [INFO] [backup] Tier 2 copied paperless-ngx → /mnt/sys_drive/felhom-data/backups/secondary/paperless-ngx (69.8 MB, 1 leg(s), 0s) [SSD: state-only]
+2026/10/05 01:30:01 [INFO] [backup] Tier 2 copied privatebin → /mnt/felhom-drives/adatlemez/backups/secondary/privatebin (28.3 KB, 0 leg(s), 0s)
+2026/10/05 01:30:01 [INFO] [backup] Tier 2 run complete: 3 app(s) processed (incl. volume-only — F6)
+2026/10/05 01:30:01 [INFO] [scheduler] Job tier2-backup completed (took 1.303s)

documentation/audits/night-2026-10-04/night/n2-demo-hp-offsite.txt

@@ -0,0 +1,34 @@
+2026/10/05 02:14:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:14:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:15:00 scheduler.go:346: [INFO] [scheduler] Running job: offbox-backup
+2026/10/05 02:15:00 offbox.go:1001: [INFO] [offbox] backup run started (9 app(s) toggled)
+2026/10/05 02:16:20 offbox.go:1048: [INFO] [offbox] pre-push dump leg completed in 1m20.405s — snapshot pair is coherent
+2026/10/05 02:16:27 offbox.go:1479: [INFO] [offbox] backed up opengist (/mnt/sys_drive/felhom-data/backups/primary/opengist, 0 mandatory path(s))
+2026/10/05 02:16:28 offbox.go:1479: [INFO] [offbox] backed up privatebin (/mnt/sys_drive/felhom-data/backups/primary/privatebin, 0 mandatory path(s))
+2026/10/05 02:16:30 offbox.go:1479: [INFO] [offbox] backed up romm (/mnt/felhom-drives/hdd_1/backups/primary/romm, 0 mandatory path(s))
+2026/10/05 02:16:33 offbox.go:1479: [INFO] [offbox] backed up bookstack (/mnt/sys_drive/felhom-data/backups/primary/bookstack, 0 mandatory path(s))
+2026/10/05 02:16:35 offbox.go:1479: [INFO] [offbox] backed up docmost (/mnt/sys_drive/felhom-data/backups/primary/docmost, 0 mandatory path(s))
+2026/10/05 02:16:38 offbox.go:1479: [INFO] [offbox] backed up kimai (/mnt/sys_drive/felhom-data/backups/primary/kimai, 0 mandatory path(s))
+2026/10/05 02:16:44 offbox.go:1476: [WARN] [offbox] backed up bentopdf (/mnt/sys_drive/felhom-data/backups/primary/bentopdf, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it
+2026/10/05 02:16:46 offbox.go:1479: [INFO] [offbox] backed up calibre-web (/mnt/felhom-drives/hdd_1/backups/primary/calibre-web, 1 mandatory path(s))
+2026/10/05 02:16:48 offbox_window.go:206: [INFO] [offbox] retention skipped (after-run): no clean-up window now (not due (last window 2026-10-04T05:36:14Z)) — nothing deleted (decision 68)
+2026/10/05 02:16:53 offbox.go:1244: [INFO] [offbox] backup OK: 9 app(s) backed up, 136 snapshot(s), 1m48s
+2026/10/05 02:16:53 unattended.go:270: [INFO] [update-leg] started (after-offsite): window 02:30, no step starts at or after 07:30
+2026/10/05 02:16:53 unattended.go:248: [INFO] [update-leg] update leg (after-offsite): done=0 undone=0 held=0 failed=0 skipped=1 in 0s [skipped: romm=held]
+2026/10/05 02:16:53 scheduler.go:363: [INFO] [scheduler] Job offbox-backup completed (took 1m53.096s)
+2026/10/05 02:19:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:19:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:24:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:24:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:29:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:29:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:34:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:34:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:39:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:39:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 1ms)
+2026/10/05 02:44:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:44:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:49:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:49:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:54:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:54:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)

documentation/audits/night-2026-10-04/night/n2-felhom-pve-offsite.txt

@@ -0,0 +1,27 @@
+2026/10/05 02:12:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:12:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:15:00 [INFO] [scheduler] Running job: offbox-backup
+2026/10/05 02:15:00 [INFO] [offbox] backup run started (1 app(s) toggled)
+2026/10/05 02:15:00 [INFO] [offbox] pre-push dump leg completed in 894ms — snapshot pair is coherent
+2026/10/05 02:15:05 [INFO] [offbox] backed up opengist (/mnt/sys_drive/felhom-data/backups/primary/opengist, 0 mandatory path(s))
+2026/10/05 02:15:10 [ERROR] [offbox] clean-up window 3: the fake-snapshot guard REFUSED — nothing deleted: the policy would remove snapshot 343d57a5 from 2026-09-28T02:15:05Z — younger than 8 days and not superseded the same day, which honest retention never does (R-822)
+2026/10/05 02:15:15 [INFO] [offbox] backup OK: 1 app(s) backed up, 15 snapshot(s), 12s
+2026/10/05 02:15:15 [INFO] [update-leg] started (after-offsite): window 02:30, no step starts at or after 07:30
+2026/10/05 02:15:15 [INFO] [update-leg] update leg (after-offsite): done=0 undone=0 held=0 failed=0 skipped=0 in 0s [skipped: ]
+2026/10/05 02:15:15 [INFO] [scheduler] Job offbox-backup completed (took 15.079s)
+2026/10/05 02:17:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:17:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:22:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:22:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:27:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:27:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:32:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:32:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:37:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:37:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:42:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:42:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:47:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:47:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:52:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:52:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)

documentation/audits/night-2026-10-04/night/n2-tester1-offsite.txt

@@ -0,0 +1,23 @@
+2026/10/05 02:12:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:12:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:15:00 [INFO] [scheduler] Running job: offbox-backup
+2026/10/05 02:15:00 [INFO] [offbox] skipped — pending key escrow (no offsite run until the repo password is escrowed under R)
+2026/10/05 02:15:00 [INFO] [update-leg] started (after-offsite): window 02:30, no step starts at or after 07:30
+2026/10/05 02:15:00 [INFO] [update-leg] update leg (after-offsite): done=0 undone=0 held=0 failed=0 skipped=0 in 0s [skipped: ]
+2026/10/05 02:15:00 [INFO] [scheduler] Job offbox-backup completed (took 107ms)
+2026/10/05 02:17:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:17:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:22:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:22:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:27:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:27:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:32:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:32:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:37:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:37:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:42:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:42:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:47:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:47:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:52:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:52:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)

documentation/audits/night-2026-10-04/night/n3-demo-hp-wholeguest-osleg.txt

@@ -0,0 +1,32 @@
+Oct 05 04:39:24 demo-hp felhom-agent[447632]: time=2026-10-05T04:39:24.344+02:00 level=INFO msg="janitor: stale-lock sweep deferred — a heavy operation is in flight" busy=backup:local
+Oct 05 04:40:16 demo-hp felhom-agent[447632]: time=2026-10-05T04:40:16.647+02:00 level=INFO msg="backup: completed" vmid=9201 target=local archive=local:backup/vzdump-lxc-9201-2026_10_05-04_35_24.tar.zst size_bytes=4882309520 uncovered_volumes=2
+Oct 05 04:40:16 demo-hp felhom-agent[447632]: time=2026-10-05T04:40:16.647+02:00 level=INFO msg="local-api: backup job complete" vmid=9201 target=local job=backup-9201-1791167723831350602 archive=local:backup/vzdump-lxc-9201-2026_10_05-04_35_24.tar.zst
+Oct 05 04:41:46 demo-hp felhom-agent[447632]: time=2026-10-05T04:41:46.648+02:00 level=INFO msg="osupdate: START" run=20261005T024146Z layer=guest vmid=9201 ring=0 trigger=night enabled=true release=ring0-20261005T024146Z
+Oct 05 04:41:47 demo-hp felhom-os-apply[1985513]: os-apply: START release=ring0-20261005T024146Z layer=guest:9201 lane=fast mode=apply select=pending-fast packages=0
+Oct 05 04:41:57 demo-hp felhom-os-apply[1985958]: os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0
+Oct 05 04:41:57 demo-hp felhom-os-apply[1985959]: os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)
+Oct 05 04:42:04 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:04.983+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: START release=ring0-20261005T024146Z layer=guest:9201 lane=fast mode=apply select=pending-fast packages=0"
+Oct 05 04:42:04 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:04.983+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0"
+Oct 05 04:42:04 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:04.983+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)"
+Oct 05 04:42:04 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:04.983+02:00 level=INFO msg="osupdate: DONE" run=20261005T024146Z layer=guest vmid=9201 ring=0 trigger=night outcome=nothing healthy=true reason="" upgraded=0 pending=0 not_covered=0 restart_n
+Oct 05 04:42:05 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:05.036+02:00 level=INFO msg="osupdate: START" run=20261005T024146Z layer=host vmid=9201 ring=0 trigger=night enabled=true release=ring0-20261005T024146Z
+Oct 05 04:42:06 demo-hp felhom-os-apply[1986777]: os-apply: START release=ring0-20261005T024146Z layer=host lane=fast mode=apply select=pending-fast packages=0
+Oct 05 04:42:14 demo-hp felhom-os-apply[1987237]: os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0
+Oct 05 04:42:14 demo-hp felhom-os-apply[1987238]: os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)
+Oct 05 04:42:22 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:22.500+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: START release=ring0-20261005T024146Z layer=host lane=fast mode=apply select=pending-fast packages=0"
+Oct 05 04:42:22 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:22.500+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0"
+Oct 05 04:42:22 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:22.500+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)"
+Oct 05 04:42:23 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:23.580+02:00 level=INFO msg="osupdate: DONE" run=20261005T024146Z layer=host vmid=9201 ring=0 trigger=night outcome=nothing healthy=true reason="" upgraded=0 pending=78 not_covered=78 restart_
+Oct 05 04:42:25 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:25.734+02:00 level=INFO msg="osupdate: START" run=20261005T024146Z layer=docker vmid=9201 ring=0 trigger=night enabled=true release=ring0-20261005T024146Z
+Oct 05 04:42:27 demo-hp felhom-os-apply[1988603]: os-apply: START release=ring0-20261005T024146Z layer=docker:9201 lane=slow mode=apply select=pending-docker packages=0 authority=ring0
+Oct 05 04:42:37 demo-hp felhom-os-apply[1989188]: os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0
+Oct 05 04:42:37 demo-hp felhom-os-apply[1989189]: os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)
+Oct 05 04:42:46 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:46.151+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: START release=ring0-20261005T024146Z layer=docker:9201 lane=slow mode=apply select=pending-docker packages=0 authority=ring0"
+Oct 05 04:42:46 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:46.151+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0"
+Oct 05 04:42:46 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:46.151+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)"
+Oct 05 04:42:46 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:46.152+02:00 level=INFO msg="osupdate: DONE" run=20261005T024146Z layer=docker vmid=9201 ring=0 trigger=night outcome=nothing healthy=true reason="" upgraded=0 pending=0 not_covered=0 restart_
+2026/10/05 02:35:02 quiesce.go:505: [INFO] [quiesce] backup due on 1 tier(s) — quiescing 9 stack(s): [adventurelog bentopdf bookstack calibre-web docmost kimai opengist paperless-ngx privatebin]
+2026/10/05 02:35:23 quiesce.go:554: [INFO] [quiesce] tier local: backup job backup-9201-1791167723831350602 started — polling
+2026/10/05 02:35:33 quiesce.go:623: [INFO] [quiesce] tier local: job backup-9201-1791167723831350602 snapshotted — resuming app early (8B.2)
+2026/10/05 02:35:33 quiesce.go:492: [INFO] [quiesce] unquiescing (snapshotted (early resume, last tier)): restarting 9 stack(s)
+2026/10/05 02:40:21 quiesce.go:628: [INFO] [quiesce] tier local: backup job backup-9201-1791167723831350602 done

documentation/audits/night-2026-10-04/night/n4-demo-felhom-prune-guard.txt

@@ -0,0 +1,2 @@
+2026/10/05 02:15:10 [ERROR] [offbox] clean-up window 3: the fake-snapshot guard REFUSED — nothing deleted: the policy would remove snapshot 343d57a5 from 2026-09-28T02:15:05Z — younger than 8 days and not superseded the same day, which honest retention never does (R-822)
+2026/10/05 02:15:15 [INFO] [update-leg] started (after-offsite): window 02:30, no step starts at or after 07:30

documentation/audits/night-2026-10-04/night/n5-notifications-night.txt

@@ -0,0 +1,3 @@
+('demo-felhom', 'offsite_prune_guard_refused', 'sent', 'operator', '', '2026-10-05 02:15:11')
+('demo-felhom', 'offsite_prune_guard_refused', 'skipped', 'customer', 'operator_only', '2026-10-05 02:15:11')
+('tester-1', 'offbox_repo_orphaned', 'sent', 'operator', '', '2026-10-05 03:08:58')

documentation/audits/night-2026-10-04/tester1/t0-operator-selfbind.txt

@@ -0,0 +1,3 @@
+2026-10-04T19:26:07Z
+HTTP/1.1 303 See Other
+Location: /customers/tester-1?flash=selfbind-sent#tab=setup

documentation/audits/night-2026-10-04/tester1/t1-vm-config.txt

@@ -0,0 +1,28 @@
+Formatting '/mnt/hdd_1/images/341/vm-341-disk-0.raw', fmt=raw size=540672 preallocation=off
+transferred 0.0 B of 528.0 KiB (0.00%)
+transferred 528.0 KiB of 528.0 KiB (100.00%)
+transferred 528.0 KiB of 528.0 KiB (100.00%)
+efidisk0: successfully created disk 'nvme-scratch:341/vm-341-disk-0.raw,efitype=4m,pre-enrolled-keys=0,size=528K'
+Formatting '/mnt/hdd_1/images/341/vm-341-disk-1.raw', fmt=raw size=214748364800 preallocation=off
+scsi0: successfully created disk 'nvme-scratch:341/vm-341-disk-1.raw,size=200G'
+Formatting '/mnt/hdd_1/images/341/vm-341-disk-2.raw', fmt=raw size=53687091200 preallocation=off
+scsi1: successfully created disk 'nvme-scratch:341/vm-341-disk-2.raw,size=50G'
+update VM 341: -boot order=ide2;scsi0
+bios: ovmf
+boot: order=ide2;scsi0
+cores: 4
+cpu: host
+efidisk0: nvme-scratch:341/vm-341-disk-0.raw,efitype=4m,pre-enrolled-keys=0,size=528K
+ide2: local:iso/felhom-installer-1.29.0-pve9.2-1.iso,media=cdrom,size=1665356K
+machine: q35
+memory: 8192
+meta: creation-qemu=11.0.0,ctime=1791141969
+name: night1004-tester1
+net0: virtio=BC:24:11:AC:E3:F9,bridge=vmbr0
+ostype: l26
+scsi0: nvme-scratch:341/vm-341-disk-1.raw,size=200G
+scsi1: nvme-scratch:341/vm-341-disk-2.raw,size=50G
+scsihw: virtio-scsi-single
+smbios1: uuid=451c8d94-abf2-46e4-a278-b579a9f315b5
+vga: std
+vmgenid: acdf89db-a810-445c-9d88-7bccd688d3c1

documentation/audits/night-2026-10-04/tester1/t10-install-time-chain.txt

@@ -0,0 +1,7 @@
+Oct 04 21:48:28 felhom felhom-agent[2492]: time=2026-10-04T21:48:28.339+02:00 level=INFO msg="backup: completed" vmid=9201 target=local archive=local:backup/vzdump-lxc-9201-2026_10_04-21_47_12.tar.zst size_bytes=1378818894 uncovered_volumes=2
+Oct 04 21:49:58 felhom felhom-agent[2492]: time=2026-10-04T21:49:58.341+02:00 level=INFO msg="osupdate: START" run=20261004T194958Z layer=guest vmid=9201 ring=1 trigger=night enabled=true release=""
+Oct 04 21:50:19 felhom felhom-agent[2492]: time=2026-10-04T21:50:19.590+02:00 level=INFO msg="osupdate: DONE" run=20261004T194958Z layer=guest vmid=9201 ring=1 trigger=night outcome=nothing healthy=true reason="" upgraded=0 pending=49 not_covered=49 restart_needed=0 reboot_needed=false wrapper_seconds=21.2
+Oct 04 21:50:19 felhom felhom-agent[2492]: time=2026-10-04T21:50:19.629+02:00 level=INFO msg="osupdate: START" run=20261004T194958Z layer=host vmid=9201 ring=1 trigger=night enabled=true release=""
+Oct 04 21:50:36 felhom felhom-agent[2492]: time=2026-10-04T21:50:36.213+02:00 level=INFO msg="osupdate: DONE" run=20261004T194958Z layer=host vmid=9201 ring=1 trigger=night outcome=nothing healthy=true reason="" upgraded=0 pending=185 not_covered=185 restart_needed=0 reboot_needed=false wrapper_seconds=15.5
+Oct 04 21:50:36 felhom felhom-agent[2492]: time=2026-10-04T21:50:36.239+02:00 level=INFO msg="osupdate: docker step skipped — ring 1 takes an engine set only inside a signed operator job (`11` §5.8)" run=20261004T194958Z vmid=9201 trigger=night ring=1 enabled=true
+Oct 04 22:00:05 felhom felhom-agent[2492]: time=2026-10-04T22:00:05.529+02:00 level=INFO msg="backup: completed" vmid=9201 target=felhom-pbs archive=felhom-pbs:backup/ct/9201/2026-10-04T19:57:18Z size_bytes=4913374023 uncovered_volumes=2

documentation/audits/night-2026-10-04/tester1/t11-system-line.txt

@@ -0,0 +1 @@
+ tester-1-d70be4 Tester 1 ring 1 → demo updates ON switch off running 9.2.2 7.0.2-6-pve 7.0.2-6-pve 13.5 — 185 106 none no 10 s no 0 armed 0.143.0 13.6 — 49 0 29.8.2 2.3.6-1~debian.13~trixie on — 18 min ago · nothing · 16 s Amber: worth a look. Red: an operator alarm fires (`08` §6.3). "unknown": the box could not read the value — never a guess. Felhom Hub 0.133.0 

documentation/audits/night-2026-10-04/tester1/t12-box-facts.txt

@@ -0,0 +1,4 @@
+10
+armed True
+live-restore=true engine=29.8.2
+gitea.dooplex.hu/admin/felhom-controller:0.293.0

documentation/audits/night-2026-10-04/tester1/t13-escrow.txt

@@ -0,0 +1,7 @@
+03:07:37
+{"data":{"job_id":"escrow-1791169657458544213","phase":"running"},"error":"","ok":true}
+{'claimable': True, 'detail': '', 'entropy_bits': 129.24070185585344, 'phase': 'done', 'restic_pw_sealed': True, 'uploaded': True}
+03:07:42
+claim ok True keys ['recovery_code'] err 
+escrow_state pending
+escrow_state=escrowed 03:08:15

documentation/audits/night-2026-10-04/tester1/t14-d78-offsite-run.txt

@@ -0,0 +1,14 @@
+2026/10/05 03:08:23 [INFO] [offbox] backup run started (3 app(s) toggled)
+2026/10/05 03:08:56 [INFO] [offbox] pre-push dump leg completed in 32.838s — snapshot pair is coherent
+2026/10/05 03:08:58 [INFO] [offbox] orphaned repo, auto (returning household — this box never made an off-site copy; decision 78) — setting the old copy aside (move-aside + re-init, nothing deleted)
+2026/10/05 03:08:58 [WARN] [offbox] resetting orphaned repo (auto (returning household — this box never made an off-site copy; decision 78)): asking the hub to set /home/felhom-repo aside, then re-init
+2026/10/05 03:08:58 [INFO] Event pushed: offbox_repo_orphaned (warning) [hu-only] — A távoli mentési tároló elárvult: a benne lévő mentések egy korábbi, már nem elérhető kulccsal készültek (újratelepítés). Új mentés a tároló visszaállításáig nem készül.
+2026/10/05 03:08:58 [INFO] [offbox] the hub set the orphaned repo aside: /home/felhom-repo ->  (nothing deleted)
+2026/10/05 03:09:02 [INFO] [offbox] orphaned repo reset complete — old history set aside at /home/felhom-repo.orphaned-20261005 (move-aside, not deleted); fresh repo initialized
+2026/10/05 03:09:02 [INFO] Event pushed: offbox_repo_reset (info) [hu-only] — A távoli mentési tároló visszaállítva: a régi előzmény félretéve (nem törölve), és egy üres, új tároló jött létre a mostani kulccsal.
+2026/10/05 03:09:05 [INFO] [offbox] backed up privatebin (/mnt/sys_drive/felhom-data/backups/primary/privatebin, 0 mandatory path(s))
+2026/10/05 03:09:09 [INFO] [offbox] backed up paperless-ngx (/mnt/felhom-drives/adatlemez/backups/primary/paperless-ngx, 1 mandatory path(s))
+2026/10/05 03:09:12 [INFO] [offbox] backed up bookstack (/mnt/sys_drive/felhom-data/backups/primary/bookstack, 0 mandatory path(s))
+2026/10/05 03:09:16 [INFO] [offbox] clean-up window 4: the policy removes nothing
+2026/10/05 03:09:21 [INFO] [offbox] backup OK: 3 app(s) backed up, 3 snapshot(s), 54s
+2026/10/05 03:09:21 [INFO] [offbox] manual run progress reporting ended after 57s

documentation/audits/night-2026-10-04/tester1/t2-install-pressed.txt

@@ -0,0 +1 @@
+19:31:30

documentation/audits/night-2026-10-04/tester1/t3-firstboot-poweron.txt

@@ -0,0 +1 @@
+19:37:42

documentation/audits/night-2026-10-04/tester1/t4-bind-result.txt

@@ -0,0 +1 @@
+ Felhom — Doboz összekötése Felhom doboz összekötése Sikeres összekötés. A doboz kb. egy percen belül folytatja a telepítést. Ezt az oldalt bezárhatod — a beállítás a háttérben befejeződik, és a vezérlőpultod hamarosan elérhető lesz. Felhom.eu 

documentation/audits/night-2026-10-04/tester1/t5-claim.txt

@@ -0,0 +1,4 @@
+19:42:15
+HTTP/2 302 
+location: /
+launcher 200

documentation/audits/night-2026-10-04/tester1/t6-drive.txt

@@ -0,0 +1,3 @@
+19:44:08
+{"data":{"phase":"formatting","started":true},"ok":true}
+{"data":{"device":"/dev/sdb","durable_id":"","error":"","opsign":"","phase":"done","reason":"","started_at":"2026-10-04T19:44:08.674482321Z","updated_at":"2026-10-04T19:44:10.414201508Z","where":"/mnt/felhom-drives/adatlemez"},"ok":true}

documentation/audits/night-2026-10-04/tester1/t7-deploy.txt

@@ -0,0 +1,18 @@
+19:44:38
+privatebin fields sent: ['DOMAIN', 'SUBDOMAIN'] {"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
+
+HTTP 202
+bookstack fields sent: ['ADMIN_PASSWORD', 'APP_KEY', 'DB_PASSWORD', 'DOMAIN', 'SUBDOMAIN'] {"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
+
+HTTP 202
+paperless-ngx fields sent: ['DB_PASSWORD', 'DOMAIN', 'HDD_PATH', 'PAPERLESS_ADMIN_PASSWORD', 'PAPERLESS_ADMIN_USER', 'PAPERLESS_OCR_LANGUAGE', 'PAPERLESS_SECRET_KEY', 'SUBDOMAIN'] {"ok":false,"error":"path \"/mnt/felhom-drives/adatlemez/appdata/paperless-ngx\" does not exist for field \"Adattárolási útvonal\""}
+
+HTTP 400
+paperless-ngx fields sent: ['DB_PASSWORD', 'DOMAIN', 'HDD_PATH', 'PAPERLESS_ADMIN_PASSWORD', 'PAPERLESS_ADMIN_USER', 'PAPERLESS_OCR_LANGUAGE', 'PAPERLESS_SECRET_KEY', 'SUBDOMAIN'] {"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
+
+HTTP 202
+19:55:59
+bookstack fields sent: ['ADMIN_PASSWORD', 'APP_KEY', 'DB_PASSWORD', 'DOMAIN', 'SUBDOMAIN'] {"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
+
+HTTP 202
+bookstack running True

documentation/audits/night-2026-10-04/tester1/t8-bookstack-failed-image-retention.txt

@@ -0,0 +1,20 @@
+2026/10/04 19:44:39 [INFO] [api] Deploy requested for stack: bookstack
+2026/10/04 19:44:39 [INFO] [stacks] bookstack: install HOLD before the first start — only the household reaches [wiki.enkicsifelhom.hu] until the known first login is replaced
+2026/10/04 19:44:39 [DEBUG] [stacks] SaveAppConfig: saving /opt/docker/stacks/bookstack — 5 env vars, 3 encrypted, 3 sensitive fields
+2026/10/04 19:44:39 [INFO] [stacks] Deploying stack bookstack with 5 env vars: [DOMAIN, SUBDOMAIN, APP_KEY, DB_PASSWORD, ADMIN_PASSWORD]
+2026/10/04 19:44:39 [INFO] [stacks] SaveAppConfig: saved config for bookstack
+2026/10/04 19:44:44 [INFO] [stacks] Stack privatebin deployed successfully (took 5.3s)
+2026/10/04 19:45:04 [INFO] [stacks] image retention (one-time clean-up): deleted [mariadb:<none>] (dfff46ef3f9d, 334MB) — no container, installed app or undo names it (decision 53)
+2026/10/04 19:45:04 [INFO] [stacks] image retention (one-time clean-up): pass over 8 image(s) of [actualbudget/actual-server calcom/cal.com codewithcj/sparkyfitness codewithcj/sparkyfitness_server crocodilestick/calibre-web-automated deluan/navidrome docmost/docmost emby/embyserver f0rc3/gokapi fallenbagel/jellyseerr flomp/wanderer-db flomp/wanderer-web freikin/dawarich getmeili/meilisearch ghcr.io/advplyr/audiobookshelf ghcr.io/alam00000/bentopdf ghcr.io/alexta69/metube ghcr.io/claperco/claper ghcr.io/cmintey/wishlist ghcr.io/diced/zipline ghcr.io/gethomepage/homepage ghcr.io/gramps-project/grampsweb ghcr.io/grimmory-tools/grimmory ghcr.io/home-assistant/home-assistant ghcr.io/immich-app/immich-machine-learning ghcr.io/immich-app/immich-server ghcr.io/immich-app/postgres ghcr.io/karakeep-app/karakeep ghcr.io/karakeep-app/karakeep-chrome ghcr.io/kozea/radicale ghcr.io/lukegus/termix ghcr.io/mealie-recipes/mealie ghcr.io/paperless-ngx/paperless-ngx ghcr.io/papra-hq/papra ghcr.io/seanmorley15/adventurelog-backend ghcr.io/seanmorley15/adventurelog-frontend ghcr.io/sysadminsmedia/homebox ghcr.io/tandoorrecipes/recipes ghcr.io/thomiceli/opengist ghost gitea.dooplex.hu/admin/recipe-importer gitea/gitea glanceapp/glance gotson/komga grafana/grafana jellyfin/jellyfin kimai/kimai2 louislam/uptime-kuma lscr.io/linuxserver/bookstack lscr.io/linuxserver/code-server lscr.io/linuxserver/radarr lscr.io/linuxserver/sonarr lukevella/rallly mariadb msdeluise/plant-it n8nio/n8n nextcloud onlyoffice/documentserver outlinewiki/outline plexinc/pms-docker postgis/postgis postgres privatebin/pdo redis registry.gitlab.com/crafty-controller/crafty-4 rommapp/romm vaultwarden/server vikunja/vikunja wger/server] — 1 candidate(s), 1 deleted, the rest kept
+2026/10/04 19:45:04 [INFO] [stacks] image retention (one-time): deleted 1 image(s). docker disk before: Images 1.364GB 436.4MB (31%) | after: Images 1.031GB 102.6MB (9%)
+2026/10/04 19:45:05 [INFO] [stacks] controller image retention: pass over 1 controller image(s) — running 0.293.0, previous "" (), 0 candidate(s), 0 deleted, the rest kept
+2026/10/04 19:45:05 [ERROR] [stacks] Command failed: docker compose up -d (in /opt/docker/stacks/bookstack) — exit code 1 (took 25.6s)
+2026/10/04 19:45:05 [ERROR] [stacks] stderr: Image lscr.io/linuxserver/bookstack:26.09.1@sha256:99cd1f5707c1911afad213adec5c9739763b76f843d1477142231834ecdcb6f7 Pulling 
+2026/10/04 19:45:05 [ERROR] [stacks] Stack bookstack deploy failed after 25.6s: exit code 1
+stderr: Image lscr.io/linuxserver/bookstack:26.09.1@sha256:99cd1f5707c1911afad213adec5c9739763b76f843d1477142231834ecdcb6f7 Pulling 
+2026/10/04 19:45:05 [INFO] [stacks] Stack bookstack: the failed deploy's containers were removed (volumes kept) — R-649
+2026/10/04 19:45:05 [DEBUG] [stacks] SaveAppConfig: saving /opt/docker/stacks/bookstack — 5 env vars, 3 encrypted, 3 sensitive fields
+2026/10/04 19:45:05 [INFO] [stacks] SaveAppConfig: saved config for bookstack
+stderr: Image lscr.io/linuxserver/bookstack:26.09.1@sha256:99cd1f5707c1911afad213adec5c9739763b76f843d1477142231834ecdcb6f7 Pulling 
+2026/10/04 19:45:24 [INFO] [stacks] bookstack: removed an install-hold file for an app that is not held
+2026/10/04 19:45:36 [INFO] [stacks] Stack paperless-ngx deployed successfully (took 47.3s)

documentation/audits/night-2026-10-04/tester1/t9-data-bookstack.txt

@@ -0,0 +1,2 @@
+book: https://wiki.enkicsifelhom.hu/books/csaladi-receptek
+page: location: https://wiki.enkicsifelhom.hu/books/csaladi-receptek/page/turos-csusza

documentation/audits/night-2026-10-04/tester1/t9-data-paperless.txt

@@ -0,0 +1,2 @@
+upload: "5cb7a425-a645-4822-bbec-d31f3aaea6f9"
+HTTP 200

documentation/audits/night-2026-10-04/tester1/t9-data-privatebin.txt

@@ -0,0 +1 @@
+status 0 id 3f5172ad798b9377 url /?3f5172ad798b9377

documentation/audits/night-2026-10-04/tester2-hourly.txt

@@ -0,0 +1,13 @@
+== 21:12:40 Tester 2
+ Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 21:13:33  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 21:43:34  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 22:13:34  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 22:43:34  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 23:13:42  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 23:28:43  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 23:43:44  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 23:58:44  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 00:13:45  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 03:22:27  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 04:20:28  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 

documentation/audits/night-2026-10-04/undo/u0-before.txt

@@ -0,0 +1,15 @@
+2026-10-04T20:10:41Z
+cores: 3
+hookscript: local:snippets/felhom-guest-hook.sh
+memory: 12288
+mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=250G
+mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
+mp9: /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1
+onboot: 1
+rootfs: local-lvm:vm-9201-disk-0,size=32G
+felhom-backup:backup/vzdump-lxc-9201-2026_10_02-07_45_20.tar.zst tar.zst backup    734719733 9201
+felhom-backup:backup/vzdump-lxc-9201-2026_10_03-07_48_06.tar.zst tar.zst backup    736103026 9201
+felhom-backup:backup/vzdump-lxc-9201-2026_10_04-07_49_00.tar.zst tar.zst backup    735936533 9201
+libpcre2-8-0:amd64	10.46-1~deb13u3
+libssh2-1t64:amd64	1.11.1-1+deb13u2
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u3

documentation/audits/night-2026-10-04/undo/u1-rolled-back.txt

@@ -0,0 +1,11 @@
+local                 dir     active        98497780        28882564        64565668   29.32%
+0 upgraded, 0 newly installed, 3 downgraded, 0 to remove and 0 not upgraded.
+Unpacking libpcre2-8-0:amd64 (10.46-1~deb13u2) over (10.46-1~deb13u3) ...
+Setting up libpcre2-8-0:amd64 (10.46-1~deb13u2) ...
+Unpacking libssh2-1t64:amd64 (1.11.1-1+deb13u1) over (1.11.1-1+deb13u2) ...
+Unpacking libxml2:amd64 (2.12.7+dfsg+really2.9.14-2.1+deb13u1) over (2.12.7+dfsg+really2.9.14-2.1+deb13u3) ...
+Setting up libssh2-1t64:amd64 (1.11.1-1+deb13u1) ...
+Setting up libxml2:amd64 (2.12.7+dfsg+really2.9.14-2.1+deb13u1) ...
+libpcre2-8-0:amd64	10.46-1~deb13u2
+libssh2-1t64:amd64	1.11.1-1+deb13u1
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u1

documentation/audits/night-2026-10-04/undo/u2-backup-before.txt

@@ -0,0 +1,11 @@
+20:11:04
+INFO: Starting Backup of VM 9201 (lxc)
+INFO: including mount point rootfs ('/') in backup
+INFO: including mount point mp0 ('/var/lib/felhom') in backup
+INFO: excluding bind mount point mp8 ('/mnt/felhom-drives') from backup (not a volume)
+INFO: excluding bind mount point mp9 ('/etc/felhom-bootstrap') from backup (not a volume)
+INFO: creating vzdump archive '/var/lib/vz/dump/vzdump-lxc-9201-2026_10_04-22_11_05.tar.zst'
+INFO: archive file size: 899MB
+INFO: Finished Backup of VM 9201 (00:00:31)
+20:11:36
+/var/lib/vz/dump/vzdump-lxc-9201-2026_10_04-22_11_05.log

documentation/audits/night-2026-10-04/undo/u3-debug-pass-forward.txt

@@ -0,0 +1,27 @@
+20:11:43
+=== felhom-agent 0.143.0 selftest=os-update vmid=9201 ring=0 enabled=true guest-release=false host-release=false appliance=true ===
+    "health_reason": "",
+    "healthy": true,
+    "outcome": "applied",
+    "refused": null,
+    "upgraded": [
+        "name": "libpcre2-8-0",
+        "version": "10.46-1~deb13u3",
+        "name": "libssh2-1t64",
+        "version": "1.11.1-1+deb13u2",
+        "name": "libxml2",
+        "version": "2.12.7+dfsg+really2.9.14-2.1+deb13u3",
+    "health_reason": "",
+    "healthy": true,
+    "outcome": "nothing",
+    "refused": null,
+    "upgraded": [],
+    "health_reason": "",
+    "healthy": true,
+    "outcome": "nothing",
+    "refused": null,
+    "upgraded": [],
+20:12:39
+libpcre2-8-0:amd64	10.46-1~deb13u3
+libssh2-1t64:amd64	1.11.1-1+deb13u2
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u3

documentation/audits/night-2026-10-04/undo/u4-restore.txt

@@ -0,0 +1,25 @@
+cloudflared Up 9 hours (healthy)
+felhom-controller Up 2 hours (healthy)
+filebrowser Up 11 hours (healthy)
+opengist Up 14 hours (healthy)
+traefik Up 4 hours
+DOWN-FROM 20:12:54
+stopped 20:13:07
+  Logical volume "vm-9201-disk-2" created.
+  Logical volume pve/vm-9201-disk-2 changed.
+  WARNING: You have not turned on protection against thin pools running out of space.
+  WARNING: Set activation/thin_pool_autoextend_threshold below 100 to trigger automatic extension of thin pools before they get full.
+  Logical volume "vm-9201-disk-3" created.
+  WARNING: Sum of all thin volume sizes (564.00 GiB) exceeds the size of thin pool pve/data and the size of whole volume group (<475.94 GiB).
+  Logical volume pve/vm-9201-disk-3 changed.
+  Logical volume "vm-9201-disk-0" successfully removed.
+  Logical volume "vm-9201-disk-1" successfully removed.
+extracting archive '/var/lib/vz/dump/vzdump-lxc-9201-2026_10_04-22_11_05.tar.zst'
+restored 20:13:23
+hookscript: local:snippets/felhom-guest-hook.sh
+mp0: local-lvm:vm-9201-disk-3,mp=/var/lib/felhom,backup=1,size=250G
+mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
+mp9: /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1
+onboot: 1
+rootfs: local-lvm:vm-9201-disk-2,size=32G
+started 20:13:27

documentation/audits/night-2026-10-04/undo/u5-healthy-and-versions.txt

@@ -0,0 +1,9 @@
+ALL-HEALTHY 20:13:42
+cloudflared Up 11 seconds (healthy)
+felhom-controller Up 10 seconds (healthy)
+filebrowser Up 11 seconds (healthy)
+opengist Up 11 seconds (healthy)
+traefik Up 11 seconds
+libpcre2-8-0:amd64	10.46-1~deb13u2
+libssh2-1t64:amd64	1.11.1-1+deb13u1
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u1

documentation/audits/night-2026-10-04/undo/u6-forward-again.txt

@@ -0,0 +1,11 @@
+20:13:55
+    "healthy": true,
+    "outcome": "applied",
+    "healthy": true,
+    "outcome": "nothing",
+    "healthy": true,
+    "outcome": "nothing",
+libpcre2-8-0:amd64	10.46-1~deb13u3
+libssh2-1t64:amd64	1.11.1-1+deb13u2
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u3
+Oct 04 22:13:10 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:13:10.553+02:00 level=INFO msg="guest-power: guest is stopped but LOCKED — leaving it to the stale-lock path" vmid=9201 lock=create

documentation/audits/night-fixes-2026-10-05/partA/demo-felhom-snapshots-after.json

@@ -0,0 +1,142 @@
+[
+ {
+  "id": "6ea854132efc6053ee5f7ca900a2db6f767dd3d89250efeb52fa30e319598ed1",
+  "short_id": "6ea85413",
+  "time": "2026-08-12T15:15:33.030477238Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "drill-retained-key-20260812"
+  ]
+ },
+ {
+  "id": "b4d7cb79502a6c3f772254bc79463ec726f722f185a1c10571c389516e31746d",
+  "short_id": "b4d7cb79",
+  "time": "2026-08-31T02:15:04.935400697Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "6ce44d9de433625eff342dc0234d526a11336fb9b813aaa49cd737682c07387a",
+  "short_id": "6ce44d9d",
+  "time": "2026-09-20T02:15:05.018256188Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "c7000d7de36008707347c3b6dec9c79166feeae2a517137daa2c47004221e7ef",
+  "short_id": "c7000d7d",
+  "time": "2026-09-27T02:15:05.066652132Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "8ccc027e486d4f2e1b5415e2e602e29e8acbf0001a1596ec08b00c43b148ea68",
+  "short_id": "8ccc027e",
+  "time": "2026-09-29T02:15:05.16680869Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "40826801b49bdb9a249d0d0e7576081d5c96ea2bc7d4503d9a1bce6bfb19cb60",
+  "short_id": "40826801",
+  "time": "2026-09-30T02:15:05.173694815Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "c3a3b13b9832ba3d98cc3dc047b01b376ced2c824506e8f06001d8a3a7c5660e",
+  "short_id": "c3a3b13b",
+  "time": "2026-10-01T02:15:05.016873278Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "b2606da6d28cb24ce8d5c0616ced769b1a7f7b3d0b2923fca23b4364262b7a31",
+  "short_id": "b2606da6",
+  "time": "2026-10-02T02:15:05.138940278Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "64129ff5dcb75ea1ff766605e1a0b4dc36e6a4441a0be9433fe2519e5ddd16e0",
+  "short_id": "64129ff5",
+  "time": "2026-10-03T02:15:05.108133602Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "2bb8fb60447e6387d374d98d196807dd9e32187695ddab5df85ff2a1ac856404",
+  "short_id": "2bb8fb60",
+  "time": "2026-10-03T15:05:39.219021268Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "5dd1f0b99e8ed22d7fdcc9005501e880ddd600341fe35bd6897174acdd943857",
+  "short_id": "5dd1f0b9",
+  "time": "2026-10-03T15:17:27.992813997Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "89df02373ec2ffbe4a6b02d622c30c6f5001b922fc692bb1e1b84dfb0b8d2971",
+  "short_id": "89df0237",
+  "time": "2026-10-04T02:15:03.833138622Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "4e7867af43f024c8f712417bce982c5c8085524b51e7f37040c665d0dc1146de",
+  "short_id": "4e7867af",
+  "time": "2026-10-05T02:15:03.941403075Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "47bad696fe89450b2f5db11bfbc3a958edf2796a60d851dd9d92585eb36d53fc",
+  "short_id": "47bad696",
+  "time": "2026-10-05T05:21:04.032874428Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ }
+]

documentation/audits/night-fixes-2026-10-05/partA/demo-felhom-snapshots-before.json

@@ -0,0 +1,152 @@
+[
+ {
+  "id": "6ea854132efc6053ee5f7ca900a2db6f767dd3d89250efeb52fa30e319598ed1",
+  "short_id": "6ea85413",
+  "time": "2026-08-12T15:15:33.030477238Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "drill-retained-key-20260812"
+  ]
+ },
+ {
+  "id": "b4d7cb79502a6c3f772254bc79463ec726f722f185a1c10571c389516e31746d",
+  "short_id": "b4d7cb79",
+  "time": "2026-08-31T02:15:04.935400697Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "92e49f62c017e103cf7a1f73f8982a7faa39d77eb9c7fd129b3910cc5734a262",
+  "short_id": "92e49f62",
+  "time": "2026-09-13T02:15:05.107149713Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "6ce44d9de433625eff342dc0234d526a11336fb9b813aaa49cd737682c07387a",
+  "short_id": "6ce44d9d",
+  "time": "2026-09-20T02:15:05.018256188Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "c7000d7de36008707347c3b6dec9c79166feeae2a517137daa2c47004221e7ef",
+  "short_id": "c7000d7d",
+  "time": "2026-09-27T02:15:05.066652132Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "343d57a5614f88b80a18b129b52753740c8391581073f406fe9878bf40716381",
+  "short_id": "343d57a5",
+  "time": "2026-09-28T02:15:05.279260454Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "8ccc027e486d4f2e1b5415e2e602e29e8acbf0001a1596ec08b00c43b148ea68",
+  "short_id": "8ccc027e",
+  "time": "2026-09-29T02:15:05.16680869Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "40826801b49bdb9a249d0d0e7576081d5c96ea2bc7d4503d9a1bce6bfb19cb60",
+  "short_id": "40826801",
+  "time": "2026-09-30T02:15:05.173694815Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "c3a3b13b9832ba3d98cc3dc047b01b376ced2c824506e8f06001d8a3a7c5660e",
+  "short_id": "c3a3b13b",
+  "time": "2026-10-01T02:15:05.016873278Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "b2606da6d28cb24ce8d5c0616ced769b1a7f7b3d0b2923fca23b4364262b7a31",
+  "short_id": "b2606da6",
+  "time": "2026-10-02T02:15:05.138940278Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "64129ff5dcb75ea1ff766605e1a0b4dc36e6a4441a0be9433fe2519e5ddd16e0",
+  "short_id": "64129ff5",
+  "time": "2026-10-03T02:15:05.108133602Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "2bb8fb60447e6387d374d98d196807dd9e32187695ddab5df85ff2a1ac856404",
+  "short_id": "2bb8fb60",
+  "time": "2026-10-03T15:05:39.219021268Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "5dd1f0b99e8ed22d7fdcc9005501e880ddd600341fe35bd6897174acdd943857",
+  "short_id": "5dd1f0b9",
+  "time": "2026-10-03T15:17:27.992813997Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "89df02373ec2ffbe4a6b02d622c30c6f5001b922fc692bb1e1b84dfb0b8d2971",
+  "short_id": "89df0237",
+  "time": "2026-10-04T02:15:03.833138622Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ },
+ {
+  "id": "4e7867af43f024c8f712417bce982c5c8085524b51e7f37040c665d0dc1146de",
+  "short_id": "4e7867af",
+  "time": "2026-10-05T02:15:03.941403075Z",
+  "hostname": "demo-felhom",
+  "tags": [
+   "felhom-offbox",
+   "opengist"
+  ]
+ }
+]

documentation/audits/night-fixes-2026-10-05/partA/demo-felhom-window.txt

@@ -0,0 +1,26 @@
+2026-10-05T05:20:57Z
+grant HTTP 200
+
+HTTP 302
+before 15 after 14
+removed: [('343d57a5', '2026-09-28T02:15:05'), ('92e49f62', '2026-09-13T02:15:05')]
+added by the run: [('47bad696', '2026-10-05T05:21:04')]
+2026/10/05 05:16:20 [INFO] [scheduler] Daily job offbox-backup scheduled for 2026-10-06 04:15 CEST
+2026/10/05 05:16:35 [INFO] [bootrecon] boot window: fleet settled after 10s (3 identical samples 5s apart) — sweeping
+2026/10/05 05:21:00 [INFO] [offbox] backup run started (1 app(s) toggled)
+2026/10/05 05:21:01 [INFO] [offbox] pre-push dump leg completed in 892ms — snapshot pair is coherent
+2026/10/05 05:21:06 [INFO] [offbox] backed up opengist (/mnt/sys_drive/felhom-data/backups/primary/opengist, 0 mandatory path(s))
+2026/10/05 05:21:14 [INFO] [offbox] clean-up window 5 (after-run): 2 of 5 planned snapshot(s) removed, 16 -> 14, in 6s
+2026/10/05 05:21:18 [INFO] [offbox] backup OK: 1 app(s) backed up, 14 snapshot(s), 15s
+2026/10/05 05:21:18 [INFO] [offbox] manual run progress reporting ended after 18s
+Traceback (most recent call last):
+  File "<stdin>", line 3, in <module>
+sqlite3.OperationalError: no such column: removed
+Traceback (most recent call last):
+  File "<stdin>", line 3, in <module>
+sqlite3.OperationalError: no such column: box_reason
+--- hub offsite_windows (demo-felhom, newest 3)
+(5, '2026-10-05 05:21:08', '2026-10-05 05:21:15', 16, 14, 8, 'pruned', 'box')
+(3, '2026-10-05 02:15:08', '2026-10-05 02:15:11', 15, 15, 7, 'guard-refused', 'box')
+--- hub events since 05:20 UTC
+--- hub notification_log since 05:20 UTC

documentation/audits/night-fixes-2026-10-05/partA/demo-hp-prediction.txt

@@ -0,0 +1,46 @@
+PLAN 80ebd0d6 2026-09-13T02:16:27Z [felhom-offbox bentopdf]
+PLAN 29516b0c 2026-09-13T02:16:31Z [felhom-offbox bookstack]
+PLAN 21efaca4 2026-09-13T02:16:35Z [felhom-offbox calibre-web]
+PLAN c8562d68 2026-09-13T02:16:39Z [felhom-offbox docmost]
+PLAN b4350226 2026-09-13T02:16:44Z [felhom-offbox kimai]
+PLAN 1ebc8069 2026-09-13T02:16:54Z [felhom-offbox paperless-ngx]
+PLAN 6fac4ba8 2026-09-13T02:17:01Z [felhom-offbox romm]
+PLAN 8cda9681 2026-09-13T02:17:08Z [felhom-offbox opengist]
+PLAN 605bf9c7 2026-09-13T02:17:11Z [felhom-offbox privatebin]
+PLAN 9efec80f 2026-09-28T13:42:12Z [felhom-offbox docmost]
+PLAN ef800224 2026-09-28T13:42:20Z [felhom-offbox opengist]
+PLAN c9c2414d 2026-09-28T13:42:24Z [felhom-offbox bentopdf]
+PLAN 14981ce0 2026-09-28T13:42:27Z [felhom-offbox bookstack]
+PLAN 693c93e1 2026-09-28T13:42:31Z [felhom-offbox calibre-web]
+PLAN 90da3064 2026-09-28T13:42:36Z [felhom-offbox kimai]
+PLAN 7db18829 2026-09-28T13:43:46Z [felhom-offbox paperless-ngx]
+PLAN 57191440 2026-09-28T13:43:52Z [felhom-offbox privatebin]
+PLAN 0febfb1d 2026-09-28T13:43:55Z [felhom-offbox romm]
+PLAN b522e2f4 2026-10-03T02:16:49Z [felhom-offbox bentopdf]
+PLAN c974cffe 2026-10-03T02:16:56Z [felhom-offbox calibre-web]
+PLAN 0bffcb8f 2026-10-03T02:17:00Z [felhom-offbox paperless-ngx]
+PLAN b5d27227 2026-10-03T02:17:08Z [felhom-offbox bookstack]
+PLAN 5d1830e6 2026-10-03T02:17:13Z [felhom-offbox docmost]
+PLAN 4a3c71f5 2026-10-03T02:17:19Z [felhom-offbox kimai]
+PLAN 0a155533 2026-10-03T02:17:26Z [felhom-offbox opengist]
+PLAN a5822405 2026-10-03T02:17:29Z [felhom-offbox privatebin]
+PLAN 2cd36d95 2026-10-03T02:17:32Z [felhom-offbox romm]
+PLAN bea276a7 2026-10-03T15:24:46Z [felhom-offbox bentopdf]
+PLAN 59717090 2026-10-03T15:24:49Z [felhom-offbox calibre-web]
+PLAN c6b5c67b 2026-10-03T15:24:51Z [felhom-offbox docmost]
+PLAN cb83c862 2026-10-03T15:24:54Z [felhom-offbox paperless-ngx]
+PLAN 38fbd3bc 2026-10-03T15:24:57Z [felhom-offbox privatebin]
+PLAN 4ce84465 2026-10-03T15:24:59Z [felhom-offbox romm]
+PLAN 2f72df90 2026-10-03T15:25:02Z [felhom-offbox bookstack]
+PLAN 2c0385d3 2026-10-03T15:25:04Z [felhom-offbox kimai]
+PLAN c43f2d0e 2026-10-03T15:25:07Z [felhom-offbox opengist]
+PLAN 2d412cd5 2026-10-04T02:16:44Z [felhom-offbox bentopdf]
+PLAN 93a66c3e 2026-10-04T02:16:46Z [felhom-offbox calibre-web]
+PLAN 6dbbceac 2026-10-04T02:16:48Z [felhom-offbox docmost]
+PLAN 84559526 2026-10-04T02:16:51Z [felhom-offbox paperless-ngx]
+PLAN 2abceaa3 2026-10-04T02:16:54Z [felhom-offbox privatebin]
+PLAN a86c8d7f 2026-10-04T02:16:56Z [felhom-offbox romm]
+PLAN 40328365 2026-10-04T02:16:59Z [felhom-offbox bookstack]
+PLAN f6c41de0 2026-10-04T02:17:01Z [felhom-offbox kimai]
+PLAN d2b6725f 2026-10-04T02:17:04Z [felhom-offbox opengist]
+GUARD at 2026-10-05T05:23:43Z: removes 18 [80ebd0d6 29516b0c 21efaca4 c8562d68 b4350226 1ebc8069 6fac4ba8 8cda9681 605bf9c7 9efec80f ef800224 c9c2414d 14981ce0 693c93e1 90da3064 7db18829 57191440 0febfb1d] refusal=""

documentation/audits/night-fixes-2026-10-05/partA/demo-hp-window.txt

@@ -0,0 +1,33 @@
+2026-10-05T05:23:54Z
+grant HTTP 200
+HTTP 302
+2026/10/05 05:26:03 offbox_window.go:273: [INFO] [offbox] clean-up window 6 (after-run): 18 of 54 planned snapshot(s) removed, 145 -> 127, in 10s
+2026/10/05 05:26:08 offbox.go:1244: [INFO] [offbox] backup OK: 9 app(s) backed up, 127 snapshot(s), 2m7s
+before 136 after 127 removed 18 added by the run 9
+removed == predicted: True
+  removed 80ebd0d6 2026-09-13T02:16:27 ['bentopdf']
+  removed 29516b0c 2026-09-13T02:16:31 ['bookstack']
+  removed 21efaca4 2026-09-13T02:16:35 ['calibre-web']
+  removed c8562d68 2026-09-13T02:16:39 ['docmost']
+  removed b4350226 2026-09-13T02:16:44 ['kimai']
+  removed 1ebc8069 2026-09-13T02:16:54 ['paperless-ngx']
+  removed 6fac4ba8 2026-09-13T02:17:01 ['romm']
+  removed 8cda9681 2026-09-13T02:17:08 ['opengist']
+  removed 605bf9c7 2026-09-13T02:17:11 ['privatebin']
+  removed 9efec80f 2026-09-28T13:42:12 ['docmost']
+  removed ef800224 2026-09-28T13:42:20 ['opengist']
+  removed c9c2414d 2026-09-28T13:42:24 ['bentopdf']
+  removed 14981ce0 2026-09-28T13:42:27 ['bookstack']
+  removed 693c93e1 2026-09-28T13:42:31 ['calibre-web']
+  removed 90da3064 2026-09-28T13:42:36 ['kimai']
+  removed 7db18829 2026-09-28T13:43:46 ['paperless-ngx']
+  removed 57191440 2026-09-28T13:43:52 ['privatebin']
+  removed 0febfb1d 2026-09-28T13:43:55 ['romm']
+--- hub offsite_windows (demo-hp, newest 2)
+(6, '2026-10-05 05:25:53', '2026-10-05 05:26:04', 145, 127, 72, 'pruned', 'box')
+(2, '2026-10-04 05:36:14', '2026-10-04 05:36:17', 127, 127, None, 'nothing', 'box')
+--- hub events since 05:23 UTC
+--- notification_log since 05:23 UTC
+--- key audit
+[{"customer":"Tester-2","lines":1,"pinned":1,"findings":null},{"customer":"demo-felhom","lines":1,"pinned":1,"findings":null},{"customer":"demo-hp","lines":1,"pinned":1,"findings":null},{"customer":"tester-1","lines":1,"pinned":1,"findings":null}]
+

documentation/audits/night-fixes-2026-10-05/partA/key-audit-after-felhom.json

@@ -0,0 +1 @@
+[{"customer":"Tester-2","lines":1,"pinned":1,"findings":null},{"customer":"demo-felhom","lines":1,"pinned":1,"findings":null},{"customer":"demo-hp","lines":1,"pinned":1,"findings":null},{"customer":"tester-1","lines":1,"pinned":1,"findings":null}]

documentation/audits/night-fixes-2026-10-05/partA/lab-real-restic-vs-simulation.txt

@@ -0,0 +1,17 @@
+R-867 lab, 2026-10-05, on DooPlex scratchpad (local repo, deleted after). restic binary copied out of
+gitea.dooplex.hu/admin/felhom-controller:0.293.0: `restic 0.14.0 compiled with go1.19.8 on linux/amd64`.
+
+Snapshot set: 2 groups (host box, tags opengist / bookstack), one snapshot per night at 02:15:05 UTC from
+2026-08-20 to 2026-10-05, box OFF 2026-09-15..17 (no snapshots), a same-day manual run at 15:00 on 2026-09-10
+and 2026-09-30. 92 snapshots, all UTC.
+
+Real policy: restic forget --group-by host,tags --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --dry-run --json
+  -> removes 72 snapshots
+Test simulation restic0140Plan (offbox_window_test.go) over the same `restic snapshots --json`:
+  -> removes 72 snapshots
+diff of the two sorted id lists: EMPTY (identical)
+
+The guard (v0.294.0 candidate) on that plan at now = 2026-10-05T02:20:00Z, maxRemove 500:
+  GUARD removes=70 refusal=""
+  (the 2 kept back are the 2026-09-30 02:15 copies superseded by the same-day 15:00 run — R-824's exclusion;
+  removed in a later window once 7 calendar days old)

documentation/audits/night-fixes-2026-10-05/partA/red-proofs.txt

@@ -0,0 +1,45 @@
+### RED-PROOF 1 the 8-day age line back: 'if calendarDaysBefore(s.Time, now) < keepDaily {' -> 'if now.Sub(s.Time) < 8*24*time.Hour {'
+    offbox_window_test.go:425: the honest drop of a 7 d + 5 s snapshot must pass: ids=[] why="the policy would remove snapshot n0 from 2026-09-28T02:15:05Z — within the last 7 days kept daily and not superseded the same day, which honest retention never does"
+--- FAIL: TestOffsiteGuard_RealPolicyMeasuredShapeAllowed (0.00s)
+    offbox_window_test.go:456: night 7 (2026-08-27T02:17:00Z): the guard refused the honest policy: the policy would remove snapshot opengist0 from 2026-08-20T02:15:00Z — within the last 7 days kept daily and not superseded the same day, which honest retention never does
+--- FAIL: TestOffsiteGuard_RealPolicySixtyNightsNeverRefuses (0.00s)
+    offbox_window_test.go:502: weekly window on 2026-09-14 refused: the policy would remove snapshot s6 from 2026-09-07T02:15:00Z — within the last 7 days kept daily and not superseded the same day, which honest retention never does
+--- FAIL: TestOffsiteGuard_RealPolicyWeeklyWindows (0.00s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/backup	0.020s
+FAIL
+rc=1
+### RED-PROOF 2 drop the future-date refusal: 's.Time.After(now.Add(offsiteGuardSkew))' -> 'false && s.Time.After(now.Add(offsiteGuardSkew))'
+    offbox_window_test.go:155: window close = [{ID:7 CountBefore:16 CountAfter:16 Removed:0 Outcome:guard-refused Reason:snapshot f1 (2027-01-01T03:00:00Z) is newer than the hub allows (2026-10-05T04:55:06Z)}]
+--- FAIL: TestOffsiteGuard_LabThirteenFutureFakes_Refused (0.00s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/backup	0.023s
+FAIL
+rc=1
+### RED-PROOF 3 drop the newer-than-hub refusal: '!newestAllowed.IsZero() && s.Time.After' -> 'false && s.Time.After'
+    offbox_window_test.go:169: newest-allowed bound not enforced: ""
+--- FAIL: TestOffsiteGuard_RecentRemovalRefused (0.00s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/backup	0.023s
+FAIL
+rc=1
+### RED-PROOF 4 drop the young-removal refusal: 'return nil, fmt.Sprintf("the policy would remove snapshot %s from %s — within' -> 'continue; _ = fmt.Sprintf("the policy would remove snapshot %s from %s — within'
+    offbox_window_test.go:165: why = ""
+--- FAIL: TestOffsiteGuard_RecentRemovalRefused (0.00s)
+    offbox_window_test.go:232: why = ""
+--- FAIL: TestOffsiteGuard_SameDaySupersededYoungExcluded (0.00s)
+    offbox_window_test.go:532: why = "" — a real snapshot inside the daily window must not be removed
+--- FAIL: TestOffsiteGuard_RealPolicySkewWindowFakeRefused (0.00s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/backup	0.024s
+FAIL
+rc=1
+### RED-PROOF 5 drop the weekly cap: 'if maxRemove >= 0 && len(keep) > maxRemove {' -> 'if false && len(keep) > maxRemove {'
+    offbox_window_test.go:202: ids=[o5-full o4-full o3-full o2-full o1-full o0-full] why=""
+--- FAIL: TestOffsiteGuard_AboveWeeklyCapRefused (0.00s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/backup	0.023s
+FAIL
+rc=1
+### restored
+ok  	gitea.dooplex.hu/admin/felhom-controller/internal/backup	0.022s

documentation/audits/night-fixes-2026-10-05/partB/r863-live.txt

@@ -0,0 +1,37 @@
+### 05:28:31 pull 0.294.0 in 9202 (outside the timing)
+gitea.dooplex.hu/admin/felhom-controller:0.294.0
+0
+### 05:28:34 make the one-time clean-up due: remove its marker; switch the image; restart
+gitea.dooplex.hu/admin/felhom-controller:0.294.0 started 2026-10-05T05:28:35.617220084Z
+### 05:31:15 DEPLOY bookstack (POST /api/stacks/bookstack/deploy, the endpoint the install button calls)
+
+HTTP 202
+05:31:20 
+05:31:36 
+05:31:53 bookstack=Created bookstack-db=Up 9 seconds (health: starting) 
+05:32:09 bookstack=Up 15 seconds (health: starting) bookstack-db=Up 26 seconds (healthy) 
+### controller log since start (image retention + bookstack deploy lines)
+2026/10/05 05:31:36 controller_image_retention.go:184: [INFO] [stacks] controller image retention: deleted gitea.dooplex.hu/admin/felhom-controller:0.291.0 (dde6b167c496, 410MB) — older than the previous controller and no container uses it (decision 56)
+2026/10/05 05:31:36 controller_image_retention.go:115: [INFO] [stacks] controller image retention: pass over 3 controller image(s) — running 0.294.0, previous "0.293.0" (by version order (no swap record names one present)), 1 candidate(s), 1 deleted, the rest kept
+2026/10/05 05:31:36 image_retention.go:211: [INFO] [stacks] image retention (one-time clean-up): skipped — an app install, update, restore or undo is pulling images now (R-863); tried again later
+2026/10/05 05:31:54 deploy.go:611: [INFO] [stacks] Stack bookstack deployed successfully (took 35.5s)
+2026/10/05 05:31:57 manager.go:1598: [INFO] [stacks] Stack bookstack post-start status:
+### 05:33:54 after the retry
+2026/10/05 05:31:36 image_retention.go:211: [INFO] [stacks] image retention (one-time clean-up): skipped — an app install, update, restore or undo is pulling images now (R-863); tried again later
+2026/10/05 05:33:36 image_retention.go:389: [INFO] [stacks] image retention (one-time): deleted 0 image(s). docker disk before: Images 6.245GB 2.943GB (47%) | after: Images 6.245GB 2.943GB (47%)
+deleted 0
+
+bookstack lscr.io/linuxserver/bookstack:26.09.1 Up 2 minutes (healthy)
+bookstack-db mariadb:12.3 Up 2 minutes (healthy)
+### 05:34:05 teardown: stop + remove through the product
+HTTP 200
+
+HTTP 200
+### 05:34:49 verify
+0
+ls: cannot access '/opt/docker/stacks/bookstack/app.yaml': No such file or directory
+0
+2026/10/05 05:34:41 delete.go:804: [INFO] Stack bookstack removed successfully (took 26.7s)
+2026/10/05 05:34:43 image_retention.go:265: [INFO] [stacks] image retention (remove of bookstack): deleted [lscr.io/linuxserver/bookstack:<none>] (b274bee3f111, 416MB) — no container, installed app or undo names it (decision 53)
+2026/10/05 05:34:43 image_retention.go:265: [INFO] [stacks] image retention (remove of bookstack): deleted [mariadb:<none>] (dfff46ef3f9d, 334MB) — no container, installed app or undo names it (decision 53)
+2026/10/05 05:34:43 image_retention.go:238: [INFO] [stacks] image retention (remove of bookstack): pass over 15 image(s) of [lscr.io/linuxserver/bookstack mariadb] — 2 candidate(s), 2 deleted, the rest kept

documentation/audits/night-fixes-2026-10-05/partB/red-proofs.txt

@@ -0,0 +1,28 @@
+### RED-PROOF R-863: TryImageCleanup check dropped (endCleanup, ok := func() {}, true)
+    image_retention_r863_test.go:70: the install failed: the clean-up deleted the image compose had just pulled (rmi [sha256:MDB])
+--- FAIL: TestR863_OneTimeCleanupDuringFirstInstallKeepsThePulledImage (0.01s)
+--- PASS: TestR863_OnlyPullingVerbsHoldTheLock (0.00s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	0.014s
+FAIL
+rc=1
+### RED-PROOF R-863b: a busy pass reports done (the old behaviour: the one-time clean-up's marker ends it for good)
+    image_retention_r863_test.go:79: the clean-up reported done although it did not run — its marker would end it for good
+--- FAIL: TestR863_OneTimeCleanupDuringFirstInstallKeepsThePulledImage (0.01s)
+--- PASS: TestR863_OnlyPullingVerbsHoldTheLock (0.00s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	0.017s
+FAIL
+rc=1
+### restored
+ok  	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	0.018s
+### RED-PROOF R-864: truncateStr (head) instead of tailStr for stderr
+    r864_stderr_tail_test.go:45: the reason was cut from the returned error: "exit code 1\nstderr: Image lscr.io/linuxserver/bookstack:26.09.1@sha256:99cd1f5707c1911afad213adec5c9739763b76f843d1477142231834ecdcb6f7 Pulli
+--- FAIL: TestR864_FailedComposeLogsTheReasonNotThePullProgress (0.01s)
+--- PASS: TestR864_TailStrKeepsTheEndOnARuneBoundary (0.00s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	0.012s
+FAIL
+rc=1
+### restored
+ok  	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	0.015s