hub 0.169.0 (unreleased, not built): the upload watch's four events — allowed, operator-only, per-app cooldown, one readable Watch line in the operator mail

app_unexplained_upload / app_unexplained_cpu (warning) and their _cleared (info), from controller v0.342.0 (08 section 9, operator ruling 2026-10-23). Red-proved: operator-only, the render line, the allow-list.
hub 0.168.0: seal the last plain tokens in config_json (R-975, R-1241's Felhom half); decide row R-1243 for the hub's plain Longhorn copies (register 188 -> 189)
2026-10-23 21:26:36 +02:00 · 2026-10-23 19:48:17 +02:00 · 2026-10-23 17:53:43 +02:00 · 2026-10-23 13:35:38 +02:00 · 2026-10-23 11:27:52 +02:00 · 2026-10-23 11:03:45 +02:00
148 changed files with 5281 additions and 150 deletions
@@ -16,6 +16,43 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.


+> **2026-10-23 19:22 — operator rulings by starting the weekend-night brief (R-1241's Felhom half; the upload watch).**
+> **Part 1 = R-1241's Felhom half:** seal R-975 (done in hub 0.168.0, not deployed — `05` §16.2,
+> `audits/hub-token-seal-2026-10-23/`); the hub's plain Longhorn copies are decide row R-1243 (CC's pick: take the hub
+> volume out of the Longhorn backup; ep0's encrypted copy is the backup). **Part 2 = the upload watch, shaped by the
+> operator:** the box measures its own upload line (first from what it already sees — the off-site backup's upload
+> rate — a short test at a quiet hour only if needed); on a sustained high upload it attributes the bytes to an app's
+> container and ASKS THE APP (qBittorrent's seeding, Plex's remote sessions); a mismatch is the alarm
+> (`app_unexplained_upload`, the same shape for CPU, `app_unexplained_cpu`) — operator only. qBittorrent gets a default
+> upload limit from the measured line; a limit the household set is respected. **Open for the operator, CC's pick in
+> STATUS:** the default limit's size (CC: 50 % of the measured upload) and who is told (CC: the family only about the
+> qBittorrent limit they can change; the unexplained alarms to the operator only — the R-388 rule).
+
+> **2026-10-23 ~12:00 — operator rulings by starting the D39 brief (`09` §3 decision 255; R-1239 closed).** **D39 = B:** a
+> `security_fix` ladder step — box walk on 9202 required, bench optional, taken by the night leg. **No operator word per
+> incident:** a public advisory id (CVE or GHSA) + its https:// notice is the authority; the session that writes the step
+> reports it to the operator after the push. The design (Claude.ai's recommendation) was taken as written; one fact in the
+> brief was checked and held (Plex's box fixture exists but is a `NoRoute` stub, so `seed: "none"` is right). Built:
+> catalog `3898593` (`ladder.py` `check_security` + `engine_majors_crossed` importing `check-engine-major.py`; the move gate
+> accepts it; `check-test-record.py` WARNs on a head with no bench; `upgrade-test.py --write-ladder --security`;
+> `box_walk.py --security` + `refresh_box_mirror()`), controller **0.341.0** (`legCandidate` takes `proven` or
+> `security_fix`; global floor 11:24 UTC with MinAgent 0.158.1, the operator's yes in chat). Proof:
+> `audits/security-lane-2026-10-23/`. Older controllers skip the step at night and take it on a hand press (proven).
+
+> **2026-10-23 10:56 — operator ruling: Plex to the fixed version now, without the test record (Plex2Shell).**
+> Verbatim: *„bump the version to the newest in the app template immediately (as there are no customers yet), I want the
+> demo boxes on the newest version asap."* It skips `09` §3 decision 13's test record **once, for Plex only**. Done: catalog
+> `6cc317d` (Plex 1.41.4.9463-630c9f557 → 1.43.5.11029-6bf8af3f0, CVE-2026-96652/-96654/-96655/-96656), pushed
+> `--no-verify` past `check-test-record-move.py` (its refusal is in `app-catalog-felhom.eu/REPORT.md`); the only box running
+> Plex (demo-hp 9201) was checked for the attack's signs (none) and updated by the Update press; the guide re-checked
+> (`guide.checked_version` moved). Decision 13 itself is unchanged. Follow-ups: R-1238 (Plex's test record and fixture),
+> R-1239 (a fast lane for security fixes — the operator's decision, D39). Evidence: `audits/plex-demo-boxes-2026-10-23/`.
+
+> **2026-10-23 morning — the operator's „go" for the day brief: the releases, D31 as built, D32–D36 (decide rows in `STATUS-HISTORY.md`).**
+> **Releases:** controller 0.340.0 (global floor 06:41 UTC, MinAgent 0.158.1); agent 0.163.0 (binary sha256 561b5316…, bundle 3afb88d9…, vouched by the operator 07:58 UTC; delivered to the three test boxes by signed jobs through a step bundle `0.163.0-step1` — the D4 drop-in is a new path, R-880); installer 1.36.0 (tag `installer-v1.36.0` → 83388c08, both webpage pins); hub 0.167.0 (sha256:177860a9…, 08:27 UTC); the website `0bb57a4f`.
+> **D31** = as built (the re-issue reads the newest deletion of a KEY-HOLDING host; an install that got the password but no recovery package is rotated without a press). **D32** = yes: the sheet is names and places only, one A4, HU + EN; the operator prints and fills it. **D33** = yes: `scripts/release-copy/` nightly 01:40, newest 3 image tags (controller, hub, samba) + 5 agent versions, skopeo `dir:` (digest-true — why not `docker save`: a re-push re-compresses), ep0 `/srv/felhom-release-copy` under the one limited user `felhom-relcopy` (rrsync), cap 3 GB enforced by the sender, a read-only registry token of its own. **D34** = yes: hub snapshots at 02/08/14/20 (catch-up > 6 h), DooPlex push :30 after, limit 7 h + a wait for a snapshot being written (R-1234: 2 h was wrong), alarm 13 h; ep0 retention unchanged (keep-daily 14, keep-weekly 8). **D35** = yes, after the release week (R-1228, dated 2026-10-30). **D36** = yes, both sentences, published.
+> **Added on the operator's word the same day (not soaked):** D34's hub half went into 0.167.0 (asked before the build). Record: `audits/day-2026-10-23/`, `REPORT-day-2026-10-23.md`.
+
 > **2026-10-22 evening — operator rulings D29, D30, D31 (CC's picks accepted; the decide rows now in `STATUS-HISTORY.md`).**
 > **D29** = no: the controller repository stays public for now (R-925). **D30** = the agent makes a new WireGuard key and
 > registers it on the existing peer path (R-1204). **D31** = the hub skips a deleted install that never made a key when it
@@ -0,0 +1,103 @@
+# REPORT — day 2026-10-23: the releases and the DooPlex hour (the operator's „go")
+
+Design read: `07-backup-architecture.md` §6.3/§8, `09-update-architecture.md` §3 decision 250, `03-host-agent.md`,
+`05-hub-architecture.md` §16.3, `runbooks/total-loss-of-dooplex.md`, `audits/dooplex-survival-2026-10-22/PLAN.md`.
+Evidence: `documentation/audits/day-2026-10-23/01`–`14`.
+
+## Five lines
+
+1. Released: controller 0.340.0 (global floor), agent 0.163.0 (vouched by the operator), installer 1.36.0, hub 0.167.0,
+   the website with D36's two sentences.
+2. Root SSH from the LAN is key-only on all three test boxes; new installs get it from installer 1.36.0.
+3. The hub database now leaves every 6 hours (restored back byte-identical); the released images and agent packages
+   leave nightly to ep0 (pulled back, every sha256 OK, one image loaded on a scratch box).
+4. One false failure mail at 10:28 (my install of the 6-hourly copy) — filed R-1234, fixed and red-proved the same hour.
+5. Register 191 → 184; the operator: print the sheet, Hosts page clean-up, D37 + D38.
+
+## Per box — versions before → after, and the SSH checks
+
+| Box | controller | agent | root-file bundle | `sshd -T` root | sshd reloaded | key login | felhom-sshd | swap = RAM (9201) |
+|---|---|---|---|---|---|---|---|---|
+| Tester 1 | 0.339.0 → 0.340.0 | 0.162.0 → 0.163.0 | 0.160.0 → 0.163.0 (via 0.163.0-step1) | without-password | yes, 09:27:38 | ok | active, `sshd -t` ok | 4096/4096 |
+| demo-hp | 0.339.0 → 0.340.0 | 0.162.0 → 0.163.0 | 0.160.0 → 0.163.0 | without-password | yes, 09:19:44 | ok | active, `sshd -t` ok | 25898/25898 |
+| demo-felhom | 0.339.0 → 0.340.0 | 0.162.0 → 0.163.0 | 0.160.0 → 0.163.0 | without-password | yes, 09:24:42 | ok | active, `sshd -t` ok | 12288/12288 |
+| hub | 0.165.0 → 0.167.0 | | | | | | | |
+
+Not proven (said plainly): the real root password over SSH (CC does not hold it — a dummy one is refused, but OpenSSH logs
+only „Failed password"); a felhom-sshd connection (it admits only the operator's tunnel peer); the physical console (the
+drop-in does not touch it; `passwd -S root` = P).
+
+## Digests, sha256, CI by commit
+
+| What | Value |
+|---|---|
+| controller 0.340.0 | `sha256:a8d1c6458da4ea9d667f928498656a291771e0b3756b20f2fcc8c1cf9d516621` — `caaa86e`, CI 2245 success |
+| agent 0.163.0 binary / bundle | `561b5316cd511de9fa9d8b8be4553da7add684f715d3bea533ca330ff7f3763c` / `3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8` — `1109092` CI 2246, `b4721ee` CI 2249 success |
+| step bundle 0.163.0-step1 | `6cbc066902d5f3294765d5c7dc7113166c1dca25e994dbc36bfc5f139bb61fcf` |
+| installer 1.36.0 (served = tag) | `de8bf5f32cbcda44c9976ba829f04ea151e3b30634b54d5fdd9eb6c4a0351cec` — `83388c08` CI 2247 success; pins `2aebf1bd` |
+| hub 0.167.0 | `sha256:177860a996cb285d935777d6ffdf85725f6cf4489885f54fd3bf8135c68041a0` — built at `d306b8c2` (hub/ = `be7e97dc`, CI 2250 success; `d306b8c2` CI 2251 success); manifest `34979d5d` |
+| website | `0bb57a4f` |
+| D34 fix (R-1234) | `52af38df` |
+| prometheus rules | homelab-manifests `1bbef892` |
+
+CI of the last commits (`2aebf1bd`, `0bb57a4f`, `34979d5d`, `52af38df` and this close-out): see the final message.
+
+## Parts
+
+- **1 — controller 0.340.0:** 9202 smoke, per-customer floors, three boxes green, box walk + https-only rc 0, global floor
+  06:41 UTC (MinAgent 0.158.1), read back with the WAL (`01`–`06`).
+- **2 — agent + installer:** release, a step bundle because the D4 drop-in is a new path (R-880), three signed jobs per
+  box (`07`); the operator's vouch read back from the DB and the live page (`10`); installer tag, both pins, a
+  webpage-only sync, the served script = the tag (`11`).
+- **3 — hub 0.167.0:** built from a clean clone; on the operator's word it also carries D34's 6-hourly snapshot (asked
+  before the build; not soaked); hub-only sync; 30-minute watch: 0 hub events, 0 errors, all boxes reporting, no hub mail
+  (`14`).
+- **4 — website:** D3/D5 patch + D36 HU + EN; site gates; published; read back live: new text present, old gone (control:
+  the previous commit), screenshots at 390 and 1366 px, no sideways scroll (`12-website-readback/`).
+- **5 — D34:** retention unchanged, server-side on ep0 (`prune-operator-hubdb` 03:45, keep-daily 14, keep-weekly 8 — the
+  current day's up to 4 copies until the next prune). Hand run 501.6 MiB / 24.5 MiB uploaded in 4 s; the newest copy
+  restored from ep0 with the read-only token = the pod's snapshot by sha256 `a9ff4c8a…`, integrity ok, 4 hosts, holds
+  today's vouch. Alarm 13 h. Runbook updated (`13`).
+- **6 — D33:** ep0 before: `/` 14 GB free (the data disk's root IS the PBS datastore — not used). One user
+  `felhom-relcopy` (locked, rrsync-confined: shell and `..` refused), one directory `/srv/felhom-release-copy`. Cap 3 GB,
+  enforced by the sender (ep0 has no quota). **skopeo, not `docker save`:** `dir:` keeps the registry's bytes, so a push
+  back keeps the digest; no Docker daemon. A read-only registry token of its own, minted in the Gitea pod straight into a
+  0600 file. First run 676 MB, 91 s; pulled back: 141 files OK, 9 images re-verified (digests match independent records),
+  controller 0.340.0 loaded on 9202 (ID = config digest). Alarm `FelhomReleaseCopyStale`. Restore steps in
+  `total-loss-of-dooplex.md` (`08`).
+- **7 — D32:** the sheet is names and places only, HU + EN, one A4 (rendered: 1 page; a copy in the operator's home
+  folder); every place checked to exist. demo-hp: three superseded ISOs removed by name, `/` 8.5 → 14 GB free (`09`).
+  R-548: the box half done, the product fix proposed (R-921's pattern).
+- **8 — close-out:** CONTEXT rulings, STATUS (decide rows D32–D36 → history, D37/D38 new, the do list, D35 dated
+  2026-10-30), REPORTs and CHANGELOGs; the system poster's facts file updated, its hub-DB label edited (text), and a new
+  arrow asked for in STATUS („System poster needs a refresh").
+
+## Register — 191 → 184; opened 4, closed 11
+
+Opened: R-1234 (closed the same hour), R-1235, R-1236, R-1237. Closed: R-49, R-982, R-985, R-991, R-1204, R-1205,
+R-1225, R-1226, R-1227, R-1230, R-1234. Updated: R-1214 (released; dated check 2026-10-24), R-1187, R-1189, R-232,
+R-548, R-923, R-924, R-1228 (D35, dated 2026-10-30), R-1183's check text (four snapshot slots).
+
+## Observations
+
+- The D34 first push refused the hub's own catch-up and mailed admin@ — FILED: R-1234 (closed, fixed `52af38df`).
+- The release copy is proven to load, not to restore a registry; it follows the newest versions, not the floor/vouch; no
+  golden — FILED: R-1235.
+- Gitea OOM-killed at its 1 GiB limit, the last at 06:41:10 UTC during the release — FILED: R-1236 (STATUS D37).
+- The night sweep's mail: one-time test-box codes in one session record — FILED: R-1237.
+- The hub DB snapshot is 501 MiB, not 24 MB — NOT-A-FINDING: 24 MB is the compressed upload, which is what ep0 stores.
+- felhom-sshd does not answer from the LAN — NOT-A-FINDING: its firewall admits only the operator peer (H1, by design).
+- A dummy root password logs „Failed password", not a policy refusal — NOT-A-FINDING: OpenSSH's behaviour under
+  `prohibit-password`; the policy is proven by `sshd -T` and the reload.
+- The vouch left `artifact_wrapper_sha256` empty — NOT-A-FINDING: an optional field; the wrapper rides the vouched bundle.
+- Guests 9202, 9401 (demo-hp) and a transient 990000 (Tester 1) have swap ≠ RAM — NOT-A-FINDING: outside the felhom pool.
+- `known_hosts` holds an older key for 192.168.0.155 (demo-hp's guest address) — NOT-A-FINDING: guests are reached by
+  `pct exec`; nothing was changed.
+- The D4 drop-in needed a step bundle — NOT-A-FINDING: the documented R-880 path for a new bundle path.
+
+## Teardown — three layers
+
+Machine: 9202 — the test image untagged, the tar removed. Host: demo-hp `/tmp` tar removed; three ISOs removed on purpose
+(Part 7); DooPlex: the read-back copies and the hub-DB scratch restore shredded/removed. Hub: nothing provisioned; the
+per-customer floors cleared after the global floor. Left on purpose: the ep0 user + directory, the DooPlex release-copy
+job, the 6-hourly hub-DB timer, both alarms.
@@ -0,0 +1,42 @@
+# REPORT — Plex to the fixed version in the catalog and on the demo/test boxes (2026-10-23 day, Plex2Shell)
+
+**Plain words first.**
+- The catalog now gives Plex 1.43.5.11029-6bf8af3f0 (catalog `6cc317d`, pushed without the update test, on your ruling).
+- One box ran Plex: demo-hp. It showed no sign of the attack. CC pressed Update; it runs the new Plex now.
+- You have one decision (D39): may a security fix reach the boxes at night without the full update test?
+
+## Per box
+
+| Box | Plex before → after | Signs check | Box walk |
+|---|---|---|---|
+| demo-hp 9201 | 1.41.4.9463-630c9f557 → 1.43.5.11029-6bf8af3f0 | clean (NOT-A-FINDING; logs reach back only to 00:32 UTC today — CPU history and files cover 10-16 → 10-22) | green: all containers healthy, 0 errors, 0 warnings since the press |
+| demo-hp 9202, demo-felhom 9201, tester-1 9201 | no Plex | — | — |
+| Tester4 | hub host DOWN, VM gone | — | — |
+| Tester 2 | no host on the hub | — | — |
+
+Detail and evidence: `documentation/audits/plex-demo-boxes-2026-10-23/README.md`.
+
+## Records
+
+- Register 184 → 186: opened R-1238 (P2, Plex has no test record or fixture), R-1239 (P2, a fast lane for security
+  fixes — the operator's decision); closed none.
+- `CONTEXT.md`: the 10:56 ruling. `STATUS.md`: decide row D39. No „broken" line: Part 2 was finished before the
+  records were written, so the line the brief asked for would have been added and removed in the same commit.
+  The „Updated" paragraph was left as the day session wrote it (it is that session's summary; this run adds one
+  decide row only).
+- Architecture read: `09-update-architecture.md` §3 decisions 13 and 52; `13-threat-model.md` (Plex row);
+  `runbooks/target-selection.md`. Decision 13 is unchanged; no poster fact changed (none of the three poster actions).
+- `--no-verify` was used ONCE, for catalog `6cc317d`, on the ruling. The `check-test-record-move.py` refusal is verbatim
+  in `app-catalog-felhom.eu/REPORT.md`.
+
+## Fixed without a row
+
+- The memory index (`.claude-memory/MEMORY.md`, outside git) had grown to 201 lines / 25 735 bytes at 11:09 (another
+  session), over the 200 / 25 600 ceiling, so `instructions_gate` failed and so did two script suites that run it.
+  Lines 71–72 (two memories about the deleted credentials file, both superseded by `sec`) became one line: 200 lines,
+  25 590 bytes. `repo_gates.py --fast` then OK. The index sits right at the ceiling; the next added line trips it again.
+
+## Teardown
+
+Machine: Plex stays on the new version; helper scripts removed from guest and host. Host: nothing provisioned.
+Hub: reads only.
@@ -0,0 +1,75 @@
+# REPORT — did the Plex attack on DooPlex reach Felhom's secrets? (2026-10-23)
+
+## Plain words first
+
+1. **Verdict: NOT REACHED.** Two open doors led from the hacked Plex to Felhom's secrets. Neither was used in the attack
+   days: the backup folder got no new connection at all, and Longhorn made no backup or disk outside its normal plan.
+2. **The shared backup folder: closed to the home network and the tailnet** (your yes). It is **still open to every app
+   on DooPlex** — Longhorn needs that, so the real fix is the homelab session's.
+3. **What you do next:** give the homelab session the hand-over list (`documentation/audits/plex2shell-felhom-impact-2026-10-23/README.md`,
+   last section). Nothing needs to be rotated.
+
+## The Part 4 table
+
+In `documentation/audits/plex2shell-felhom-impact-2026-10-23/README.md` § Part 4. Short form: every Felhom secret on
+DooPlex has exposure **none**. The ones a hacked pod *could* have reached: the hub's unencrypted nightly copies (with the
+unsealed Cloudflare/tunnel/git tokens, R-975) through the NFS export or a Longhorn backup, and the operator signing keys
+through the NFS file-handle escape (documented, not exercised). Sealed hub columns need a key that is not in the copies;
+escrow blobs need each household's recovery code; the k8s API, the kubelet and the hub refuse a caller with no credential
+(measured).
+
+## The paths and the evidence per path
+
+| path | existed? | evidence of use (window 10-17 04:00Z → 10-23 08:04Z) |
+|---|---|---|
+| NFS export `longhorn-pvc` (`*`, `no_root_squash`, `no_subtree_check`; `secure` void in pods) | yes | **unused** — `node_nfsd_connections_total` flat at 288 for 13 days, 3902 samples, no gap; positive control: today's three probe connections moved it to 4. nfsd is TCP-only. Reads only in Longhorn's backup hours |
+| Longhorn API :9500, no login | yes | **no sign of use** — 0 backups first seen off-schedule (1-min scrape); every night wrote to the local store; no unexplained volume; the backup target is the 2025-11-29 one. Manager logs: lost (reboot) |
+| hub `hub:8080` direct | yes, but no secret without a credential | 0 requests from 10.42.0.52 in `/data/access-log` (from 10-18 10:25Z; positive control: the probe's IP is logged). 10-17 04:00Z → 10-18 10:25Z: no record |
+| k8s API, kubelet | no (401) | — |
+| SSH, Samba on DooPlex | login needed | 0 sshd lines from the pod network (control: 61 from the LAN); no Samba client file for 10.42.0.52 (positive control: the probe made one) |
+| Vaultwarden | login needed; vault encrypted | logs lost (reboot) |
+
+**Evidence lost before this session started:** the 13:20Z maintenance reboot erased the pre-reboot container logs of
+longhorn-manager, longhorn-ui, the ingress, the hub, Gitea, Vaultwarden, Grafana and Prometheus. Reproduced
+independently from records that survived: Prometheus history (nfsd, Longhorn, cAdvisor, node network), the hub's own
+access log, the journal (boot -1), Samba per-client files, CoreDNS error lines, the Alertmanager silence list. The
+incident session's pre-reboot greps (10.42.0.52 in longhorn-manager, CNPG, Gitea, authentik: 0) are cited as theirs.
+
+## For the homelab session
+
+The seven items at the end of the audit README: the export still open to pods (and `secure` is void there); Longhorn API
+and UI with no login; an unattributed Longhorn delete of the old Plex volume at 11:24:15Z; **~1.5 TB sent out by the Plex
+pod 10-18 → 10-22** (not in INCIDENT.md) plus `hand.genddos.st` DNS lookups on 10-19; the reboot that erased the logs;
+the monitoring stack and Headlamp reachable from every pod; a `python3 main.py` listener on :8443. No HM numbers minted;
+`homelab-manifests` not touched.
+
+## What this session changed
+
+- **DooPlex `/etc/exports`** (operator yes, ~15:18Z): `longhorn-pvc` from `*` to `10.42.0.0/16`, `exportfs -ra`; Longhorn
+  target `available: true` at 15:20:10Z. Backup `/etc/exports.bak-2026-10-23-plex2shell`. The only change on DooPlex.
+- **Probe pod** `default/cc-p2s-probe`: created 15:19:46Z, removed 15:33:44Z; before/after listings in the evidence. No
+  other object created. The incident's NetworkPolicies untouched.
+- **felhom.eu:** the audit folder; R-1241 and R-1242 in `OPEN-ITEMS.md`; `13-threat-model.md` (attacker j, one boundary
+  row); `STATUS.md` (verdict in „What works", the P1 in „What is broken", one „do" item; the old „Updated" paragraph moved to
+  `STATUS-HISTORY.md`).
+- Nothing rotated. No secret value written anywhere (evidence scanned for secret shapes; the only 64-hex string is the
+  sha256 of `/etc/exports`).
+
+## Rows
+
+Before 186, after 188; opened 2 (R-1241 P1, R-1242 P3), closed 0.
+
+## Observations
+
+- Hacked pod → hub backups + signing keys through the NFS export and the Longhorn API — FILED: R-1241.
+- Demo NAS export on the same disk with `no_subtree_check` — FILED: R-1242.
+- The hub answers pods without the geo filter — NOT-A-FINDING: the geo filter is not authentication; every no-token path refused.
+- demo-felhom's Proxmox UI and SSH reachable from any DooPlex pod — NOT-A-FINDING: the door of R-982; added as attacker j in `13` §3.
+- Pod logs erased by the reboot — NOT-A-FINDING for Felhom (the hub's access log persisted, R-1140); handed to the homelab session.
+
+## Notes for the next session
+
+- Teardown, three layers: machine — probe pod removed, export change kept on purpose (operator yes); host — none; hub —
+  none (read-only access-log aggregation in the running pod).
+- System poster: no fact on it changed (none of the three applied).
+- `unproven.py`: not run — no capability claim changed.
@@ -0,0 +1,17 @@
+# REPORT — D39 = B: the security-fix lane (2026-10-23, attended)
+
+**Plain words first.** An app with a public security hole can now get its fix at night on every box, after one test
+on the test box. Controller 0.341.0 does it and is the floor since 13:24 (your yes). Older controllers skip such a fix
+at night and take it when a person presses Update — both seen on the test box. Nothing needs you.
+
+- Design: `09-update-architecture.md` §3 decision 255 (+ a dated note on decision 13). Capability map B23.
+- Catalog `3898593` (+ a box-walk address fix after it); controller `63dcccf` = 0.341.0; drill commits `8c1d908` …
+  `17e0da0` (the drill only).
+- Evidence and the full table: `documentation/audits/security-lane-2026-10-23/README.md`.
+- Register 186 → 186: closed R-1239 (D39 = B); opened R-1240 (9202's 34 saved configs with the catalog token); R-1238
+  stays open, its text now says the next Plex fix can use the lane.
+- `STATUS.md`: D39 out of the decide table, one „what works" line, the „Updated" paragraph replaced (the old one is in
+  `STATUS-HISTORY.md`). `CONTEXT.md`: the rulings. System poster: no fact changed (none of the three actions).
+- Instruction / fact files edited: `app-catalog-felhom.eu/CLAUDE.md` (the lane, added); `operations/nodes.md` line 221
+  (9202 „same dashboard password" → its own password, measured) and line 46 (Tester 1 `.101` → DHCP, `.148` today).
+- No `--no-verify` in this run.
@@ -2,9 +2,10 @@

 **Ready for Tester 2? Yes — tell the friend go (hand-over list: `documentation/pilot/TESTER2-handover.md`).**

-**Updated 2026-10-23 (morning).** Your three picks are built (the tunnel repairs itself with a new key, the hub skips a keyless deleted install, the controller repository stays public), and the night copy can no longer outlive the controller. Four fresh reviews found 34 points, every real one fixed or a row; the test night PASSED (no failed check at night, every night job passed, nothing lost). Nothing was released or deployed; the morning list has the order, and the DooPlex survey asks four questions (D32–D35).
+**Updated 2026-10-23 (evening).** The Plex attack on DooPlex did NOT reach Felhom's secrets: the two open doors to them (a shared backup folder and Longhorn's page) were not used in the attack days. The backup folder is now closed to the home network (your yes); it is still open to every app on DooPlex, so a hacked app there could read the hub's backups (R-1241, the homelab session's fix).

 ## What works
+- **The Plex attack (2026-10-17 → 10-23) did not reach Felhom's secrets** — no connection to the backup folder, no unplanned backup (R-1241).
 - A box installs from nothing with the public installer, links to the hub, and moves to the floor by itself (map A1, A3, A4).
 - 65 catalog apps install, update one tested step at a time, and a failed update undoes itself (map B1, B3, B4, B6).
 - Backups: database dumps, a second-drive copy, an off-site copy and whole-box copies; restore tests run by themselves (map C1–C4, A17, A18).
@@ -12,16 +13,16 @@
 - After a power cut the box starts by itself, cleans up a half-written backup, and Immich repairs broken photos (map C10, F12).
 - A second drive is offered as the backup target; media apps see every drive; a one-disk box gets its own data area (map D1, D13, D15).
 - The three test boxes answer only over https; the hub's key opens nothing on a box; password guesses are counted (map E12, E13, E17).
+- An urgent security fix reaches the boxes at night after one test on the test box; the box backs up first and undoes a failed update (map B23).
 - The hub mails alarms and recoveries, and keeps one whole-box copy per week on ep0; CC uses its own limited token, not your password (map F1, F11, G15).

 ## What is broken
- **P1:** about 12 homelab logins still use a password that was public, and the public Gitea repo is not decided (R-925, yours).
- Tester 2 is off since 2026-10-04: old emergency password, no off-site check, no bootstrap (R-1139, R-1104, R-862).
+- **P1:** any hacked app on DooPlex can read the hub's nightly backups, and maybe the signing keys (R-1241, homelab session); about 12 homelab logins still use a password that was public, and the public Gitea repo is not decided (R-925, yours).
+- Tester 2 is off since 2026-10-04: old emergency password, no off-site check, no bootstrap (R-1139, R-1104, R-862). The scratch box cannot use agent features (R-1083).
 - DooPlex: the failed disk is still in the box, its alarms silenced (R-934); something sets the shared checkout to „bare" (R-935).
- The scratch box cannot use agent features (R-1083).

 ## What we work on
- Dated checks, run by CC. 2026-10-23: no app stop when the host is busy (R-1173). 2026-10-26: each hub daily job ran once on the clock-change day (R-1183). 2026-10-27: the weekly clean-up window (R-435; the logs of the last one were lost to restarts).
+- Dated checks, run by CC. 2026-10-24: the 8 GB box's first night copy on 0.340.0 (R-1214). 2026-10-26: each hub daily job ran once on the clock-change day (R-1183). 2026-10-27: the weekly clean-up window (R-435; the logs of the last one were lost to restarts). 2026-10-30: D35, website and installer to Cloudflare, starts (R-1228, ruled yes).

 ## Waiting on you — decide

@@ -29,11 +30,9 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te

 | # | Row | Question | Pick (why) | The other option costs | If you do nothing | Blocked |
 |---|---|---|---|---|---|---|
-| D36 | R-1225, R-1226 | Two website sentences before the publish: „8 GB runs the basics; the photo app needs 16 GB” and „what you open from outside the home passes Cloudflare's network, readable there; the backups leave only encrypted”? | **Yes, both** (the patch's own aim is the whole truth) | — | the patch publishes with both promises a little too strong | — |
-| D35 | R-1228 | After the release week, serve the website and the installer from Cloudflare, like the ISO? | **Yes, later** (no new installs stop when DooPlex is down) | keep them home: after a DooPlex loss, no install until it is back | the same | — |
-| D34 | R-232 | Copy the hub database to ep0 every 6 hours instead of every night? | **Yes** (0 €, about 30 minutes, one DooPlex change) | keep nightly: up to a day of hub changes lost, e.g. a new box's recovery package | the same | — |
-| D33 | R-1227 | Copy the released images and agent packages to ep0 every night? | **Yes** (0 €, about 2 hours of CC, a few GB on ep0) | a timed rebuild drill instead: about 3 hours once, and rebuilt images are not the same | after a DooPlex loss no box updates, reinstalls or installs until everything is rebuilt | — |
-| D32 | R-923, R-924 | Print the break-glass sheet now (eight keys and logins + ep0's fingerprint) and keep it outside the home? | **Yes** (30 minutes; nothing else opens the off-site copies after a loss) | an encrypted USB stick outside the home: ~10 €, 1 hour, one more passphrase | after a DooPlex loss no off-site copy opens | — |
+| D40 | R-1243 | The hub's backups in DooPlex's shared folder are not encrypted (two there now hold the tunnel tokens). Encrypt the hub's disk, or stop that backup? | **Stop it** (the hub's own copy to ep0 is encrypted, every 6 h, tested weekly) | encrypt: 5–10 min hub downtime and one more key to keep | the plain copies stay readable by any hacked DooPlex app | a homelab change |
+| D38 | R-1235 | Put the newest golden (637 MB) into the nightly release copy on ep0 too? | **Yes** (a new install after a DooPlex loss needs it; it fits under the 3 GB cap) | leave it out: after a loss, no new install until a golden is rebuilt and vouched | the same | — |
+| D37 | R-1236 | Raise Gitea's memory limit from 1 GiB to 2 GiB? It was killed for memory 4 times in 17 days, once during today's release. | **Yes** (DooPlex has the RAM; a DooPlex change, so yours) | keep 1 GiB: a restart in release hours fails box updates and CI for a minute | the same | — |
 | D9 | R-1062 | Split the N100's USB drive in two, for multi-drive tests? | **No — keep one drive** (the lived-in box keeps its nightly whole-box backup) | Split: the box loses its local whole-box backup, or you buy a second drive first | it stays one drive; multi-drive tests stay on Tester 1 | — |
 | D7 | R-990, R-989 | Rule on the forum ideas and the selfh.st ideas now, or park them? | **Park them** (P4; nothing waits on them) | Rule now: about one hour of reading | nothing changes; the research gets old | — |

@@ -48,17 +47,16 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te
 6. BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. Since 2026-10-14.
 7. Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). Since 2026-10-12.

-**Morning, 2026-10-23 — in this order.**
-1. Hold or go: CC says go — the test night passed on a fresh 8 GB box (no failed check at night, every night job passed, nothing lost; one gap: no whole-box copy to ep0, R-1232). One question from the review: D31 as built also covers an install that got the whole-box password but no recovery package — its password is rotated without your press (R-1205). CC: go. If not: revert one hub commit before item 4.
-2. Release controller 0.340.0 (main after tonight; tested as rc.8 on the scratch box, rc.6 on the test box): the safe night copy, the catch-up fix, R-49, R-1187, R-1189, R-1214. If not: these wait.
-3. Release the agent (the tunnel repair, its tunnel field, the root-SSH bundle) and the installer tag with the root-SSH removal (R-1204, R-982); then vouch. If not: a clock-ahead box stays cut off; root keeps its password on the LAN.
-4. Build and deploy hub 0.167.0 (D31, the tunnel alarm and its clearing). If not: a dead tunnel stays silent.
-5. Publish the website patch (D3, D5), with D36's two sentences if yes. If not: the old wording stays.
-6. On the hub's Hosts page: Discard appliance 49, and delete host Tester4-16fdef (tonight's test box). If not: two dead entries alarm.
-7. The DooPlex hour: D32–D35 in the table. If not: a DooPlex loss stays as the survey describes.
+**Day, 2026-10-23 — your do list.**
+1. Print the break-glass sheet (`documentation/runbooks/break-glass-sheet.md`, the part from „The sheet”, one A4), fill it by hand, keep it outside the home (D32; R-923, R-924). If not: after a DooPlex loss no off-site copy opens.
+2. On the hub's Hosts page: Discard appliance 49, and delete host Tester4-16fdef. If not: two dead entries alarm.
+3. D37 and D38 in the table (two small yes/no). If not: Gitea may restart in release hours; no golden in the release copy.
+4. Give the homelab session R-1241, R-1242 and the 7-item list at the end of `documentation/audits/plex2shell-felhom-impact-2026-10-23/README.md`. If not: the next hacked app on DooPlex can read the hub's backups.
+5. Monday: deploy hub 0.168.0 — the last plain tokens locked (R-975). If not: a copy of the hub database still holds them.
 **The rest**
+- System poster needs a refresh: the new 01:40 „release copy” arrow from DooPlex to ep0 (D33); the hub-database label already says every 6 hours. If not: the drawing misses one copy.
 - Pull the failed disk Z6A07P2G out of DooPlex (R-934). If not: its alarms return on 11 November. Since 2026-10-12.
 - Rotate the reused homelab logins and decide the Gitea repo's visibility (R-925, P1). Since 2026-10-09.
 - Two leftovers on DooPlex: the Facebook `first-post/` folder in `leftovers/2026-10-14/` (keep, commit or delete); the `deny`-list edit in homelab-manifests' `.claude/settings.json` (commit or drop). If not: they stay. Since 2026-10-14.
- Before the first paying customer: Tandoor's permission (R-789); a lawyer for the licence list and the terms (R-802, R-813); SparkyFitness by e-mail (R-784); print the break-glass sheet and the signing keys (R-923, R-924).
+- Before the first paying customer: Tandoor's permission (R-789); a lawyer for the licence list and the terms (R-802, R-813); SparkyFitness by e-mail (R-784);.
 - Later (yours, not urgent): R-1229 (ArgoCD's sync settings into git), R-862 (Tester 2's bootstrap, when it is back), R-504, R-1071, R-1073, R-1077, R-1042, R-132, R-908, R-779, R-904, R-232, R-433, R-933, R-213, R-832, R-388, R-882, R-883, R-814, R-1056, R-1164, R-930, R-920, R-902.
@@ -124,6 +124,7 @@
 | <a id="b20"></a>[B20](capability-map-detail/B.md#b20) | App crashes → customer notified (one event per transition, no flapping spam) | controller v0.120, hub v0.48 | **IMPLEMENTED** | crash→customer mail never live-confirmed | `audits/CAMPAIGN-3-2026-07-11.md` (2026-07-11) |
 | <a id="b21"></a>[B21](capability-map-detail/B.md#b21) | Post-deploy optional config (API keys etc.) with restart | controller, catalog `.felhom.yml` | **IMPLEMENTED** | config-save + restart in no campaign | `tests/CAMPAIGN-2-2026-07-07.md` (2026-07-07) |
 | <a id="b22"></a>[B22](capability-map-detail/B.md#b22) | Backup classification: 13 bind-bearing apps carry mandatory/optional/excluded classes | catalog, controller v0.132–133 | **PROVEN-LIVE** | — | `audits/SPIKE-backup-classification-2026-07-14.md` (2026-07-14); `audits/CAMPAIGN-6D-2026-07-15.md` (2026-07-15) |
+| <a id="b23"></a>[B23](capability-map-detail/B.md#b23) | An urgent security fix reaches the boxes at night — a `security_fix` ladder step (box walk required, bench optional, a CVE/GHSA notice), taken by the night update (`09` §3 decision 255, D39 = B) | catalog `3898593`, controller v0.341.0 | **PROVEN-LIVE** | scratch 9202 (drill catalog), Plex 1.43.4 → 1.43.5; an app with no box fixture is checked by health, version and a soak only (`seed: none`) | `audits/security-lane-2026-10-23/` (2026-10-23) |

 ## C. Protection & recovery (the product promise)

@@ -555,6 +555,16 @@ record unreadable: its serve paths answer 500, a save refuses it (never blanks i
 to a hub before v0.138.0** needs the columns opened first: `felhom-hub -unseal-box-secrets` (all or nothing; exit 1 =
 nothing changed) — run in the running pod, then put the old image back. `guests.api_key` is an unused, always-empty
 column and is not sealed. *Decided by CC unattended — operator may reverse (`09` §3 decision 132).*
+**Since v0.168.0 (R-975, R-1241) the last plain tokens are sealed too:** the Cloudflare tunnel token, the Cloudflare API
+token and the git token live INSIDE `customer_configs.config_json` (`infrastructure.cf_tunnel_token`,
+`infrastructure.cf_api_token`, `git.token`). Each of those JSON leaves holds the same `enc:v1:` seal; the rest of the JSON
+stays readable. `SaveCustomerConfig` seals, every reader opens through `openCustomerSecrets` (a leaf that does not open is
+blanked and marks the record unreadable, as above). Legacy rows are sealed at start-up (`SealLegacyConfigTokens`, without
+a `config_version` bump — the box's config is byte-for-byte the same, so no box re-pulls or restarts), followed ONCE by
+`VACUUM` + a WAL checkpoint, because an `UPDATE` leaves the old plaintext row in a freed block of the file
+(`TestR975_DBFileWithoutKeyRevealsNoToken`). `-unseal-box-secrets` opens these leaves too, so the roll-back above also
+covers a return to a hub before v0.168.0. The full list of secret-bearing columns, measured on a copy of the live database
+2026-10-23: `audits/hub-token-seal-2026-10-23/README.md`.
 **And the key is the other half:** a backup of the database restores a hub that can open the sealed columns only
 with the same `OFFSITE_SECRET_KEY`; today that key exists only on DooPlex (the k8s Secret, and the GPG secrets export
 on the same machine). The off-site plan for the database and its key: `runbooks/RUNBOOK-hub-db-offsite-backup.md`
@@ -286,6 +286,9 @@ builds them (`audits/update-rulings-2026-09-23/`).
    update night measured the proxy wrong in both directions — minor moves that held
    (adventurelog, outline) and a tag shape it cannot read at all (§3b Q3). The test record is the
    thing the proxy was guessing at.
+    **Dated note 2026-10-23 (decision 255, D39 = B):** a second step kind now exists — the `security_fix` step, proven
+    on the box with the bench optional, for an urgent upstream fix with a public notice. Decision 13's rule is
+    unchanged for every other move: a step a box takes was still tested, on at least the box venue.

 14. **The update ladder** (Q3). A box more than one step behind **climbs one tested step at a time, in
    order, and never jumps**. Each step is the full guarded update of §6.1. **Why:** a step was tested
@@ -1031,6 +1034,52 @@ its length, and both fixes cost something the household would notice — operato
     Built in controller v0.314.0 (`internal/stacks/restore_gate.go`); pinned by `restore_gate_test.go` and
     `r1057_unit_gate_test.go` (ten mutations each seen failing). Proof: `audits/gate-restore-2026-10-15/9202/`.

+### 2026-10-23 (~12:00) — D39 = B: the security-fix step (operator ruling by starting the run; R-1239)
+
+255. **An urgent upstream security fix reaches the boxes at night as a `security_fix` ladder step: the box walk is
+     required, the bench is optional, and a public notice is the authority.** *Operator ruling 2026-10-23 ~12:00 (D39 =
+     B, R-1239), taken by starting the D39 brief; its design is Claude.ai's recommendation, taken with it.* Why: on
+     2026-10-23 the only route for the Plex2Shell fix was an operator word, `git push --no-verify` past the move gate,
+     and a hand press on each box — and the night leg never takes a step with no test record (R-1238). That does not
+     scale past the first customers and needs the operator awake.
+     1. **The entry** (`scripts/ladder.py` `check_security`, the one reader): `"verdict": "security_fix"` with `security`
+        `{ids: [CVE-…|GHSA-…], advisory: "https://…", fixed_in}`, `box_evidence` (required), `seed` `read_back`|`none`,
+        `memory_peak_pct` from the BOX soak with `memory_basis: "box_soak"`; `evidence` = the bench record or null — a
+        bench given must be `proven` (`bench_verdict`, `harness_version` ≥ 2 ride with it). Never `backfilled`,
+        `digest_from` (a same-tag fix stays decision 52's lane), `engine_conversion`, nor a database engine MAJOR (any
+        engine — MariaDB included; the judgement is `check-engine-major.py`'s own `engine_of`/`major_of`, imported).
+     2. **No operator word per incident.** The session that writes the step reports it to the operator after the push.
+     3. **The gates:** the move gate accepts a `security_fix` move exactly as a proven one (from/to per service, digests
+        the registry still serves); `check-test-record.py` WARNs on every push while a template's head is a security-fix
+        step with no bench test („<app>: security-fix step <to> has no bench test (since <tested_at>)"). Seven decoys
+        (`test_gate_decoys.py`), each seen failing with the rules switched off.
+     4. **The box venue:** `box_walk.py --security` on 9202 through the product's Update; verdict `proven` only if the
+        update ended `done` with no undo and no hold, the app runs, the four version observables are TO, the seed (if
+        any) reads back, and a soak (default 600 s, cgroup `anon` against the limit, OOM kills and restarts counted)
+        sees no kill and no restart. A negative control (a TO image that exits at once) comes back `failed`.
+     5. **The writer:** `upgrade-test.py --write-ladder --security …`, refusing a box walk not proven, a bench given and
+        not proven, a template not at the walk's FROM, a digest that moved since the walk, an engine major, a missing
+        field. The compose move, `catalog_since` and the superseded step's own files are the shared `apply_entry`.
+     6. **The controller (v0.341.0):** the leg takes `proven` OR `security_fix`; every other guard runs unchanged, in
+        the same order; it logs `[update-leg] <app>: security fix <ids> taken (<from> → <to>)` and the hub report's
+        step carries the ids. A person's press and the badge are unchanged. **A controller ≤ 0.340.0 skips the step at
+        night (`not_proven`) and a hand press takes it** — proven on 9202, below.
+     7. **The trade, stated.** A security-fix step skipped the bench. For an app with a box fixture the data is still
+        read back after the update; for an app without one (Plex today) the step is checked only by „it starts, it is
+        healthy, it runs the new version, and a 10-minute soak sees no kill or restart". `files_may_change` is a bench
+        measurement: with no bench the step carries `false`. That is accepted because the leg's own guard is not the only
+        net — the update takes a per-app backup first, the undo puts the pre-update data back on a failed health check
+        (decision 15), and a security fix that rewrites files without breaking the health check is the case the bench
+        would catch and this lane accepts the risk of. A session that knows a fix migrates files runs the bench.
+     **Proof (9202, drill catalog, 2026-10-23):** `audits/security-lane-2026-10-23/` — the negative control (TO
+     `busybox:1.36.1`) came back `failed` (the box undid it after 335 s) and the writer refused it; Plex 1.43.4.10903 →
+     1.43.5.11029 `proven` (done in 36.9 s, the four observables at TO, digest `sha256:01bdf0ad…5c5f`, soak 600 s: anon
+     peak 10.7 % of 2 GiB, 0 kills, 0 restarts, `seed: none`); the writer wrote the drill step (CVE-2026-96652, -96654,
+     -96655, -96656; Plex's own notice as CISA KEV cites it, added 2026-10-20; fixed in 1.43.3.10861); on 0.340.0 the
+     night leg logged `plex: skipped — not_proven` and a hand press took the step; on 0.341.0-rc.1 the night leg logged
+     `plex: security fix CVE-2026-96652,CVE-2026-96654,CVE-2026-96655,CVE-2026-96656 taken` and ended `done` in 30.1 s
+     after the update's second-drive copy and undo copy. Released as controller 0.341.0, global floor 11:24 UTC.
+
 ### 2026-10-15 (07:48–08:20) — bake first; Plex through its own key; HSTS one day (recorded before the media build)

 247. ~~**Bake first.** A controller version is RELEASED only when its golden is baked.~~ **REVERSED by decision 250,
@@ -36,6 +36,7 @@ decision (R-925).
 | g | a compromised Gitea / registry / build | push to the catalog, the images and the installer tag |
 | h | a thief with the box | the disks |
 | i | Cloudflare | the plaintext of tunnel traffic — **accepted** (R-904) |
+| j | **added 2026-10-23:** a hacked homelab app pod on DooPlex (happened: Plex2Shell, HM-040) | the pod network with free egress: every cluster Service, the node's ports (NFS, kubelet, k3s API), the LAN masqueraded as DooPlex; no service-account token |

 ## 4. Entry points

@@ -75,6 +76,7 @@ OS packages (exact versions, apt-signed), the installer script (by tag, R-980).
 | **added:** LAN ↔ box | partly | root password SSH on the host from the LAN (R-982) |
 | **added:** hub ↔ box (inbound) | **does not hold** | `01` §4 says the box exposes no control endpoint; a hub-key route can replace the box's settings (R-970) |
 | **added:** catalog ↔ every box | **design gap** | a catalog push reaches every box with no check on the box (R-971) |
+| **added 2026-10-23 (R-1241):** a hacked app pod on DooPlex ↔ Felhom's secrets | **does not hold**; not used in the Plex2Shell window | two no-login doors: the Longhorn NFS export (the hub's unencrypted nightly copies with the unsealed tokens of R-975; by a published file-handle escape the whole sda1 disk, the operator signing keys included — not exercised) and the Longhorn API (backup a volume to any target). Plex2Shell, 2026-10-17 → 10-23: **NOT REACHED** — 0 new NFS connections in the window, no off-schedule backup or volume; the hub, the k8s API and the kubelet refuse a caller with no credential (measured). The export was narrowed to the pod network on 2026-10-23; the pod side stays open (`audits/plex2shell-felhom-impact-2026-10-23/`) |

 ## 6. What we accept (do not re-report)

@@ -379,3 +379,28 @@
 **Gap / roadmap (as written):** Remaining ~39 apps are legacy-class by design (unit-only offsite)

 ---
+
+## B23 — An urgent security fix reaches the boxes at night (the security-fix step)
+
+*Map row: [B23](../00-capability-map.md#b23) · added 2026-10-23.*
+
+**Scenario:** an app has a published hole (a CVE or GHSA id with its notice) and a fixed upstream version. CC walks the
+step on scratch 9202 through the product's Update (`box_walk.py --security`: install at FROM, the guarded Update, the
+four version observables at TO, a 600 s memory soak), and the only writer turns a proven walk into a `security_fix`
+ladder step. Every box on controller >= 0.341.0 takes it at night with the usual guards (backup first, undo on a
+failed health check, held / stopped / needs_person / W+5h respected).
+
+**Components:** catalog `3898593` (`ladder.py check_security`, the two test-record gates, `upgrade-test.py --write-ladder
+--security`, `box_walk.py --security`); controller v0.341.0 (`legCandidate`).
+
+**Status:** **PROVEN-LIVE** on 9202 with the drill catalog, 2026-10-23.
+
+**Evidence:** `audits/security-lane-2026-10-23/` — the negative control (TO `busybox:1.36.1`) `failed` and the writer
+refused it; Plex 1.43.4.10903 → 1.43.5.11029 `proven`; on 0.340.0 the night leg logged `plex: skipped — not_proven` and
+a hand press took the step; on 0.341.0-rc.1 the night leg logged `plex: security fix CVE-2026-96652,… taken` and ended
+`done` after a second-drive copy and an undo copy.
+
+**Gap:** an app with no box fixture (Plex today, R-1238) is checked only by health, version and the soak — no data is
+read back. `files_may_change` is a bench measurement and reads `false` when no bench ran (decision 255 item 7).
+
+---
@@ -101,6 +101,7 @@ Footnote: "W = the household's backup window start, 02:30 by default. Tiers 1–
  - one namespace **per household** (whole-guest copies, each household's own key),
    with a NEUTRAL note under it (not a red gap box): "By design: each household holds the key to its own copies; the operator cannot open them without their recovery code." — *fix (c), 2026-10-09: this is a property of the design, not a gap, and a red box said the opposite of what it means.*
  - the **`operator`** namespace: two groups — **"hub database"** and **"DooPlex copy"** (code, password manager, secrets, signing keys).
+  - outside PBS, a plain folder: the **release copy** (images + agent packages, D33).
  Prune jobs on ep0: households keep one copy per week for 2 weeks (`keep-weekly 2`, R-1162, 2026-10-19; every new household's job is made with its namespace, R-1165); `operator` keeps 14 daily + 8 weekly.
  Mark ep0 with a small shield: "**Protected** — holds the only off-premises copy of real household data."
 - **Hetzner Storage Box** (grey): the shared box for the households' per-app restic copies (Tier 3), one sub-account per household, add-only keys.
@@ -121,8 +122,9 @@ Footnote: "W = the household's backup window start, 02:30 by default. Tiers 1–

 Arrows from DooPlex (dashed, orange → ep0):
 - **00:20 "DooPlex copy"**: the code (614 MB), Gitea's database and settings, the **password manager**, the nightly secrets export, the **signing keys**. Encrypted on DooPlex with the **DooPlex off-site key**. The key that writes it **cannot delete** old copies. Tested back every Sunday.
- **02:30 "Hub database"**: encrypted with the **hub-DB key**. Tested back every Sunday at 04:30.
- **Left out on purpose:** the container registry (27.7 GB) — "rebuilt from the code".
+- **02:30, 08:30, 14:30, 20:30 "Hub database"** (every 6 hours since 2026-10-23, D34): encrypted with the **hub-DB key**. Tested back every Sunday at 04:30.
+- **01:40 "Release copy"** (since 2026-10-23, D33): the newest 3 released images of the controller, hub and samba, and the newest 5 agent packages — not encrypted (nothing secret), into a plain folder on ep0 (`/srv/felhom-release-copy`, its own limited user, outside PBS), about 0.7 GB, capped at 3 GB.
+- **Left out on purpose:** the rest of the container registry (older tags, test builds, non-Felhom images) — "rebuilt from the code".
 Arrow ep0 → DooPlex (dashed, 05:00): "**ep0-copy** pull: a second copy of ep0 at home. Keeps 8 weekly copies. A daily job removes a deleted customer's copy within 30 days."

 **The test machines** (small, plain tiles near DooPlex, labelled "disposable"):
@@ -133,7 +133,7 @@ code{font-family: ui-monospace, "SFMono-Regular", Menlo, monospace; font-size: 1
 <div style="position: absolute; left: 1720px; top: 706px; width: 184px; font-size: 16px; line-height: 20px; font-weight: 400; color: #4a5670; text-align: center;">The hub never connects into a box.</div>
 <div style="position: absolute; left: 1720px; top: 784px; width: 184px; font-size: 16px; line-height: 20px; font-weight: 800; color: #a85400; text-align: center;">00:20 DooPlex copy</div>
 <div style="position: absolute; left: 1720px; top: 824px; width: 184px; font-size: 16px; line-height: 20px; font-weight: 400; color: #a85400; text-align: center;">DooPlex off-site key</div>
-<div style="position: absolute; left: 1720px; top: 872px; width: 184px; font-size: 16px; line-height: 20px; font-weight: 800; color: #a85400; text-align: center;">02:30 hub database</div>
+<div style="position: absolute; left: 1720px; top: 872px; width: 184px; font-size: 16px; line-height: 20px; font-weight: 800; color: #a85400; text-align: center;">every 6 h: hub database</div>
 <div style="position: absolute; left: 1720px; top: 912px; width: 184px; font-size: 16px; line-height: 20px; font-weight: 400; color: #a85400; text-align: center;">hub-DB key</div>
 <div style="position: absolute; left: 1720px; top: 962px; width: 184px; font-size: 16px; line-height: 20px; font-weight: 800; color: #0a3d73; text-align: center;">05:00 ep0-copy pull</div>
 <div style="position: absolute; left: 1720px; top: 1002px; width: 184px; font-size: 16px; line-height: 20px; font-weight: 400; color: #0a3d73; text-align: center;">ciphertext only</div>
@@ -0,0 +1,6 @@
+== 9202 smoke 06:37:25
+switched to gitea.dooplex.hu/admin/felhom-controller:0.340.0 at 06:37:28
+healthy after ~10s: Up 7 seconds (healthy)
+2026/10/23 06:37:28 [INFO] [tier2] start-up: no leftover second-drive copy container
+errors, unhealthy+restarting: 0 0
+login page: 200
@@ -0,0 +1,3 @@
+tester-1: HTTP/1.1 303 See Other Location: /customers/tester-1?flash=floor_set
+demo-hp: HTTP/1.1 303 See Other Location: /customers/demo-hp?flash=floor_set
+demo-felhom: HTTP/1.1 303 See Other Location: /customers/demo-felhom?flash=floor_set
@@ -0,0 +1,15 @@
+### root@192.168.0.154
+containers=10 unhealthy=0 restarting=0 gitea.dooplex.hu/admin/felhom-controller:0.340.0 Up 53 seconds (healthy)
+errors=0
+copy-containers=0
+2026/10/23 06:38:21 [INFO] [tier2] start-up: no leftover second-drive copy container
+### hp
+containers=24 unhealthy=0 restarting=0 gitea.dooplex.hu/admin/felhom-controller:0.340.0 Up 54 seconds (healthy)
+errors=0
+copy-containers=0
+2026/10/23 06:38:22 [INFO] [tier2] start-up: no leftover second-drive copy container
+### felhom-pve
+containers=9 unhealthy=0 restarting=0 gitea.dooplex.hu/admin/felhom-controller:0.340.0 Up 58 seconds (healthy)
+errors=0
+copy-containers=0
+2026/10/23 06:38:05 [INFO] [tier2] start-up: no leftover second-drive copy container
@@ -0,0 +1,33 @@
+control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
+== tester-1 (enkicsifelhom.hu): 6 public name(s)
+   OK   control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
+== demo-hp (enkisfelhom.hu): 14 public name(s)
+   OK   http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
+   OK   http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
+   OK   http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
+   OK   http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
+   OK   http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
+   OK   http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
+   OK   http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
+   OK   http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
+   OK   http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
+   OK   http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
+   OK   http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
+   OK   http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
+   OK   http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
+   OK   http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
+== demo-felhom (demo-felhom.eu): 8 public name(s)
+   OK   http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
+   OK   http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
+   OK   http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
+   OK   http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
+   OK   http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
+== every public name redirects http -> https
@@ -0,0 +1,13 @@
+== tester-1 (dashboard login with the household password, the press a browser makes)
+python3: can't open file '/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/38fde0c6-e964-4ec1-b0c7-56e62d675225/scratchpad/n23/fileswalk.py': [Errno 2] No such file or directory
+== demo-hp (no session): GET /__files/open -> HTTP/2 302  location: /login
+== demo-felhom (no session): GET /__files/open -> HTTP/2 302  location: /login
+== tester-1 06:40:35
+Fájlok press: GET /__files/open -> ['HTTP/2 302'] https://files.enkicsifelhom.hu/_felhom/sso
+manual second-drive copy: 200 2. mentés elindítva
+2026/10/23 06:40:43 [INFO] [backup] Tier 2 copied bookstack → /mnt/felhom-drives/adatlemez/backups/secondary/bookstack (157.0 MB, 0 leg(s), 1s)
+2026/10/23 06:40:46 [INFO] [backup] Tier 2 copied paperless-ngx → /mnt/sys_drive/felhom-data/backups/secondary/paperless-ngx (85.9 MB, 1 leg(s), 2s) [SSD: state-only]
+2026/10/23 06:40:48 [INFO] [backup] Tier 2 copied privatebin → /mnt/felhom-drives/adatlemez/backups/secondary/privatebin (16.4 KB, 0 leg(s), 0s)
+2026/10/23 06:40:48 [INFO] [backup] Tier 2 run complete: 3 app(s) processed (incl. volume-only — F6)
+copy-containers-left=0
+[exited with code 0]
@@ -0,0 +1,5 @@
+== global floor 06:41:04: HTTP/1.1 303 See Other Location: /configuration?flash=floor_set
+clear tester-1: HTTP/1.1 303 See Other Location: /customers/tester-1?flash=floor_set
+clear demo-hp: HTTP/1.1 303 See Other Location: /customers/demo-hp?flash=floor_set
+clear demo-felhom: HTTP/1.1 303 See Other Location: /customers/demo-felhom?flash=floor_set
+read back (with WAL): [('min_controller_version', '0.340.0', '2026-10-23 06:41:04'), ('min_controller_version_declared_min_agent', '0.340.0=0.158.1', '2026-10-23 06:41:04')]
@@ -0,0 +1,78 @@
+# Part 2 — agent 0.163.0 (operator go 2026-10-23), read 2026-10-23T07:28:53Z
+
+## release (scripts/release-agent.sh at felhom-agent 1109092, CI 2246 green; CHANGELOG b4721ee CI 2249 green)
+[release-agent] built ok: sha256 561b5316cd511de9fa9d8b8be4553da7add684f715d3bea533ca330ff7f3763c
+[release-agent] config bundle built: sha256 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8
+[publish-agent] upload OK (HTTP 201)
+[publish-agent] round-trip GET verified (sha256 matches)
+[release-agent] config bundle published (HTTP 201)
+    sha256  : 561b5316cd511de9fa9d8b8be4553da7add684f715d3bea533ca330ff7f3763c
+    bundle  : 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8   (felhom-config-bundle.json — vouch it with the agent)
+ * [new tag]         v0.163.0 -> v0.163.0
+
+## step bundle (R-880: the D4 drop-in is a NEW path; the boxes ran bundle 0.160.0 = 6b06090190ff609af1fe9842447ebf385fd52da4be382bc7ca708b558c8e202f)
+0.163.0-step1 = base 0.160.0 with only /usr/local/sbin/felhom-os-apply replaced; sha256 6cbc066902d5f3294765d5c7dc7113166c1dca25e994dbc36bfc5f139bb61fcf; PUT 201; read back by download: same sha
+
+## delivery: three signed jobs per box (felhom-opsign, key felhom-op-1): agent_update 06:48Z, agent_config_update 0.163.0-step1 06:59Z, agent_config_update 0.163.0 07:19Z
+
+## hp (192.168.0.104) 2026-10-23T07:26:29Z
+agent: felhom-agent 0.163.0
+bundle: 0.163.0 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8 2026-10-23T07:19:44Z
+      1 BUNDLE DONE agent=0.163.0 written=1 same=30 self-check=ok
+      2 BUNDLE DONE agent=0.163.0-step1 written=1 same=29 self-check=ok
+guest 9201: memory: 25898 swap: 25898 
+guest 9202: memory: 25898 swap: 512 
+guest 9401: memory: 10240 swap: 0 
+drop-in: -rw-r--r-- 1 root root 690 Oct 23 09:19 /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf
+drop-in content: PermitRootLogin prohibit-password
+sshd -T: permitrootlogin without-password
+root password set (passwd -S): P
+felhom-sshd: active; its root policy: permitrootlogin without-password
+felhom-sshd listens: 0.0.0.0:8822 [::]:8822  config test: ok; firewall admits only: elements = { 10.77.0.250 }
+main sshd reloaded after the drop-in: Oct 23 09:19:44 demo-hp sshd[1010]: Received SIGHUP; restarting. Oct 23 09:19:44 demo-hp systemd[1]: Reloaded ssh.service - OpenBSD Secure Shell server. 
+pveproxy: active
+main sshd banner from DooPlex (:22): SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4
+key login: ok
+root password attempt rc=255 (non-zero = refused)
+Oct 23 09:26:37 demo-hp sshd-session[3026730]: Failed password for root from 192.168.0.180 port 34150 ssh2
+## root@192.168.0.154 (192.168.0.154) 2026-10-23T07:28:00Z
+agent: felhom-agent 0.163.0
+bundle: 0.163.0 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8 2026-10-23T07:27:38Z
+      2 BUNDLE DONE agent=0.163.0 written=1 same=30 self-check=ok
+      2 BUNDLE DONE agent=0.163.0-step1 written=1 same=29 self-check=ok
+guest 9201: memory: 4096 swap: 4096 
+guest 990000: memory: 4096 swap: 512 
+drop-in: -rw-r--r-- 1 root root 690 Oct 23 09:27 /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf
+drop-in content: PermitRootLogin prohibit-password
+sshd -T: permitrootlogin without-password
+root password set (passwd -S): P
+felhom-sshd: active; its root policy: permitrootlogin without-password
+felhom-sshd listens: 0.0.0.0:8822 [::]:8822  config test: ok; firewall admits only: elements = { 10.77.0.250 }
+main sshd reloaded after the drop-in: Oct 23 09:27:38 felhom sshd[890]: Received SIGHUP; restarting. Oct 23 09:27:38 felhom systemd[1]: Reloaded ssh.service - OpenBSD Secure Shell server. 
+pveproxy: active
+main sshd banner from DooPlex (:22): SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4
+key login: ok
+root password attempt rc=255 (non-zero = refused)
+Oct 23 09:28:08 felhom sshd-session[4184378]: Failed password for root from 192.168.0.180 port 33442 ssh2
+## felhom-pve (192.168.0.162) 2026-10-23T07:28:11Z
+agent: felhom-agent 0.163.0
+bundle: 0.163.0 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8 2026-10-23T07:24:43Z
+      2 BUNDLE DONE agent=0.163.0 written=1 same=30 self-check=ok
+      2 BUNDLE DONE agent=0.163.0-step1 written=1 same=29 self-check=ok
+guest 9201: memory: 12288 swap: 12288 
+drop-in: -rw-r--r-- 1 root root 690 Oct 23 09:24 /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf
+drop-in content: PermitRootLogin prohibit-password
+sshd -T: permitrootlogin without-password
+root password set (passwd -S): P
+felhom-sshd: active; its root policy: permitrootlogin without-password
+felhom-sshd listens: 0.0.0.0:8822 [::]:8822  config test: ok; firewall admits only: elements = { 10.77.0.250 }
+main sshd reloaded after the drop-in: Oct 23 09:24:42 demo-felhom sshd[1011]: Received SIGHUP; restarting. Oct 23 09:24:42 demo-felhom systemd[1]: Reloaded ssh.service - OpenBSD Secure Shell server 
+pveproxy: active
+main sshd banner from DooPlex (:22): SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4
+key login: ok
+root password attempt rc=255 (non-zero = refused)
+
+## notes
+- felhom-sshd :8822 admits only the operator peer 10.77.0.250 over wg-felhom (H1); a connection test from DooPlex times out BY DESIGN — proven: active, listening, sshd -t ok, firewall set.
+- a dummy root password is logged as 'Failed password' (OpenSSH refuses a root password silently under prohibit-password); the policy proof is sshd -T + the SIGHUP reload after the drop-in. The real root password was not tried (CC does not hold it).
+- guests 9202, 9401 (demo-hp) and the transient 990000 (Tester 1, gone a minute later) are outside the felhom pool; swap = RAM applies to pool guests (9201 on all three: swap = memory).
@@ -0,0 +1,53 @@
+# Part 6 — D33: the released images and agent packages to ep0 nightly (operator yes 2026-10-23), 2026-10-23T07:51:56Z
+
+## ep0 — free space first, then ONE user and ONE directory (nothing else on ep0 changed)
+before: /dev/sda1 38G 23G used 14G free 63% (/mnt/pbs-datastore is the PBS datastore root — not used)
+created: user felhom-relcopy (system, uid 999, password locked 'L', shell /bin/sh for the forced command), /srv/felhom-release-copy (0750) with data/ and .ssh/authorized_keys:
+  command="/usr/bin/rrsync /srv/felhom-release-copy/data",restrict ssh-ed25519 <the job key, felhom-release-copy@dooplex>
+fence test: rsync --list-only OK; a shell command → 'rrsync error: SSH_ORIGINAL_COMMAND does not run rsync'; '..' → 'do not use .. in arg'
+after the first copy: /dev/sda1 38G 24G used 13G free 65%; /srv/felhom-release-copy/data 677M
+cap: CAP_MB=3072, enforced by the sender (ep0's root fs has no quota; a quota would change more than one directory)
+
+## DooPlex — the job (felhom.eu d306b8c2): /usr/local/sbin/felhom-release-copy + .service + .timer (01:40), /etc/felhom-release-copy/{env,id_ed25519,known_hosts,registry-token}
+registry token: a NEW Gitea access token for user admin, name felhom-release-copy-d33, scope read:package ONLY — minted inside the gitea pod straight into /etc/felhom-release-copy/registry-token (0600 root); never printed
+known_hosts: ep0's ed25519 host key, SHA256:NGtcS5v3K+9UjMTM6X5Ib0CoChdhqj9bezLz1hOUqgY — equal to the key already pinned for root@ep0
+skopeo, not docker save: skopeo dir: keeps the registry's manifest bytes and compressed blobs, so a push back gives the SAME digest (docker save re-compresses → a new digest); no Docker daemon needed
+
+## the first run (systemctl start, under the unit's sandbox)
+2026-10-23T09:48:33+02:00 dooplex felhom-release-copy[1567269]: felhom-release-copy: felhom-controller: keeping 0.338.0, 0.339.0, 0.340.0
+2026-10-23T09:48:37+02:00 dooplex felhom-release-copy[1567269]: felhom-release-copy: felhom-hub: keeping 0.164.0, 0.165.0, 0.166.0
+2026-10-23T09:48:43+02:00 dooplex felhom-release-copy[1567269]: felhom-release-copy: felhom-samba: keeping 1.0.0, 1.1.0, 1.2.0
+2026-10-23T09:48:47+02:00 dooplex felhom-release-copy[1567269]: felhom-release-copy: felhom-agent: keeping 0.159.2, 0.160.0, 0.161.0, 0.162.0, 0.163.0
+2026-10-23T09:48:51+02:00 dooplex felhom-release-copy[1567269]: felhom-release-copy: staged and verified: 676 MB, new this run: felhom-controller:0.338.0, felhom-controller:0.339.0, felhom-controller:0.340.0, felhom-hub:0.164.0, felhom-hub:0.165.0, felhom-hub:0.166.0, felhom-samba:1.0.0, felhom-samba:1.1.0, felhom-samba:1.2.0
+2026-10-23T09:49:51+02:00 dooplex felhom-release-copy[1567269]: felhom-release-copy: pushed to ep0 and compared by checksum: no difference (91 s)
+2026-10-23T09:49:51+02:00 dooplex felhom-release-copy[1567269]: felhom-release-copy: success signal written
+2026-10-23T09:49:51+02:00 dooplex systemd[1]: felhom-release-copy.service: Consumed 30.416s CPU time, 743.1M memory peak.
+
+## read back from ep0 (rsync pull with the job key → /var/lib/felhom-release-copy/readback)
+sha256sum -c SHA256SUMS: every file OK (141 files), 677 MB
+every image re-verified (top manifest = its digest, every blob = its name):
+  felhom-controller 0.338.0 sha256:e8a529f395bfe8c0e7b87d5d98929a6f8e9834aa13c0ab77bd214ee9e7e53433
+  felhom-controller 0.339.0 sha256:fee71aafceb4a7d5f24ae4a6a273a8d51eb26e0550fe9d12d4d86955f6a343a8
+  felhom-controller 0.340.0 sha256:a8d1c6458da4ea9d667f928498656a291771e0b3756b20f2fcc8c1cf9d516621
+  felhom-hub 0.164.0 sha256:931594e333a4e8a9784eff2fb144d022ab46f89dd6a865a93e6100dc28dbd9dc
+  felhom-hub 0.165.0 sha256:c6180fb79a2ff7d5546a704c68b634b9207afb0a0ecd524c74b0310434532537
+  felhom-hub 0.166.0 sha256:829667bb289c790bc99719e88dad8f7d08faaa9f662df1e9a06b1774915a1af6
+  felhom-samba 1.0.0 sha256:0fa9fae3eaa9d48836c855a4884f0751a90ff050dc9e7d17e41d93bb434499c0
+  felhom-samba 1.1.0 sha256:1c17c09422bec0366d7cf0e0fcfc1486ba6c90334a0a5d5c851073a9342f8f10
+  felhom-samba 1.2.0 sha256:da96f25033827fbb77d0ee398e86fe5b744e2f29be9de898994533340c97acf9
+  agent 0.159.2 binary 4d98868e922d6c10665a6c0da9323e8627ea9c589094e81d27d741e625d9d8f9 bundle 477704ea2980948433ffc34bb59f008cc11410fd9683d386bfd3e2f085d55bc9
+  agent 0.160.0 binary 7ebb547f2b1ab93544ba828d3040351b60c4126327a5b85bbcb33f8f2b3dfca1 bundle 6b06090190ff609af1fe9842447ebf385fd52da4be382bc7ca708b558c8e202f
+  agent 0.161.0 binary ff4e6dc52dd70234913445ecdeb88d31dea8e394d77c48704d26ff19b999d3b5 bundle 485f36c957d83f772aa22cac24e5e73f44da5cf8b957b1fd513bec2bc1d12c47
+  agent 0.162.0 binary 5fd7a23bfe319cb521c4bc399612d5fb3413f1e695f79bc663c386f69c757928 bundle ac772967fd4669045e837a70bf5acca239c58d55f7f00212e472a8facd60b5a5
+  agent 0.163.0 binary 561b5316cd511de9fa9d8b8be4553da7add684f715d3bea533ca330ff7f3763c bundle 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8
+independent controls (other channels): controller 0.340.0 = the release digest from build.sh (03-release-0340-boxes.txt); hub 0.165.0 = the running hub pod's imageID; hub 0.164.0 = hub/CHANGELOG; agent 0.163.0 = release-agent.sh today; agent 0.161.0 = night2-2026-10-20/P1/1b; bundle 0.160.0 = the three boxes' installed bundle_sha256
+
+## load on a scratch machine (9202 on demo-hp, Tier 0)
+the ep0 copy of felhom-controller 0.340.0 → skopeo docker-archive (amd64) → pct push 9202 → docker load:
+  Loaded image: felhom-restorecopy-test:0.340.0; ID=sha256:3f34d74519463c338422594b70c31d9c5beabed48847134c6d26b5a95ebbae2b = the copy's amd64 config digest; a container ran (ls /)
+  teardown: image untagged (0 left), the tar removed on 9202, on demo-hp /tmp and on DooPlex
+
+timer: Sat 2026-10-24 01:42:16 CEST  15h -         - felhom-release-copy.timer felhom-release-copy.service
+
+## alarm (homelab-manifests 1bbef892): FelhomReleaseCopyStale (> 26 h or absent, warning) — promtool check: 7 rules OK; promtool test: quiet at 25 h, fires at 27 h
+synced ConfigMap mon-system/prometheus-rules only; POST /-/reload 200; /api/v1/rules: FelhomReleaseCopyStale inactive ok; metric age at read ~3235 s
@@ -0,0 +1,10 @@
+no guest references the three
+BEFORE: /dev/mapper/pve-root   39G   29G  8.5G  77% /
+Removed volume 'local:iso/felhom-installer-1.27.1-pve9.2-1.iso'
+removed local:iso/felhom-installer-1.27.1-pve9.2-1.iso
+Removed volume 'local:iso/felhom-installer-1.28.0-pve9.2-1.iso'
+removed local:iso/felhom-installer-1.28.0-pve9.2-1.iso
+Removed volume 'local:iso/felhom-installer-1.29.0-pve9.2-1.iso'
+removed local:iso/felhom-installer-1.29.0-pve9.2-1.iso
+AFTER: /dev/mapper/pve-root   39G   24G   14G  64% /
+local:iso/felhom-installer-1.30.0-pve9.2-1.iso iso     iso       1705324544
@@ -0,0 +1,16 @@
+# The vouch read-back — agent 0.163.0 (the operator vouched on the hub, answered 'Vouched now'), read 2026-10-23T08:00:42Z
+
+## channel 1: hub DB (hub.db + -wal + -shm in ONE tar from the pod), hub_settings
+artifact_agent_sha256|561b5316cd511de9fa9d8b8be4553da7add684f715d3bea533ca330ff7f3763c|2026-10-23 07:58:46
+artifact_agent_version|0.163.0|2026-10-23 07:58:46
+artifact_bundle_sha256|3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8|2026-10-23 07:58:46
+artifact_golden_sha256|3881de62b0986ccbe5e55580e3f1bb9765d65b8d898f67c6339bac105244f84f|2026-10-23 07:58:46
+artifact_golden_version|0.331.0|2026-10-23 07:58:46
+artifact_min_agent|0.158.1|2026-10-23 07:58:46
+artifact_wrapper_sha256||2026-10-23 07:58:46
+
+## channel 2: the running hub's operator page GET /configuration (CC's token), the selected options
+value="0.163.0" data-sha="561b5316cd511de9fa9d8b8be4553da7add684f715d3bea533ca330ff7f3763c" selected>0.163.0
+value="0.331.0" data-sha="3881de62b0986ccbe5e55580e3f1bb9765d65b8d898f67c6339bac105244f84f" selected>0.331.0
+
+agent 0.163.0 sha256 = the release (561b5316…); bundle sha256 = the release (3afb88d9…). Golden 0.331.0 unchanged. The floor's MinAgent stays 0.158.1 (artifact_min_agent 0.158.1; controller 0.340.0 declares 0.158.1).
@@ -0,0 +1,13 @@
+# Installer 1.36.0 published (operator yes 2026-10-23), read 2026-10-23T08:16:46Z
+
+1. bump: felhom.eu 83388c08 (SCRIPT_VERSION 1.36.0; scripts/test_hostinstall.py 40 passed; CI 2247 success)
+2. tag: installer-v1.36.0 (annotated d00f868c) -> 83388c08, pushed
+3. pins: manifests/webpage.yaml both --ref=installer-v1.36.0 (sidecar git-sync-scripts + init git-sync-scripts-init), commit 2aebf1bd;
+   ArgoCD: only Deployment felhom-system/felhom-webpage was OutOfSync; synced that ONE resource at revision 2aebf1bd; rollout ok;
+   live args: git-sync-scripts-init ['--ref=installer-v1.36.0'], git-sync-scripts ['--ref=installer-v1.36.0'], website git-sync ['--ref=main'] (unchanged)
+4. read back: curl https://felhom.eu/scripts/felhom-host-install.sh
+   SCRIPT_VERSION="1.36.0"   # the SINGLE version source (F-1): -h and the run banners follow it.
+   sha256 served   = de8bf5f32cbcda44c9976ba829f04ea151e3b30634b54d5fdd9eb6c4a0351cec
+   sha256 tag file = de8bf5f32cbcda44c9976ba829f04ea151e3b30634b54d5fdd9eb6c4a0351cec
+   the drop-in name 10-felhom-root-key-only appears 2 times (the uninstall's removal)
+Rollback: move the tag back to installer-v1.35.0's commit and wait ~30 s (no sync).
@@ -0,0 +1,4 @@
+# Website publish read-back (felhom.eu 0bb57a4f, operator yes 2026-10-23)
+Method: headless Chromium (playwright 1.61.1 image) on the LIVE site; the FAQ answer opened by a click; 390x844 (phone) and 1366x900 (computer).
+No page scrolls sideways at either size (scrollWidth == viewport on all 10 shots).
+Text: see text-check.txt (new sentences present; the old 'only encrypted (the remote backup)' gone; control: HEAD~1 had it twice).
@@ -0,0 +1,7 @@
+waited ~0 s
+NEW letoltes 'az alapokat futtatja' count 1 (want 2 on the FAQ: visible + JSON-LD; 1 on download)
+NEW en/download 'runs the basics; the photo app needs 16 GB' count 1 (want 2 on the FAQ: visible + JSON-LD; 1 on download)
+NEW gyik 'a Cloudflare h' count 4 (want 2 on the FAQ: visible + JSON-LD; 1 on download)
+NEW en/faq "passes through Cloudflare's network and is readable there" count 2 (want 2 on the FAQ: visible + JSON-LD; 1 on download)
+OLD gyik 'otthonodat (a t' live 0 (want 0); control HEAD~1 2 (want 2)
+OLD en/faq 'leaves your home only encrypted (the remote backup)' live 0 (want 0); control HEAD~1 2 (want 2)
@@ -0,0 +1,43 @@
+# Part 5 — D34: the hub DB off-site every 6 hours (operator yes 2026-10-23), 2026-10-23T08:41:15Z
+
+## what changed
+- hub 0.167.0 (deployed 08:27Z, image sha256:177860a9…): snapshots at 02:00 08:00 14:00 20:00 Budapest; start-up catch-up when the newest > 6 h. Hub log at start:
+    2026/10/23 10:28:12 [INFO] db-snapshot 08:00: next run at 2026-10-24 08:00 CEST (in 21h31m48s)
+    2026/10/23 10:28:12 [INFO] db-snapshot 14:00: next run at 2026-10-23 14:00 CEST (in 3h31m48s)
+    2026/10/23 10:28:12 [INFO] db-snapshot 20:00: next run at 2026-10-23 20:00 CEST (in 9h31m48s)
+    2026/10/23 10:28:12 [INFO] db-snapshot 02:00: next run at 2026-10-24 02:00 CEST (in 15h31m48s)
+    2026/10/23 10:30:06 [INFO] db snapshot written: hub-20261023T082812Z.db (525996032 bytes, 1m54.537s); pruned 1, keeping 2
+- DooPlex felhom-hub-db-backup (felhom.eu 52af38df): timer 02:30 08:30 14:30 20:30; waits ≤ 20 min for a snapshot being written; refuses a newest snapshot older than 7 h
+- R-1234 (closed): the first version (2 h, no wait, be7e97dc) refused the timer's own catch-up at 10:28 CEST and mailed admin@ once — fixed in 52af38df
+
+## retention (ep0, server-side, unchanged): prune-job prune-operator-hubdb, ns operator, 03:45, keep-daily 14, keep-weekly 8
+=> the current day's copies (up to 4) stay until the next 03:45 prune, then the newest of each day for 14 days and one per week for 8 weeks. Size per copy: 501.6 MiB raw, 24.5 MiB uploaded (compressed, dedup'd chunks).
+
+## run once by hand (systemctl start felhom-hub-db-backup.service, 10:39 CEST)
+2026-10-23T10:39:33+02:00 dooplex felhom-hub-db-backup[2374380]: felhom-hub-db-backup: snapshot hub-20261023T082812Z.db, 11 min old
+2026-10-23T10:39:45+02:00 dooplex felhom-hub-db-backup[2374380]: felhom-hub-db-backup: checked: 525996032 bytes, integrity ok, 4 host(s)
+2026-10-23T10:39:48+02:00 dooplex felhom-hub-db-backup[2377041]: hubdb.pxar: had to backup 501.629 MiB of 501.629 MiB (compressed 24.471 MiB) in 2.47 s (average 203.437 MiB/s)
+2026-10-23T10:39:49+02:00 dooplex felhom-hub-db-backup[2377041]: Duration: 3.21s
+2026-10-23T10:39:49+02:00 dooplex felhom-hub-db-backup[2374380]: felhom-hub-db-backup: pushed hub-20261023T082812Z.db to ep0 (ns operator) in 4 s
+2026-10-23T10:39:49+02:00 dooplex felhom-hub-db-backup[2374380]: felhom-hub-db-backup: success signal written
+
+## read back: restore the NEWEST copy from ep0 with the READ-ONLY token into a scratch dir (shredded after)
+15 copies on ep0, oldest 2026-10-10T00:30:56Z
+newest copy on ep0: host/dooplex-hub/2026-10-23T08:39:45Z
+Using encryption key from '/etc/felhom-hub-backup/enc.key'..    
+Fingerprint: b2:19:bf:36:3b:97:3d:6c    
+restore complete (501.629 MiB processed in 5.4s, average 92.519 MiB/s)    
+restored size: 525996032 bytes
+restored sha256: a9ff4c8a0d0fe34da72411d9c165e573069f5601492d1e625578464f56adbde7
+integrity_check: ok
+SELECT COUNT(*) FROM hosts: 4
+SELECT value FROM hub_settings WHERE key='artifact_agent_version': 0.163.0
+pod snapshot hub-20261023T082812Z.db: 525996032 bytes, sha256 a9ff4c8a0d0fe34da72411d9c165e573069f5601492d1e625578464f56adbde7 (kubectl exec sha256sum — a different channel from the restore)
+=> byte-identical; it holds today's vouch (artifact_agent_version 0.163.0, set 07:58Z) — a nightly copy could not
+
+## timers
+Fri 2026-10-23 14:30:08 CEST 3h 48min Fri 2026-10-23 10:28:30 CEST 12min ago felhom-hub-db-backup.timer felhom-hub-db-backup.service
+
+## alarm (homelab-manifests 1bbef892): HubDBBackupStale 26 h -> 13 h (two missed 6-hourly pushes)
+promtool test: quiet at 12 h, fires at 14 h; RED-PROOF: the rule at 26 h fails the 14 h case
+in force: /api/v1/rules shows the 13 * 3600 expression, inactive ok; metric age at read ~237 s
@@ -0,0 +1,21 @@
+# Part 3 — hub 0.167.0 deploy and the 30-minute watch (operator yes 2026-10-23), read 2026-10-23T08:56:31Z
+
+build: clean clone at d306b8c2 (hub/ unchanged since be7e97dc, CI 2250 success; d306b8c2 CI 2251 success before the deploy); hub tests rc 0 (28 packages)
+image: gitea.dooplex.hu/admin/felhom-hub:0.167.0 sha256:177860a996cb285d935777d6ffdf85725f6cf4489885f54fd3bf8135c68041a0
+manifest 34979d5d; ArgoCD: only Deployment felhom-system/hub OutOfSync; synced that one resource; rollout ok 08:27:34Z; pod imageID = the digest above; Synced/Healthy
+
+## watch 08:27:34Z → 08:56:31Z — channel 1: the hub DB (with WAL) + log
+events since the deploy: 0 (newest event 07:07:10Z Tester4 host_down — the expected dead test box; 161 events since 2026-10-22: the table is live)
+host report|demo-felhom-8363b5|2026-10-23 08:54:54|2
+host report|demo-hp-bb76ea|2026-10-23 08:49:41|2
+host report|tester-1-d70be4|2026-10-23 08:42:35|1
+controller report|demo-felhom|2026-10-23 08:53:20|3
+controller report|demo-hp|2026-10-23 08:53:24|3
+controller report|tester-1|2026-10-23 08:53:23|3
+hub log since deploy: 0 [ERROR]; 'osupdates: alarm check done … 0 alarm(s) sent'; 'Host staleness checker initialized: 3 ok, 1 already alarmed (seeded silently, R-1001)' — Tester4 not re-mailed
+
+## channel 2: the operator mailbox (Gmail connector, to:admin@felhom.eu newer_than:1d)
+after 08:27Z: ONE mail, 08:28:32Z '[DooPlex backup] FAILED: felhom-hub-db-backup.service' — NOT from the hub: CC's install of the 6-hourly timer (R-1234, closed, fixed 52af38df). No hub mail after the deploy.
+before the deploy (control that the channel delivers): 07:07:11Z Tester4 host_down, 07:04:11Z node_down, 06:22Z/06:19Z stale — the hub's mails do arrive
+
+verdict: no new false alarm from the hub in the 30 minutes after the deploy; one CC-caused DooPlex mail, filed and fixed
@@ -0,0 +1,104 @@
+# The hub's last plain tokens, sealed (R-975, R-1241's Felhom half) — 2026-10-23 night
+
+Class: implementation (hub 0.168.0, built, **not deployed**) + a design for the backup copies (Part 1.4).
+Architecture read: `architecture/05-hub-architecture.md` §16.2–§16.3 (sealing, the snapshot), `13-threat-model.md`
+(attacker j, R-1241), `audits/plex2shell-felhom-impact-2026-10-23/README.md`. Names and places only — no value appears
+here or in any file of this session. Every count below came from a read-only copy of the hub's own 14:00Z snapshot
+(`VACUUM INTO`, so it holds every committed write), copied to a 0700 scratch folder and deleted after.
+
+## 1. Every hub column that holds a secret (measured, 2026-10-23)
+
+| Where | What | Before 0.168.0 | 0.168.0 |
+|---|---|---|---|
+| `hosts.api_key` | each box's hub key | sealed (R-879, 0.138.0) — 4/4 | same |
+| `customer_configs.api_key`, `retrieval_password` | controller key, owner passphrase | sealed (R-879) — 5/5 each | same |
+| `host_pbs_secrets.value` | PBS-DR token | sealed (R-879) — 4/4 | same |
+| `one_time_secrets.value` | Storage Box sub-account password | sealed (R-821, 0.127.0) — 4/4 | same |
+| `host_recovery.secret` | break-glass console password | sealed (R-133, 0.135.0) — 4/4 | same |
+| **`customer_configs.config_json` → `infrastructure.cf_tunnel_token`** | Cloudflare tunnel token | **plain — 4 rows** | **sealed** |
+| **`customer_configs.config_json` → `infrastructure.cf_api_token`** | Cloudflare API token | **plain — 4 rows** | **sealed** |
+| **`customer_configs.config_json` → `git.token`** | git token (the form still accepts one) | none stored today | **sealed** when written |
+| `host_escrow.blob`, `identity_blob`; `host_escrow_superseded.*` | escrow | age-wrapped by the household's recovery code — not the hub's to seal | same |
+| `api_tokens.token_hash`, `selfbind_tokens.token_hash`, `appliance_registrations.token_hash`, `customer_claims.code_hash`, `hub_settings[operator_password_hash]` | operator tokens, bind tokens, claim codes, operator password | one-way hashes (SHA-256 / bcrypt) | same |
+| `hosts.api_key_hash`, `customer_configs.api_key_hash` | lookup twins | unkeyed SHA-256 of a 256-bit random key (R-879) | same |
+| `wg_peers.pubkey`, `wg_endpoints.server_pubkey`, `host_escrow.key_fingerprint`, `appliance_registrations.ssh_host_pubkeys`, `hub_settings[oob_operator_ssh_pubkey]` | public keys, fingerprints | not secret | same |
+| `guests.api_key` | unused column | empty 7/7 | same |
+| `appliance_registrations.pairing_code` | 6-character console code | plain, 31 rows | **NOT-A-FINDING:** it is printed on the box's screen and is only one of two factors; the other (the self-bind token) is stored as a hash. Pending registrations only. |
+
+**Do the token VALUES sit anywhere else?** Each of the 8 distinct Cloudflare values was searched (by value, in memory,
+never printed) in every column of every other table: **0 hits**. The key NAME `cf_tunnel_token` appears in one
+`reports.report_json` and one `app_telemetry.issues_json` row — names, not values. `events.details_json` carries
+`repo_key` (literally the word „changed") and PBS `token_id`s (a name like `user@pbs!name`, not a secret).
+
+## 2. The change (hub 0.168.0)
+
+- **Same mechanism, same key** (`05` §16.2): each token leaf in `config_json` holds `enc:v1:` + AES-256-GCM under
+  `OFFSITE_SECRET_KEY`. The rest of the JSON stays readable. `internal/store/r975_config_token_seal.go`.
+- **New writes sealed:** `SaveCustomerConfig` (the only writer of `config_json`). No key and a token → refused.
+- **Every reader opens through the existing helper:** `openCustomerSecrets`, which the three readers
+  (`GetCustomerConfig`, `GetCustomerConfigByAPIKey`, `ListCustomerConfigs`) already call. A leaf that does not open is
+  blanked and sets `SecretsUnreadable` (R-879's rule: never served, a save refuses the record, `configgen.Generate` refuses).
+- **Old rows sealed once at start-up:** `SealLegacyConfigTokens`, logged as `config tokens sealed at rest (N legacy
+  plaintext token(s) sealed now)` — counts only. **No `config_version` bump** — the box's config is byte-for-byte the
+  same, so no box re-pulls or restarts. Expected on the live hub: N = 8 on the first start, 0 after.
+- **Then one `VACUUM` + WAL checkpoint** (only when N > 0): an `UPDATE` leaves the old plaintext row in a freed block of
+  `hub.db` (the SQLite driver's `secure_delete` is 0 — measured). Timed on a copy of the live 534 MB database: **2.8 s**,
+  well inside the liveness probe's ~95 s. The volume has 2.4 GB free for it.
+- **Roll-back:** `felhom-hub -unseal-box-secrets` now also opens these leaves (all or nothing), so going back to
+  0.167.0 stays the documented procedure (`05` §16.2). Without it an older hub would hand the box the sealed string as its
+  tunnel token.
+
+**Tests, each red-proved** (the rule broken on purpose → the test failed → restored):
+
+| Test | Pins | Red-proof (mutation → failed) |
+|---|---|---|
+| `TestR975_FreshWriteIsStoredSealed` | a fresh write is sealed; non-secret fields intact; no key → refused | write path unsealed → FAIL (with 5 others) |
+| `TestR975_ReaderGetsTheSameValue` | all three readers + a load-modify-save return the same value | open on read removed → FAIL |
+| `TestR975_MigrationSealsOnceThenNoOp` | 3 sealed, then 0; no `config_version`/`updated_at` change | migration no-op → FAIL; migration bumps the version → FAIL |
+| `TestR975_DBFileWithoutKeyRevealsNoToken` | **a copy of `hub.db` + `-wal` + `-shm` greps clean**; positive control: the pre-0.168.0 rows DO show in the file | VACUUM removed → FAIL (the old row stays in a freed block) |
+| `TestR975_WrongKeyBlanksAndRefusesSave` | wrong key → blanked, flagged, save refused, right key restores | not blanked → FAIL; flag ignores the tokens → FAIL |
+| `TestR975_UnsealRestoresPlaintextForAnOlderHub` | roll-back opens the tokens, all or nothing | the config half skipped → FAIL |
+| `TestR975_EveryFormSecretIsSealed` (web) | every leaf the operator form writes is either on a 2-name non-secret list or sealed | write path unsealed → FAIL |
+| `TestR975_GeneratedConfigCarriesThePlainTunnelToken` (configgen) | the box still gets the REAL token in `controller.yaml` | open on read removed → FAIL |
+
+Two first mutations broke the build instead of a test (an unused variable) and were redone so a test, not the
+compiler, failed. The first version of the file test passed with the VACUUM removed — the token row was the last cell on
+its page, so the new row overwrote it; a second customer written after it (as on the live hub) made the test honest.
+
+**Measured on the live file (count of the key name only):** `cf_tunnel_token` occurs 12 times both in the live
+`hub.db` and in the clean `VACUUM INTO` snapshot, so the live file holds no extra old copies today.
+
+## 3. The backup copies — design only (Part 1.4)
+
+**What exists today (measured):**
+
+| Copy | Where | Encrypted? | Holds the tokens? |
+|---|---|---|---|
+| Hub snapshots `<data>/snapshots/` (2, 6-hourly) | the hub's Longhorn volume | no (the volume is `encrypted=false`) | after 0.168.0: sealed |
+| **Longhorn backups of the hub volume** | `/mnt/5_hdd/backup/longhorn-pvc` (the NFS folder of R-1241) — **2 backups: 2026-10-18 03:00Z (weekly) and 2026-10-23 02:01Z (daily)**, ~4.1 GB each, `retain 1` each | **no** | **yes, in plaintext** — both predate 0.168.0 |
+| The hub's own copy to ep0 (`felhom-hub-db-backup`, 6-hourly :30) | ep0 PBS, namespace `operator` | **yes, at rest:** 16 snapshots 2026-10-10 → 10-23, every `hubdb.pxar.didx` and catalog `crypt-mode: encrypt` (`index.json.blob` sign-only). The key `/etc/felhom-hub-backup/enc.key` is on DooPlex's **root disk (sdb1)**, not on the NFS disk, and on paper (S2). **In transit:** SSH port-forward `127.0.0.1:18007` + PBS TLS with a pinned fingerprint. Last push 14:31 CEST today, 7 s; the weekly restore-test last passed 2026-10-18 („4 sealed console password(s), 0 readable"). | sealed after 0.168.0 |
+
+**The two options:**
+
+| | (a) Encrypt the hub's Longhorn volume | (b) Take the hub volume out of the Longhorn NFS backup |
+|---|---|---|
+| What | A new Longhorn volume with `encrypted=true` (a StorageClass with a crypto Secret), copy `/data` across, point `manifests/hub.yaml` at it | Remove the volume from the `default` recurring-job group (one label on the Longhorn volume); the ep0 copy is the hub's only backup |
+| Hub downtime | ~5–10 min (scale to 0, copy 1.5 GB, scale up) | none |
+| Who | homelab (a StorageClass + Secret in `longhorn-system`) + a Felhom manifest change | homelab (the Longhorn volume label); no Felhom code |
+| New key to keep | yes — the volume passphrase, on paper, and it lives in the cluster where the R-1241 attacker reaches the Longhorn API | none |
+| What it fixes | the backups stay but are ciphertext; also the volume's freed blocks | no more hub copies in the NFS folder at all |
+| What it loses | nothing | the hub's 90-day access log (`/data/access-log`, R-1140) and its local snapshots are no longer backed up anywhere; a lost volume is restored from ep0 (`RUNBOOK-hub-db-offsite-backup.md` §restore, restore-tested weekly) — at most ~6.5 h of hub data lost, the same as today's off-site promise |
+| Does the encryption key sit next to the data? | yes (cluster Secret) | the PBS key is on another disk and on paper |
+
+**CC's pick: (b)**, because the ep0 copy is already encrypted at rest and in transit (measured above), off-site, every 6
+hours, and restore-tested weekly — the Longhorn copy adds a second, unencrypted copy in exactly the folder R-1241 found
+open, and (a) would put its key in the same cluster. The access log's loss can be closed later by adding
+`/data/access-log` to the ep0 push (small; not tonight). → decide row **R-1243**.
+
+**The plain copies already in the folder** (the two hub-volume backups above): they hold today's tokens in plaintext.
+Deleting backups is the operator's decision. Without action they rotate out by themselves after 0.168.0 is deployed —
+the daily one at the next 04:00 run, the weekly one at the next Sunday 05:00 run (`retain 1` each) — **but only if the
+volume stays in the backup job** (option a, or no decision). With option (b) the last two copies stay until someone
+deletes them. Either way the tokens in them should then be considered exposed only if R-1241's door is used — the
+Plex2Shell audit measured it was not. **Note:** Longhorn backs up the volume's blocks, so a block freed by the VACUUM can
+still hold old plaintext in a later Longhorn backup; only (a) or (b) removes that — not measured, reasoned.
@@ -0,0 +1,81 @@
+# Plex to the fixed version on the demo/test boxes — 2026-10-23 (Plex2Shell)
+
+Operator ruling 2026-10-23 10:56 (recorded in `CONTEXT.md`): move the catalog's Plex to the newest fixed version at once,
+without the test record of `09` §3 decision 13, and put the demo boxes on it. DooPlex and ep0 were not touched; the
+incident session handles DooPlex.
+
+## The catalog move
+
+- Catalog `6cc317d`: `plexinc/pms-docker:1.41.4.9463-630c9f557` → `1.43.5.11029-6bf8af3f0` (Docker Hub, pushed
+  2026-10-20; manifest list `sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f`, re-resolved at
+  start — still the newest plain `X.Y.Z.B-hash` tag; `public`/`beta`/`plexpass` moved on 2026-10-22 but carry no plain
+  tag and are excluded). `catalog_since: "2026-10-23"`.
+- Gates green: image-pins, catalog-since (range), test-record, image-resolvable (plex), `catalog_gates.py --fast plex`.
+  `check-test-record-move.py --range ce33e3b..6cc317d` refused, as expected (verbatim in `app-catalog-felhom.eu/REPORT.md`).
+  Pushed with `--no-verify`, that commit only.
+- Read back from the box's catalog cache on demo-hp 9201 after one sync: the new tag, `catalog_since: "2026-10-23"`,
+  HEAD `6cc317d`. The badge went to „Frissítés elérhető — ma" / „Update available — today" in 4.7 s.
+
+## Which boxes run Plex
+
+Hub `/hosts` (CC token, read only): four hosts — Tester4 (DOWN), demo-felhom, demo-hp, tester-1. The customer
+**Tester 2 has 0 hosts**, so the operator's question was not needed. The hub's `/apps` page counts 2 Plex deployments;
+the boxes say ONE runs it (a second channel: `docker ps -a` in every running guest):
+
+| Box | Guest | Plex |
+|---|---|---|
+| demo-hp | 9201 | yes, 1.41.4.9463-630c9f557 |
+| demo-hp | 9202 (scratch) | no |
+| demo-felhom (N100) | 9201 | no |
+| tester-1 (VM 341 on demo-hp) | 9201 | no |
+| Tester4 | — | the hub host is DOWN and its VM no longer exists on demo-hp or felhom-pve (`qm list`); nothing to update. The hub's second Plex deployment is most likely this stale host's last report (not proven). |
+
+## demo-hp 9201 — the signs check (before the update, read only) → **NOT-A-FINDING**
+
+Scripts: `demo-hp-9201/signs.sh`, `demo-hp-9201/signs2.sh` (run inside the guest). Outputs, e-mail and token redacted:
+`demo-hp-9201/signs-9201-before-update.txt`, `demo-hp-9201/signs2-9201-before-update.txt`.
+
+| Sign | Result | Control |
+|---|---|---|
+| CPU, last days | whole guest 0.23–0.34 cores average of 7, max 1.04, per day 10-16 → 10-23 (PVE rrd, the HOST's channel). A miner would hold several cores flat. | — |
+| Processes in the container | only s6, Plex Media Server, Plex Script Host, Plex Tuner Service | — |
+| `xmrig`, `mylovelyminer`, `x12345`, `myawesomeproxy` anywhere in the guest | none | — |
+| ELF files under `Codecs` | none (one file, `.device-id`; one empty codec dir from 2026-10-15) | the ELF test says ELF for `/usr/bin/docker`, not for `Preferences.xml` |
+| ELF > 10 kB in the config volume newer than 2026-10-15 | none | same |
+| Container layer (`docker diff plex`) | 80 entries, all s6 runtime under `/run` | — |
+| `TranscoderH264Options` / `…Override` in `Preferences.xml` | absent | the attribute list printed (27 names) |
+| Log lines `searchOne`, `/video/:/transcode/universal`, `?x=http…` | 0, 0, 0 | 633 `Request: [` lines in the same log |
+| Open connections from the container | plex.tv / Cloudflare 443 and the box's traefik only | — |
+
+**Limit, stated:** Plex keeps 6 rotated logs and restarted several times in the night, so the logs reach back only to
+2026-10-23 00:32 UTC — not to 2026-10-16. The 10-16 → 10-22 window is covered by the CPU history and the files only,
+not by the logs. The container was recreated at 04:39 UTC, so its layer has no history before that either.
+
+## The update (the product's Update press, `POST /api/stacks/plex/update`)
+
+`demo-hp-9201/update-press.json`: accepted 202; phases safety-dump → pulling → copying → verifying → done in 28.4 s;
+no error, no hold. After (`demo-hp-9201/after-update.txt`):
+
+- `/identity`: version `1.43.5.11029-6bf8af3f0`, `claimed: true`, the SAME `machineIdentifier` as before.
+- Library: 0 sections before and after (this Plex never had a library; `demo-hp-9201/library-before-update.txt`). The
+  server's identity and claim are what carried over.
+- Box walk: every container healthy (traefik has no health check, up), none restarting; 0 `[ERROR]` and 0 `[WARN]` lines
+  in the controller log since the press (control: 99 `[INFO]` lines in the same window); badge „Naprakész" / „Up to date";
+  pinned = installed = catalog = live compose = the running container, all the new tag.
+
+## The guide (Part 3)
+
+The guide's labels were read from the new image's own web client (`WebClient.bundle/.../translations/hu.json`, plex-web
+4.162.1; its keys are the English labels): Home/„Kezdőképernyő", Play/„Lejátszás", Scan Library Files/„Könyvtárfájlok
+beolvasása", More/„Több", Fix Match/„Találatok pontosítása", Settings/„Beállítások", Manage Library Access/„Könyvtár
+hozzáférés kezelése", and the FAQ's Video Quality/„Videó minőség", Original/„Eredeti" — all present, all equal
+(`demo-hp-9201/guide-labels-1.43.5.txt`; ASCII-fragment controls: `beolvas` 5, `kezel` 26, `xqzzyw` 0). The box's own
+Plex wiring (`POST /api/storage/media/wire`, the household's „connect now") answered `plex: unchanged`, no error, against
+the new Plex (`demo-hp-9201/guide-wiring-after-update.txt`). **Not exercised:** the wiring's PUT that adds a new
+drive's folder — this box has one drive and no library, so it had nothing to add. `guide.checked_version` moved.
+
+## Teardown
+
+- Machine: Plex stays on the new version (that is the goal). The helper scripts were removed from the guest and host.
+- Host: nothing provisioned.
+- Hub: nothing changed (reads only).
@@ -0,0 +1,57 @@
+identity: {"MediaContainer":{"size":0,"apiVersion":"1.2.3","claimed":true,"machineIdentifier":"fb56097105b927dd42576cd879499a50c064c9fc","version":"1.43.5.11029-6bf8af3f0"}}
+sections: 0
+---containers
+adventurelog	Up 5 hours (healthy)
+adventurelog-frontend	Up 5 hours (healthy)
+adventurelog-postgres	Up 5 hours (healthy)
+bentopdf	Up 5 hours (healthy)
+bookstack	Up 5 hours (healthy)
+bookstack-db	Up 5 hours (healthy)
+calibre-web	Up 5 hours (healthy)
+cloudflared	Up 2 days (healthy)
+docmost	Up 4 hours (healthy)
+docmost-postgres	Up 5 hours (healthy)
+docmost-redis	Up 5 hours (healthy)
+felhom-controller	Up 3 hours (healthy)
+filebrowser	Up 2 days (healthy)
+home-assistant	Up 4 hours (healthy)
+opengist	Up 4 hours (healthy)
+paperless-postgres	Up 4 hours (healthy)
+paperless-redis	Up 4 hours (healthy)
+paperless-webserver	Up 4 hours (healthy)
+plex	Up 48 seconds (healthy)
+privatebin	Up 4 hours (healthy)
+romm	Up 4 hours (healthy)
+romm-db	Up 4 hours (healthy)
+romm-redis	Up 4 hours (healthy)
+traefik	Up 30 hours
+---not-healthy
+---restarting
+---ctl-errors-since-update
+0
+---ctl-plex-lines
+2026/10/23 09:08:22 manager.go:675: [DEBUG] [stacks] ScanStacks: found stack "plex" deployed=true composePath=/opt/docker/stacks/plex/docker-compose.yml
+2026/10/23 09:08:22 healthprobe.go:64: [DEBUG] [stacks] RunHealthProbes: skipping plex — last check 4s ago, effective interval 5m0s, healthy=true
+2026/10/23 09:08:22 backup.go:526: [DEBUG] groupStacksByDrive: /mnt/felhom-drives/hdd_1 → [calibre-web, paperless-ngx, plex, romm]
+2026/10/23 09:08:23 dbdump.go:149: [DEBUG] DiscoverDatabases: docker ps output: e94565919cd7	plex	plex	plexinc/pms-docker:1.43.5.11029-6bf8af3f0
+f8900ef8917f	felhom-controller		gitea.dooplex.hu/admin/felhom-controller:0.340.0
+2026/10/23 09:08:23 dbdump.go:171: [DEBUG] DiscoverDatabases: skipping container plex (image=plexinc/pms-docker:1.43.5.11029-6bf8af3f0, not a database)
+2026/10/23 09:08:23 dbdump.go:171: [DEBUG] DiscoverDatabases: skipping container felhom-controller (image=gitea.dooplex.hu/admin/felhom-controller:0.340.0, not a database)
+2026/10/23 09:08:23 sync.go:559: [DEBUG] [sync] plex/docker-compose.yml: hash match, skipped
+2026/10/23 09:08:23 sync.go:559: [DEBUG] [sync] plex/.felhom.yml: hash match, skipped
+2026/10/23 09:08:23 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for /opt/docker/stacks/plex/docker-compose.yml
+2026/10/23 09:08:23 recovery_unit.go:248: [INFO] [backup] plex: the app now runs [plexinc/pms-docker:1.43.5.11029-6bf8af3f0]; the unit keeps the definition of its data ([plexinc/pms-docker:1.41.4.9463-630c9f557], written 2026-10-23T02:16:55Z) until the next backup replaces the data
+2026/10/23 09:08:23 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for plex → /mnt/felhom-drives/hdd_1/backups/primary/plex (images=1, secrets-referenced=0, data_keys=0, portable-carried=0/0, withheld=0)
+2026/10/23 09:08:24 auth.go:144: [DEBUG] [web] auth: valid session for GET /apps/plex
+2026/10/23 09:08:24 server.go:637: [DEBUG] [web] ServeHTTP: GET /apps/plex from 172.18.0.10:45638
+2026/10/23 09:08:24 handlers.go:421: [DEBUG] [web] deployPageData: stack=plex method=GET
+2026/10/23 09:08:24 auth.go:144: [DEBUG] [web] auth: valid session for GET /apps/plex
+2026/10/23 09:08:24 server.go:637: [DEBUG] [web] ServeHTTP: GET /apps/plex from 172.18.0.10:45638
+2026/10/23 09:08:24 handlers.go:421: [DEBUG] [web] deployPageData: stack=plex method=GET
+2026/10/23 09:08:24 auth.go:144: [DEBUG] [web] auth: valid session for GET /api/stacks/plex
+2026/10/23 09:08:24 router.go:78: [DEBUG] [api] GET /api/stacks/plex (path=/stacks/plex)
+2026/10/23 09:08:25 logscanner.go:69: [DEBUG] [metrics] logscanner: scanned plex: errors=0 warnings=0 issues=0 (took 28ms)
+2026/10/23 09:08:32 healthprobe.go:64: [DEBUG] [stacks] RunHealthProbes: skipping plex — last check 13s ago, effective interval 5m0s, healthy=true
+2026/10/23 09:08:42 healthprobe.go:64: [DEBUG] [stacks] RunHealthProbes: skipping plex — last check 23s ago, effective interval 5m0s, healthy=true
+2026/10/23 09:08:52 healthprobe.go:64: [DEBUG] [stacks] RunHealthProbes: skipping plex — last check 33s ago, effective interval 5m0s, healthy=true
+2026/10/23 09:09:02 healthprobe.go:64: [DEBUG] [stacks] RunHealthProbes: skipping plex — last check 43s ago, effective interval 5m0s, healthy=true
@@ -0,0 +1,10 @@
+Plex web client translations/hu.json from plexinc/pms-docker:1.43.5.11029-6bf8af3f0 (WebClient plex-4.162.1), keys = the English UI string
+EN key 'Home': present=True; HU in Plex='Kezdőképernyő'; guide HU='Kezdőképernyő'; match=True
+EN key 'Play': present=True; HU in Plex='Lejátszás'; guide HU='Lejátszás'; match=True
+EN key 'Scan Library Files': present=True; HU in Plex='Könyvtárfájlok beolvasása'; guide HU='Könyvtárfájlok beolvasása'; match=True
+EN key 'More': present=True; HU in Plex='Több'; guide HU='Több'; match=True
+EN key 'Fix Match': present=True; HU in Plex='Találatok pontosítása'; guide HU='Találatok pontosítása'; match=True
+EN key 'Settings': present=True; HU in Plex='Beállítások'; guide HU='Beállítások'; match=True
+EN key 'Manage Library Access': present=True; HU in Plex='Könyvtár hozzáférés kezelése'; guide HU='Könyvtár hozzáférés kezelése'; match=True
+EN key 'Video Quality': present=True; HU in Plex='Videó minőség'; guide HU='Videó minőség'; match=True
+EN key 'Original': present=True; HU in Plex='Eredeti'; guide HU='Eredeti'; match=True
@@ -0,0 +1,2 @@
+status 200 {"data": {"pending": false, "drives": null, "apps": ["plex"], "wiring": [{"app": "folders", "state": "done"}, {"app": "plex", "state": "unchanged"}], "wired_at": "2026-10-23T09:10:30Z"}, "ok": true}
+wire 200 {"data": [{"app": "folders", "state": "done"}, {"app": "plex", "state": "unchanged"}], "ok": true}
@@ -0,0 +1,2 @@
+identity: {"MediaContainer":{"size":0,"apiVersion":"0.1.0","claimed":true,"machineIdentifier":"fb56097105b927dd42576cd879499a50c064c9fc","version":"1.41.4.9463-630c9f557"}}
+sections: 0
@@ -0,0 +1,63 @@
+### 1. processes in the plex container (docker top)
+PID                 USER                ELAPSED             TIME                %CPU                COMMAND
+1493203             root                04:25:08            00:00:00            0.0                 s6-svscan
+1493262             root                04:25:08            00:00:00            0.0                 s6-supervise
+1493541             root                04:25:08            00:00:00            0.0                 s6-supervise
+1493544             1000                04:25:08            00:00:21            0.1                 Plex Media Serv
+1493588             1000                04:25:08            00:00:15            0.0                 Plex Script Hos
+1494146             1000                04:25:05            00:00:12            0.0                 Plex Tuner Serv
+### 1b. suspect names anywhere in the guest
+none
+### 1c. top CPU processes in the guest
+    PID USER     %CPU     ELAPSED COMMAND
+    235 root      1.7  2-06:15:22 dockerd
+    183 root      0.8  2-06:15:23 containerd
+1493858 999       0.7    04:25:07 redis-server
+1489649 999       0.6    04:25:33 redis-server
+1492193 999       0.6    04:25:19 redis-server
+1717354 root      0.3    02:26:14 felhom-controll
+1496145 root      0.3    04:24:23 gunicorn
+   1698 65532     0.3  2-06:15:16 cloudflared
+1496141 root      0.3    04:24:23 gunicorn
+1492308 1000      0.2    04:25:19 node-MainThread
+1495252 1000      0.2    04:24:46 [celeryd: celer
+### 2. ELF files under Codecs (path size mtime sha256)
+all files under Codecs: 1
+total 16
+drwxr-xr-x  3 1000 1000 4096 2026-10-15 08:46:05.701113471 +0000 .
+drwxr-xr-x 11 1000 1000 4096 2026-10-23 08:39:53.737639828 +0000 ..
+-rw-r--r--  1 1000 1000   36 2026-10-15 08:46:05.701113471 +0000 .device-id
+drwxr-xr-x  2 1000 1000 4096 2026-10-15 08:46:05.700807513 +0000 e613bce-97f23d579c1001d8e9cc0d2e-linux-x86_64
+### 2b. any ELF in the config volume outside Plex's own folders, newer than 2026-10-15
+(end 2b)
+### 3. Preferences.xml transcoder attributes
+TranscoderH264Options*: absent
+attribute names present:
+AcceptedEULA AnonymousMachineIdentifier CertificateUUID CertificateVersion DlnaEnabled FSEventLibraryPartialScanEnabled FSEventLibraryUpdatesEnabled GlobalMusicVideoPathMigrated LanguageInCloud LastAutomaticMappedPort MachineIdentifier MetricsEpoch OldestPreviousVersion PlexOnlineHome PlexOnlineMail PlexOnlineToken PlexOnlineUsername ProcessedMachineIdentifier PubSubServer PubSubServerPing PubSubServerRegion PublishServerOnPlexOnlineKey TranscoderTempDirectory customConnections encoding version 
+### 4. log lines: searchOne / transcode/universal (tokens redacted)
+total 940
+drwxr-xr-x  3 1000 1000   4096 2026-10-23 04:39:29.306642337 +0000 .
+drwxr-xr-x 11 1000 1000   4096 2026-10-23 08:39:53.737639828 +0000 ..
+drwxr-xr-x  2 1000 1000   4096 2026-10-23 04:39:30.774964086 +0000 PMS Plugin Logs
+-rw-r--r--  1 1000 1000    880 2026-10-23 04:38:23.878139505 +0000 Plex Crash Uploader.1.log
+-rw-r--r--  1 1000 1000    561 2026-10-23 03:34:34.438792292 +0000 Plex Crash Uploader.2.log
+-rw-r--r--  1 1000 1000    880 2026-10-23 03:33:23.603543601 +0000 Plex Crash Uploader.3.log
+-rw-r--r--  1 1000 1000    561 2026-10-23 02:59:31.142955018 +0000 Plex Crash Uploader.4.log
+-rw-r--r--  1 1000 1000    880 2026-10-23 02:58:23.855206791 +0000 Plex Crash Uploader.5.log
+-rw-r--r--  1 1000 1000    561 2026-10-23 04:39:28.559376452 +0000 Plex Crash Uploader.log
+-rw-r--r--  1 1000 1000 122590 2026-10-23 04:38:23.956828290 +0000 Plex Media Server.1.log
+-rw-r--r--  1 1000 1000  95344 2026-10-23 03:33:23.650544218 +0000 Plex Media Server.2.log
+-rw-r--r--  1 1000 1000  97012 2026-10-23 02:58:23.959207947 +0000 Plex Media Server.3.log
+-rw-r--r--  1 1000 1000  96861 2026-10-23 02:38:23.762270724 +0000 Plex Media Server.4.log
+-rw-r--r--  1 1000 1000 157007 2026-10-23 02:16:45.904202135 +0000 Plex Media Server.5.log
+-rw-r--r--  1 1000 1000 311157 2026-10-23 09:04:06.104368626 +0000 Plex Media Server.log
+-rw-r--r--  1 1000 1000   2769 2026-10-23 04:38:23.939140257 +0000 Plex Tuner Service.1.log
+-rw-r--r--  1 1000 1000   2769 2026-10-23 03:33:23.635544021 +0000 Plex Tuner Service.2.log
+-rw-r--r--  1 1000 1000   2769 2026-10-23 02:58:23.938207713 +0000 Plex Tuner Service.3.log
+-rw-r--r--  1 1000 1000   2769 2026-10-23 02:38:23.745270485 +0000 Plex Tuner Service.4.log
+-rw-r--r--  1 1000 1000   2769 2026-10-23 02:16:45.852201461 +0000 Plex Tuner Service.5.log
+-rw-r--r--  1 1000 1000   1855 2026-10-23 04:39:39.105066764 +0000 Plex Tuner Service.log
+count searchOne: 0
+count transcode/universal: 0
+count lines with http(s):// in a query: 0
+oldest log line: Oct 23, 2026 02:32:13.754 [1343875524390
@@ -0,0 +1,34 @@
+#!/bin/sh
+# Read-only Plex2Shell signs check, run INSIDE the guest. Prints no token.
+V=/var/lib/docker/volumes/plex_plex_config/_data
+P="$V/Library/Application Support/Plex Media Server"
+echo "### 1. processes in the plex container (docker top)"
+docker top plex -eo pid,user,etime,time,pcpu,comm
+echo "### 1b. suspect names anywhere in the guest"
+ps -eo pid,user,comm,args | grep -i -E 'xmrig|mylovelyminer|x12345|myawesomeproxy' | grep -v grep || echo "none"
+echo "### 1c. top CPU processes in the guest"
+ps -eo pid,user,pcpu,etime,comm --sort=-pcpu | head -12
+echo "### 2. ELF files under Codecs (path size mtime sha256)"
+if [ -d "$P/Codecs" ]; then
+  find "$P/Codecs" -type f | while read -r f; do
+    if head -c 4 "$f" | grep -q 'ELF'; then
+      printf '%s\t%s\t%s\t%s\n' "$f" "$(stat -c %s "$f")" "$(stat -c %y "$f")" "$(sha256sum "$f" | cut -c1-64)"
+    fi
+  done
+  echo "all files under Codecs: $(find "$P/Codecs" -type f | wc -l)"
+  ls -la --time-style=full-iso "$P/Codecs"
+else echo "no Codecs dir"; fi
+echo "### 2b. any ELF in the config volume outside Plex's own folders, newer than 2026-10-15"
+find "$V" -type f -newermt 2026-10-15 -size +10k 2>/dev/null | while read -r f; do head -c 4 "$f" | grep -q ELF && printf '%s\t%s\t%s\n' "$f" "$(stat -c %s "$f")" "$(sha256sum "$f"|cut -c1-64)"; done; echo "(end 2b)"
+echo "### 3. Preferences.xml transcoder attributes"
+grep -o -E 'TranscoderH264Options(Override)?="[^"]*"' "$P/Preferences.xml" || echo "TranscoderH264Options*: absent"
+echo "attribute names present:"; grep -o -E ' [A-Za-z]+="' "$P/Preferences.xml" | tr -d ' ="' | sort | tr '\n' ' '; echo
+echo "### 4. log lines: searchOne / transcode/universal (tokens redacted)"
+ls -la --time-style=full-iso "$P/Logs/" | head -30
+for f in "$P/Logs/"Plex\ Media\ Server*.log; do
+  grep -h -E 'searchOne|/video/:/transcode/universal' "$f" 2>/dev/null
+done | sed -E 's/(X-Plex-Token|PlexOnlineToken|token)=[^&" ]*/\1=REDACTED/gI' | head -200
+echo "count searchOne: $(cat "$P/Logs/"Plex\ Media\ Server*.log 2>/dev/null | grep -c searchOne)"
+echo "count transcode/universal: $(cat "$P/Logs/"Plex\ Media\ Server*.log 2>/dev/null | grep -c '/video/:/transcode/universal')"
+echo "count lines with http(s):// in a query: $(cat "$P/Logs/"Plex\ Media\ Server*.log 2>/dev/null | grep -c -E '[?&][a-zA-Z]+=https?(%3A|:)')"
+echo "oldest log line: $(head -1 "$P/Logs/Plex Media Server.5.log" 2>/dev/null | cut -c1-40)"
@@ -0,0 +1,21 @@
+#!/bin/sh
+V=/var/lib/docker/volumes/plex_plex_config/_data
+P="$V/Library/Application Support/Plex Media Server"
+echo "### controls"
+printf 'ELF detector on /usr/bin/docker (positive): '; head -c 4 /usr/bin/docker | grep -q ELF && echo ELF || echo not-ELF
+printf 'ELF detector on Preferences.xml (negative): '; head -c 4 "$P/Preferences.xml" | grep -q ELF && echo ELF || echo not-ELF
+echo "log grep positive control (lines with 'Request: [' in current log): $(grep -c 'Request: \[' "$P/Logs/Plex Media Server.log")"
+echo "### docker diff plex (files changed in the container layer)"
+docker diff plex | head -60; echo "total changes: $(docker diff plex | wc -l)"
+echo "### created / started / restarts"
+docker inspect plex --format 'created={{.Created}} started={{.State.StartedAt}} restarts={{.RestartCount}}'
+echo "### transcode volume: files"
+find /var/lib/docker/volumes/plex_plex_transcode/_data -type f | head; echo "(n=$(find /var/lib/docker/volumes/plex_plex_transcode/_data -type f | wc -l))"
+echo "### crash uploader log (latest)"
+sed -E 's/(token|Token)[=:" ]+[A-Za-z0-9_-]{8,}/\1=REDACTED/g' "$P/Logs/Plex Crash Uploader.1.log"
+echo "### first lines of each PMS log (start time)"
+for f in "$P/Logs/"Plex\ Media\ Server*.log; do echo "$(basename "$f"): $(head -1 "$f" | cut -c1-24)"; done
+echo "### outbound connections now from plex netns"
+PID=$(docker inspect -f '{{.State.Pid}}' plex); nsenter -t $PID -n ss -tnp 2>/dev/null | head -20
+echo "### docker logs plex (tail, redacted)"
+docker logs --tail 30 plex 2>&1 | sed -E 's/(claim-|token=)[A-Za-z0-9_-]+/\1REDACTED/g'
@@ -0,0 +1,78 @@
+{
+ "update": {
+  "accepted": true,
+  "http": "202",
+  "phases": [
+   {
+    "t": 0.0,
+    "phase": "safety-dump",
+    "label": "Adatbázis pillanatkép…",
+    "updating": true,
+    "error": null,
+    "hold": null
+   },
+   {
+    "t": 4.1,
+    "phase": "pulling",
+    "label": "Új verzió letöltése…",
+    "updating": true,
+    "error": null,
+    "hold": null
+   },
+   {
+    "t": 10.1,
+    "phase": "copying",
+    "label": "Az adatok másolása a frissítés előtt…",
+    "updating": true,
+    "error": null,
+    "hold": null
+   },
+   {
+    "t": 22.3,
+    "phase": "verifying",
+    "label": "Működés ellenőrzése…",
+    "updating": true,
+    "error": null,
+    "hold": null
+   },
+   {
+    "t": 28.4,
+    "phase": "done",
+    "label": "Frissítve",
+    "updating": false,
+    "error": null,
+    "hold": null
+   }
+  ],
+  "duration_s": 28.4,
+  "final_phase": "done",
+  "update_error": null,
+  "hold_reason": null,
+  "state": "running"
+ },
+ "observables": {
+  "pinned_images": {
+   "plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+  },
+  "installed_images": {
+   "plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+  },
+  "catalog_images": {
+   "plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+  },
+  "live_compose_image_lines": [
+   "image: plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+  ],
+  "docker_inspect": [
+   "plex  plexinc/pms-docker:1.43.5.11029-6bf8af3f0  running=true  restarts=0"
+  ]
+ },
+ "log": [
+  "11:07:51   [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
+  "11:07:51       +   0.0s  phase=safety-dump  label=Adatbázis pillanatkép…  err=None  hold=None",
+  "11:07:55       +   4.1s  phase=pulling  label=Új verzió letöltése…  err=None  hold=None",
+  "11:08:01       +  10.1s  phase=copying  label=Az adatok másolása a frissítés előtt…  err=None  hold=None",
+  "11:08:14       +  22.3s  phase=verifying  label=Működés ellenőrzése…  err=None  hold=None",
+  "11:08:20       +  28.4s  phase=done  label=Frissítve  err=None  hold=None"
+ ]
+}
@@ -0,0 +1,148 @@
+# Plex2Shell on DooPlex — did the attack reach Felhom's secrets? (2026-10-23)
+
+Read-only investigation. Source of the incident facts: `~/incident-plex-2026-10-23/INCIDENT.md` on DooPlex (HM-040,
+homelab session). Architecture read first: `architecture/01-topology-and-trust.md`, `04-control-plane-authorization.md`
+§3.1, `05-hub-architecture.md` §16.2, `13-threat-model.md`, `runbooks/secrets.md`, `runbooks/total-loss-of-dooplex.md`,
+`runbooks/target-selection.md` (DooPlex = Tier 2). Window: **2026-10-17 04:00Z → 2026-10-23 08:04:34Z** (the isolation
+NetworkPolicy `incident-2026-10-23-plex-isolate`, `creationTimestamp` in INCIDENT.md Phase 2a).
+
+## Verdict: **NOT REACHED**
+
+Two open paths led from the hacked Plex pod to Felhom secrets. Each would have left a trace in a record that survived,
+and neither trace exists:
+
+1. **NFS export** (`/mnt/5_hdd/backup/longhorn-pvc`, `*(rw,no_root_squash,no_subtree_check)`): the NFS server accepted
+   **zero new TCP connections from 2026-10-10 00:00Z to 2026-10-23 13:05Z** — `node_nfsd_connections_total` flat at 288,
+   3902 five-minute samples, no gap. Every NFS request needs a TCP connection (nfsd listens on TCP only: `portlist`,
+   `rpcinfo`). **Positive control:** after this session's probe pod made three TCP connections to :2049 today the counter
+   read 4 (one Longhorn client + three probes), in `/proc/net/rpc/nfsd` and in Prometheus alike. The only NFS client in
+   the window was Longhorn's own manager (one long-lived NFSv4.2 connection). Read operations happened only in Longhorn's
+   backup hours; bytes read per day stayed at 18–39 MiB.
+2. **Longhorn manager API** (no login, port 9500 — can create backups, backup targets, volumes): no backup was created
+   outside the two recurring jobs' times (`longhorn_backup_state` series, 1-minute scrape); every scheduled night of the
+   window wrote its backups to DooPlex's own NFS store (so the target was local each night); no volume existed in the
+   window that is not explained; the backup target object is the one created 2025-11-29; DooPlex's network card sent
+   no more than the Plex pod itself sent.
+
+**What would change this verdict:** evidence of a container escape to the host (the incident session found none,
+`INCIDENT.md` „Anything OUTSIDE the Plex pod"), or a Longhorn target swap + backup + delete inside one minute (no
+record either way; Longhorn manager logs were lost, below).
+
+## Part 1 — the shared backup folder
+
+| what | value | evidence |
+|---|---|---|
+| export (before) | `/mnt/5_hdd/backup/longhorn-pvc *(rw,sync,no_subtree_check,no_root_squash)` | `p1-nfs-exports-clients.txt` |
+| who can reach :2049 | the host firewall accepts 192.168.0.0/24, 10.42.0.0/16 (pods), 10.43.0.0/16, 100.64.0.0/10 (tailnet) | `nft list ruleset`, input chain |
+| `secure` option | **no protection inside a pod**: containerd 2.x sets `net.ipv4.ip_unprivileged_port_start=0` in every pod; a uid-1000 probe with CapEff 0 bound port 700 and connected to :2049 | `p2-targeted-probes.txt` (last line), sysctl read in the Plex pod netns = 0, host = 1024 |
+| filesystem | the export is a sub-directory of `/dev/sda1` (ext4, mounted at `/mnt/5_hdd`); root inode 2 has generation 0 | `findmnt`, `lsattr -vd /mnt/5_hdd` |
+| contents | Longhorn backup store, 119 GB: nightly backups of every Longhorn volume, **including `felhom-system/hub-data` (the hub database), NOT encrypted** (`spec.encrypted=false` on all four felhom-system volumes) | `p1-backup-folder-listing.txt` |
+| v4 pseudo-root | `/`, `/mnt`, `/mnt/5_hdd`, `/mnt/5_hdd/backup` appear read-only as path components only; no other directory under `/mnt/5_hdd/backup` is exported | `/proc/fs/nfsd/exports` |
+| clients now | one: `longhorn-manager-w4tf6` 10.42.0.214, NFSv4.2 | `/proc/fs/nfsd/clients/*/info` |
+| NFS logging | NFSv3 mounts are logged only at debug level; NFSv4 attaches are not logged at all (**positive control:** client 3 is attached and the journal has no attach line); detaches are logged (2 lines in boot -1, none in the window); illegal-port refusals are logged (none). An absent line proves nothing for v4. | `journalctl -t rpc.mountd`, `strings rpc.mountd` |
+
+**No subtree check matters beyond the folder.** With `no_subtree_check` on a sub-directory export, the server checks
+only that a file handle belongs to the exported *filesystem*. A published technique (HvS-Consulting's
+`nfs-security-tooling`, 2024) builds the handle of the filesystem's root directory and walks the whole disk; with
+`no_root_squash` it does so as root. On `/dev/sda1` that reaches the **operator signing keys** (`/mnt/5_hdd/felhom.eu/
+felhom-op-operational`, `felhom-rec-recovery`, `felhom_op_ed25519`, no passphrase, R-924), the private security-review
+evidence, the workspace, the encrypted `sec` store (its age key is on `/dev/sdb1`, not reachable) and the other backup
+trees. **Grade: documented technique, every precondition measured here, NOT exercised** (doing it would be an attack on
+a Tier-2 machine).
+
+**The change (operator yes, 2026-10-23 ~15:18Z):** the line became
+`/mnt/5_hdd/backup/longhorn-pvc 10.42.0.0/16(rw,sync,no_subtree_check,no_root_squash)`; `exportfs -ra` rc 0. Read back:
+`exportfs -v` and `/proc/fs/nfsd/exports` show `10.42.0.0/16`; Longhorn's backup target synced at 15:20:10Z with
+`available: true`; the Longhorn client is still attached. Backup of the old file: `/etc/exports.bak-2026-10-23-plex2shell`.
+Undo: `sudo cp -p /etc/exports.bak-2026-10-23-plex2shell /etc/exports && sudo exportfs -ra`. **This closes the folder to
+the home network and the tailnet. It does NOT close it to a hacked pod** — Longhorn connects from its pod address, so
+the pod network must stay allowed; limiting it to DooPlex itself would break Longhorn. Root squash is not possible either
+(the store is root-owned 0700 and Longhorn writes as root). `p1-export-change.txt`.
+
+## Part 2 — what the hacked Plex could reach without a login
+
+Measured from probe pod `default/cc-p2s-probe` (uid 1000, CapEff 0, no service-account token, no NetworkPolicy in
+`default` — the Plex pod's position before the isolation). Created 15:19:46Z, removed 15:33:44Z
+(`p2-probe-lifecycle.txt`, before/after listings). 186 of 196 TCP Service ports answered (`p2-service-sweep.txt`).
+
+| target | no-login result | what a no-login caller gets |
+|---|---|---|
+| Longhorn manager API `longhorn-backend:9500`, UI `longhorn-frontend:80` | 200 | every volume (234 names), backup targets, backup volumes; actions `snapshotCreate`, `snapshotBackup`, `attach`, `detach`, `pvcCreate`, `activate` offered on `hub-data` |
+| NFS on the node :2049, :111 | open | see Part 1 |
+| Felhom hub `hub:8080` (bypasses the ingress geo filter) | `/healthz` 200, `/login` 200, every data path 401/403/302 | nothing (matches `13` §4: health, login, register, armed re-enroll) |
+| kube-apiserver 10.43.0.1:443 / 192.168.0.180:6443 | 401 | nothing (k3s `config.yaml` unchanged since 2026-08-05) |
+| kubelet :10250 | 401; :10255 closed | nothing |
+| Prometheus, Grafana (anonymous Viewer), Alertmanager, node-exporter, kube-state-metrics | 200 | metrics and dashboards; Alertmanager also lets anyone create a silence. No secret values |
+| Gitea | 200 | the public repos (R-925 ruling); registry `/v2/` 401 |
+| Vaultwarden | `/alive`, `/api/config`, `/admin` login page 200 | nothing without the master password |
+| ArgoCD, Headlamp, the filebrowsers | 401 on the API | nothing (Headlamp's own service account can read every Secret — behind OIDC) |
+| `felhom-system/umami-db` 5432, other databases | open | password needed |
+| LAN | router admin (.1), a TP-Link (.254), a printer (.20), **demo-felhom's Proxmox UI and SSH (.162)**, PBS UI on DooPlex :8007, Samba :445 | logins needed; `p2-lan-reach.txt` |
+
+## Part 3 — evidence of use in the window, per path
+
+| path | best record that exists | result |
+|---|---|---|
+| NFS | nfsd counters in Prometheus (connections, ops by method, bytes, RPC errors) — `p3-nfsd-*.json` | **unused** (verdict 1). RPC errors (auth/fmt/cInt) 0 |
+| Longhorn API | `longhorn_backup_state`, `longhorn_volume_state` series; nfsd bytes written per night; Backup/Snapshot/BackupTarget/Volume `creationTimestamp` — `p3-longhorn-*` | **no sign of use**: 106 backups in the window = 53 daily (10-23 02:00Z) + 53 weekly (10-18 03:00Z), all to the local URL; 0 backups first seen off-schedule; no unexplained volume. Longhorn CRs carry **no managedFields**, so who changed what is not recorded there (`p3-longhorn-objects.txt`, CORRECTION) |
+| Longhorn manager/UI logs | — | **no record: lost.** DooPlex was rebooted at 13:20Z by the maintenance session (`~/maintenance/2026-10-window`); the pre-reboot container logs of longhorn-manager, longhorn-ui, the hub, the ingress, Gitea, Vaultwarden, Grafana and Prometheus are gone. The incident session's earlier greps (before the reboot) found 10.42.0.52 in none of longhorn-manager, CNPG, Gitea (from 10-21 20:59), authentik; that is their record, not re-verifiable |
+| hub | `/data/access-log` (R-1140), 10-18 10:25Z → now, 12 764 lines — `p3-hub-access-log.txt` | **no call from the Plex pod** (10.42.0.52: 0; positive control: the probe's 10.42.0.107 is logged). Credentialed requests come only from the boxes' LAN addresses, the home WAN and the operator's sessions. **Gap:** 10-17 04:00Z → 10-18 10:25Z no record (the log started then) — but no hub route gives a secret without a credential |
+| SSH to DooPlex | journal (boot -1 survives) | 0 sshd lines from 10.42/10.43 in the window (control: 61 lines from 192.168.x) |
+| Samba | per-client log files `log.%m` | no file for 10.42.0.52 (positive control: `log.10.42.0.107` appeared when the probe touched :445) — `p3-samba-clients.txt` |
+| Alertmanager | silences API (keeps expired ones) | only two silences, both CC's, both outside the attack |
+| DNS | CoreDNS keeps **no query log**; only upstream-timeout lines name a domain, without the client | names in `p3-coredns-error-names.txt`; `hand.genddos.st` looked up 10 times on 10-19 08:31–09:50Z (client unknown) |
+| network bytes | cAdvisor per pod (no peer label) — `p3-network-bytes.txt` | **the Plex pod sent ~1.5 TB** (143 / 202 / 528 / 441 / 206 GiB per day, 10-18 → 10-22; before: 0.04 GiB/day) and received ≤ 7.9 GiB/day. DooPlex's NIC `eno1` sent the same extra out. Outbound-heavy: the shape of a flood tool or of streaming, not of a download. It did **not** come from the NFS store (nfsd reads flat) or from other pods (bridge-to-pod bytes flat) |
+
+## Part 4 — Felhom's secrets on DooPlex
+
+Exposure = what a path could read, judged with Part 3. „Possible path" means the door existed; it does not mean it was used.
+
+| secret | where it lives | path that could read it (Part 2) | evidence of use | exposure |
+|---|---|---|---|---|
+| hub DB: Cloudflare API tokens, tunnel tokens, git tokens (**unsealed**, R-975) | `hub.db` on Longhorn `hub-data`; **unencrypted nightly copies in the NFS store** | NFS export (direct, no escape needed); Longhorn API backup to an outside target | none (Part 3) | **none** |
+| hub DB: box API keys, controller keys, owner passphrases, PBS-DR tokens, break-glass passwords, Storage Box sub-account passwords (**sealed**, AES-GCM, key `OFFSITE_SECRET_KEY`) | same | same — but the key is a k8s Secret, not in the DB or its backups | none | **none** (sealed values useless without the key) |
+| escrow blobs `host_escrow.blob` / `identity_blob` | same | same | none | **none** — sealed means: wrapped by each household's recovery code, which the hub never holds (`03-host-agent.md`, escrow retention: „the hub never decrypts either table") |
+| hub tokens (`api_tokens.token_hash`), self-bind / claim codes | same, hashed | same | none | **none** (hashes) |
+| k8s Secrets in `felhom-system` (report-api global key, offsite-secret-key, storagebox = main Storage Box/Hetzner login, resend-api, tenantsync, agent-poke, wg-endpoint-ssh, gitea-creds, umami, TLS keys) | etcd/k3s datastore (`/var/lib/rancher`, sdb1); also the nightly GPG secrets export on sda1 (`/mnt/5_hdd/backup/secrets/exports`, symmetric, passphrase file on sdb1) | k8s API anonymous: 401. NFS escape → the `.gpg` files only (key not on sda1) | none | **none** |
+| hub session / signing material | k8s Secret / hub DB | as above | none | **none** |
+| **operator signing keys** (operational + recovery + `felhom_op_ed25519`, no passphrase) | `/mnt/5_hdd/felhom.eu/` on **sda1** | NFS export → file-handle escape (documented, not exercised) | none (no NFS connection at all) | **none** — but the door is still open to any pod (row filed) |
+| `sec` store | `cc-secrets/store/cc.sops.yaml` on sda1, age key `~/.config/sops/age/keys.txt` on sdb1 | escape → ciphertext only | none | **none** |
+| registry login, Gitea tokens | `~/.docker/config.json`, `~/.git-credentials` (sdb1, 0600) | none from the pod network (registry 401, Gitea API anonymous = public repos only) | — | **none** |
+| Vaultwarden (operator's password manager, R-923) | Longhorn volume; nightly unencrypted Longhorn copy in the NFS store (vault items stay encrypted by the master password) | login page; NFS export → encrypted vault DB | none for NFS; login logs lost | **none** (no record of login attempts — logs lost, and the vault is encrypted at rest) |
+| off-site ciphertext (ep0 copy, demo-felhom backups) | sda1 | escape → ciphertext only | none | **none** |
+
+## Part 5 — plan
+
+Verdict NOT REACHED → **no rotation plan.** The open doors are filed instead (rows below). Nothing was rotated.
+
+## Observations
+
+- **A hacked pod on DooPlex can still read the hub's unencrypted nightly backups and, by the file-handle escape, the
+  operator signing keys through the NFS export.** → FILED: R-1241 (P1).
+- **The Felhom demo NAS export `/mnt/5_hdd/felhom-data → 192.168.0.162` is a sub-directory of the same disk with
+  `no_subtree_check`**: a compromised demo-felhom host could walk all of sda1 as uid 101000 (world-readable files only,
+  e.g. the `.gpg` secrets exports and every repo). → FILED: R-1242 (P3).
+- The hub answers pods directly, without the ingress geo filter. → NOT-A-FINDING: the geo filter is not an
+  authentication control; every no-token path refused (measured).
+- demo-felhom's Proxmox UI and SSH are reachable from any DooPlex pod (masqueraded as 192.168.0.180). → NOT-A-FINDING:
+  same door as R-982 (root password SSH from the LAN), now with „a hacked DooPlex pod" as one more LAN attacker; added
+  to `13` §3.
+- Pre-reboot pod logs were erased by the 13:20Z reboot. → NOT-A-FINDING for Felhom: the hub's own access log
+  persisted (R-1140 did its job). Homelab item, below.
+
+## For the homelab session (no HM numbers minted; evidence paths in this folder)
+
+1. **The NFS export is still open to every pod**, `no_root_squash`, `no_subtree_check`, on the disk that holds the
+   Felhom signing keys. `secure` does nothing in pods (containerd sets `ip_unprivileged_port_start=0`). Options: an
+   egress NetworkPolicy so only `longhorn-system` reaches :2049/:111, and/or move the store to its own filesystem
+   (LV or loop) so the subtree escape has nothing else to reach. Not managed by Ansible — the narrowed line persists.
+2. **Longhorn manager API and UI need no login** from any pod (create backups/targets/volumes, delete volumes).
+3. **The old Plex volume was deleted through Longhorn's API at 11:24:15Z** by nobody identified (`INCIDENT.md`
+   EVIDENCE NOTE). Ask the operator whether it was them; if not, it is an unattributed write on an open API.
+4. **The Plex pod sent ~1.5 TB out on 10-18 → 10-22** (not in INCIDENT.md); and CoreDNS saw `hand.genddos.st`
+   lookups on 10-19. Possibly a flood tool riding the same compromise.
+5. **The maintenance reboot at 13:20Z erased the window's pod logs** (longhorn-manager, ingress, hub, Gitea, …): no log
+   shipping, kubelet keeps one previous container log. Evidence rule R-320 applies to the homelab too.
+6. Prometheus, Alertmanager (silences!), Grafana (anonymous Viewer), kube-state-metrics, node-exporter, MinIO console,
+   Headlamp (its service account can read every Secret and write RBAC — behind OIDC) all answer every pod.
+7. A user process `python3 main.py -d -i` (kisfenyo) listens on 0.0.0.0:8443 on DooPlex.
@@ -0,0 +1,49 @@
+# captured 2026-10-23T14:24:03Z
+$ sudo ls -la /mnt/5_hdd/backup
+total 64
+drwxr-xr-x 16 root     root     4096 2026-10-03 21:12 .
+drwxr-xr-x 17 kisfenyo kisfenyo 4096 2026-10-23 11:01 ..
+drwxr-xr-x  3 root     root     4096 2026-01-05 16:07 data
+drwxr-xr-x  5 backup   backup   4096 2026-07-10 19:42 demo-felhom
+drwxr-xr-x  4 backup   backup   4096 2026-10-18 08:30 ep0-copy
+drwxr-xr-x  4 root     root     4096 2026-10-23 03:01 homelab-manifests
+drwxrwxr-x  3 kisfenyo kisfenyo 4096 2026-10-23 04:00 jarrs.eu
+drwxr-xr-x  3 root     root     4096 2026-01-05 16:07 k3s
+drwxr-xr-x  2 root     root     4096 2026-01-05 16:35 logs
+drwxr-xr-x  3 root     root     4096 2026-01-06 04:00 longhorn-pvc
+drwxr-x---  2 kisfenyo kisfenyo 4096 2026-10-23 15:55 minecraft-tlauncher
+drwxr-xr-x  2 root     root     4096 2026-08-10 18:28 paperless
+drwxr-xr-x  4       26 tape     4096 2026-06-25 11:32 postgresql
+drwxr-xr-x  2 root     root     4096 2026-08-10 18:16 romm
+drwxr-xr-x  4 root     root     4096 2026-01-05 16:07 secrets
+drwxr-xr-x  2 root     root     4096 2026-10-08 07:24 sparkyfitness
+
+$ sudo ls /mnt/5_hdd/backup/longhorn-pvc
+total 12
+drwxr-xr-x  3 root root 4096 2026-01-06 04:00 .
+drwxr-xr-x 16 root root 4096 2026-10-03 21:12 ..
+drwx------  3 root root 4096 2026-01-06 04:00 backupstore
+
+$ dirs depth<=4
+/mnt/5_hdd/backup/longhorn-pvc
+/mnt/5_hdd/backup/longhorn-pvc/backupstore
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/4f
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/4f/33
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/9f
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/9f/fc
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/1d
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/1d/5c
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/a9
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/a9/95
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/3b
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/3b/f9
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/5f
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/5f/21
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/bb
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/bb/3f
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/0e
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/0e/6e
+/mnt/5_hdd/backup/longhorn-pvc/backupstore/volumes/11
+
+$ du per backup volume (sizes only)
@@ -0,0 +1,29 @@
+# Part 1 change, operator OK 'Yes, narrow it' — 2026-10-23T15:18:52Z
+$ sha256sum /etc/exports (before)
+bb9047fd8bf9cebd589ac680dbbb45746bc621591c68add15f0ae410e0c6cd76  /etc/exports
+$ backup copy: /etc/exports.bak-2026-10-23-plex2shell
+$ diff old new
+12c12
+< /mnt/5_hdd/backup/longhorn-pvc *(rw,sync,no_subtree_check,no_root_squash)
+---
+> /mnt/5_hdd/backup/longhorn-pvc 10.42.0.0/16(rw,sync,no_subtree_check,no_root_squash)
+rc=1
+$ sudo exportfs -ra
+rc=0
+$ sudo exportfs -v
+/mnt/5_hdd/felhom-data
+		192.168.0.162(sync,wdelay,hide,no_subtree_check,anonuid=101000,anongid=101000,sec=sys,rw,secure,root_squash,all_squash)
+/mnt/5_hdd/backup/longhorn-pvc
+		10.42.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+
+# read-back 2026-10-23T15:21:36Z
+$ backuptarget default: available lastSyncedAt (sync AFTER the 15:18:52Z change)
+true 2026-10-23T15:20:10Z
+$ nfsd v4 clients now
+address: "10.42.0.214:669"
+seconds from last renew: 16
+name: "Linux NFSv4.2 longhorn-manager-w4tf6"
+callback address: "10.42.0.214:0"
+$ grep longhorn-pvc /proc/fs/nfsd/exports
+/mnt/5_hdd/backup/longhorn-pvc	10.42.0.0/16(rw,no_root_squash,sync,wdelay,no_subtree_check,uuid=2fb0cf66:1b3d4fcc:850508ca:f5a7f8fc,sec=1)
+UNDO: sudo cp -p /etc/exports.bak-2026-10-23-plex2shell /etc/exports && sudo exportfs -ra
@@ -0,0 +1,126 @@
+# captured 2026-10-23T14:21:56Z on dooplex
+$ cat /etc/exports (comments stripped)
+/mnt/5_hdd/backup/longhorn-pvc *(rw,sync,no_subtree_check,no_root_squash)
+/mnt/5_hdd/felhom-data 192.168.0.162(rw,all_squash,anonuid=101000,anongid=101000,no_subtree_check)
+ls: cannot access '/etc/exports.d': No such file or directory
+-rw-r--r-- 1 root root 680 Aug 14 06:59 /etc/exports
+
+$ sudo exportfs -v
+/mnt/5_hdd/felhom-data
+		192.168.0.162(sync,wdelay,hide,no_subtree_check,anonuid=101000,anongid=101000,sec=sys,rw,secure,root_squash,all_squash)
+/mnt/5_hdd/backup/longhorn-pvc
+		<world>(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+
+$ showmount -a localhost
+All mount points on localhost:
+
+$ /var/lib/nfs/rmtab
+
+$ /proc/fs/nfsd/clients/*/info
+== /proc/fs/nfsd/clients/*/info
+cat: '/proc/fs/nfsd/clients/*/info': No such file or directory
+
+$ /proc/fs/nfsd/versions
+3 +4 +4.1 +4.2
+$ /etc/nfs.conf (non-comment)
+[general]
+pipefs-directory=/run/rpc_pipefs
+[nfsrahead]
+[exports]
+[exportfs]
+[gssd]
+[lockd]
+[exportd]
+[mountd]
+manage-gids=y
+[nfsdcld]
+[nfsd]
+[statd]
+[sm-notify]
+[svcgssd]
+
+$ ss -tnp sport/dport 2049, 111, 20048
+State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess                                                   
+LISTEN 0      4096         0.0.0.0:2049       0.0.0.0:*                                                             
+LISTEN 0      4096         0.0.0.0:111        0.0.0.0:*    users:(("rpcbind",pid=1932,fd=4),("systemd",pid=1,fd=47))
+ESTAB  0      0      192.168.0.180:38514  10.43.69.49:2049                                                          
+ESTAB  0      0      192.168.0.180:58280 10.43.31.240:2049                                                          
+ESTAB  0      0      192.168.0.180:2049   10.42.0.214:669                                                           
+LISTEN 0      4096            [::]:2049          [::]:*                                                             
+LISTEN 0      4096            [::]:111           [::]:*    users:(("rpcbind",pid=1932,fd=6),("systemd",pid=1,fd=49))
+
+$ ss -lntup nfs/rpc listeners
+udp   UNCONN 0      0                                     0.0.0.0:111        0.0.0.0:*    users:(("rpcbind",pid=1932,fd=5),("systemd",pid=1,fd=48))                    
+udp   UNCONN 0      0                                     0.0.0.0:33506      0.0.0.0:*    users:(("tailscaled",pid=86160,fd=19))                                       
+udp   UNCONN 0      0                                     0.0.0.0:34514      0.0.0.0:*    users:(("rpc.mountd",pid=2203,fd=8))                                         
+udp   UNCONN 0      0                                     0.0.0.0:38607      0.0.0.0:*    users:(("rpc.mountd",pid=2203,fd=4))                                         
+udp   UNCONN 0      0                                        [::]:111           [::]:*    users:(("rpcbind",pid=1932,fd=7),("systemd",pid=1,fd=50))                    
+udp   UNCONN 0      0                                        [::]:34707         [::]:*    users:(("tailscaled",pid=86160,fd=18))                                       
+tcp   LISTEN 0      64                                    0.0.0.0:37541      0.0.0.0:*                                                                                 
+tcp   LISTEN 0      4096                                  0.0.0.0:36457      0.0.0.0:*    users:(("rpc.mountd",pid=2203,fd=9))                                         
+tcp   LISTEN 0      4096                                  0.0.0.0:2049       0.0.0.0:*                                                                                 
+tcp   LISTEN 0      4096                                  0.0.0.0:111        0.0.0.0:*    users:(("rpcbind",pid=1932,fd=4),("systemd",pid=1,fd=47))                    
+tcp   LISTEN 0      4096                                     [::]:2049          [::]:*                                                                                 
+tcp   LISTEN 0      4096                                     [::]:111           [::]:*    users:(("rpcbind",pid=1932,fd=6),("systemd",pid=1,fd=49))                    
+tcp   LISTEN 0      4096   [fd7a:115c:a1e0::fc01:579a]%tailscale0:33516         [::]:*    users:(("tailscaled",pid=86160,fd=24))                                       
+tcp   LISTEN 0      4096                                        *:31983            *:*    users:(("k3s-server",pid=2231,fd=41))                                        
+tcp   LISTEN 0      4096                                        *:31433            *:*    users:(("k3s-server",pid=2231,fd=80))                                        
+tcp   LISTEN 0      4096                                        *:30196            *:*    users:(("k3s-server",pid=2231,fd=324))                                       
+tcp   LISTEN 0      4096                                        *:30239            *:*    users:(("k3s-server",pid=2231,fd=320))                                       
+tcp   LISTEN 0      4096                                        *:30627            *:*    users:(("k3s-server",pid=2231,fd=317))                                       
+
+$ rpcinfo -p
+   program vers proto   port  service
+    100000    4   tcp    111  portmapper
+    100000    3   tcp    111  portmapper
+    100000    2   tcp    111  portmapper
+    100000    4   udp    111  portmapper
+    100000    3   udp    111  portmapper
+    100000    2   udp    111  portmapper
+    100005    1   udp  38607  mountd
+    100005    1   tcp  51925  mountd
+    100005    2   udp  34514  mountd
+    100005    2   tcp  36457  mountd
+    100005    3   udp  42427  mountd
+    100005    3   tcp  57549  mountd
+    100024    1   udp  56119  status
+    100024    1   tcp  52519  status
+    100003    3   tcp   2049  nfs
+    100003    4   tcp   2049  nfs
+    100227    3   tcp   2049  nfs_acl
+    100021    1   udp  45443  nlockmgr
+    100021    3   udp  45443  nlockmgr
+    100021    4   udp  45443  nlockmgr
+    100021    1   tcp  37541  nlockmgr
+    100021    3   tcp  37541  nlockmgr
+    100021    4   tcp  37541  nlockmgr
+
+# appended 2026-10-23T14:22:12Z
+$ sudo ls /proc/fs/nfsd/clients; cat */info
+== client 3
+clientid: 0x6c6ec1426adb63eb
+address: "10.42.0.214:669"
+status: confirmed
+seconds from last renew: 49
+name: "Linux NFSv4.2 longhorn-manager-w4tf6"
+minor version: 2
+Implementation domain: "kernel.org"
+Implementation name: "Linux 6.12.113+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.113-1 (2026-10-15) x86_64"
+Implementation time: [0, 0]
+callback state: UP
+callback address: "10.42.0.214:0"
+admin-revoked states: 0
+$ sudo cat /proc/fs/nfsd/exports
+# Version 1.1
+# Path Client(Flags) # IPs
+/mnt/5_hdd	*(ro,insecure,no_root_squash,sync,no_wdelay,no_subtree_check,v4root,uuid=d2423144:e2585cd2:bcf24caa:707cadf0,sec=1)
+/mnt	*(ro,insecure,no_root_squash,sync,no_wdelay,no_subtree_check,v4root,uuid=0a4bfb73:2e6b5931:9b78e97b:7691fb97,sec=1)
+/mnt/5_hdd/backup/longhorn-pvc	*(rw,no_root_squash,sync,wdelay,no_subtree_check,uuid=2fb0cf66:1b3d4fcc:850508ca:f5a7f8fc,sec=1)
+/mnt/5_hdd/backup	*(ro,insecure,no_root_squash,sync,no_wdelay,no_subtree_check,v4root,uuid=a14fb08e:93ef58c9:8e149646:540a8430,sec=1)
+/	*(ro,insecure,no_root_squash,sync,no_wdelay,no_subtree_check,v4root,fsid=0,sec=1)
+$ peer 10.42.0.214 = pod longhorn-system/longhorn-manager-w4tf6 (kubectl get pods -A -o wide)
+$ 10.43.31.240 / 10.43.69.49 = longhorn-system ClusterIP services pvc-1d4ec717 / pvc-8ed5eea5 (RWX share-managers; DooPlex is the CLIENT there)
+$ uptime / nfs-server active since
+ 16:22:12 up 41 min,  7 users,  load average: 3.38, 4.81, 5.47
+ActiveEnterTimestamp=Fri 2026-10-23 15:40:59 CEST
+ActiveEnterTimestamp=Fri 2026-10-23 15:40:56 CEST
@@ -0,0 +1,21 @@
+# P2 LAN reach from cc-p2s-probe (pod egress, masqueraded to 192.168.0.180), TCP connect only, 16 ports, 2026-10-23T15:22:57Z
+192.168.0.1 open: 22 53 80 443
+192.168.0.20 open: 80 631 9100
+192.168.0.110 open: 22 139 445
+192.168.0.149 open: 22 80 443
+192.168.0.162 open: 22 53 111 8006
+192.168.0.180 open: 22 111 139 445 2049 8007 8443 9100
+192.168.0.192 open: 80 443
+192.168.0.203 open: 3000
+192.168.0.209 open: 80
+192.168.0.250 open: 53 80
+192.168.0.254 open: 22 80
+# end 2026-10-23T15:24:51Z
+# identification (GET / title, no login), 2026-10-23T15:26Z
+# 192.168.0.162:8006  demo-felhom - Proxmox Virtual Environment (the lived-in N100 box's host; also the felhom-data NFS client)
+# 192.168.0.180:8007  dooplex - Proxmox Backup Server (login page)
+# 192.168.0.180:8443  a user process `python3 main.py -d -i` (kisfenyo), 302
+# 192.168.0.180:139/445 smbd; :111/:2049 NFS; :6443 k3s API (401 anonymous); :10250 kubelet (401 anonymous)
+# 192.168.0.254       TP-LINK Archer C5 admin page;  192.168.0.1 router admin (200)
+# 192.168.0.20        printer-shaped (80, 631 IPP, 9100 JetDirect)
+# 192.168.0.192/.203/.209/.250  k3s LoadBalancer IPs (ingress, gitea ssh/3000, pihole)
@@ -0,0 +1,23 @@
+# 2026-10-23T15:19:46Z BEFORE: pods in default
+No resources found in default namespace.
+networkpolicies in default:
+No resources found in default namespace.
+pod/cc-p2s-probe created
+pod/cc-p2s-probe condition met
+NAME           READY   STATUS    RESTARTS   AGE   IP            NODE      NOMINATED NODE   READINESS GATES
+cc-p2s-probe   1/1     Running   0          1s    10.42.0.107   dooplex   <none>           <none>
+
+# 2026-10-23T15:33:44Z TEARDOWN
+before:
+NAME           READY   STATUS    RESTARTS   AGE   IP            NODE      NOMINATED NODE   READINESS GATES
+cc-p2s-probe   1/1     Running   0          13m   10.42.0.107   dooplex   <none>           <none>
+pod "cc-p2s-probe" deleted
+after:
+No resources found in default namespace.
+No resources found in default namespace.
+no namespace, NetworkPolicy, ServiceAccount or other object was created; the incident's NetworkPolicies were not touched:
+networkpolicy.networking.k8s.io/allow-acme-solver
+networkpolicy.networking.k8s.io/allow-dns
+networkpolicy.networking.k8s.io/allow-plex-clients
+networkpolicy.networking.k8s.io/allow-plex-egress-https
+networkpolicy.networking.k8s.io/default-deny-all
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: cc-p2s-probe
+  namespace: default
+  labels: {purpose: plex2shell-felhom-impact-probe}
+  annotations: {note: "read-only reach probe, CC 2026-10-23; removed after"}
+spec:
+  automountServiceAccountToken: false
+  enableServiceLinks: false
+  activeDeadlineSeconds: 5400
+  restartPolicy: Never
+  securityContext: {runAsUser: 1000, runAsGroup: 1000, runAsNonRoot: true}
+  containers:
+  - name: probe
+    image: docker.io/curlimages/curl:8.11.1
+    imagePullPolicy: IfNotPresent
+    command: ["sleep", "5400"]
+    securityContext: {allowPrivilegeEscalation: false, capabilities: {drop: ["ALL"]}}
+    resources: {limits: {cpu: "500m", memory: "128Mi"}}
@@ -0,0 +1,201 @@
+# P2 in-cluster service sweep from cc-p2s-probe (10.42.0.107, uid 1000, CapEff 0, no SA token, ns default, no NetworkPolicy) 2026-10-23T15:20:04Z
+# format: ns/service ip:port OPEN scheme http_code <title> — GET / only, no credentials
+actualbudget-system/actualbudget 10.43.212.93:5006 OPEN http 200 Actual
+admin-system/smartctl-exporter 10.43.107.224:9633 OPEN http 200 smartctl_exporter
+admin-system/upsnap 10.43.71.31:8090 OPEN http 200 UpSnap
+admin-system/wan-monitor 10.43.247.236:9115 OPEN http 200 Blackbox Exporter
+admin-system/wan-monitor 10.43.247.236:9116 OPEN http 404 404 Not Found
+adventurelog-system/adventurelog-backend 10.43.25.95:80 OPEN http 200 AdventureLog API Server
+adventurelog-system/adventurelog-frontend 10.43.144.156:3000 OPEN http 200 AdventureLog
+adventurelog-system/adventurelog-postgres 10.43.27.145:5432 OPEN https 000 AdventureLog
+arcade-system/romm 10.43.212.194:8080 OPEN http 200 RomM
+arcade-system/romm-db 10.43.59.10:3306 OPEN https 000 RomM
+arcade-system/romm-redis 10.43.2.16:6379 OPEN https 000 RomM
+argocd/argocd-applicationset-controller 10.43.107.242:7000 OPEN http 404 
+argocd/argocd-applicationset-controller 10.43.107.242:8080 OPEN http 404 
+argocd/argocd-dex-server 10.43.116.227:5556 closed-or-filtered
+argocd/argocd-dex-server 10.43.116.227:5557 closed-or-filtered
+argocd/argocd-dex-server 10.43.116.227:5558 OPEN http 404 
+argocd/argocd-metrics 10.43.211.46:8082 OPEN http 404 
+argocd/argocd-notifications-controller-metrics 10.43.213.199:9001 OPEN http 404 
+argocd/argocd-redis 10.43.241.255:6379 closed-or-filtered
+argocd/argocd-repo-server 10.43.146.85:8081 closed-or-filtered
+argocd/argocd-repo-server 10.43.146.85:8084 OPEN http 404 
+argocd/argocd-server 10.43.16.170:80 OPEN http 200 Argo CD
+argocd/argocd-server 10.43.16.170:443 OPEN http 200 Argo CD
+argocd/argocd-server-metrics 10.43.225.99:8083 OPEN http 404 
+audiobookshelf-system/audiobookshelf 10.43.219.190:80 OPEN http 200 Audiobookshelf
+auth-system/ak-outpost-arr-outpost 10.43.47.195:9000 OPEN http 400 
+auth-system/ak-outpost-arr-outpost 10.43.47.195:9443 OPEN http 400 
+auth-system/ak-outpost-arr-outpost-metrics 10.43.233.224:9300 OPEN http 404 
+auth-system/ak-outpost-authentik-embedded-outpost 10.43.101.194:9000 OPEN http 302 
+auth-system/ak-outpost-authentik-embedded-outpost 10.43.101.194:9443 OPEN http 400 
+auth-system/ak-outpost-code-outpost 10.43.148.172:9000 OPEN http 404 
+auth-system/ak-outpost-code-outpost 10.43.148.172:9443 OPEN http 400 
+auth-system/ak-outpost-code-outpost-metrics 10.43.58.49:9300 OPEN http 404 
+auth-system/ak-outpost-crafty-outpost 10.43.44.155:9000 OPEN http 404 
+auth-system/ak-outpost-crafty-outpost 10.43.44.155:9443 OPEN http 400 
+auth-system/ak-outpost-crafty-outpost-metrics 10.43.27.113:9300 OPEN http 404 
+auth-system/ak-outpost-filebrowser-outpost 10.43.7.249:9000 OPEN http 404 
+auth-system/ak-outpost-filebrowser-outpost 10.43.7.249:9443 OPEN http 400 
+auth-system/ak-outpost-filebrowser-outpost-metrics 10.43.85.99:9300 OPEN http 404 
+auth-system/ak-outpost-glance-orsi-outpost 10.43.196.9:9000 OPEN http 404 
+auth-system/ak-outpost-glance-orsi-outpost 10.43.196.9:9443 OPEN http 400 
+auth-system/ak-outpost-glance-orsi-outpost-metrics 10.43.196.125:9300 OPEN http 404 
+auth-system/ak-outpost-glance-outpost 10.43.142.74:9000 OPEN http 404 
+auth-system/ak-outpost-glance-outpost 10.43.142.74:9443 OPEN http 400 
+auth-system/ak-outpost-glance-outpost-metrics 10.43.201.140:9300 OPEN http 404 
+auth-system/ak-outpost-homepage-orsi-outpost 10.43.66.136:9000 OPEN http 404 
+auth-system/ak-outpost-homepage-orsi-outpost 10.43.66.136:9443 OPEN http 400 
+auth-system/ak-outpost-homepage-orsi-outpost-metrics 10.43.244.43:9300 OPEN http 404 
+auth-system/ak-outpost-homepage-outpost 10.43.199.21:9000 OPEN http 404 
+auth-system/ak-outpost-homepage-outpost 10.43.199.21:9443 OPEN http 400 
+auth-system/ak-outpost-homepage-outpost-metrics 10.43.187.161:9300 OPEN http 404 
+auth-system/ak-outpost-kisfenyo-outpost 10.43.176.115:9000 OPEN http 404 
+auth-system/ak-outpost-kisfenyo-outpost 10.43.176.115:9443 OPEN http 400 
+auth-system/ak-outpost-kisfenyo-outpost-metrics 10.43.233.48:9300 OPEN http 404 
+auth-system/ak-outpost-ldap-outpost 10.43.162.147:389 OPEN https 000 
+auth-system/ak-outpost-ldap-outpost 10.43.162.147:636 OPEN https 000 
+auth-system/ak-outpost-ldap-outpost 10.43.162.147:9300 OPEN http 404 
+auth-system/ak-outpost-ldap-outpost-metrics 10.43.108.223:9300 OPEN http 404 
+auth-system/ak-outpost-orsi-outpost 10.43.208.171:9000 OPEN http 404 
+auth-system/ak-outpost-orsi-outpost 10.43.208.171:9443 OPEN http 400 
+auth-system/ak-outpost-orsi-outpost-metrics 10.43.112.181:9300 OPEN http 404 
+auth-system/ak-outpost-pihole-outpost 10.43.89.237:9000 OPEN http 404 
+auth-system/ak-outpost-pihole-outpost 10.43.89.237:9443 OPEN http 400 
+auth-system/ak-outpost-pihole-outpost-metrics 10.43.161.157:9300 OPEN http 404 
+auth-system/ak-outpost-plantit-outpost 10.43.20.58:9000 OPEN http 404 
+auth-system/ak-outpost-plantit-outpost 10.43.20.58:9443 OPEN http 400 
+auth-system/ak-outpost-plantit-outpost-metrics 10.43.253.17:9300 OPEN http 404 
+auth-system/ak-outpost-privatebin-outpost 10.43.41.96:9000 OPEN http 404 
+auth-system/ak-outpost-privatebin-outpost 10.43.41.96:9443 OPEN http 400 
+auth-system/ak-outpost-privatebin-outpost-metrics 10.43.87.152:9300 OPEN http 404 
+auth-system/ak-outpost-uptimekuma-outpost 10.43.15.220:9000 OPEN http 404 
+auth-system/ak-outpost-uptimekuma-outpost 10.43.15.220:9443 OPEN http 400 
+auth-system/ak-outpost-uptimekuma-outpost-metrics 10.43.77.209:9300 OPEN http 404 
+auth-system/authentik-server 10.43.142.123:80 OPEN http 302 
+auth-system/authentik-server 10.43.142.123:443 OPEN http 400 
+auth-system/authentik-server-metrics 10.43.224.102:9300 OPEN http 404 
+auth-system/authentik-worker-metrics 10.43.107.115:9300 OPEN http 200 
+booking-system/calcom 10.43.105.14:3000 OPEN http 307 
+booking-system/calcom-redis 10.43.160.2:6379 OPEN https 000 
+bookstack-system/bookstack 10.43.209.167:80 OPEN http 302 Redirecting to https://bookstack.dooplex.hu/login
+bookstack-system/bookstack-mariadb 10.43.65.20:3306 OPEN https 000 Redirecting to https://bookstack.dooplex.hu/login
+calibre-system/calibre-web-automated 10.43.232.53:8083 OPEN http 302 Redirecting...
+cert-manager/cert-manager 10.43.71.177:9402 OPEN http 404 
+cert-manager/cert-manager-cainjector 10.43.152.171:9402 OPEN http 404 
+cert-manager/cert-manager-webhook 10.43.210.109:443 OPEN http 400 
+cert-manager/cert-manager-webhook 10.43.210.109:9402 OPEN http 404 
+cnpg-system/cnpg-webhook-service 10.43.220.80:8080 OPEN http 400 
+code-system/code-server 10.43.200.176:8080 OPEN http 302 
+crafty-system/craftycontroller-https 10.43.35.97:8443 OPEN https 302 
+crafty-system/serverpackcreator 10.43.246.127:8080 OPEN http 200 ServerPackCreator
+database-system/postgresql-r 10.43.232.70:5432 OPEN https 000 ServerPackCreator
+database-system/postgresql-ro 10.43.242.254:5432 closed-or-filtered
+database-system/postgresql-rw 10.43.190.86:5432 OPEN https 000 ServerPackCreator
+default/kubernetes 10.43.0.1:443 OPEN http 400 
+felhom-system/contact-mailer 10.43.202.255:80 OPEN http 404 
+felhom-system/felhom-webpage 10.43.10.226:80 OPEN http 200 Felhom.eu — Saját felhőd, saját szabályaid | Otthoni szerver
+felhom-system/filebrowser 10.43.219.38:80 OPEN http 200       File Browser    
+felhom-system/hub 10.43.52.34:8080 OPEN http 302 
+felhom-system/umami 10.43.41.11:80 OPEN http 200 Umami
+felhom-system/umami-db 10.43.90.120:5432 OPEN https 000 Umami
+fileshare-system/gokapi 10.43.217.203:53842 OPEN http 200 
+gitea-system/gitea 10.43.8.106:3000 OPEN http 200 Gitea: Git with a cup of tea
+gitea-system/gitea 10.43.8.106:2222 OPEN https 000 Gitea: Git with a cup of tea
+glance-system/glance-helper 10.43.236.190:8000 OPEN http 404 
+glance-system/glance-kisfenyo 10.43.96.155:8080 OPEN http 200 Home
+glance-system/glance-orsi 10.43.42.102:8080 OPEN http 200 Home
+glance-system/idokep-scraper 10.43.34.231:8000 OPEN http 404 
+headlamp-system/headlamp 10.43.47.50:80 OPEN http 200 Headlamp
+homepage-system/homepage 10.43.34.4:3000 OPEN http 200 
+homepage-system/homepage-orsi 10.43.33.155:3000 OPEN http 200 
+immich-system/immich-machine-learning 10.43.134.146:3003 OPEN http 200 
+immich-system/immich-postgres 10.43.216.166:5432 OPEN https 000 
+immich-system/immich-server 10.43.69.28:2283 OPEN http 200 
+immich-system/immich-valkey 10.43.245.230:6379 OPEN https 000 
+jarr-nightly-system/nightly-jarr 10.43.41.156:3000 closed-or-filtered
+jarr-nightly-system/nightly-jarr-postgres 10.43.212.186:5432 closed-or-filtered
+jarr-nightly-system/nightly-jarr-redis 10.43.46.139:6379 closed-or-filtered
+jarrs-system/dev-jarr 10.43.3.168:3000 OPEN http 200 JARR — Just A Random Result
+jarrs-system/dev-jarr-postgres 10.43.28.40:5432 OPEN https 000 JARR — Just A Random Result
+jarrs-system/dev-jarr-redis 10.43.168.17:6379 OPEN https 000 JARR — Just A Random Result
+kisfenyo-system/guacamole 10.43.198.33:8080 OPEN http 200 
+kisfenyo-system/guacd 10.43.84.231:4822 OPEN https 000 
+kisfenyo-system/kisfenyo-filebrowser 10.43.14.45:80 OPEN http 200 "FileBrowser Quantum"
+kube-system/kube-dns 10.43.0.10:53 UDP skip-udp
+kube-system/kube-dns 10.43.0.10:53 OPEN https 000 "FileBrowser Quantum"
+kube-system/kube-dns 10.43.0.10:9153 OPEN http 404 
+kube-system/metrics-server 10.43.183.127:443 OPEN http 400 
+longhorn-system/longhorn-admission-webhook 10.43.91.126:9502 OPEN http 400 
+longhorn-system/longhorn-backend 10.43.241.105:9500 OPEN http 200 
+longhorn-system/longhorn-frontend 10.43.195.177:80 OPEN http 200 
+longhorn-system/longhorn-recovery-backend 10.43.98.183:9503 OPEN http 404 
+longhorn-system/pvc-1d4ec717-7ee5-40a0-b093-3a62fd2a81a4 10.43.31.240:2049 OPEN https 000 
+longhorn-system/pvc-8ed5eea5-67d4-46fc-9806-6b8fdd61e42e 10.43.69.49:2049 OPEN https 000 
+mediaserver-system/plex-plex-media-server 10.43.190.78:32400 closed-or-filtered
+metallb-system/metallb-webhook-service 10.43.36.127:443 OPEN http 400 
+mon-system/alertmanager 10.43.143.131:9093 OPEN http 200 Alertmanager
+mon-system/exportarr-prowlarr 10.43.171.82:9709 OPEN http 200 
+mon-system/exportarr-radarr 10.43.126.173:9708 OPEN http 200 
+mon-system/exportarr-sonarr 10.43.232.101:9707 OPEN http 200 
+mon-system/grafana 10.43.32.171:3000 OPEN http 200 Grafana
+mon-system/kube-state-metrics 10.43.77.239:8080 OPEN http 200 kube-state-metrics
+mon-system/kube-state-metrics 10.43.77.239:8081 OPEN http 200 kube-state-metrics
+mon-system/node-exporter 10.43.42.73:9100 OPEN http 200 Node Exporter
+mon-system/prometheus 10.43.75.209:9090 OPEN http 302 
+nextcloud-system/nextcloud 10.43.181.86:80 OPEN http 400 Nextcloud
+nextcloud-system/nextcloud-postgresql 10.43.18.100:5432 OPEN https 000 Nextcloud
+nginx-system/ingress-nginx-internal-controller 10.43.166.147:80 OPEN http 404 404 Not Found
+nginx-system/ingress-nginx-internal-controller 10.43.166.147:443 OPEN http 400 400 The plain HTTP request was sent to HTTPS port
+nginx-system/ingress-nginx-internal-controller-admission 10.43.90.248:443 OPEN http 400 
+nginx-system/ingress-nginx-internal-controller-metrics 10.43.83.22:10254 OPEN http 404 
+office-system/bentopdf 10.43.169.90:8080 OPEN http 200 BentoPDF - Free Online PDF Tools | Privacy-First PDF Toolkit
+office-system/onlyoffice 10.43.79.155:80 OPEN http 302 302 Found
+opengist-system/opengist 10.43.253.238:80 OPEN http 302 
+opengist-system/opengist 10.43.253.238:2222 OPEN https 000 
+orsi-system/orsi-filebrowser 10.43.188.12:80 OPEN http 200       File Browser    
+orsi-system/revfulop-calendar 10.43.213.82:3000 OPEN http 200 Révfülöp · Nyaraló Naptár
+outline-system/outline 10.43.46.49:3000 OPEN http 301 
+outline-system/outline-minio 10.43.166.151:9000 OPEN http 403 
+outline-system/outline-minio 10.43.166.151:9001 OPEN http 200 MinIO Console
+outline-system/outline-redis 10.43.65.17:6379 OPEN https 000 MinIO Console
+paperless-system/paperless 10.43.218.141:8000 OPEN http 302 
+paperless-system/paperless-redis 10.43.183.83:6379 OPEN https 000 
+pihole-system/external-dns-pihole 10.43.18.28:7979 OPEN http 404 
+pihole-system/pihole-dhcp 10.43.72.243:67 UDP skip-udp
+pihole-system/pihole-dns-tcp 10.43.236.96:53 OPEN https 000 
+pihole-system/pihole-dns-udp 10.43.192.211:53 UDP skip-udp
+pihole-system/pihole-exporter 10.43.102.172:9617 OPEN http 404 
+pihole-system/pihole-web 10.43.182.233:80 OPEN http 403 Pi-hole pihole-786ff65bd7-5zhzx
+pihole-system/pihole-web 10.43.182.233:443 closed-or-filtered
+plantit-system/plantit 10.43.56.143:3000 OPEN http 200 app
+plantit-system/plantit 10.43.56.143:8080 OPEN http 404 HTTP Status 404 – Not Found
+plantit-system/plantit-cache 10.43.134.91:6379 OPEN https 000 HTTP Status 404 – Not Found
+plantit-system/plantit-db 10.43.105.32:3306 OPEN https 000 HTTP Status 404 – Not Found
+privatebin-system/privatebin 10.43.30.60:80 OPEN http 200 Dooplex Paste
+servarr-system/ak-outpost-arr-outpost null:9000 closed-or-filtered
+servarr-system/prowlarr 10.43.41.42:9696 OPEN http 200 Prowlarr
+servarr-system/qbittorrent 10.43.174.87:8080 OPEN http 200 qBittorrent WebUI
+servarr-system/qbittorrent 10.43.174.87:6881 OPEN https 000 qBittorrent WebUI
+servarr-system/radarr 10.43.45.108:7878 OPEN http 200 Radarr
+servarr-system/radarrkids 10.43.244.174:7879 OPEN http 200 Radarr
+servarr-system/seerr 10.43.135.162:5055 OPEN http 307 
+servarr-system/sonarr 10.43.176.56:8989 OPEN http 200 Sonarr
+servarr-system/tautulli 10.43.36.206:8181 OPEN http 303 
+tandoor-system/recipe-importer 10.43.182.17:8000 OPEN http 401 
+tandoor-system/tandoor 10.43.31.47:8080 OPEN http 302 
+termix-system/termix 10.43.236.34:8080 OPEN http 200 Termix
+uptimekuma-system/uptimekuma 10.43.214.117:3001 OPEN http 302 
+vaultwarden-system/vaultwarden 10.43.38.33:80 OPEN http 200 
+version-checker-system/version-checker 10.43.124.2:8080 OPEN http 404 
+wanderer-system/wanderer-db 10.43.111.144:8090 OPEN http 404 
+wanderer-system/wanderer-meilisearch 10.43.152.86:7700 OPEN http 200 
+wanderer-system/wanderer-web 10.43.207.245:3000 OPEN http 200 Home | wanderer
+web-system/filebrowser 10.43.204.98:80 OPEN http 200       File Browser    
+web-system/static-server 10.43.92.56:80 OPEN http 403 403 Forbidden
+workout-system/sparkyfitness-db 10.43.190.119:5432 OPEN https 000 403 Forbidden
+workout-system/sparkyfitness-export 10.43.253.80:80 OPEN http 200 SparkyFitness export
+workout-system/sparkyfitness-frontend 10.43.83.16:80 OPEN http 200 SparkyFitness
+workout-system/sparkyfitness-server 10.43.66.255:3010 OPEN http 401 
+zipline-system/zipline 10.43.175.211:80 OPEN http 301 
@@ -0,0 +1,88 @@
+# P2 targeted no-login probes from cc-p2s-probe 2026-10-23T15:22:24Z. Response bodies stay in the pod's /tmp; only codes, sizes and counts are recorded.
+== Longhorn manager API (longhorn-backend 9500) and UI proxy (longhorn-frontend 80) — GET only
+http://10.43.241.105:9500/v1                                           200 bytes=6028
+http://10.43.241.105:9500/v1/volumes                                   200 bytes=797538
+http://10.43.241.105:9500/v1/backuptargets                             200 bytes=638
+http://10.43.241.105:9500/v1/backupvolumes                             200 bytes=196193
+http://10.43.241.105:9500/v1/settings/backup-target                    500 bytes=245
+http://10.43.241.105:9500/v1/recurringjobs                             200 bytes=667
+  volumes listed via API: 234
+  hub-data volume visible via API: 1
+  actions offered on a volume (names only): "activate" "attach" "detach" "pvcCreate" "snapshotBackup" "snapshotCreate" "updateReplicaCount" 
+http://10.43.195.177/v1/volumes                                        200 bytes=781928
+== Felhom hub (service hub:8080, bypasses the ingress geo filter) — GET, no token
+http://10.43.52.34:8080/healthz                                        200 bytes=2
+http://10.43.52.34:8080/                                               302 bytes=29
+http://10.43.52.34:8080/login                                          200 bytes=554
+http://10.43.52.34:8080/api/v1/customers                               403 bytes=31
+http://10.43.52.34:8080/api/v1/hosts                                   404 bytes=19
+http://10.43.52.34:8080/api/v1/preferences                             401 bytes=13
+http://10.43.52.34:8080/api/v1/box-config/x                            401 bytes=13
+http://10.43.52.34:8080/api/v1/artifacts/x                             401 bytes=51
+http://10.43.52.34:8080/api/v1/assets/file/x                           401 bytes=13
+http://10.43.52.34:8080/api/v1/wait                                    401 bytes=13
+http://10.43.52.34:8080/api/v1/appliance/poll                          401 bytes=13
+http://10.43.52.34:8080/metrics                                        302 bytes=29
+http://10.43.52.34:8080/hosts                                          302 bytes=29
+http://10.43.52.34:8080/configs                                        302 bytes=29
+http://10.43.52.34:8080/customers                                      302 bytes=29
+http://10.43.52.34:8080/escrow                                         302 bytes=29
+http://10.43.52.34:8080/export                                         302 bytes=29
+http://10.43.52.34:8080/backup                                         302 bytes=29
+== kube-apiserver anonymous
+https://10.43.0.1:443/version                                          401 bytes=157
+https://10.43.0.1:443/api                                              401 bytes=157
+https://10.43.0.1:443/api/v1/namespaces                                401 bytes=157
+https://10.43.0.1:443/api/v1/namespaces/felhom-system/secrets          401 bytes=157
+https://192.168.0.180:6443/version                                     401 bytes=157
+https://192.168.0.180:6443/api/v1/namespaces/felhom-system/secrets     401 bytes=157
+== kubelet anonymous
+https://192.168.0.180:10250/pods                                       401 bytes=12
+https://192.168.0.180:10250/healthz                                    401 bytes=12
+https://192.168.0.180:10250/metrics                                    401 bytes=12
+http://192.168.0.180:10255/pods                                        000 bytes=0
+== monitoring
+http://10.43.75.209:9090/api/v1/status/buildinfo                       200 bytes=205
+http://10.43.75.209:9090/api/v1/query?query=up                         200 bytes=5924
+http://10.43.143.131:9093/api/v2/status                                200 bytes=3340
+http://10.43.143.131:9093/api/v2/silences                              200 bytes=758
+http://10.43.32.171:3000/api/health                                    200 bytes=101
+http://10.43.32.171:3000/api/search                                    200 bytes=7276
+http://10.43.32.171:3000/api/datasources                               200 bytes=1053
+http://10.43.42.73:9100/metrics                                        200 bytes=880412
+== Gitea + registry
+http://10.43.8.106:3000/api/v1/repos/search?limit=50                   200 bytes=16231
+  anon-visible repos: "full_name":"authentik Default Admin" "full_name":"admin/app-catalog-felhom.eu" "full_name":"authentik Default Admin" "full_name":"admin/felhom-agent" "full_name":"authentik Default Admin" "full_name":"admin/felhom-controller" "full_name":"authentik Default Admin" "full_name":"admin/felhom.eu" "full_name":"authentik Default Admin" "full_name":"admin/misc-scripts" "full_name":"authentik Default Admin" "full_name":"admin/recipe-importer" "full_name":"authentik Default Admin" "full_name":"admin/revfulop-calendar" 
+http://10.43.8.106:3000/v2/                                            401 bytes=49
+http://10.43.8.106:3000/v2/_catalog                                    401 bytes=49
+http://10.43.8.106:3000/v2/admin/felhom-hub/tags/list                  401 bytes=49
+http://10.43.8.106:3000/v2/admin/felhom-controller/tags/list           401 bytes=49
+== Vaultwarden
+http://10.43.38.33/alive                                               200 bytes=29
+http://10.43.38.33/api/config                                          200 bytes=596
+http://10.43.38.33/admin                                               200 bytes=6364
+== ArgoCD
+http://10.43.16.170/api/v1/applications                                401 bytes=79
+http://10.43.16.170/api/version                                        200 bytes=28
+== filebrowsers (felhom-system one + others): API without login
+http://10.43.219.38/api/resources/                                     401 bytes=17
+http://10.43.204.98/api/resources/                                     401 bytes=17
+http://10.43.188.12/api/resources/                                     401 bytes=17
+http://10.43.14.45/api/resources                                       401 bytes=54
+== felhom-system/umami + contact-mailer
+http://10.43.41.11/api/auth/verify                                     405 bytes=0
+http://10.43.202.255/healthz                                           200 bytes=55
+== DooPlex node ports from the pod (TCP connect only)
+node 192.168.0.180:22     open
+node 192.168.0.180:111    open
+node 192.168.0.180:2049   open
+node 192.168.0.180:3000   closed
+node 192.168.0.180:5000   closed
+node 192.168.0.180:6443   open
+node 192.168.0.180:8006   closed
+node 192.168.0.180:9100   open
+node 192.168.0.180:10250  open
+node 192.168.0.180:10255  closed
+node 192.168.0.180:32400  closed
+== NFS from a PRIVILEGED source port as uid 1000 (connect only; the 'secure' option checks this)
+bind :700 + connect 2049: SUCCESS
@@ -0,0 +1,57 @@
+# CoreDNS has NO query log (Corefile: errors/health/ready/kubernetes/hosts/prometheus/cache/loop/reload/loadbalance/forward — no 'log' plugin). Only upstream-timeout ERROR lines name a domain, and they carry the COREDNS pod's upstream socket, not the client. Names below: ERROR lines 2026-10-17T06:00+02 .. 2026-10-23T10:06+02, counted. Source: /var/log/pods/kube-system_coredns-65d746d599-d56mt_77a81c54-d56d-4921-8043-db05a3138b17/coredns/3.log (survived the 13:20Z reboot).
+    391 metrics.jarrs.eu.
+    372 _grpc_config.argocd-repo-server.
+    259 authentik.dooplex.hu.
+    247 store.steampowered.com.
+    234 _grpc_config.localhost.
+    224 hetzner.abonet.hu.
+    208 api.github.com.
+    184 gitea.dooplex.hu.
+    153 telex.hu.
+    142 outline.dooplex.hu.
+    137 pb.wanderer.dooplex.hu.
+    135 jarrs.eu.
+    127 bookstack.dooplex.hu.
+    122 nextcloud.dooplex.hu.
+     82 quay.io.
+     69 registry.hub.docker.com.
+     64 log.tailscale.com.
+     63 smtp.gmail.com.
+     48 pubsub00.pop.fra.plex.bz.
+     40 plex.enkisfelhom.hu.
+     39 pubsub13.pop.fra.plex.bz.
+     23 plex.tv.
+     22 ncore.pro.
+     16 grafana.com.
+     16 dl.k8s.io.
+     15 v4.plex.tv.
+     11 smtp.resend.com.
+     11 pubsub07.pop.fra.plex.bz.
+     10 pubsub01.pop.atl.plex.bz.
+     10 pubsub00.pop.dfw.plex.bz.
+     10 hand.genddos.st.
+      9 api.hetzner.com.
+      8 t.ncore.sh.
+      8 registry.k8s.io.
+      8 raw.githubusercontent.com.
+      7 version.goauthentik.io.
+      4 t.ncore.pro.
+      4 api.segment.io.
+      4 10-42-0-52.abcdefghijklmnopqrstuvwxyz012345.plex.direct.
+      3 version.immich.cloud.
+      3 controlplane.tailscale.com.
+      2 scrobbles.plex.tv.
+      2 pubsub08.pop.ewr.plex.bz.
+      1 thexem.info.
+      1 api.resend.com.
+# hand.genddos.st lookups (all, local time +02:00):
+2026-10-19T10:31:55
+2026-10-19T10:48:24
+2026-10-19T10:49:27
+2026-10-19T11:43:02
+2026-10-19T11:43:19
+2026-10-19T11:43:36
+2026-10-19T11:43:45
+2026-10-19T11:43:47
+2026-10-19T11:50:01
+2026-10-19T11:50:48
@@ -0,0 +1,98 @@
+# P3 hub access log (/data/access-log, R-1140) aggregates, read in the running hub pod 2026-10-23T15:28:30Z. Lines carry path/status/remote/xff/cred/auth only.
+files: access-2026-10-18.log
+access-2026-10-19.log
+access-2026-10-20.log
+access-2026-10-21.log
+access-2026-10-22.log
+access-2026-10-23.log
+first line: 2026-10-18T10:25:05Z
+lines total: 12764
+== remote= values (count)
+  12481 remote=10.42.0.200
+    210 remote=10.42.0.1
+     54 remote=10.42.0.213
+     19 remote=10.42.0.107
+== xff= first hop, grouped by /24 (count) — positive control: ingress traffic must show a client here
+  11728 192.168.0.x
+    762 37.191.56.x
+     38 176.77.140.x
+      4 176.77.139.x
+      3 10.42.0.x
+== any remote or xff in the pod CIDR 10.42.x other than the ingress 10.42.0.200 (count, then lines)
+283
+2026-10-18T10:28:45Z GET /healthz 200 0ms remote=10.42.0.1 xff=- cred=- auth=-
+2026-10-18T10:28:45Z GET /bind/[redacted] 200 0ms remote=10.42.0.1 xff=- cred=- auth=-
+2026-10-18T10:28:45Z GET /configuration 302 0ms remote=10.42.0.1 xff=- cred=- auth=-
+2026-10-18T10:28:45Z GET /api/v1/wait 401 0ms remote=10.42.0.1 xff=- cred=bearer+session-cookie auth=-
+2026-10-18T10:28:45Z POST /login 401 187ms remote=10.42.0.1 xff=- cred=- auth=-
+2026-10-18T10:29:00Z GET /configuration 200 1403ms remote=10.42.0.1 xff=- cred=token auth=token
+2026-10-18T10:29:02Z GET /configuration/artifacts 403 0ms remote=10.42.0.1 xff=- cred=token auth=-
+2026-10-18T10:29:10Z GET /configuration 200 7ms remote=10.42.0.1 xff=- cred=token auth=token
+2026-10-18T10:39:55Z GET /api/v1/admin/hosts/demo-hp-bb76ea/recovery-credential 200 9ms remote=10.42.0.1 xff=- cred=bearer auth=global
+2026-10-18T10:43:43Z GET /api/v1/admin/hosts/demo-hp-bb76ea/recovery-credential 200 0ms remote=10.42.0.1 xff=- cred=bearer auth=global
+2026-10-18T10:55:13Z POST /api/v1/admin/hosts/demo-hp-bb76ea/jobs 201 26ms remote=10.42.0.1 xff=- cred=bearer auth=global
+2026-10-18T10:55:13Z POST /api/v1/admin/hosts/demo-hp-bb76ea/jobs 201 4ms remote=10.42.0.1 xff=- cred=bearer auth=global
+2026-10-18T11:09:23Z POST /customers/tester-1/floor 303 13ms remote=10.42.0.1 xff=- cred=token auth=token
+2026-10-18T11:09:24Z POST /customers/demo-hp/floor 303 11ms remote=10.42.0.1 xff=- cred=token auth=token
+2026-10-18T11:09:24Z POST /customers/demo-felhom/floor 303 9ms remote=10.42.0.1 xff=- cred=token auth=token
+2026-10-18T11:10:59Z POST /configuration/global-floor 303 39ms remote=10.42.0.1 xff=- cred=token auth=token
+2026-10-18T11:10:59Z POST /customers/tester-1/floor 303 8ms remote=10.42.0.1 xff=- cred=token auth=token
+2026-10-18T11:11:00Z POST /customers/demo-hp/floor 303 11ms remote=10.42.0.1 xff=- cred=token auth=token
+2026-10-18T11:11:00Z POST /customers/demo-felhom/floor 303 7ms remote=10.42.0.1 xff=- cred=token auth=token
+2026-10-18T12:22:00Z POST /api/v1/admin/hosts/tester-1-d70be4/jobs 201 14ms remote=10.42.0.1 xff=- cred=bearer auth=global
+== negative-control search: plex pod IP 10.42.0.52 anywhere
+0
+== credentialed requests (cred!=none) by xff and auth (count)
+   2511 xff=192.168.0.155 cred=bearer auth=customer
+   2444 xff=192.168.0.149 cred=bearer auth=customer
+   1889 xff=192.168.0.148 cred=bearer auth=customer
+   1272 xff=192.168.0.110 cred=session-cookie auth=session
+    552 xff=192.168.0.104 cred=bearer auth=host
+    549 xff=37.191.56.193 cred=bearer auth=host
+    531 xff=192.168.0.154 cred=bearer auth=host
+    523 xff=192.168.0.101 cred=bearer auth=customer
+    444 xff=192.168.0.133 cred=bearer auth=customer
+    263 xff=192.168.0.134 cred=bearer auth=-
+    261 xff=192.168.0.151 cred=bearer auth=customer
+    241 xff=192.168.0.125 cred=bearer auth=customer
+    173 xff=37.191.56.193 cred=bearer auth=customer
+    160 xff=- cred=token auth=token
+    130 xff=192.168.0.139 cred=bearer auth=customer
+    112 xff=192.168.0.128 cred=bearer auth=host
+     95 xff=192.168.0.134 cred=bearer auth=host
+     48 xff=192.168.0.128 cred=bearer auth=-
+     42 xff=192.168.0.159 cred=bearer auth=-
+     32 xff=192.168.0.110 cred=session-cookie auth=-
+     32 xff=- cred=bearer auth=global
+     27 xff=192.168.0.133 cred=bearer auth=host
+     23 xff=176.77.140.26 cred=session-cookie auth=session
+     22 xff=192.168.0.157 cred=bearer auth=customer
+     22 xff=192.168.0.135 cred=bearer auth=customer
+     20 xff=192.168.0.109 cred=bearer auth=-
+     15 xff=176.77.140.26 cred=session-cookie auth=-
+     14 xff=192.168.0.128 cred=passphrase auth=-
+     13 xff=- cred=token auth=-
+      9 xff=37.191.56.193 cred=session-cookie auth=session
+
+== lines with xff in 10.42.x (all)
+2026-10-23T13:00:38Z GET / 302 0ms remote=10.42.0.200 xff=10.42.0.1 cred=- auth=-
+2026-10-23T13:02:09Z GET / 302 0ms remote=10.42.0.200 xff=10.42.0.1 cred=- auth=-
+2026-10-23T14:00:08Z GET / 302 0ms remote=10.42.0.213 xff=10.42.0.1 cred=- auth=-
+== remote=10.42.0.213: first/last and path set
+2026-10-23T14:00:08Z GET / 302 0ms remote=10.42.0.213 xff=10.42.0.1 cred=- auth=-
+2026-10-23T15:21:24Z GET /api/v1/wait 200 240000ms remote=10.42.0.213 xff=37.191.56.193 cred=bearer auth=customer
+      8 GET / 200
+      2 GET / 302
+     22 GET /api/v1/wait 200
+      1 GET /configuration 200
+      4 GET /hosts 200
+      1 GET /login 200
+      1 GET /style.css 200
+      6 POST /api/v1/host-report 200
+      7 POST /api/v1/report 200
+      1 POST /appliances/49/discard 303
+      1 POST /login 303
+== remote=10.42.0.107 = this session's probe pod cc-p2s-probe (positive control: a direct pod call is logged with the pod IP)
+2026-10-23T15:20:21Z GET / 302 0ms remote=10.42.0.107 xff=- cred=- auth=-
+2026-10-23T15:22:25Z GET /healthz 200 0ms remote=10.42.0.107 xff=- cred=- auth=-
+2026-10-23T15:22:25Z GET / 302 0ms remote=10.42.0.107 xff=- cred=- auth=-
@@ -0,0 +1,370 @@
+# P3 Longhorn objects created or changed in the window 2026-10-17T04:00:00Z .. 2026-10-23T08:05:00Z (and to now), 2026-10-23T15:26:52Z
+== backuptargets: total 1
+== volumes: total 78
+2026-10-23T10:29:26Z  pvc-625fd054-e576-46bb-89df-44df916705d0  created-in-window=true  changes=[]  {"longhornvolume":"pvc-625fd054-e576-46bb-89df-44df916705d0","recurring-job-group.longhorn.io/default":"enabled"}
+== engines: total 78
+2026-10-23T10:29:26Z  pvc-625fd054-e576-46bb-89df-44df916705d0-e-0  created-in-window=true  changes=[]  {"longhornvolume":"pvc-625fd054-e576-46bb-89df-44df916705d0"}
+== replicas: total 78
+2026-10-23T10:29:26Z  pvc-625fd054-e576-46bb-89df-44df916705d0-r-39bf02b9  created-in-window=true  changes=[]  {"longhornvolume":"pvc-625fd054-e576-46bb-89df-44df916705d0"}
+== backups: total 178
+2026-10-18T03:00:06Z  backup-83f5ca7773d241dd  created-in-window=true  changes=[]  {"backup-volume":"pvc-486c9809-4672-4b56-b70e-0bf01d0c3628"}
+2026-10-18T03:00:06Z  backup-9cb157e9f9404406  created-in-window=true  changes=[]  {"backup-volume":"pvc-1ae51535-0b2b-4975-bd9f-e651cc7a1edd"}
+2026-10-18T03:00:21Z  backup-831843c912bf4b12  created-in-window=true  changes=[]  {"backup-volume":"pvc-4e3fd336-9f09-4251-bd90-cdc259ef739e"}
+2026-10-18T03:00:26Z  backup-8b2ca7e2fbe34bf0  created-in-window=true  changes=[]  {"backup-volume":"pvc-71cbab32-86f9-40a5-8f3b-220ad626c492"}
+2026-10-18T03:00:42Z  backup-6e03f6813d7748cb  created-in-window=true  changes=[]  {"backup-volume":"pvc-4e4aba1e-b414-4016-8895-ecdf0fb04a6b"}
+2026-10-18T03:01:17Z  backup-c64693c622f34710  created-in-window=true  changes=[]  {"backup-volume":"pvc-4fdd6da2-e795-4fa9-9e36-96f212c7018b"}
+2026-10-18T03:01:22Z  backup-1929a083d7244abc  created-in-window=true  changes=[]  {"backup-volume":"pvc-11b257b2-8edc-4bf6-b846-00979feb195f"}
+2026-10-18T03:01:33Z  backup-68391531c3af4b10  created-in-window=true  changes=[]  {"backup-volume":"pvc-297c20e6-4ac0-42c4-9c69-24580a7f12ee"}
+2026-10-18T03:01:42Z  backup-11c551d5375b4b73  created-in-window=true  changes=[]  {"backup-volume":"pvc-1c47727a-d5ac-4171-ac36-26c2df3d0d63"}
+2026-10-18T03:01:48Z  backup-e830ec38da3e4aa0  created-in-window=true  changes=[]  {"backup-volume":"pvc-202e3bf2-9e61-4c59-ae0c-43fa6a42b403"}
+2026-10-18T03:01:58Z  backup-f7f8ab0ab97d4123  created-in-window=true  changes=[]  {"backup-volume":"pvc-42695a34-d921-4007-b5e5-e40aa728e104"}
+2026-10-18T03:02:03Z  backup-4388930c28b249ac  created-in-window=true  changes=[]  {"backup-volume":"pvc-22343573-266d-492e-bd0a-37296217b523"}
+2026-10-18T03:02:13Z  backup-265f326237f943bc  created-in-window=true  changes=[]  {"backup-volume":"pvc-459e6d2a-92b8-438e-a339-ff7e40089f3d"}
+2026-10-18T03:02:38Z  backup-31058e4d796843e0  created-in-window=true  changes=[]  {"backup-volume":"pvc-2e2e8c4c-4ba3-4dcf-9ed4-78acaf7ef92b"}
+2026-10-18T03:02:49Z  backup-d118ae8350584600  created-in-window=true  changes=[]  {"backup-volume":"pvc-6ed74c1a-3f10-4638-9baa-9330cbff980d"}
+2026-10-18T03:02:54Z  backup-6cc7894ae5d548e1  created-in-window=true  changes=[]  {"backup-volume":"pvc-38e8c624-5717-483b-8da1-613e703e36c8"}
+2026-10-18T03:03:04Z  backup-f9ef84c50f2a4f64  created-in-window=true  changes=[]  {"backup-volume":"pvc-b359d7de-1c7c-4b6a-9f6d-6776c2f876ef"}
+2026-10-18T03:03:09Z  backup-247107e8a9f4438a  created-in-window=true  changes=[]  {"backup-volume":"pvc-79478678-07e4-4140-aef1-771ff763ab3f"}
+2026-10-18T03:03:25Z  backup-ef8d1e513d754e0a  created-in-window=true  changes=[]  {"backup-volume":"pvc-7d6dec2c-0cda-43c7-ad1d-44ffebcb8cb6"}
+2026-10-18T03:03:29Z  backup-e0e842ed504b47f6  created-in-window=true  changes=[]  {"backup-volume":"pvc-cbfd55b0-4f44-487d-90fd-9c80b916ced7"}
+2026-10-18T03:03:40Z  backup-3c9743af9aba4880  created-in-window=true  changes=[]  {"backup-volume":"pvc-c6b9ab63-24b8-46f2-b52a-06da86393de8"}
+2026-10-18T03:03:50Z  backup-c6b2adafd1104326  created-in-window=true  changes=[]  {"backup-volume":"pvc-c8c0d0f1-c9ea-4ed3-9e22-1e254a026c49"}
+2026-10-18T03:03:55Z  backup-d43ed113492441e9  created-in-window=true  changes=[]  {"backup-volume":"pvc-c911715e-56ee-4d97-836e-89efc448ad9d"}
+2026-10-18T03:04:16Z  backup-64df95594d61410e  created-in-window=true  changes=[]  {"backup-volume":"pvc-d9f09398-17cf-44b0-b3a2-9475bc773fec"}
+2026-10-18T03:04:30Z  backup-ddb8de7a110845a8  created-in-window=true  changes=[]  {"backup-volume":"pvc-d2ea5b66-d251-4467-9829-14654fab7a2f"}
+2026-10-18T03:04:31Z  backup-642f2c4d5e1f46e4  created-in-window=true  changes=[]  {"backup-volume":"pvc-e2151b14-2b24-4128-993a-c392c8d9706a"}
+2026-10-18T03:04:46Z  backup-324ef5fac7c04cf3  created-in-window=true  changes=[]  {"backup-volume":"pvc-8401df55-4668-40e3-97d2-d53e2c1090f1"}
+2026-10-18T03:04:52Z  backup-3df2312ae5834927  created-in-window=true  changes=[]  {"backup-volume":"pvc-7fc61dcd-52f0-45b4-97f1-9c82b28ab714"}
+2026-10-18T03:05:01Z  backup-36eb129a7fa340bf  created-in-window=true  changes=[]  {"backup-volume":"pvc-a9dd6c7c-19eb-4a0a-935d-d2c30545c378"}
+2026-10-18T03:05:07Z  backup-affa5f905744417d  created-in-window=true  changes=[]  {"backup-volume":"pvc-e3b26fdc-fd52-4fdf-9fa2-1d1ecfd029e4"}
+2026-10-18T03:05:21Z  backup-7954dead7a2f4ac0  created-in-window=true  changes=[]  {"backup-volume":"pvc-9ca6a486-40bb-46ac-ac48-bd49d4399f4b"}
+2026-10-18T03:05:22Z  backup-2c527e242af3442c  created-in-window=true  changes=[]  {"backup-volume":"pvc-85be87dc-3351-4459-9f82-55f8cc598a2f"}
+2026-10-18T03:05:43Z  backup-05d9bbb684154607  created-in-window=true  changes=[]  {"backup-volume":"pvc-e5b8f824-7720-454c-b546-a098608df24a"}
+2026-10-18T03:05:57Z  backup-d8f19882fa7d464f  created-in-window=true  changes=[]  {"backup-volume":"pvc-e57c220f-bc92-4815-89c9-0dee35eab3c3"}
+2026-10-18T03:05:58Z  backup-158db9819d8940a9  created-in-window=true  changes=[]  {"backup-volume":"pvc-8ed5eea5-67d4-46fc-9806-6b8fdd61e42e"}
+2026-10-18T03:06:12Z  backup-8ae6abaa0da54230  created-in-window=true  changes=[]  {"backup-volume":"pvc-88b4d7b4-cb5d-48e0-871e-9e150872d0bd"}
+2026-10-18T03:06:13Z  backup-12a5c7d715754fe4  created-in-window=true  changes=[]  {"backup-volume":"pvc-be9d7813-1881-462e-8951-1bd1315f7dc5"}
+2026-10-18T03:06:27Z  backup-935a9c3d36d7480a  created-in-window=true  changes=[]  {"backup-volume":"pvc-ea977627-fb0a-4dee-8678-9ceceea448da"}
+2026-10-18T03:06:29Z  backup-c8d9e42845514f20  created-in-window=true  changes=[]  {"backup-volume":"pvc-b10da48e-6fcc-42ef-8414-d5d617028d68"}
+2026-10-18T03:06:44Z  backup-b9301ac86e494ac4  created-in-window=true  changes=[]  {"backup-volume":"pvc-beb0ad8a-755a-4152-a0af-f7367b32b19c"}
+2026-10-18T03:06:48Z  backup-50ba4beb9ca741d3  created-in-window=true  changes=[]  {"backup-volume":"pvc-b0e94be5-7cd8-4a4c-9295-901614e9eeb7"}
+2026-10-18T03:07:00Z  backup-7c33f6000bba49ad  created-in-window=true  changes=[]  {"backup-volume":"pvc-8931072a-e34e-4333-9ab5-9629b6078505"}
+2026-10-18T03:07:08Z  backup-25ffadfcb65a4236  created-in-window=true  changes=[]  {"backup-volume":"pvc-c4dfbc43-2c35-4ef0-9cfe-39b3dc885dae"}
+2026-10-18T03:07:30Z  backup-f377a53003b44ec2  created-in-window=true  changes=[]  {"backup-volume":"pvc-7eb1f195-6a35-46c3-bbb1-5bab48209624"}
+2026-10-18T03:07:34Z  backup-5bc64db7e1854620  created-in-window=true  changes=[]  {"backup-volume":"pvc-17e3b3cc-9c6a-4d70-85cc-c2ae72e0b4ec"}
+2026-10-18T03:07:49Z  backup-70a99267481e466a  created-in-window=true  changes=[]  {"backup-volume":"pvc-0113bbbf-fd5c-441b-9d58-6943ffa8c133"}
+2026-10-18T03:07:50Z  backup-2a7db97121514867  created-in-window=true  changes=[]  {"backup-volume":"pvc-5fbd3bbc-fb14-406d-954c-1a232ce313ce"}
+2026-10-18T03:08:04Z  backup-b736b062e3244ec5  created-in-window=true  changes=[]  {"backup-volume":"pvc-63f3b34f-3ac6-41a5-8790-3a27db0b5a2b"}
+2026-10-18T03:08:06Z  backup-d1654988274b4ef6  created-in-window=true  changes=[]  {"backup-volume":"pvc-2382e7bb-9514-409b-a2cc-e97c9725512a"}
+2026-10-18T03:08:20Z  backup-99f7cf4d8a6843c4  created-in-window=true  changes=[]  {"backup-volume":"pvc-3b23c214-ea15-40f8-aac5-61f783bf5beb"}
+2026-10-18T03:08:21Z  backup-d357833443b84351  created-in-window=true  changes=[]  {"backup-volume":"pvc-5acabaa7-6017-4793-b45e-f1f4fd80ab97"}
+2026-10-18T03:08:35Z  backup-0172504296ed493e  created-in-window=true  changes=[]  {"backup-volume":"pvc-fc3d2f7f-6569-473c-acb4-002c613e5f18"}
+2026-10-18T03:08:47Z  backup-5bbbc3ddca4b4a62  created-in-window=true  changes=[]  {"backup-volume":"pvc-0eae2db7-47f1-477b-b9a9-9968c2d49a6d"}
+2026-10-23T02:00:06Z  backup-81b6314085e24457  created-in-window=true  changes=[]  {"backup-volume":"pvc-486c9809-4672-4b56-b70e-0bf01d0c3628"}
+2026-10-23T02:00:06Z  backup-e77c1fd337bb456b  created-in-window=true  changes=[]  {"backup-volume":"pvc-71cbab32-86f9-40a5-8f3b-220ad626c492"}
+2026-10-23T02:00:22Z  backup-eb26a242694a4235  created-in-window=true  changes=[]  {"backup-volume":"pvc-5acabaa7-6017-4793-b45e-f1f4fd80ab97"}
+2026-10-23T02:00:42Z  backup-45644a4760604077  created-in-window=true  changes=[]  {"backup-volume":"pvc-4e3fd336-9f09-4251-bd90-cdc259ef739e"}
+2026-10-23T02:01:08Z  backup-3a373d05a9764a36  created-in-window=true  changes=[]  {"backup-volume":"pvc-4e4aba1e-b414-4016-8895-ecdf0fb04a6b"}
+2026-10-23T02:01:32Z  backup-9ccd1d94f68c485e  created-in-window=true  changes=[]  {"backup-volume":"pvc-4fdd6da2-e795-4fa9-9e36-96f212c7018b"}
+2026-10-23T02:01:33Z  backup-1a5d5f5f6f254880  created-in-window=true  changes=[]  {"backup-volume":"pvc-22343573-266d-492e-bd0a-37296217b523"}
+== backupvolumes: total 91
+== backupbackingimages: total 0
+== systembackups: total 0
+== systemrestores: total 0
+== recurringjobs: total 2
+== volumeattachments: total 78
+2026-10-23T10:29:26Z  pvc-625fd054-e576-46bb-89df-44df916705d0  created-in-window=true  changes=[]  {"longhornvolume":"pvc-625fd054-e576-46bb-89df-44df916705d0"}
+== snapshots: total 149
+2026-10-18T03:00:01Z  backup-w-9e561c5f-39bf-4de0-b86d-4154538ced31  created-in-window=true  changes=[]  {"longhornvolume":"pvc-1ae51535-0b2b-4975-bd9f-e651cc7a1edd"}
+2026-10-18T03:00:01Z  backup-w-c9cb53aa-4359-4309-9976-530a6faf3310  created-in-window=true  changes=[]  {"longhornvolume":"pvc-486c9809-4672-4b56-b70e-0bf01d0c3628"}
+2026-10-18T03:00:16Z  backup-w-8822d0fe-6849-4df1-bed1-7ea948861d7b  created-in-window=true  changes=[]  {"longhornvolume":"pvc-71cbab32-86f9-40a5-8f3b-220ad626c492"}
+2026-10-18T03:00:16Z  backup-w-ce5a0dec-ec88-4da1-b14f-7acf37cda9e2  created-in-window=true  changes=[]  {"longhornvolume":"pvc-4e3fd336-9f09-4251-bd90-cdc259ef739e"}
+2026-10-18T03:00:37Z  backup-w-f36ce009-f2ec-4da5-bef2-e72746c50eae  created-in-window=true  changes=[]  {"longhornvolume":"pvc-4e4aba1e-b414-4016-8895-ecdf0fb04a6b"}
+2026-10-18T03:01:12Z  backup-w-152bc04c-cfb0-494e-a020-b8edceb99208  created-in-window=true  changes=[]  {"longhornvolume":"pvc-4fdd6da2-e795-4fa9-9e36-96f212c7018b"}
+2026-10-18T03:01:17Z  backup-w-7be4c31e-99c9-4858-abc0-8b2b102fa6eb  created-in-window=true  changes=[]  {"longhornvolume":"pvc-11b257b2-8edc-4bf6-b846-00979feb195f"}
+2026-10-18T03:01:28Z  backup-w-492c52b6-af58-4b56-b031-e1a2f610e656  created-in-window=true  changes=[]  {"longhornvolume":"pvc-297c20e6-4ac0-42c4-9c69-24580a7f12ee"}
+2026-10-18T03:01:32Z  backup-w-500c8206-b274-4c95-adc1-7dbf77b41806  created-in-window=true  changes=[]  {"longhornvolume":"pvc-1c47727a-d5ac-4171-ac36-26c2df3d0d63"}
+2026-10-18T03:01:43Z  backup-w-477bb594-f177-4d5b-be17-2db7fc908486  created-in-window=true  changes=[]  {"longhornvolume":"pvc-202e3bf2-9e61-4c59-ae0c-43fa6a42b403"}
+2026-10-18T03:01:52Z  backup-w-5a54721b-bdfc-48ae-8f5f-8612bff3525d  created-in-window=true  changes=[]  {"longhornvolume":"pvc-42695a34-d921-4007-b5e5-e40aa728e104"}
+2026-10-18T03:01:53Z  backup-w-dea6667f-c93f-4bb7-ad59-b8b3bc772476  created-in-window=true  changes=[]  {"longhornvolume":"pvc-22343573-266d-492e-bd0a-37296217b523"}
+2026-10-18T03:02:08Z  backup-w-069a5b3f-1600-4147-9566-29f351d2bb39  created-in-window=true  changes=[]  {"longhornvolume":"pvc-459e6d2a-92b8-438e-a339-ff7e40089f3d"}
+2026-10-18T03:02:33Z  backup-w-a493d271-9d5e-41d5-a93c-7954e173eb0f  created-in-window=true  changes=[]  {"longhornvolume":"pvc-2e2e8c4c-4ba3-4dcf-9ed4-78acaf7ef92b"}
+2026-10-18T03:02:44Z  backup-w-34fa0b60-8201-4c21-aad1-f73656d1fc4c  created-in-window=true  changes=[]  {"longhornvolume":"pvc-6ed74c1a-3f10-4638-9baa-9330cbff980d"}
+2026-10-18T03:02:44Z  backup-w-db1904d5-7bfe-45f4-81c6-e17010691225  created-in-window=true  changes=[]  {"longhornvolume":"pvc-38e8c624-5717-483b-8da1-613e703e36c8"}
+2026-10-18T03:02:59Z  backup-w-e06ba46d-8847-4f8c-9a9c-ad67982d4f5c  created-in-window=true  changes=[]  {"longhornvolume":"pvc-b359d7de-1c7c-4b6a-9f6d-6776c2f876ef"}
+2026-10-18T03:03:04Z  backup-w-cac58903-1e3d-4c60-95ed-72e4d7ac4662  created-in-window=true  changes=[]  {"longhornvolume":"pvc-79478678-07e4-4140-aef1-771ff763ab3f"}
+2026-10-18T03:03:14Z  backup-w-80d619fb-2f32-4af8-aa0c-7d6c034896a7  created-in-window=true  changes=[]  {"longhornvolume":"pvc-7d6dec2c-0cda-43c7-ad1d-44ffebcb8cb6"}
+2026-10-18T03:03:19Z  backup-w-34af7ebb-cca6-47a6-a668-541a5f4124a3  created-in-window=true  changes=[]  {"longhornvolume":"pvc-cbfd55b0-4f44-487d-90fd-9c80b916ced7"}
+2026-10-18T03:03:35Z  backup-w-ec972d0f-02f6-47de-8252-f3471a63d29a  created-in-window=true  changes=[]  {"longhornvolume":"pvc-c6b9ab63-24b8-46f2-b52a-06da86393de8"}
+2026-10-18T03:03:40Z  backup-w-336bb191-b457-432c-8b3b-a49b8fbcb844  created-in-window=true  changes=[]  {"longhornvolume":"pvc-c8c0d0f1-c9ea-4ed3-9e22-1e254a026c49"}
+2026-10-18T03:03:50Z  backup-w-132be759-46d9-48f4-9b7f-731dbf00aa5a  created-in-window=true  changes=[]  {"longhornvolume":"pvc-c911715e-56ee-4d97-836e-89efc448ad9d"}
+2026-10-18T03:04:06Z  backup-w-81d52611-6488-4b98-aced-cb0dd836c4c0  created-in-window=true  changes=[]  {"longhornvolume":"pvc-d9f09398-17cf-44b0-b3a2-9475bc773fec"}
+2026-10-18T03:04:25Z  backup-w-f12dd015-e375-4aeb-903d-a6d24adb621a  created-in-window=true  changes=[]  {"longhornvolume":"pvc-d2ea5b66-d251-4467-9829-14654fab7a2f"}
+2026-10-18T03:04:26Z  backup-w-b5f21af2-a32d-4a2d-954d-4853baf4520b  created-in-window=true  changes=[]  {"longhornvolume":"pvc-e2151b14-2b24-4128-993a-c392c8d9706a"}
+2026-10-18T03:04:40Z  backup-w-501e9c93-1004-4c30-acea-26b58f69f598  created-in-window=true  changes=[]  {"longhornvolume":"pvc-8401df55-4668-40e3-97d2-d53e2c1090f1"}
+2026-10-18T03:04:41Z  backup-w-9929ed08-8a85-4c29-83a9-c0e3bfb23b33  created-in-window=true  changes=[]  {"longhornvolume":"pvc-7fc61dcd-52f0-45b4-97f1-9c82b28ab714"}
+2026-10-18T03:04:56Z  backup-w-44cb1d12-6aeb-4ced-9977-029cf9296c86  created-in-window=true  changes=[]  {"longhornvolume":"pvc-a9dd6c7c-19eb-4a0a-935d-d2c30545c378"}
+2026-10-18T03:05:02Z  backup-w-5c387443-5da4-4918-b5b7-c23f0873d081  created-in-window=true  changes=[]  {"longhornvolume":"pvc-e3b26fdc-fd52-4fdf-9fa2-1d1ecfd029e4"}
+2026-10-18T03:05:11Z  backup-w-908f1c40-5b75-4a93-bd0b-c5ec6c3b5c5a  created-in-window=true  changes=[]  {"longhornvolume":"pvc-9ca6a486-40bb-46ac-ac48-bd49d4399f4b"}
+2026-10-18T03:05:17Z  backup-w-a26221ac-ad81-45a1-93cd-c730ebf48fa9  created-in-window=true  changes=[]  {"longhornvolume":"pvc-85be87dc-3351-4459-9f82-55f8cc598a2f"}
+2026-10-18T03:05:32Z  backup-w-8af31417-1f16-4ed5-9bb4-1e3ec016f766  created-in-window=true  changes=[]  {"longhornvolume":"pvc-e5b8f824-7720-454c-b546-a098608df24a"}
+2026-10-18T03:05:52Z  backup-w-24190c0e-85a4-480b-9451-91a931351415  created-in-window=true  changes=[]  {"longhornvolume":"pvc-e57c220f-bc92-4815-89c9-0dee35eab3c3"}
+2026-10-18T03:05:53Z  backup-w-ce360270-a851-4ff8-a481-ad9933848b48  created-in-window=true  changes=[]  {"longhornvolume":"pvc-8ed5eea5-67d4-46fc-9806-6b8fdd61e42e"}
+2026-10-18T03:06:07Z  backup-w-768fe287-8ac0-43ce-b7c4-017f340a6276  created-in-window=true  changes=[]  {"longhornvolume":"pvc-88b4d7b4-cb5d-48e0-871e-9e150872d0bd"}
+2026-10-18T03:06:08Z  backup-w-55284120-f572-42de-a65d-f32ce33b8d6b  created-in-window=true  changes=[]  {"longhornvolume":"pvc-be9d7813-1881-462e-8951-1bd1315f7dc5"}
+2026-10-18T03:06:22Z  backup-w-89e8e1d8-e924-4911-80da-d88420c47ab6  created-in-window=true  changes=[]  {"longhornvolume":"pvc-ea977627-fb0a-4dee-8678-9ceceea448da"}
+2026-10-18T03:06:24Z  backup-w-6ec192d8-7928-4fed-bba5-8d3db7f4ccaf  created-in-window=true  changes=[]  {"longhornvolume":"pvc-b10da48e-6fcc-42ef-8414-d5d617028d68"}
+2026-10-18T03:06:39Z  backup-w-5c4c2d48-70be-402d-8ef6-0665f01012cf  created-in-window=true  changes=[]  {"longhornvolume":"pvc-beb0ad8a-755a-4152-a0af-f7367b32b19c"}
+2026-10-18T03:06:43Z  backup-w-073e62b6-6177-4d87-a7e2-28b55567d729  created-in-window=true  changes=[]  {"longhornvolume":"pvc-b0e94be5-7cd8-4a4c-9295-901614e9eeb7"}
+2026-10-18T03:06:54Z  backup-w-9689a569-2397-4947-b1b5-94042bc973f4  created-in-window=true  changes=[]  {"longhornvolume":"pvc-8931072a-e34e-4333-9ab5-9629b6078505"}
+2026-10-18T03:07:03Z  backup-w-47b6014f-5f34-4484-9d80-10bab2b2633f  created-in-window=true  changes=[]  {"longhornvolume":"pvc-c4dfbc43-2c35-4ef0-9cfe-39b3dc885dae"}
+2026-10-18T03:07:25Z  backup-w-d0f4fe40-8c48-4990-969a-d421e45e734c  created-in-window=true  changes=[]  {"longhornvolume":"pvc-7eb1f195-6a35-46c3-bbb1-5bab48209624"}
+2026-10-18T03:07:29Z  backup-w-cf531882-6842-4629-8470-97a63d9f1263  created-in-window=true  changes=[]  {"longhornvolume":"pvc-17e3b3cc-9c6a-4d70-85cc-c2ae72e0b4ec"}
+2026-10-18T03:07:40Z  backup-w-94e25d95-26b5-441f-b57c-6c38dcfd1bd5  created-in-window=true  changes=[]  {"longhornvolume":"pvc-5fbd3bbc-fb14-406d-954c-1a232ce313ce"}
+2026-10-18T03:07:44Z  backup-w-7c27529f-7e1c-4515-b4e3-5a92eef9904a  created-in-window=true  changes=[]  {"longhornvolume":"pvc-0113bbbf-fd5c-441b-9d58-6943ffa8c133"}
+2026-10-18T03:07:59Z  backup-w-9e4f3b48-85bb-4b17-a504-3774ea4e6e14  created-in-window=true  changes=[]  {"longhornvolume":"pvc-63f3b34f-3ac6-41a5-8790-3a27db0b5a2b"}
+2026-10-18T03:08:01Z  backup-w-3c194f84-d8a0-4ecb-baf0-9c4a16318987  created-in-window=true  changes=[]  {"longhornvolume":"pvc-2382e7bb-9514-409b-a2cc-e97c9725512a"}
+2026-10-18T03:08:15Z  backup-w-849c9f2d-fbab-4084-998b-2dcbc5b8e3af  created-in-window=true  changes=[]  {"longhornvolume":"pvc-3b23c214-ea15-40f8-aac5-61f783bf5beb"}
+2026-10-18T03:08:16Z  backup-w-6a5d4be2-a059-40b4-bee8-abf12199ae05  created-in-window=true  changes=[]  {"longhornvolume":"pvc-5acabaa7-6017-4793-b45e-f1f4fd80ab97"}
+2026-10-18T03:08:30Z  backup-w-aec12d6b-becd-4ca1-9590-a60f5f4a4f45  created-in-window=true  changes=[]  {"longhornvolume":"pvc-fc3d2f7f-6569-473c-acb4-002c613e5f18"}
+2026-10-18T03:08:41Z  backup-w-b3049de0-fe68-472b-8964-f0140a6b2c54  created-in-window=true  changes=[]  {"longhornvolume":"pvc-0eae2db7-47f1-477b-b9a9-9968c2d49a6d"}
+2026-10-23T02:00:01Z  backup-d-bcf88ff5-ab92-4511-bcd4-a4686c8941f2  created-in-window=true  changes=[]  {"longhornvolume":"pvc-71cbab32-86f9-40a5-8f3b-220ad626c492"}
+2026-10-23T02:00:01Z  backup-d-d8d68af0-acc6-4a07-bd57-1eb283dc8588  created-in-window=true  changes=[]  {"longhornvolume":"pvc-486c9809-4672-4b56-b70e-0bf01d0c3628"}
+2026-10-23T02:00:17Z  backup-d-6afe7cd9-fd63-48ff-96b7-b8bd7ba03aa0  created-in-window=true  changes=[]  {"longhornvolume":"pvc-5acabaa7-6017-4793-b45e-f1f4fd80ab97"}
+2026-10-23T02:00:37Z  backup-d-ab86b601-8c71-4e9e-ab5f-6211e6bccc2f  created-in-window=true  changes=[]  {"longhornvolume":"pvc-4e3fd336-9f09-4251-bd90-cdc259ef739e"}
+2026-10-23T02:01:03Z  backup-d-723e6872-0483-4fa0-8482-2f449b038fbd  created-in-window=true  changes=[]  {"longhornvolume":"pvc-4e4aba1e-b414-4016-8895-ecdf0fb04a6b"}
+2026-10-23T02:01:27Z  backup-d-532d9238-ffdd-43ae-a17e-02e263490801  created-in-window=true  changes=[]  {"longhornvolume":"pvc-4fdd6da2-e795-4fa9-9e36-96f212c7018b"}
+2026-10-23T02:01:28Z  backup-d-d2227be3-7347-4bdc-a023-9164ce5a0b0b  created-in-window=true  changes=[]  {"longhornvolume":"pvc-22343573-266d-492e-bd0a-37296217b523"}
+== settings: total 97
+== nodes: total 1
+== orphans: total 0
+== sharemanagers: total 2
+== backingimages: total 0
+
+# CORRECTION 2026-10-23T15:27:30Z: Longhorn CRs carry NO managedFields (checked: backuptarget 'default' mf=[] while its generation is 93466). The 'changes=' column above is therefore EMPTY BY CONSTRUCTION and proves nothing. Only creationTimestamp is evidence.
+
+== backups created in window, by volume, with target URL and labels
+2026-10-18T03:00:06Z pvc-1ae51535-0b2b-4975-bd9f-e651cc7a1edd state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-9e561c5f-39bf-4de0-b86d-4154538
+2026-10-18T03:00:06Z pvc-486c9809-4672-4b56-b70e-0bf01d0c3628 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-c9cb53aa-4359-4309-9976-530a6fa
+2026-10-18T03:00:21Z pvc-4e3fd336-9f09-4251-bd90-cdc259ef739e state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-ce5a0dec-ec88-4da1-b14f-7acf37c
+2026-10-18T03:00:26Z pvc-71cbab32-86f9-40a5-8f3b-220ad626c492 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-8822d0fe-6849-4df1-bed1-7ea9488
+2026-10-18T03:00:42Z pvc-4e4aba1e-b414-4016-8895-ecdf0fb04a6b state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-f36ce009-f2ec-4da5-bef2-e72746c
+2026-10-18T03:01:17Z pvc-4fdd6da2-e795-4fa9-9e36-96f212c7018b state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-152bc04c-cfb0-494e-a020-b8edceb
+2026-10-18T03:01:22Z pvc-11b257b2-8edc-4bf6-b846-00979feb195f state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-7be4c31e-99c9-4858-abc0-8b2b102
+2026-10-18T03:01:33Z pvc-297c20e6-4ac0-42c4-9c69-24580a7f12ee state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-492c52b6-af58-4b56-b031-e1a2f61
+2026-10-18T03:01:42Z pvc-1c47727a-d5ac-4171-ac36-26c2df3d0d63 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-500c8206-b274-4c95-adc1-7dbf77b
+2026-10-18T03:01:48Z pvc-202e3bf2-9e61-4c59-ae0c-43fa6a42b403 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-477bb594-f177-4d5b-be17-2db7fc9
+2026-10-18T03:01:58Z pvc-42695a34-d921-4007-b5e5-e40aa728e104 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-5a54721b-bdfc-48ae-8f5f-8612bff
+2026-10-18T03:02:03Z pvc-22343573-266d-492e-bd0a-37296217b523 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-dea6667f-c93f-4bb7-ad59-b8b3bc7
+2026-10-18T03:02:13Z pvc-459e6d2a-92b8-438e-a339-ff7e40089f3d state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-069a5b3f-1600-4147-9566-29f351d
+2026-10-18T03:02:38Z pvc-2e2e8c4c-4ba3-4dcf-9ed4-78acaf7ef92b state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-a493d271-9d5e-41d5-a93c-7954e17
+2026-10-18T03:02:49Z pvc-6ed74c1a-3f10-4638-9baa-9330cbff980d state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-34fa0b60-8201-4c21-aad1-f73656d
+2026-10-18T03:02:54Z pvc-38e8c624-5717-483b-8da1-613e703e36c8 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-db1904d5-7bfe-45f4-81c6-e170106
+2026-10-18T03:03:04Z pvc-b359d7de-1c7c-4b6a-9f6d-6776c2f876ef state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-e06ba46d-8847-4f8c-9a9c-ad67982
+2026-10-18T03:03:09Z pvc-79478678-07e4-4140-aef1-771ff763ab3f state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-cac58903-1e3d-4c60-95ed-72e4d7a
+2026-10-18T03:03:25Z pvc-7d6dec2c-0cda-43c7-ad1d-44ffebcb8cb6 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-80d619fb-2f32-4af8-aa0c-7d6c034
+2026-10-18T03:03:29Z pvc-cbfd55b0-4f44-487d-90fd-9c80b916ced7 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-34af7ebb-cca6-47a6-a668-541a5f4
+2026-10-18T03:03:40Z pvc-c6b9ab63-24b8-46f2-b52a-06da86393de8 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-ec972d0f-02f6-47de-8252-f3471a6
+2026-10-18T03:03:50Z pvc-c8c0d0f1-c9ea-4ed3-9e22-1e254a026c49 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-336bb191-b457-432c-8b3b-a49b8fb
+2026-10-18T03:03:55Z pvc-c911715e-56ee-4d97-836e-89efc448ad9d state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-132be759-46d9-48f4-9b7f-731dbf0
+2026-10-18T03:04:16Z pvc-d9f09398-17cf-44b0-b3a2-9475bc773fec state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-81d52611-6488-4b98-aced-cb0dd83
+2026-10-18T03:04:30Z pvc-d2ea5b66-d251-4467-9829-14654fab7a2f state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-f12dd015-e375-4aeb-903d-a6d24ad
+2026-10-18T03:04:31Z pvc-e2151b14-2b24-4128-993a-c392c8d9706a state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-b5f21af2-a32d-4a2d-954d-4853baf
+2026-10-18T03:04:46Z pvc-8401df55-4668-40e3-97d2-d53e2c1090f1 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-501e9c93-1004-4c30-acea-26b58f6
+2026-10-18T03:04:52Z pvc-7fc61dcd-52f0-45b4-97f1-9c82b28ab714 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-9929ed08-8a85-4c29-83a9-c0e3bfb
+2026-10-18T03:05:01Z pvc-a9dd6c7c-19eb-4a0a-935d-d2c30545c378 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-44cb1d12-6aeb-4ced-9977-029cf92
+2026-10-18T03:05:07Z pvc-e3b26fdc-fd52-4fdf-9fa2-1d1ecfd029e4 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-5c387443-5da4-4918-b5b7-c23f087
+2026-10-18T03:05:21Z pvc-9ca6a486-40bb-46ac-ac48-bd49d4399f4b state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-908f1c40-5b75-4a93-bd0b-c5ec6c3
+2026-10-18T03:05:22Z pvc-85be87dc-3351-4459-9f82-55f8cc598a2f state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-a26221ac-ad81-45a1-93cd-c730ebf
+2026-10-18T03:05:43Z pvc-e5b8f824-7720-454c-b546-a098608df24a state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-8af31417-1f16-4ed5-9bb4-1e3ec01
+2026-10-18T03:05:57Z pvc-e57c220f-bc92-4815-89c9-0dee35eab3c3 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-24190c0e-85a4-480b-9451-91a9313
+2026-10-18T03:05:58Z pvc-8ed5eea5-67d4-46fc-9806-6b8fdd61e42e state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-ce360270-a851-4ff8-a481-ad99338
+2026-10-18T03:06:12Z pvc-88b4d7b4-cb5d-48e0-871e-9e150872d0bd state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-768fe287-8ac0-43ce-b7c4-017f340
+2026-10-18T03:06:13Z pvc-be9d7813-1881-462e-8951-1bd1315f7dc5 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-55284120-f572-42de-a65d-f32ce33
+2026-10-18T03:06:27Z pvc-ea977627-fb0a-4dee-8678-9ceceea448da state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-89e8e1d8-e924-4911-80da-d88420c
+2026-10-18T03:06:29Z pvc-b10da48e-6fcc-42ef-8414-d5d617028d68 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-6ec192d8-7928-4fed-bba5-8d3db7f
+2026-10-18T03:06:44Z pvc-beb0ad8a-755a-4152-a0af-f7367b32b19c state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-5c4c2d48-70be-402d-8ef6-0665f01
+2026-10-18T03:06:48Z pvc-b0e94be5-7cd8-4a4c-9295-901614e9eeb7 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-073e62b6-6177-4d87-a7e2-28b5556
+2026-10-18T03:07:00Z pvc-8931072a-e34e-4333-9ab5-9629b6078505 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-9689a569-2397-4947-b1b5-94042bc
+2026-10-18T03:07:08Z pvc-c4dfbc43-2c35-4ef0-9cfe-39b3dc885dae state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-47b6014f-5f34-4484-9d80-10bab2b
+2026-10-18T03:07:30Z pvc-7eb1f195-6a35-46c3-bbb1-5bab48209624 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-d0f4fe40-8c48-4990-969a-d421e45
+2026-10-18T03:07:34Z pvc-17e3b3cc-9c6a-4d70-85cc-c2ae72e0b4ec state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-cf531882-6842-4629-8470-97a63d9
+2026-10-18T03:07:49Z pvc-0113bbbf-fd5c-441b-9d58-6943ffa8c133 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-7c27529f-7e1c-4515-b4e3-5a92eef
+2026-10-18T03:07:50Z pvc-5fbd3bbc-fb14-406d-954c-1a232ce313ce state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-94e25d95-26b5-441f-b57c-6c38dcf
+2026-10-18T03:08:04Z pvc-63f3b34f-3ac6-41a5-8790-3a27db0b5a2b state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-9e4f3b48-85bb-4b17-a504-3774ea4
+2026-10-18T03:08:06Z pvc-2382e7bb-9514-409b-a2cc-e97c9725512a state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-3c194f84-d8a0-4ecb-baf0-9c4a163
+2026-10-18T03:08:20Z pvc-3b23c214-ea15-40f8-aac5-61f783bf5beb state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-849c9f2d-fbab-4084-998b-2dcbc5b
+2026-10-18T03:08:21Z pvc-5acabaa7-6017-4793-b45e-f1f4fd80ab97 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-6a5d4be2-a059-40b4-bee8-abf1219
+2026-10-18T03:08:35Z pvc-fc3d2f7f-6569-473c-acb4-002c613e5f18 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-aec12d6b-becd-4ca1-9590-a60f5f4
+2026-10-18T03:08:47Z pvc-0eae2db7-47f1-477b-b9a9-9968c2d49a6d state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-weekly snap=backup-w-b3049de0-fe68-472b-8964-f0140a6
+2026-10-23T02:00:06Z pvc-486c9809-4672-4b56-b70e-0bf01d0c3628 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-d8d68af0-acc6-4a07-bd57-1eb283d
+2026-10-23T02:00:06Z pvc-71cbab32-86f9-40a5-8f3b-220ad626c492 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-bcf88ff5-ab92-4511-bcd4-a4686c8
+2026-10-23T02:00:22Z pvc-5acabaa7-6017-4793-b45e-f1f4fd80ab97 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-6afe7cd9-fd63-48ff-96b7-b8bd7ba
+2026-10-23T02:00:42Z pvc-4e3fd336-9f09-4251-bd90-cdc259ef739e state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-ab86b601-8c71-4e9e-ab5f-6211e6b
+2026-10-23T02:01:08Z pvc-4e4aba1e-b414-4016-8895-ecdf0fb04a6b state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-723e6872-0483-4fa0-8482-2f449b0
+2026-10-23T02:01:32Z pvc-4fdd6da2-e795-4fa9-9e36-96f212c7018b state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-532d9238-ffdd-43ae-a17e-02e2634
+2026-10-23T02:01:33Z pvc-22343573-266d-492e-bd0a-37296217b523 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-d2227be3-7347-4bdc-a023-9164ce5
+2026-10-23T02:01:47Z pvc-0113bbbf-fd5c-441b-9d58-6943ffa8c133 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-c1f5fc70-576c-4da0-815c-aa93c64
+2026-10-23T02:02:03Z pvc-0eae2db7-47f1-477b-b9a9-9968c2d49a6d state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-c564cba5-6d62-49e5-b496-53b964e
+2026-10-23T02:02:18Z pvc-11b257b2-8edc-4bf6-b846-00979feb195f state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-54a62590-1809-41dd-9c31-b14134f
+2026-10-23T02:02:33Z pvc-17e3b3cc-9c6a-4d70-85cc-c2ae72e0b4ec state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-07db40a9-4578-4056-a6ab-2a8791b
+2026-10-23T02:02:49Z pvc-1ae51535-0b2b-4975-bd9f-e651cc7a1edd state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-bdd24928-efdd-4a6e-95c4-abf6858
+2026-10-23T02:03:04Z pvc-1c47727a-d5ac-4171-ac36-26c2df3d0d63 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-66d2dfd3-666d-456d-83a4-8d22f24
+2026-10-23T02:03:04Z pvc-202e3bf2-9e61-4c59-ae0c-43fa6a42b403 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-6fb4220e-6a1c-445e-92cd-a40e4c6
+2026-10-23T02:03:24Z pvc-63f3b34f-3ac6-41a5-8790-3a27db0b5a2b state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-4f745b2c-2216-4bff-996e-dd2baa0
+2026-10-23T02:03:39Z pvc-5fbd3bbc-fb14-406d-954c-1a232ce313ce state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-cc1aff9c-16cd-495a-b6b2-0e47d26
+2026-10-23T02:03:40Z pvc-38e8c624-5717-483b-8da1-613e703e36c8 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-c0247496-c63a-4579-8b68-f63d205
+2026-10-23T02:04:05Z pvc-2382e7bb-9514-409b-a2cc-e97c9725512a state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-7ff78535-6dfa-411c-a1a4-cdbb45a
+2026-10-23T02:04:31Z pvc-297c20e6-4ac0-42c4-9c69-24580a7f12ee state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-a4575f47-f837-4a26-bdab-b55c1ab
+2026-10-23T02:04:46Z pvc-2e2e8c4c-4ba3-4dcf-9ed4-78acaf7ef92b state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-6bba495f-15a9-420f-9ea8-4bae806
+2026-10-23T02:05:07Z pvc-42695a34-d921-4007-b5e5-e40aa728e104 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-a25c4421-048a-453f-ad6e-34fef26
+2026-10-23T02:05:22Z pvc-3b23c214-ea15-40f8-aac5-61f783bf5beb state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-95457e62-4a17-4a59-8d72-8047e00
+2026-10-23T02:05:42Z pvc-459e6d2a-92b8-438e-a339-ff7e40089f3d state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-4e5b167a-7310-47cb-a6b1-916168d
+2026-10-23T02:06:13Z pvc-6ed74c1a-3f10-4638-9baa-9330cbff980d state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-4cd91122-6d04-4a72-ad69-3b0d0a6
+2026-10-23T02:06:28Z pvc-b359d7de-1c7c-4b6a-9f6d-6776c2f876ef state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-8b778723-11a9-46d4-aa2b-f025a71
+2026-10-23T02:06:44Z pvc-79478678-07e4-4140-aef1-771ff763ab3f state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-0bd019c6-6214-4a71-9d9f-d6907b8
+2026-10-23T02:06:59Z pvc-7d6dec2c-0cda-43c7-ad1d-44ffebcb8cb6 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-1585fad0-6ac0-44c7-80b2-1ec603b
+2026-10-23T02:07:00Z pvc-8ed5eea5-67d4-46fc-9806-6b8fdd61e42e state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-d2ce1852-9284-491e-b424-f23bfba
+2026-10-23T02:07:20Z pvc-9ca6a486-40bb-46ac-ac48-bd49d4399f4b state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-ad0e30e9-aff2-427c-b040-aa41144
+2026-10-23T02:07:29Z pvc-a9dd6c7c-19eb-4a0a-935d-d2c30545c378 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-a3eb95b8-4c3c-40cd-a797-0b58af2
+2026-10-23T02:07:54Z pvc-b0e94be5-7cd8-4a4c-9295-901614e9eeb7 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-8f350533-d46e-4bc1-afe4-698ac27
+2026-10-23T02:08:25Z pvc-b10da48e-6fcc-42ef-8414-d5d617028d68 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-f6ef4e55-80ab-4e52-8c2c-1df09e7
+2026-10-23T02:08:45Z pvc-8401df55-4668-40e3-97d2-d53e2c1090f1 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-e2b7b133-2dd3-4b22-bec1-bab0622
+2026-10-23T02:08:56Z pvc-7fc61dcd-52f0-45b4-97f1-9c82b28ab714 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-887bfdd7-1804-4c5a-83be-80c5253
+2026-10-23T02:09:11Z pvc-e5b8f824-7720-454c-b546-a098608df24a state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-d7e129b7-5d88-4bc9-bfc0-7564ab7
+2026-10-23T02:09:26Z pvc-e57c220f-bc92-4815-89c9-0dee35eab3c3 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-ae2f297d-5714-49a9-a712-1ce8ac6
+2026-10-23T02:09:41Z pvc-c4dfbc43-2c35-4ef0-9cfe-39b3dc885dae state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-9206b338-5612-421b-83a5-1c13499
+2026-10-23T02:09:42Z pvc-d9f09398-17cf-44b0-b3a2-9475bc773fec state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-ce08dc5f-8f83-4644-8ac0-880ee0e
+2026-10-23T02:09:57Z pvc-85be87dc-3351-4459-9f82-55f8cc598a2f state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-7349021f-8111-4d08-aa74-3ec18e1
+2026-10-23T02:10:17Z pvc-c911715e-56ee-4d97-836e-89efc448ad9d state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-f18a8f97-7fd3-4bb0-ba92-f7b5704
+2026-10-23T02:10:37Z pvc-ea977627-fb0a-4dee-8678-9ceceea448da state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-1b632b7b-e42c-4516-bffd-bdc6e7e
+2026-10-23T02:10:38Z pvc-88b4d7b4-cb5d-48e0-871e-9e150872d0bd state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-4deb82a5-7b2f-42f4-a206-9778ee9
+2026-10-23T02:10:53Z pvc-beb0ad8a-755a-4152-a0af-f7367b32b19c state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-2fce6324-4e8c-4cfd-9c00-f500bbd
+2026-10-23T02:11:09Z pvc-c8c0d0f1-c9ea-4ed3-9e22-1e254a026c49 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-5524b832-3049-48f3-b6c9-ec8aefd
+2026-10-23T02:11:27Z pvc-be9d7813-1881-462e-8951-1bd1315f7dc5 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-29a6b089-b40d-473c-bcbb-4f565c7
+2026-10-23T02:11:42Z pvc-fc3d2f7f-6569-473c-acb4-002c613e5f18 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-6ad56202-8675-4dd3-9476-447b2a3
+2026-10-23T02:12:03Z pvc-e2151b14-2b24-4128-993a-c392c8d9706a state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-d10cb97e-7e9d-4904-970e-fd4607a
+2026-10-23T02:12:23Z pvc-d2ea5b66-d251-4467-9829-14654fab7a2f state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-289d6573-4b0c-4ef5-85cd-91431bf
+2026-10-23T02:12:29Z pvc-7eb1f195-6a35-46c3-bbb1-5bab48209624 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-10b20200-bcf7-4388-b919-c1b66a5
+2026-10-23T02:12:39Z pvc-c6b9ab63-24b8-46f2-b52a-06da86393de8 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-945b6c37-6893-49a5-a15e-41a9212
+2026-10-23T02:12:54Z pvc-cbfd55b0-4f44-487d-90fd-9c80b916ced7 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-949f00a2-f4e3-475a-808e-62dc20d
+2026-10-23T02:13:14Z pvc-8931072a-e34e-4333-9ab5-9629b6078505 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-25fdc074-8997-4edf-a9c6-e884269
+2026-10-23T02:13:14Z pvc-e3b26fdc-fd52-4fdf-9fa2-1d1ecfd029e4 state=Completed url=nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?backup=ba target=default rj=backup-daily snap=backup-d-f04f9565-79a1-4d11-92cf-03c0ab1
+
+== snapshots created in window (name, volume, createdBy labels)
+2026-10-18T03:00:01Z pvc-1ae51535-0b2b-4975-bd9f-e651cc7a1edd backup-w-9e561c5f-39bf-4de0-b86d-4154538ced31 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:00:01Z pvc-486c9809-4672-4b56-b70e-0bf01d0c3628 backup-w-c9cb53aa-4359-4309-9976-530a6faf3310 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:00:16Z pvc-4e3fd336-9f09-4251-bd90-cdc259ef739e backup-w-ce5a0dec-ec88-4da1-b14f-7acf37cda9e2 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:00:16Z pvc-71cbab32-86f9-40a5-8f3b-220ad626c492 backup-w-8822d0fe-6849-4df1-bed1-7ea948861d7b usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:00:37Z pvc-4e4aba1e-b414-4016-8895-ecdf0fb04a6b backup-w-f36ce009-f2ec-4da5-bef2-e72746c50eae usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:01:12Z pvc-4fdd6da2-e795-4fa9-9e36-96f212c7018b backup-w-152bc04c-cfb0-494e-a020-b8edceb99208 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:01:17Z pvc-11b257b2-8edc-4bf6-b846-00979feb195f backup-w-7be4c31e-99c9-4858-abc0-8b2b102fa6eb usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:01:28Z pvc-297c20e6-4ac0-42c4-9c69-24580a7f12ee backup-w-492c52b6-af58-4b56-b031-e1a2f610e656 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:01:32Z pvc-1c47727a-d5ac-4171-ac36-26c2df3d0d63 backup-w-500c8206-b274-4c95-adc1-7dbf77b41806 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:01:43Z pvc-202e3bf2-9e61-4c59-ae0c-43fa6a42b403 backup-w-477bb594-f177-4d5b-be17-2db7fc908486 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:01:52Z pvc-42695a34-d921-4007-b5e5-e40aa728e104 backup-w-5a54721b-bdfc-48ae-8f5f-8612bff3525d usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:01:53Z pvc-22343573-266d-492e-bd0a-37296217b523 backup-w-dea6667f-c93f-4bb7-ad59-b8b3bc772476 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:02:08Z pvc-459e6d2a-92b8-438e-a339-ff7e40089f3d backup-w-069a5b3f-1600-4147-9566-29f351d2bb39 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:02:33Z pvc-2e2e8c4c-4ba3-4dcf-9ed4-78acaf7ef92b backup-w-a493d271-9d5e-41d5-a93c-7954e173eb0f usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:02:44Z pvc-38e8c624-5717-483b-8da1-613e703e36c8 backup-w-db1904d5-7bfe-45f4-81c6-e17010691225 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:02:44Z pvc-6ed74c1a-3f10-4638-9baa-9330cbff980d backup-w-34fa0b60-8201-4c21-aad1-f73656d1fc4c usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:02:59Z pvc-b359d7de-1c7c-4b6a-9f6d-6776c2f876ef backup-w-e06ba46d-8847-4f8c-9a9c-ad67982d4f5c usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:03:04Z pvc-79478678-07e4-4140-aef1-771ff763ab3f backup-w-cac58903-1e3d-4c60-95ed-72e4d7ac4662 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:03:14Z pvc-7d6dec2c-0cda-43c7-ad1d-44ffebcb8cb6 backup-w-80d619fb-2f32-4af8-aa0c-7d6c034896a7 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:03:19Z pvc-cbfd55b0-4f44-487d-90fd-9c80b916ced7 backup-w-34af7ebb-cca6-47a6-a668-541a5f4124a3 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:03:35Z pvc-c6b9ab63-24b8-46f2-b52a-06da86393de8 backup-w-ec972d0f-02f6-47de-8252-f3471a63d29a usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:03:40Z pvc-c8c0d0f1-c9ea-4ed3-9e22-1e254a026c49 backup-w-336bb191-b457-432c-8b3b-a49b8fbcb844 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:03:50Z pvc-c911715e-56ee-4d97-836e-89efc448ad9d backup-w-132be759-46d9-48f4-9b7f-731dbf00aa5a usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:04:06Z pvc-d9f09398-17cf-44b0-b3a2-9475bc773fec backup-w-81d52611-6488-4b98-aced-cb0dd836c4c0 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:04:25Z pvc-d2ea5b66-d251-4467-9829-14654fab7a2f backup-w-f12dd015-e375-4aeb-903d-a6d24adb621a usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:04:26Z pvc-e2151b14-2b24-4128-993a-c392c8d9706a backup-w-b5f21af2-a32d-4a2d-954d-4853baf4520b usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:04:40Z pvc-8401df55-4668-40e3-97d2-d53e2c1090f1 backup-w-501e9c93-1004-4c30-acea-26b58f69f598 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:04:41Z pvc-7fc61dcd-52f0-45b4-97f1-9c82b28ab714 backup-w-9929ed08-8a85-4c29-83a9-c0e3bfb23b33 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:04:56Z pvc-a9dd6c7c-19eb-4a0a-935d-d2c30545c378 backup-w-44cb1d12-6aeb-4ced-9977-029cf9296c86 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:05:02Z pvc-e3b26fdc-fd52-4fdf-9fa2-1d1ecfd029e4 backup-w-5c387443-5da4-4918-b5b7-c23f0873d081 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:05:11Z pvc-9ca6a486-40bb-46ac-ac48-bd49d4399f4b backup-w-908f1c40-5b75-4a93-bd0b-c5ec6c3b5c5a usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:05:17Z pvc-85be87dc-3351-4459-9f82-55f8cc598a2f backup-w-a26221ac-ad81-45a1-93cd-c730ebf48fa9 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:05:32Z pvc-e5b8f824-7720-454c-b546-a098608df24a backup-w-8af31417-1f16-4ed5-9bb4-1e3ec016f766 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:05:52Z pvc-e57c220f-bc92-4815-89c9-0dee35eab3c3 backup-w-24190c0e-85a4-480b-9451-91a931351415 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:05:53Z pvc-8ed5eea5-67d4-46fc-9806-6b8fdd61e42e backup-w-ce360270-a851-4ff8-a481-ad9933848b48 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:06:07Z pvc-88b4d7b4-cb5d-48e0-871e-9e150872d0bd backup-w-768fe287-8ac0-43ce-b7c4-017f340a6276 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:06:08Z pvc-be9d7813-1881-462e-8951-1bd1315f7dc5 backup-w-55284120-f572-42de-a65d-f32ce33b8d6b usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:06:22Z pvc-ea977627-fb0a-4dee-8678-9ceceea448da backup-w-89e8e1d8-e924-4911-80da-d88420c47ab6 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:06:24Z pvc-b10da48e-6fcc-42ef-8414-d5d617028d68 backup-w-6ec192d8-7928-4fed-bba5-8d3db7f4ccaf usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:06:39Z pvc-beb0ad8a-755a-4152-a0af-f7367b32b19c backup-w-5c4c2d48-70be-402d-8ef6-0665f01012cf usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:06:43Z pvc-b0e94be5-7cd8-4a4c-9295-901614e9eeb7 backup-w-073e62b6-6177-4d87-a7e2-28b55567d729 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:06:54Z pvc-8931072a-e34e-4333-9ab5-9629b6078505 backup-w-9689a569-2397-4947-b1b5-94042bc973f4 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:07:03Z pvc-c4dfbc43-2c35-4ef0-9cfe-39b3dc885dae backup-w-47b6014f-5f34-4484-9d80-10bab2b2633f usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:07:25Z pvc-7eb1f195-6a35-46c3-bbb1-5bab48209624 backup-w-d0f4fe40-8c48-4990-969a-d421e45e734c usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:07:29Z pvc-17e3b3cc-9c6a-4d70-85cc-c2ae72e0b4ec backup-w-cf531882-6842-4629-8470-97a63d9f1263 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:07:40Z pvc-5fbd3bbc-fb14-406d-954c-1a232ce313ce backup-w-94e25d95-26b5-441f-b57c-6c38dcfd1bd5 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:07:44Z pvc-0113bbbf-fd5c-441b-9d58-6943ffa8c133 backup-w-7c27529f-7e1c-4515-b4e3-5a92eef9904a usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:07:59Z pvc-63f3b34f-3ac6-41a5-8790-3a27db0b5a2b backup-w-9e4f3b48-85bb-4b17-a504-3774ea4e6e14 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:08:01Z pvc-2382e7bb-9514-409b-a2cc-e97c9725512a backup-w-3c194f84-d8a0-4ecb-baf0-9c4a16318987 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:08:15Z pvc-3b23c214-ea15-40f8-aac5-61f783bf5beb backup-w-849c9f2d-fbab-4084-998b-2dcbc5b8e3af usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:08:16Z pvc-5acabaa7-6017-4793-b45e-f1f4fd80ab97 backup-w-6a5d4be2-a059-40b4-bee8-abf12199ae05 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:08:30Z pvc-fc3d2f7f-6569-473c-acb4-002c613e5f18 backup-w-aec12d6b-becd-4ca1-9590-a60f5f4a4f45 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-18T03:08:41Z pvc-0eae2db7-47f1-477b-b9a9-9968c2d49a6d backup-w-b3049de0-fe68-472b-8964-f0140a6b2c54 usercreated=true labels={"RecurringJob":"backup-weekly"}
+2026-10-23T02:00:01Z pvc-486c9809-4672-4b56-b70e-0bf01d0c3628 backup-d-d8d68af0-acc6-4a07-bd57-1eb283dc8588 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:00:01Z pvc-71cbab32-86f9-40a5-8f3b-220ad626c492 backup-d-bcf88ff5-ab92-4511-bcd4-a4686c8941f2 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:00:17Z pvc-5acabaa7-6017-4793-b45e-f1f4fd80ab97 backup-d-6afe7cd9-fd63-48ff-96b7-b8bd7ba03aa0 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:00:37Z pvc-4e3fd336-9f09-4251-bd90-cdc259ef739e backup-d-ab86b601-8c71-4e9e-ab5f-6211e6bccc2f usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:01:03Z pvc-4e4aba1e-b414-4016-8895-ecdf0fb04a6b backup-d-723e6872-0483-4fa0-8482-2f449b038fbd usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:01:27Z pvc-4fdd6da2-e795-4fa9-9e36-96f212c7018b backup-d-532d9238-ffdd-43ae-a17e-02e263490801 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:01:28Z pvc-22343573-266d-492e-bd0a-37296217b523 backup-d-d2227be3-7347-4bdc-a023-9164ce5a0b0b usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:01:42Z pvc-0113bbbf-fd5c-441b-9d58-6943ffa8c133 backup-d-c1f5fc70-576c-4da0-815c-aa93c6462d62 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:01:58Z pvc-0eae2db7-47f1-477b-b9a9-9968c2d49a6d backup-d-c564cba5-6d62-49e5-b496-53b964ed07eb usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:02:13Z pvc-11b257b2-8edc-4bf6-b846-00979feb195f backup-d-54a62590-1809-41dd-9c31-b14134f340df usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:02:28Z pvc-17e3b3cc-9c6a-4d70-85cc-c2ae72e0b4ec backup-d-07db40a9-4578-4056-a6ab-2a8791bb14d1 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:02:39Z pvc-1ae51535-0b2b-4975-bd9f-e651cc7a1edd backup-d-bdd24928-efdd-4a6e-95c4-abf68582861a usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:02:58Z pvc-1c47727a-d5ac-4171-ac36-26c2df3d0d63 backup-d-66d2dfd3-666d-456d-83a4-8d22f24ee2c9 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:02:59Z pvc-202e3bf2-9e61-4c59-ae0c-43fa6a42b403 backup-d-6fb4220e-6a1c-445e-92cd-a40e4c66351c usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:03:19Z pvc-63f3b34f-3ac6-41a5-8790-3a27db0b5a2b backup-d-4f745b2c-2216-4bff-996e-dd2baa03838e usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:03:34Z pvc-5fbd3bbc-fb14-406d-954c-1a232ce313ce backup-d-cc1aff9c-16cd-495a-b6b2-0e47d2674a7b usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:03:35Z pvc-38e8c624-5717-483b-8da1-613e703e36c8 backup-d-c0247496-c63a-4579-8b68-f63d2051b3f4 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:04:00Z pvc-2382e7bb-9514-409b-a2cc-e97c9725512a backup-d-7ff78535-6dfa-411c-a1a4-cdbb45a179d3 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:04:21Z pvc-297c20e6-4ac0-42c4-9c69-24580a7f12ee backup-d-a4575f47-f837-4a26-bdab-b55c1abba818 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:04:41Z pvc-2e2e8c4c-4ba3-4dcf-9ed4-78acaf7ef92b backup-d-6bba495f-15a9-420f-9ea8-4bae8064b71e usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:04:57Z pvc-42695a34-d921-4007-b5e5-e40aa728e104 backup-d-a25c4421-048a-453f-ad6e-34fef264c2b7 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:05:17Z pvc-3b23c214-ea15-40f8-aac5-61f783bf5beb backup-d-95457e62-4a17-4a59-8d72-8047e00b8cc0 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:05:32Z pvc-459e6d2a-92b8-438e-a339-ff7e40089f3d backup-d-4e5b167a-7310-47cb-a6b1-916168db3f2b usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:06:08Z pvc-6ed74c1a-3f10-4638-9baa-9330cbff980d backup-d-4cd91122-6d04-4a72-ad69-3b0d0a625622 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:06:23Z pvc-b359d7de-1c7c-4b6a-9f6d-6776c2f876ef backup-d-8b778723-11a9-46d4-aa2b-f025a714fd31 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:06:39Z pvc-79478678-07e4-4140-aef1-771ff763ab3f backup-d-0bd019c6-6214-4a71-9d9f-d6907b8703ce usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:06:53Z pvc-7d6dec2c-0cda-43c7-ad1d-44ffebcb8cb6 backup-d-1585fad0-6ac0-44c7-80b2-1ec603b5df27 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:06:55Z pvc-8ed5eea5-67d4-46fc-9806-6b8fdd61e42e backup-d-d2ce1852-9284-491e-b424-f23bfba48b39 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:07:10Z pvc-9ca6a486-40bb-46ac-ac48-bd49d4399f4b backup-d-ad0e30e9-aff2-427c-b040-aa41144177ea usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:07:24Z pvc-a9dd6c7c-19eb-4a0a-935d-d2c30545c378 backup-d-a3eb95b8-4c3c-40cd-a797-0b58af2c8bbb usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:07:44Z pvc-b0e94be5-7cd8-4a4c-9295-901614e9eeb7 backup-d-8f350533-d46e-4bc1-afe4-698ac2730f06 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:08:20Z pvc-b10da48e-6fcc-42ef-8414-d5d617028d68 backup-d-f6ef4e55-80ab-4e52-8c2c-1df09e712ffe usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:08:40Z pvc-8401df55-4668-40e3-97d2-d53e2c1090f1 backup-d-e2b7b133-2dd3-4b22-bec1-bab062295efa usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:08:46Z pvc-7fc61dcd-52f0-45b4-97f1-9c82b28ab714 backup-d-887bfdd7-1804-4c5a-83be-80c52535d5e2 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:09:06Z pvc-e5b8f824-7720-454c-b546-a098608df24a backup-d-d7e129b7-5d88-4bc9-bfc0-7564ab7a8d11 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:09:16Z pvc-e57c220f-bc92-4815-89c9-0dee35eab3c3 backup-d-ae2f297d-5714-49a9-a712-1ce8ac64913a usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:09:31Z pvc-d9f09398-17cf-44b0-b3a2-9475bc773fec backup-d-ce08dc5f-8f83-4644-8ac0-880ee0e7c662 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:09:36Z pvc-c4dfbc43-2c35-4ef0-9cfe-39b3dc885dae backup-d-9206b338-5612-421b-83a5-1c13499d9263 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:09:52Z pvc-85be87dc-3351-4459-9f82-55f8cc598a2f backup-d-7349021f-8111-4d08-aa74-3ec18e12e05a usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:10:07Z pvc-c911715e-56ee-4d97-836e-89efc448ad9d backup-d-f18a8f97-7fd3-4bb0-ba92-f7b5704c0b9a usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:10:26Z pvc-ea977627-fb0a-4dee-8678-9ceceea448da backup-d-1b632b7b-e42c-4516-bffd-bdc6e7e2ba57 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:10:28Z pvc-88b4d7b4-cb5d-48e0-871e-9e150872d0bd backup-d-4deb82a5-7b2f-42f4-a206-9778ee95aeab usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:10:48Z pvc-beb0ad8a-755a-4152-a0af-f7367b32b19c backup-d-2fce6324-4e8c-4cfd-9c00-f500bbdc44c8 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:11:03Z pvc-c8c0d0f1-c9ea-4ed3-9e22-1e254a026c49 backup-d-5524b832-3049-48f3-b6c9-ec8aefd868b4 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:11:22Z pvc-be9d7813-1881-462e-8951-1bd1315f7dc5 backup-d-29a6b089-b40d-473c-bcbb-4f565c70b062 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:11:37Z pvc-fc3d2f7f-6569-473c-acb4-002c613e5f18 backup-d-6ad56202-8675-4dd3-9476-447b2a36d07a usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:11:53Z pvc-e2151b14-2b24-4128-993a-c392c8d9706a backup-d-d10cb97e-7e9d-4904-970e-fd4607adf4f4 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:12:13Z pvc-d2ea5b66-d251-4467-9829-14654fab7a2f backup-d-289d6573-4b0c-4ef5-85cd-91431bfe3ac4 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:12:24Z pvc-7eb1f195-6a35-46c3-bbb1-5bab48209624 backup-d-10b20200-bcf7-4388-b919-c1b66a5ae153 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:12:33Z pvc-c6b9ab63-24b8-46f2-b52a-06da86393de8 backup-d-945b6c37-6893-49a5-a15e-41a9212638e2 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:12:49Z pvc-cbfd55b0-4f44-487d-90fd-9c80b916ced7 backup-d-949f00a2-f4e3-475a-808e-62dc20d59bf5 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:13:09Z pvc-8931072a-e34e-4333-9ab5-9629b6078505 backup-d-25fdc074-8997-4edf-a9c6-e88426915a57 usercreated=true labels={"RecurringJob":"backup-daily"}
+2026-10-23T02:13:09Z pvc-e3b26fdc-fd52-4fdf-9fa2-1d1ecfd029e4 backup-d-f04f9565-79a1-4d11-92cf-03c0ab1fdcc2 usercreated=true labels={"RecurringJob":"backup-daily"}
+
+== volumeattachment tickets (all), with ticket ids and types
+pvc-1d4ec717-7ee5-40a0-b093-3a62fd2a81a4 ticket=share-manager-controller-pvc-1d4ec717-7ee5-40a0-b093-3a62fd2a81a4 type=share-manager-controller node=dooplex
+pvc-8ed5eea5-67d4-46fc-9806-6b8fdd61e42e ticket=share-manager-controller-pvc-8ed5eea5-67d4-46fc-9806-6b8fdd61e42e type=share-manager-controller node=dooplex
+
+== recurring jobs
+2026-01-05T18:23:17Z backup-daily 0 4 * * * backup
+2026-01-05T18:23:17Z backup-weekly 0 5 * * 0 backup
+== backuptargets
+2025-11-29T10:22:32Z default nfs://192.168.0.180:/mnt/5_hdd/backup/longhorn-pvc?nfsOptions=soft,timeo=330,retrans=3
@@ -0,0 +1,45 @@
+# P3.5 container network bytes (cAdvisor), window 2026-10-17T04:00Z..10-23T08:05Z, 2026-10-23T15:30:10Z
+== transmit bytes per day, Plex pod (GiB)
+2026-10-11T00:00:00Z 0.04
+2026-10-12T00:00:00Z 0.04
+2026-10-13T00:00:00Z 0.04
+2026-10-14T00:00:00Z 0.04
+2026-10-15T00:00:00Z 0.26
+2026-10-16T00:00:00Z 0.08
+2026-10-17T00:00:00Z 2.25
+2026-10-18T00:00:00Z 142.97
+2026-10-19T00:00:00Z 202.37
+2026-10-20T00:00:00Z 528.45
+2026-10-21T00:00:00Z 441.46
+2026-10-22T00:00:00Z 206.1
+2026-10-23T00:00:00Z 0.09
+== receive bytes per day, Plex pod (GiB)
+2026-10-11T00:00:00Z 0.01
+2026-10-12T00:00:00Z 0.01
+2026-10-13T00:00:00Z 0.01
+2026-10-14T00:00:00Z 0.01
+2026-10-15T00:00:00Z 0.03
+2026-10-16T00:00:00Z 0.02
+2026-10-17T00:00:00Z 0.03
+2026-10-18T00:00:00Z 2.25
+2026-10-19T00:00:00Z 7.87
+2026-10-20T00:00:00Z 1.03
+2026-10-21T00:00:00Z 0.04
+2026-10-22T00:00:00Z 1.05
+2026-10-23T00:00:00Z 0.02
+== labels available on the metric (does any give the PEER?)
+["__name__","beta_kubernetes_io_arch","beta_kubernetes_io_instance_type","beta_kubernetes_io_os","id","image","instance","interface","job","kubernetes_io_arch","kubernetes_io_hostname","kubernetes_io_os","name","namespace","node_kubernetes_io_instance_type","node_role_kubernetes_io_control_plane","node_role_kubernetes_io_master","pod"]
+== longhorn-system pods: transmit bytes per day (GiB) — an off-site backup would show here
+2026-10-11T00:00:00Z 25.56
+2026-10-12T00:00:00Z 22.86
+2026-10-13T00:00:00Z 25.3
+2026-10-14T00:00:00Z 26.44
+2026-10-15T00:00:00Z 29.03
+2026-10-16T00:00:00Z 44.67
+2026-10-17T00:00:00Z 45.61
+2026-10-18T00:00:00Z 36.08
+2026-10-19T00:00:00Z 66.68
+2026-10-20T00:00:00Z 76.98
+2026-10-21T00:00:00Z 39.77
+2026-10-22T00:00:00Z 35.41
+2026-10-23T00:00:00Z 38.63
@@ -0,0 +1,4 @@
+# Samba per-client logs (log file = /var/log/samba/log.%m) 2026-10-23T15:31:45Z
+# positive control: this session's probe pod 10.42.0.107 connected to :445 during the LAN scan (15:22-15:24Z) and a file log.10.42.0.107 appeared at 17:24 CEST.
+-rw-r--r--  1 root root       0 2026-10-23 17:24 log.10.42.0.107
+# files named for any 10.42.x address: 1
@@ -0,0 +1,19 @@
+{
+  "app": "plex",
+  "walk": "security",
+  "box_walk_version": 1,
+  "verdict": "inconclusive",
+  "venue": "box 9202 (drill catalog), the guarded Update",
+  "from": {
+    "plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+  },
+  "to": {
+    "plex": "busybox:1.36.1"
+  },
+  "why": "the install at FROM did not complete — nothing was tested",
+  "log": [
+    "12:26:15   [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/plex']",
+    "12:26:15   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['PLEX_CLAIM', 'HDD_PATH']",
+    "12:26:15   [1] deploy -> 409 {'ok': False, 'error': 'Az alkalmazás adatainak helye egy meghajtó lehet, nem egy mappa a meghajtón belül. Válaszd ezt: "
+  ]
+}
@@ -0,0 +1,5 @@
+12:26:15   [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/plex']
+12:26:15   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['PLEX_CLAIM', 'HDD_PATH']
+12:26:15   [1] deploy -> 409 {'ok': False, 'error': 'Az alkalmazás adatainak helye egy meghajtó lehet, nem egy mappa a meghajtón belül. Válaszd ezt: 
+12:26:15   [9] verdict inconclusive  -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-lane-2026-10-23/P2-negative/verdict.json
+12:26:15 RESULT inconclusive — the install at FROM did not complete — nothing was tested
@@ -0,0 +1,188 @@
+{
+  "app": "plex",
+  "walk": "security",
+  "box_walk_version": 1,
+  "verdict": "failed",
+  "venue": "box 9202 (drill catalog), the guarded Update",
+  "from": {
+    "plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+  },
+  "to": {
+    "plex": "busybox:1.36.1"
+  },
+  "observables_before": {
+    "pinned_images": {
+      "plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+    },
+    "installed_images": {
+      "plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+    },
+    "catalog_images": null,
+    "live_compose_image_lines": [
+      "image: plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+    ],
+    "docker_inspect": [
+      "plex  plexinc/pms-docker:1.43.4.10903-e5521bd8c  running=true  restarts=0"
+    ]
+  },
+  "setup_gate_before": {
+    "browser": {
+      "status": "302",
+      "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
+    },
+    "script": {
+      "status": "401",
+      "redirect": null
+    }
+  },
+  "seed": "none",
+  "seed_why": "the first-run claim needs a token minted at plex.tv by a real Plex account; no account exists for this venue",
+  "drill_commit": "577947198bff",
+  "sync_waited_s": 4.5,
+  "badge_before": {
+    "hu": [
+      {
+        "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
+        "text": "Frissítés elérhető — ma"
+      }
+    ],
+    "en": [
+      {
+        "title": "A newer version of this app is available. Select the Update button to start it.",
+        "text": "Update available — today"
+      }
+    ]
+  },
+  "measured_at": "2026-10-23T10:27:24Z",
+  "update": {
+    "accepted": true,
+    "http": "202",
+    "phases": [
+      {
+        "t": 0.0,
+        "phase": "backing-up",
+        "label": "Biztonsági mentés készül a frissítés előtt…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 11.3,
+        "phase": "safety-dump",
+        "label": "Adatbázis pillanatkép…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 12.3,
+        "phase": "pulling",
+        "label": "Új verzió letöltése…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 14.4,
+        "phase": "copying",
+        "label": "Az adatok másolása a frissítés előtt…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 24.7,
+        "phase": "starting",
+        "label": "Indítás az új verzióval…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 25.7,
+        "phase": "verifying",
+        "label": "Működés ellenőrzése…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 327.2,
+        "phase": "undoing",
+        "label": "Visszaállítás az előző változatra…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 335.4,
+        "phase": "undone",
+        "label": "Visszaállítva az előző változatra",
+        "updating": false,
+        "error": null,
+        "hold": null
+      }
+    ],
+    "duration_s": 335.4,
+    "final_phase": "undone",
+    "update_error": null,
+    "hold_reason": null,
+    "state": "running"
+  },
+  "observables_after": {
+    "pinned_images": {
+      "plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+    },
+    "installed_images": {
+      "plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+    },
+    "catalog_images": {
+      "plex": "busybox:1.36.1"
+    },
+    "live_compose_image_lines": [
+      "image: plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+    ],
+    "docker_inspect": [
+      "plex  plexinc/pms-docker:1.43.4.10903-e5521bd8c  running=true  restarts=0"
+    ]
+  },
+  "badge_after": {
+    "hu": [
+      {
+        "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
+        "text": "Frissítés elérhető — ma"
+      }
+    ],
+    "en": [
+      {
+        "title": "A newer version of this app is available. Select the Update button to start it.",
+        "text": "Update available — today"
+      }
+    ]
+  },
+  "state_after": "running",
+  "hold_after": null,
+  "to_digests": {
+    "plex": "sha256:e0ab27395614a8e1a4fdf84c6bc60ac664915cfdde70c52d030c7728a1c48e14"
+  },
+  "why": "the update ended 'undone' (error None, hold None)",
+  "log": [
+    "12:26:46   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH', 'PLEX_CLAIM']",
+    "12:26:46   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
+    "12:27:06   [1] deployed, controller state=running, pinned={'plex': 'plexinc/pms-docker:1.43.4.10903-e5521bd8c'}",
+    "12:27:06     gate: plex is gated — passed as the household (cookie set)",
+    "12:27:10   [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
+    "12:27:10   [3] seed: none — the first-run claim needs a token minted at plex.tv by a real Plex account; no account exists for this venue",
+    "12:27:11   [5] drill commit 577947198bff: plex plexinc/pms-docker:1.43.4.10903-e5521bd8c -> busybox:1.36.1 (push rc=0)",
+    "12:27:19   [5] the box's drill mirror now at 57794719",
+    "12:27:24   [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
+    "12:27:24       +   0.0s  phase=backing-up  label=Biztonsági mentés készül a frissítés előtt…  err=None  hold=None",
+    "12:27:35       +  11.3s  phase=safety-dump  label=Adatbázis pillanatkép…  err=None  hold=None",
+    "12:27:37       +  12.3s  phase=pulling  label=Új verzió letöltése…  err=None  hold=None",
+    "12:27:39       +  14.4s  phase=copying  label=Az adatok másolása a frissítés előtt…  err=None  hold=None",
+    "12:27:49       +  24.7s  phase=starting  label=Indítás az új verzióval…  err=None  hold=None",
+    "12:27:50       +  25.7s  phase=verifying  label=Működés ellenőrzése…  err=None  hold=None",
+    "12:32:51       + 327.2s  phase=undoing  label=Visszaállítás az előző változatra…  err=None  hold=None",
+    "12:33:00       + 335.4s  phase=undone  label=Visszaállítva az előző változatra  err=None  hold=None"
+  ]
+}
@@ -0,0 +1,22 @@
+12:26:46   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH', 'PLEX_CLAIM']
+12:26:46   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+12:27:06   [1] deployed, controller state=running, pinned={'plex': 'plexinc/pms-docker:1.43.4.10903-e5521bd8c'}
+12:27:06     gate: plex is gated — passed as the household (cookie set)
+12:27:10   [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
+12:27:10   [3] seed: none — the first-run claim needs a token minted at plex.tv by a real Plex account; no account exists for this venue
+12:27:11   [5] drill commit 577947198bff: plex plexinc/pms-docker:1.43.4.10903-e5521bd8c -> busybox:1.36.1 (push rc=0)
+12:27:19   [5] the box's drill mirror now at 57794719
+12:27:24   [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
+12:27:24       +   0.0s  phase=backing-up  label=Biztonsági mentés készül a frissítés előtt…  err=None  hold=None
+12:27:35       +  11.3s  phase=safety-dump  label=Adatbázis pillanatkép…  err=None  hold=None
+12:27:37       +  12.3s  phase=pulling  label=Új verzió letöltése…  err=None  hold=None
+12:27:39       +  14.4s  phase=copying  label=Az adatok másolása a frissítés előtt…  err=None  hold=None
+12:27:49       +  24.7s  phase=starting  label=Indítás az új verzióval…  err=None  hold=None
+12:27:50       +  25.7s  phase=verifying  label=Működés ellenőrzése…  err=None  hold=None
+12:32:51       + 327.2s  phase=undoing  label=Visszaállítás az előző változatra…  err=None  hold=None
+12:33:00       + 335.4s  phase=undone  label=Visszaállítva az előző változatra  err=None  hold=None
+12:33:18   [9] verdict failed  -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-lane-2026-10-23/P2-negative/verdict.json
+12:33:18 RESULT failed — the update ended 'undone' (error None, hold None)
+12:33:27   [X] stop -> 200 {'ok': True, 'message': 'Stack plex stop completed'}
+12:33:59   [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'plex', 'volumes_removed': ['plex_plex_config', 'plex_plex_transcode'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'us
+12:34:08   [X] after remove: deployed=False leftovers='/opt/docker/stacks/plex'
@@ -0,0 +1 @@
+REFUSED plex: the box walk is 'security' with verdict 'failed' — only a PROVEN `box_walk.py --security` walk is written as a security-fix step
@@ -0,0 +1,9 @@
+12:57:50   [5] drill commit f8b700e1d889: plex plexinc/pms-docker:1.43.5.11029-6bf8af3f0 -> plexinc/pms-docker:1.43.4.10903-e5521bd8c (push rc=0)
+12:57:58   [5] the box's drill mirror now at f8b700e1
+f8b700e1d889
+13:00:27   [sync] the badge NEVER caught up to plexinc/pms-docker:1.43.4.10903-e5521bd8c in 148.8s — catalog_images = None
+13:00:27   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH', 'PLEX_CLAIM']
+13:00:27   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+13:00:47   [1] deployed, controller state=running, pinned={'plex': 'plexinc/pms-docker:1.43.4.10903-e5521bd8c'}
+13:00:47     gate: plex is gated — passed as the household (cookie set)
+deployed True {"pinned_images": {"plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"}, "installed_images": {"plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"}, "catalog_images": null, "live_compose_image_lines": ["image: plexinc/pms-docker:1.43.4.10903-e5521bd8c"], "docker_inspect": ["plex  plexinc/pms-docker:1.43.4.10903-e5521bd8c  running=true  restarts=0"]}
@@ -0,0 +1,15 @@
+13:01:23   [5] the box's drill mirror now at f46e1bc6
+before: {"pinned_images": {"plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"}, "installed_images": {"plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"}, "catalog_images": {"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"}, "live_compose_image_lines": ["image: plexinc/pms-docker:1.43.4.10903-e5521bd8c"], "docker_inspect": ["plex  plexinc/pms-docker:1.43.4.10903-e5521bd8c  running=true  restarts=0"]}
+badge before: {'hu': [{'title': 'Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.', 'text': 'Frissítés elérhető — ma'}], 'en': [{'title': 'A newer version of this app is available. Select the Update button to start it.', 'text': 'Update available — today'}]}
+night chain -> 202 {'data': {'legs': ['db-dump', 'tier2', 'update-leg']}, 'message': 'started', 'ok': True}
+the leg's own lines:
+2026/10/23 11:01:34 night_chain.go:108: [INFO] [night-chain] manual run started from 172.18.0.6:46254: [db-dump tier2 update-leg]
+2026/10/23 11:02:40 night_chain.go:77: [INFO] [night-chain] update-leg: started
+2026/10/23 11:02:40 unattended.go:270: [INFO] [update-leg] started (manual-chain): window 02:30, no step starts at or after 16:17
+2026/10/23 11:02:41 unattended.go:316: [INFO] [update-leg] plex: skipped — not_proven
+2026/10/23 11:02:41 unattended.go:316: [INFO] [update-leg] privatebin: skipped — stopped_by_household
+2026/10/23 11:02:41 unattended.go:248: [INFO] [update-leg] update leg (manual-chain): done=0 undone=0 held=0 failed=0 skipped=2 in 0s [skipped: plex=not_proven, privatebin=stopped_by_household]
+2026/10/23 11:02:41 night_chain.go:82: [INFO] [night-chain] update-leg: done in 0s
+
+after: {"pinned_images": {"plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"}, "installed_images": {"plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"}, "catalog_images": {"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"}, "live_compose_image_lines": ["image: plexinc/pms-docker:1.43.4.10903-e5521bd8c"], "docker_inspect": ["plex  plexinc/pms-docker:1.43.4.10903-e5521bd8c  running=true  restarts=0"]}
+state running hold None phase None
@@ -0,0 +1,11 @@
+13:03:07   [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
+13:03:07       +   0.0s  phase=safety-dump  label=Adatbázis pillanatkép…  err=None  hold=None
+13:03:08       +   1.0s  phase=pulling  label=Új verzió letöltése…  err=None  hold=None
+13:03:16       +   9.2s  phase=copying  label=Az adatok másolása a frissítés előtt…  err=None  hold=None
+13:03:26       +  19.5s  phase=starting  label=Indítás az új verzióval…  err=None  hold=None
+13:03:27       +  20.5s  phase=verifying  label=Működés ellenőrzése…  err=None  hold=None
+13:03:32       +  25.6s  phase=done  label=Frissítve  err=None  hold=None
+{"accepted": true, "final_phase": "done", "update_error": null, "hold_reason": null, "state": "running", "duration_s": 25.7}
+after: {"pinned_images": {"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"}, "installed_images": {"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"}, "catalog_images": {"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"}, "live_compose_image_lines": ["image: plexinc/pms-docker:1.43.5.11029-6bf8af3f0@sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f"], "docker_inspect": ["plex  plexinc/pms-docker:1.43.5.11029-6bf8af3f0@sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f  running=true  restarts=0"]}
+13:03:51     gate: plex is gated — passed as the household (cookie set)
+identity 200 {"MediaContainer":{"size":0,"apiVersion":"1.2.3","claimed":false,"machineIdentifier":"f34aaee0f637bb3bf168e5b4e5ce2223c7c40c5f","version":"1.43.5.11029-6bf8af3f0"}}
@@ -0,0 +1,227 @@
+{
+  "app": "plex",
+  "walk": "security",
+  "box_walk_version": 1,
+  "verdict": "proven",
+  "venue": "box 9202 (drill catalog), the guarded Update",
+  "from": {
+    "plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+  },
+  "to": {
+    "plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+  },
+  "observables_before": {
+    "pinned_images": {
+      "plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+    },
+    "installed_images": {
+      "plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+    },
+    "catalog_images": null,
+    "live_compose_image_lines": [
+      "image: plexinc/pms-docker:1.43.4.10903-e5521bd8c"
+    ],
+    "docker_inspect": [
+      "plex  plexinc/pms-docker:1.43.4.10903-e5521bd8c  running=true  restarts=0"
+    ]
+  },
+  "setup_gate_before": {
+    "browser": {
+      "status": "302",
+      "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
+    },
+    "script": {
+      "status": "401",
+      "redirect": null
+    }
+  },
+  "seed": "none",
+  "seed_why": "the first-run claim needs a token minted at plex.tv by a real Plex account; no account exists for this venue",
+  "drill_commit": "b5e2406d3b49",
+  "sync_waited_s": 4.5,
+  "badge_before": {
+    "hu": [
+      {
+        "title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
+        "text": "Frissítés elérhető — ma"
+      }
+    ],
+    "en": [
+      {
+        "title": "A newer version of this app is available. Select the Update button to start it.",
+        "text": "Update available — today"
+      }
+    ]
+  },
+  "measured_at": "2026-10-23T10:36:22Z",
+  "update": {
+    "accepted": true,
+    "http": "202",
+    "phases": [
+      {
+        "t": 0.0,
+        "phase": "backing-up",
+        "label": "Biztonsági mentés készül a frissítés előtt…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 11.3,
+        "phase": "safety-dump",
+        "label": "Adatbázis pillanatkép…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 12.3,
+        "phase": "pulling",
+        "label": "Új verzió letöltése…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 20.5,
+        "phase": "copying",
+        "label": "Az adatok másolása a frissítés előtt…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 30.8,
+        "phase": "starting",
+        "label": "Indítás az új verzióval…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 31.8,
+        "phase": "verifying",
+        "label": "Működés ellenőrzése…",
+        "updating": true,
+        "error": null,
+        "hold": null
+      },
+      {
+        "t": 36.9,
+        "phase": "done",
+        "label": "Frissítve",
+        "updating": false,
+        "error": null,
+        "hold": null
+      }
+    ],
+    "duration_s": 36.9,
+    "final_phase": "done",
+    "update_error": null,
+    "hold_reason": null,
+    "state": "running"
+  },
+  "observables_after": {
+    "pinned_images": {
+      "plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+    },
+    "installed_images": {
+      "plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+    },
+    "catalog_images": {
+      "plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+    },
+    "live_compose_image_lines": [
+      "image: plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+    ],
+    "docker_inspect": [
+      "plex  plexinc/pms-docker:1.43.5.11029-6bf8af3f0  running=true  restarts=0"
+    ]
+  },
+  "badge_after": {
+    "hu": [
+      {
+        "title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
+        "text": "Naprakész"
+      }
+    ],
+    "en": [
+      {
+        "title": "This app is running the newest version available.",
+        "text": "Up to date"
+      }
+    ]
+  },
+  "state_after": "running",
+  "hold_after": null,
+  "to_digests": {
+    "plex": "sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f"
+  },
+  "four_observables": {
+    "pinned": {
+      "plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+    },
+    "installed": {
+      "plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+    },
+    "catalog": {
+      "plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+    },
+    "live_compose": [
+      "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
+    ]
+  },
+  "setup_gate_after": {
+    "browser": {
+      "status": "302",
+      "redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
+    },
+    "script": {
+      "status": "401",
+      "redirect": null
+    }
+  },
+  "memory": {
+    "soak_s": 600,
+    "interval_s": 10,
+    "samples": 60,
+    "containers": {
+      "plex": {
+        "samples": 60,
+        "anon_peak_bytes": 229015552,
+        "limit_bytes": 2147483648,
+        "anon_peak_pct": 10.7,
+        "cgroup_peak_pct": 11.5,
+        "oom_kill_delta": 0,
+        "oom_killed_flag": false,
+        "restarts_delta": 0,
+        "running_all_samples": true,
+        "cgroup": "/sys/fs/cgroup/system.slice/docker-f699bdec12560064fa6bd64884d941915072974ca27d389bcb3e3b917861ac88.scope"
+      }
+    },
+    "oom_kills": 0,
+    "restarts": 0,
+    "peak_pct": 10.7
+  },
+  "why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak",
+  "log": [
+    "12:35:39   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH', 'PLEX_CLAIM']",
+    "12:35:40   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
+    "12:36:05   [1] deployed, controller state=running, pinned={'plex': 'plexinc/pms-docker:1.43.4.10903-e5521bd8c'}",
+    "12:36:05     gate: plex is gated — passed as the household (cookie set)",
+    "12:36:08   [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
+    "12:36:08   [3] seed: none — the first-run claim needs a token minted at plex.tv by a real Plex account; no account exists for this venue",
+    "12:36:09   [5] drill commit b5e2406d3b49: plex plexinc/pms-docker:1.43.4.10903-e5521bd8c -> plexinc/pms-docker:1.43.5.11029-6bf8af3f0 (push rc=0)",
+    "12:36:18   [5] the box's drill mirror now at b5e2406d",
+    "12:36:23   [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
+    "12:36:23       +   0.0s  phase=backing-up  label=Biztonsági mentés készül a frissítés előtt…  err=None  hold=None",
+    "12:36:34       +  11.3s  phase=safety-dump  label=Adatbázis pillanatkép…  err=None  hold=None",
+    "12:36:35       +  12.3s  phase=pulling  label=Új verzió letöltése…  err=None  hold=None",
+    "12:36:43       +  20.5s  phase=copying  label=Az adatok másolása a frissítés előtt…  err=None  hold=None",
+    "12:36:53       +  30.8s  phase=starting  label=Indítás az új verzióval…  err=None  hold=None",
+    "12:36:54       +  31.8s  phase=verifying  label=Működés ellenőrzése…  err=None  hold=None",
+    "12:36:59       +  36.9s  phase=done  label=Frissítve  err=None  hold=None",
+    "12:37:18   [7] memory soak 600 s …",
+    "12:47:24   [7] soak: peak 10.7% of the limit (anon), kills 0, restarts 0"
+  ]
+}
@@ -0,0 +1,23 @@
+12:35:39   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH', 'PLEX_CLAIM']
+12:35:40   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+12:36:05   [1] deployed, controller state=running, pinned={'plex': 'plexinc/pms-docker:1.43.4.10903-e5521bd8c'}
+12:36:05     gate: plex is gated — passed as the household (cookie set)
+12:36:08   [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
+12:36:08   [3] seed: none — the first-run claim needs a token minted at plex.tv by a real Plex account; no account exists for this venue
+12:36:09   [5] drill commit b5e2406d3b49: plex plexinc/pms-docker:1.43.4.10903-e5521bd8c -> plexinc/pms-docker:1.43.5.11029-6bf8af3f0 (push rc=0)
+12:36:18   [5] the box's drill mirror now at b5e2406d
+12:36:23   [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
+12:36:23       +   0.0s  phase=backing-up  label=Biztonsági mentés készül a frissítés előtt…  err=None  hold=None
+12:36:34       +  11.3s  phase=safety-dump  label=Adatbázis pillanatkép…  err=None  hold=None
+12:36:35       +  12.3s  phase=pulling  label=Új verzió letöltése…  err=None  hold=None
+12:36:43       +  20.5s  phase=copying  label=Az adatok másolása a frissítés előtt…  err=None  hold=None
+12:36:53       +  30.8s  phase=starting  label=Indítás az új verzióval…  err=None  hold=None
+12:36:54       +  31.8s  phase=verifying  label=Működés ellenőrzése…  err=None  hold=None
+12:36:59       +  36.9s  phase=done  label=Frissítve  err=None  hold=None
+12:37:18   [7] memory soak 600 s …
+12:47:24   [7] soak: peak 10.7% of the limit (anon), kills 0, restarts 0
+12:47:24   [9] verdict proven  -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-lane-2026-10-23/P2-walk/verdict.json
+12:47:24 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak
+12:47:33   [X] stop -> 200 {'ok': True, 'message': 'Stack plex stop completed'}
+12:48:05   [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'plex', 'volumes_removed': ['plex_plex_config', 'plex_plex_transcode'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'us
+12:48:13   [X] after remove: deployed=False leftovers='/opt/docker/stacks/plex'
@@ -0,0 +1 @@
+WROTE plex: {'plex': 'plexinc/pms-docker:1.43.4.10903-e5521bd8c'} -> {'plex': 'plexinc/pms-docker:1.43.5.11029-6bf8af3f0'} peak 10.7% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
@@ -0,0 +1,21 @@
+13:04:15   [X] stop -> 200 {'ok': True, 'message': 'Stack plex stop completed'}
+13:04:47   [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'plex', 'volumes_removed': ['plex_plex_config', 'plex_plex_transcode'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'us
+13:04:56   [X] after remove: deployed=False leftovers='/opt/docker/stacks/plex'
+remote: . Processing 1 references        
+remote: Processed 1 references in total        
+13:05:05   [5] the box's drill mirror now at 42945c94
+13:07:34   [sync] the badge NEVER caught up to plexinc/pms-docker:1.43.4.10903-e5521bd8c in 149.0s — catalog_images = None
+13:07:34   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH', 'PLEX_CLAIM']
+13:07:34   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+13:07:54   [1] deployed, controller state=running, pinned={'plex': 'plexinc/pms-docker:1.43.4.10903-e5521bd8c'}
+deploy True
+13:07:55     gate: plex is gated — passed as the household (cookie set)
+remote: . Processing 1 references        
+remote: Processed 1 references in total        
+17e0da0 Revert "DRILL plex: compose image line back to 1.43.4 ONLY (the ladder untouched) — a fresh install at FROM for the Part 3 proof; reverted right after"
+42945c9 DRILL plex: compose image line back to 1.43.4 ONLY (the ladder untouched) — a fresh install at FROM for the Part 3 proof; reverted right after
+f46e1bc DRILL plex: security_fix step 1.43.4 -> 1.43.5 written by upgrade-test.py --write-ladder --security (D39 = B proof)
+
+13:08:04   [5] the box's drill mirror now at 17e0da02
+obs {"pinned_images": {"plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"}, "installed_images": {"plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"}, "catalog_images": {"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"}, "live_compose_image_lines": ["image: plexinc/pms-docker:1.43.4.10903-e5521bd8c"], "docker_inspect": ["plex  plexinc/pms-docker:1.43.4.10903-e5521bd8c  running=true  restarts=0"]}
+badge {'hu': [{'title': 'Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.', 'text': 'Frissítés elérhető — ma'}], 'en': [{'title': 'A newer version of this app is available. Select the Update button to start it.', 'text': 'Update available — today'}]}
@@ -0,0 +1,17 @@
+13:12:03   [5] the box's drill mirror now at 17e0da02
+before: {"pinned_images": {"plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"}, "installed_images": {"plex": "plexinc/pms-docker:1.43.4.10903-e5521bd8c"}, "catalog_images": {"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"}, "live_compose_image_lines": ["image: plexinc/pms-docker:1.43.4.10903-e5521bd8c"], "docker_inspect": ["plex  plexinc/pms-docker:1.43.4.10903-e5521bd8c  running=true  restarts=0"]}
+badge before: {'hu': [{'title': 'Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.', 'text': 'Frissítés elérhető — ma'}], 'en': [{'title': 'A newer version of this app is available. Select the Update button to start it.', 'text': 'Update available — today'}]}
+night chain -> 202 {'data': {'legs': ['db-dump', 'tier2', 'update-leg']}, 'message': 'started', 'ok': True}
+the leg's own lines:
+2026/10/23 11:12:13 night_chain.go:108: [INFO] [night-chain] manual run started from 172.18.0.6:38520: [db-dump tier2 update-leg]
+2026/10/23 11:13:15 night_chain.go:77: [INFO] [night-chain] update-leg: started
+2026/10/23 11:13:15 unattended.go:279: [INFO] [update-leg] started (manual-chain): window 02:30, no step starts at or after 16:28
+2026/10/23 11:13:15 unattended.go:345: [INFO] [update-leg] plex: step pressed plex=plexinc/pms-docker:1.43.4.10903-e5521bd8c → plex=plexinc/pms-docker:1.43.5.11029-6bf8af3f0
+2026/10/23 11:13:15 unattended.go:351: [INFO] [update-leg] plex: security fix CVE-2026-96652,CVE-2026-96654,CVE-2026-96655,CVE-2026-96656 taken (plex=plexinc/pms-docker:1.43.4.10903-e5521bd8c → plex=plexinc/pms-docker:1.43.5.11029-6bf8af3f0)
+2026/10/23 11:13:45 unattended.go:359: [INFO] [update-leg] plex: step ended done after 30.1 s
+2026/10/23 11:13:45 unattended.go:325: [INFO] [update-leg] privatebin: skipped — stopped_by_household
+2026/10/23 11:13:45 unattended.go:257: [INFO] [update-leg] update leg (manual-chain): done=1 undone=0 held=0 failed=0 skipped=1 in 30s [skipped: privatebin=stopped_by_household] [security fix plex: CVE-2026-96652,CVE-2026-96654,CVE-2026-96655,CVE-2026-96656 done]
+2026/10/23 11:13:45 night_chain.go:82: [INFO] [night-chain] update-leg: done in 30s
+
+after: {"pinned_images": {"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"}, "installed_images": {"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"}, "catalog_images": {"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"}, "live_compose_image_lines": ["image: plexinc/pms-docker:1.43.5.11029-6bf8af3f0@sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f"], "docker_inspect": ["plex  plexinc/pms-docker:1.43.5.11029-6bf8af3f0@sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f  running=true  restarts=0"]}
+state running hold None phase done
@@ -0,0 +1,28 @@
+2026/10/23 11:13:15 tier2.go:507: [INFO] [backup] Tier 2 copied plex → /mnt/sizing-bench/backups/secondary/plex (2.3 MB, 0 leg(s), 0s)
+2026/10/23 11:13:15 update.go:537: [INFO] [stacks] update plex: accepted — guarded update started
+2026/10/23 11:13:15 unattended.go:345: [INFO] [update-leg] plex: step pressed plex=plexinc/pms-docker:1.43.4.10903-e5521bd8c → plex=plexinc/pms-docker:1.43.5.11029-6bf8af3f0
+2026/10/23 11:13:15 unattended.go:351: [INFO] [update-leg] plex: security fix CVE-2026-96652,CVE-2026-96654,CVE-2026-96655,CVE-2026-96656 taken (plex=plexinc/pms-docker:1.43.4.10903-e5521bd8c → plex=plexinc/pms-docker:1.43.5.11029-6bf8af3f0)
+2026/10/23 11:13:15 update.go:1378: [INFO] [stacks] update plex: phase checking
+2026/10/23 11:13:15 update.go:795: [INFO] [stacks] update plex: ladder — the last step (1 of 1) — the catalog's current definition
+2026/10/23 11:13:15 update.go:823: [INFO] [stacks] update plex: precondition met — Tier 2 (second drive) copy from 2026-10-23T11:13:04Z (0s old, limit 24h0m0s)
+2026/10/23 11:13:15 update.go:1378: [INFO] [stacks] update plex: phase safety-dump
+2026/10/23 11:13:16 update_guard.go:497: [INFO] [backup] update safety dump for plex: the app has no database — nothing to copy (no-op)
+2026/10/23 11:13:16 update.go:855: [INFO] [stacks] update plex: safety dump done (0 file(s)) []
+2026/10/23 11:13:17 undo.go:287: [INFO] [stacks] update plex: the undo copy will hold 2 named volume(s), 2.8 MiB
+2026/10/23 11:13:17 update.go:1378: [INFO] [stacks] update plex: phase pinning
+2026/10/23 11:13:17 pin.go:385: [INFO] [stacks] update plex: pin advanced to /opt/docker/felhom-controller/data/catalog-cache/templates/plex/docker-compose.yml (plex=plexinc/pms-docker:1.43.5.11029-6bf8af3f0)
+2026/10/23 11:13:17 update.go:1378: [INFO] [stacks] update plex: phase pulling
+2026/10/23 11:13:28 update.go:1378: [INFO] [stacks] update plex: phase copying
+2026/10/23 11:13:38 update.go:1378: [INFO] [stacks] update plex: phase copying
+2026/10/23 11:13:38 undo.go:437: [INFO] [stacks] update plex: copied plex_plex_config → plex_plex_config.pre-update-20261023T111338Z in 520ms
+2026/10/23 11:13:38 update.go:1378: [INFO] [stacks] update plex: phase copying
+2026/10/23 11:13:39 undo.go:437: [INFO] [stacks] update plex: copied plex_plex_transcode → plex_plex_transcode.pre-update-20261023T111338Z in 465ms
+2026/10/23 11:13:39 update.go:1378: [INFO] [stacks] update plex: phase starting
+2026/10/23 11:13:39 update.go:1378: [INFO] [stacks] update plex: phase verifying
+2026/10/23 11:13:44 update.go:1006: [INFO] [stacks] update plex: healthy after 5s (the app's health check passed)
+2026/10/23 11:13:45 update.go:1043: [INFO] [stacks] update plex: DONE in 29s
+2026/10/23 11:13:45 image_retention.go:238: [INFO] [stacks] image retention (update of plex): pass over 40 image(s) of [plexinc/pms-docker] — 0 candidate(s), 0 deleted, the rest kept
+2026/10/23 11:13:45 unattended.go:359: [INFO] [update-leg] plex: step ended done after 30.1 s
+2026/10/23 11:13:45 unattended.go:257: [INFO] [update-leg] update leg (manual-chain): done=1 undone=0 held=0 failed=0 skipped=1 in 30s [skipped: privatebin=stopped_by_household] [security fix plex: CVE-2026-96652,CVE-2026-96654,CVE-2026-96655,CVE-2026-96656 do
+identity 200 {"MediaContainer":{"size":0,"apiVersion":"1.2.3","claimed":false,"machineIdentifier":"de0d1cd3ffa436835af296505a1e2534be391d1f","version":"1.43.5.11029-6bf8af3f
+state running health None
@@ -0,0 +1,27 @@
+### root@192.168.0.154
+containers=10 unhealthy=0 restarting=0 exited=[] gitea.dooplex.hu/admin/felhom-controller:0.341.0 Up 35 seconds (healthy)
+started=2026-10-23T11:15:27.242236608Z
+errors=0 info=126
+2026/10/23 11:15:28 [INFO] Self-update enabled (check every 6h, auto-update: false, auto-update time: 04:30)
+2026/10/23 11:15:28 [INFO] [scheduler] Registered periodic job: selfupdate-check (every 6h0m0s)
+2026/10/23 11:15:59 [INFO] [selfupdate] Current version 0.341.0 is up to date
+2026/10/23 11:15:29 [INFO] [sync] Initial sync: Sablonok frissítve — a katalógus új változata betöltve; a telepített alkalmazások fájljai nem változt
+### hp
+containers=24 unhealthy=0 restarting=0 exited=[] gitea.dooplex.hu/admin/felhom-controller:0.341.0 Up 36 seconds (healthy)
+started=2026-10-23T11:15:28.047379649Z
+errors=0 info=135
+2026/10/23 11:15:29 deploy.go:1442: [WARN] [stacks] Stack bookstack: new field ADMIN_PASSWORD (type=password) requires manual configuration
+2026/10/23 11:15:29 deploy.go:1442: [WARN] [stacks] Stack calibre-web: new field ADMIN_PASSWORD (type=password) requires manual configuration
+2026/10/23 11:15:29 deploy.go:1442: [WARN] [stacks] Stack plex: new field PLEX_CLAIM (type=text) requires manual configuration
+2026/10/23 11:15:29 main.go:833: [INFO] Self-update enabled (check every 6h, auto-update: false, auto-update time: 04:30)
+2026/10/23 11:15:29 scheduler.go:120: [INFO] [scheduler] Registered periodic job: selfupdate-check (every 6h0m0s)
+2026/10/23 11:16:01 updater.go:196: [INFO] [selfupdate] Current version 0.341.0 is up to date
+2026/10/23 11:15:30 sync.go:142: [INFO] [sync] Initial sync: Sablonok frissítve — a katalógus új változata betöltve; a telepített alkalmazások fájljai
+### felhom-pve
+containers=9 unhealthy=0 restarting=0 exited=[] gitea.dooplex.hu/admin/felhom-controller:0.341.0 Up 40 seconds (healthy)
+started=2026-10-23T11:15:11.64495822Z
+errors=0 info=141
+2026/10/23 11:15:12 [INFO] Self-update enabled (check every 6h, auto-update: false, auto-update time: 04:30)
+2026/10/23 11:15:12 [INFO] [scheduler] Registered periodic job: selfupdate-check (every 6h0m0s)
+2026/10/23 11:15:44 [INFO] [selfupdate] Current version 0.341.0 is up to date
+2026/10/23 11:15:13 [INFO] [sync] Initial sync: Sablonok frissítve — a katalógus új változata betöltve; a telepített alkalmazások fájljai nem változt
@@ -0,0 +1,10 @@
+2026-10-23T11:24:47Z
+HTTP/1.1 303 See Other
+Location: /configuration?flash=floor_set
+Effective floor: v0.341.0 — source: DB (hub_settings) ; env fallback would be v0.120.0 Save global floor… DB override: v
+clear tester-1 Location: /customers/tester-1?flash=floor_set
+clear demo-hp Location: /customers/demo-hp?flash=floor_set
+clear demo-felhom Location: /customers/demo-felhom?flash=floor_set
+2026/10/23 13:15:19 [INFO] managed floor SERVED for tester-1: floor 0.341.0, agent requirement "0.158.1" from declared (golden 0.331.0)
+2026/10/23 13:15:20 [INFO] managed floor SERVED for demo-felhom: floor 0.341.0, agent requirement "0.158.1" from declared (golden 0.331.0)
+2026/10/23 13:15:20 [INFO] managed floor SERVED for demo-hp: floor 0.341.0, agent requirement "0.158.1" from declared (golden 0.331.0)
@@ -0,0 +1,33 @@
+control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
+== tester-1 (enkicsifelhom.hu): 6 public name(s)
+   OK   control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
+== demo-hp (enkisfelhom.hu): 14 public name(s)
+   OK   http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
+   OK   http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
+   OK   http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
+   OK   http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
+   OK   http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
+   OK   http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
+   OK   http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
+   OK   http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
+   OK   http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
+   OK   http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
+   OK   http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
+   OK   http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
+   OK   http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
+   OK   http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
+== demo-felhom (demo-felhom.eu): 8 public name(s)
+   OK   http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
+   OK   http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
+   OK   http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
+   OK   http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
+   OK   http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
+== every public name redirects http -> https
@@ -0,0 +1,3 @@
+9201 login ok, /api/stacks 200
+login failed: no session cookie
+n100 /api/health 200tester-1 (BASE .148) login ok, /api/stacks 200
@@ -0,0 +1,3 @@
+tester-1 HTTP/1.1 303 See Other Location: /customers/tester-1?flash=floor_set 
+demo-hp HTTP/1.1 303 See Other Location: /customers/demo-hp?flash=floor_set 
+demo-felhom HTTP/1.1 303 See Other Location: /customers/demo-felhom?flash=floor_set 
@@ -0,0 +1,74 @@
+# D39 = B — the security-fix lane, built and proven (2026-10-23)
+
+Decision: `architecture/09-update-architecture.md` §3 decision 255 (the operator started the D39 brief ~12:00; R-1239
+closed). Read before the work: `09` §3 decisions 13–17, 22, 25–26, 52 and §6.4 parts 4–7; `00-capability-map.md` (the
+B rows); `13-threat-model.md`; `runbooks/target-selection.md`; `runbooks/publish-train-rules.md`.
+
+Baselines at start: catalog `cde26ab`, controller `32e61d5` (0.340.0, global floor 06:41 UTC — read from the hub before
+the first controller commit), felhom.eu `4b9b0af3`. Machines: DooPlex (builds, the writer), demo-hp (9202 scratch; the
+release on 9201), Tester 1, demo-felhom (release only). Not touched: ep0, any household box.
+
+## Venue
+
+9202 was pointed at the drill catalog through its LOCAL mirror (`tools/repoint.py`, copied from
+`audits/burndown-3-2026-10-17/tools/`, R-992 — no catalog credential on the box): `repoint-drill.txt`. The drill was
+reset to live `main` (`cde26ab`) first. 9202's dashboard password is its own (`REHEARSAL_2026_10_20_9202_PW`; the
+demo-hp one was refused — five failed logins hit the one-minute limit; `operations/nodes.md` corrected).
+
+## Part 2 — the lane on the old controller (9202 on 0.340.0)
+
+| Step | Result | File |
+|---|---|---|
+| First try of the negative control | `inconclusive` — the install was refused before anything was made (Plex wants the drive itself as `HDD_PATH`); the walk gained `--value` | `P2-negative-try1-install-refused/` |
+| **Negative control**: FROM Plex 1.43.4.10903, TO `busybox:1.36.1` (exits at once) | **`failed`** — backing-up → … → verifying → undoing → **undone** after 335 s; Plex 1.43.4 back | `P2-negative/walk.txt`, `box-verdict-plex.json` |
+| The writer on that walk | **refused**: „the box walk is 'security' with verdict 'failed' — only a PROVEN `box_walk.py --security` walk is written" | `P2-negative/writer-refusal.txt` |
+| **The walk**: Plex 1.43.4.10903-e5521bd8c → 1.43.5.11029-6bf8af3f0 | **`proven`** — done in 36.9 s, no undo, no hold; pinned = installed = catalog = live compose = running = TO; digest `sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f` (the registry's, re-read by the writer); soak 600 s, 60 samples, anon peak 10.7 % of 2 GiB (cgroup peak 11.5 %), 0 OOM kills, 0 restarts; `seed: none` (Plex's fixture is a `NoRoute` stub) | `P2-walk/` |
+| Setup gate (unclaimed Plex) | a browser (`Accept: text/html`) → 302 to `felhom.<domain>/__gate/start`; a script → 401; the same after the update | `P2-walk/box-verdict-plex.json` |
+| The writer, into the DRILL only | wrote the `security_fix` entry: ids CVE-2026-96652/-96654/-96655/-96656; advisory Plex's notice `https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319` (the one CISA KEV cites, all four added 2026-10-20 — `cisa-kev-plex2shell.json`, from CISA's own feed); `fixed_in` 1.43.3.10861; the gate accepts it with its WARN | `P2-walk/writer.txt`; drill `f46e1bc` |
+| Old controller, night (`POST /api/debug/backup/night-chain`) | **`[update-leg] plex: skipped — not_proven`**; Plex stays 1.43.4 (control: the same leg judged privatebin) | `P2-oldctl/2-night-chain-0.340.0.txt` |
+| Old controller, hand press | **done** in 25.7 s; Plex 1.43.5 at the step's digest; `/identity` 200 with 1.43.5 | `P2-oldctl/3-hand-press-0.340.0.txt` |
+
+**How Plex was put back at 1.43.4 for Part 3:** removed through the product (with its data); drill commit `42945c9`
+moved ONLY the compose's image line back to 1.43.4 (the ladder line untouched); a fresh install pinned 1.43.4; `17e0da0`
+reverted that commit, so the step is the head again and the badge read „Frissítés elérhető" (`P3-newctl/0-…`).
+
+## Part 3 — the new controller (0.341.0-rc.1 on 9202)
+
+Controller `63dcccf` (CI run 2264 / #471 success), image `0.341.0-rc.1` set by hand (9202's self-update is off). The
+night chain: `[update-leg] plex: step pressed …`, **`[update-leg] plex: security fix
+CVE-2026-96652,CVE-2026-96654,CVE-2026-96655,CVE-2026-96656 taken (plex=…1.43.4… → plex=…1.43.5…)`**, `step ended done
+after 30.1 s`; the summary line ends `[security fix plex: … done]`. Backup first: the update's precondition met by a
+second-drive copy 0 s old, the undo copy of 2 named volumes (2.8 MiB), then the pin. `/identity` 200 with 1.43.5
+(`P3-newctl/1-…`, `2-…`).
+
+## Part 4 — release 0.341.0
+
+Image `0.341.0` (`sha256:8aa4ce60…c0bc`) from `63dcccf`; per-box floors on tester-1, demo-hp, demo-felhom (303
+`floor_set`); all three ran 0.341.0 by 11:15:31 UTC. Box walk: 0 unhealthy, 0 restarting, 0 exited, 0 `[ERROR]` lines since
+the start (126 / 135 / 141 `[INFO]` lines — the control); selfupdate „0.341.0 is up to date"; the https-only check passes
+on every public name; the dashboard login works on demo-hp and Tester 1 (`/api/stacks` 200), the N100's `/api/health`
+200 (`P4-release/`). **The operator said yes in chat; the global floor 0.341.0 / MinAgent 0.158.1 was set at 11:24:47
+UTC** (303 `floor_set`; the running hub's page reads „Effective floor: v0.341.0 — source: DB"); the per-box floors
+cleared.
+
+## Teardown (three layers)
+
+- **Machine (9202):** Plex removed through the product (no plex container or volume left); `controller.yaml` restored
+  byte-identical (`cmp`) and the catalog cache re-cloned from the live catalog (R-615); this run's saved copy deleted
+  after the `cmp`; image `0.341.0`. 34 older saved copies from earlier sessions stay — filed R-1240. The drill
+  repository keeps this run's commits as the record.
+- **Host (demo-hp):** nothing provisioned.
+- **Hub:** the global floor 0.341.0 (the operator's yes); per-box floors cleared.
+
+## Observations
+
+- FILED: R-1240 — 9202 holds 34 saved `controller.yaml` copies with the catalog token.
+- FIXED without a row: drill commits never reached a box pointed at the drill's local mirror (`box_walk.refresh_box_mirror`);
+  two stale catalog tests (9202 address, gate count + missing sibling in the shallow clone); Tester 1's guest moved
+  `.101` → `.148` and the box walk had it typed (now read from the guest); `operations/nodes.md` (9202's password,
+  Tester 1's address).
+- NOT-A-FINDING: the writer's own engine-major check is redundant with `check_entry` (two layers on purpose; the test
+  asserts the refusal); `/opt/docker/stacks/plex` keeps the catalog's template files after a removal, as every catalog
+  app's folder does (72); the demo-hp start WARNs „new field … requires manual configuration" come from code 0.341.0 did
+  not change; a waiter of mine matched its own command line (a known trap, memory `pgrep-waiter-matches-itself`) and
+  was stopped.
@@ -0,0 +1,70 @@
+{
+ "catalogVersion": "2026.10.21",
+ "dateReleased": "2026-10-21T14:04:39.8983Z",
+ "entries": [
+  {
+   "cveID": "CVE-2026-96656",
+   "vendorProject": "Plex",
+   "product": "Media Server",
+   "vulnerabilityName": "Plex Media Server External Control of File Name or Path Vulnerability",
+   "dateAdded": "2026-10-20",
+   "shortDescription": "Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.",
+   "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
+   "dueDate": "2026-10-23",
+   "knownRansomwareCampaignUse": "Unknown",
+   "forensicTriage": "Yes",
+   "notes": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96656",
+   "cwes": [
+    "CWE-73"
+   ]
+  },
+  {
+   "cveID": "CVE-2026-96655",
+   "vendorProject": "Plex",
+   "product": "Media Server",
+   "vulnerabilityName": "Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability",
+   "dateAdded": "2026-10-20",
+   "shortDescription": "Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.",
+   "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
+   "dueDate": "2026-11-03",
+   "knownRansomwareCampaignUse": "Unknown",
+   "forensicTriage": "No",
+   "notes": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96655",
+   "cwes": [
+    "CWE-918"
+   ]
+  },
+  {
+   "cveID": "CVE-2026-96654",
+   "vendorProject": "Plex",
+   "product": "Media Server",
+   "vulnerabilityName": "Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability",
+   "dateAdded": "2026-10-20",
+   "shortDescription": "Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.",
+   "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
+   "dueDate": "2026-10-23",
+   "knownRansomwareCampaignUse": "Unknown",
+   "forensicTriage": "No",
+   "notes": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96654",
+   "cwes": [
+    "CWE-84"
+   ]
+  },
+  {
+   "cveID": "CVE-2026-96652",
+   "vendorProject": "Plex",
+   "product": "Media Server",
+   "vulnerabilityName": "Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability",
+   "dateAdded": "2026-10-20",
+   "shortDescription": "Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. ",
+   "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
+   "dueDate": "2026-11-03",
+   "knownRansomwareCampaignUse": "Unknown",
+   "forensicTriage": "No",
+   "notes": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96652",
+   "cwes": [
+    "CWE-918"
+   ]
+  }
+ ]
+}
@@ -0,0 +1,33 @@
+mirror main cde26ab plex: guide checked against 1.43.5.11029-6bf8af3f0 (every HU + EN label read from the new web client, all equal); CHANGELOG + REPORT for the Plex2Shell move
+
+drill repo main: cde26ab
+26:    repo_url: file:///opt/docker/felhom-controller/drill-catalog.git
+26c26
+<     repo_url: https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
+---
+>     repo_url: file:///opt/docker/felhom-controller/drill-catalog.git
+
+Traceback (most recent call last):
+  File "/mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-lane-2026-10-23/tools/repoint.py", line 86, in <module>
+    {"mirror": mirror, "drill": drill, "restore": restore, "status": status}[sys.argv[1]]()
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
+  File "/mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-lane-2026-10-23/tools/repoint.py", line 74, in drill
+    restart_sync()
+    ~~~~~~~~~~~~^^
+  File "/mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-lane-2026-10-23/tools/repoint.py", line 64, in restart_sync
+    w.sync_rescan()
+    ~~~~~~~~~~~~~^^
+  File "/mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu/scripts/box_walk.py", line 466, in sync_rescan
+    ctl("POST", "/api/sync")
+    ~~~^^^^^^^^^^^^^^^^^^^^^
+  File "/mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu/scripts/box_walk.py", line 132, in ctl
+    sess = open(f"{SC}/sess{os.getpid()}.txt").read().strip()
+           ~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+FileNotFoundError: [Errno 2] No such file or directory: '/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/63b6c84e-0c09-4657-a160-855d2e4fe326/scratchpad/sc9202/sess3574518.txt'
+26:    repo_url: file:///opt/docker/felhom-controller/drill-catalog.git
+27:    sync_interval: 15m
+-rw------- 1 root root 1994 Oct 22 14:47 /var/lib/docker/volumes/felhom-controller-data/_data/controller.yaml.pre-seclane1023
+mirror main cde26ab plex: guide checked against 1.43.5.11029-6bf8af3f0 (every HU + EN label read from the new web client, all equal); CHANGELOG + REPORT for the Plex2Shell move
+cache HEAD cde26ab plex: guide checked against 1.43.5.11029-6bf8af3f0 (every HU + EN label read from the new web client, all equal); CHANGELOG + REPORT for the Plex2Shell move
+file:///opt/docker/felhom-controller/drill-catalog.git
+
@@ -0,0 +1,3 @@
+13:25:23   [X] stop -> 200 {'ok': True, 'message': 'Stack plex stop completed'}
+13:25:55   [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'plex', 'volumes_removed': ['plex_plex_config', 'plex_plex_transcode'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'us
+13:26:04   [X] after remove: deployed=False leftovers='/opt/docker/stacks/plex'
@@ -0,0 +1,19 @@
+RESTORED-IDENTICAL
+26:    repo_url: https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
+
+2026/10/23 11:26:11 sync.go:344: [WARN] [sync] git.repo_url changed (cache was cloned from file:///opt/docker/felhom-controller/drill-catalog.git, config says https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git) — re-cloning the catalog cache from the configured repository (R-615)
+2026/10/23 11:26:11 sync.go:318: [INFO] [sync] Cloning https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git → /opt/docker/felhom-controller/data/catalog-cache
+2026/10/23 11:26:13 sync.go:511: [WARN] [sync] immich: catalog definition REFUSED by the allow-list — the app keeps its last good compose, nothing written: the catalog definition of immich asks for container rights the box does not allow: immich-server: bind /mnt/sizing-bench/appdata/immich -> /usr/src/app/upload rw; immich-server: bind /mnt/sizing-bench/userdata/media/photos -> /external/photos ro
+2026/10/23 11:26:13 sync.go:535: [INFO] [sync] Updated plex/docker-compose.yml
+2026/10/23 11:26:13 sync.go:535: [INFO] [sync] Updated plex/.felhom.yml
+2026/10/23 11:26:13 sync.go:261: [INFO] [sync] catalog moved 17e0da02fd61 -> 389859359491 (0 new, 1 stack dir(s) changed)
+2026/10/23 11:26:13 sync.go:299: [INFO] [sync] Catalog sync complete
+2026/10/23 11:26:13 sync.go:142: [INFO] [sync] Initial sync: Sablonok frissítve — frissítve: plex
+
+26:    repo_url: https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
+27:    sync_interval: 15m
+-rw------- 1 root root 1994 Oct 22 14:47 /var/lib/docker/volumes/felhom-controller-data/_data/controller.yaml.pre-seclane1023
+mirror main 17e0da02 Revert "DRILL plex: compose image line back to 1.43.4 ONLY (the ladder untouched) — a fresh install at FROM for the Part 3 proof; reverted right after"
+cache HEAD 3898593 D39 = B: the security-fix lane — a `security_fix` ladder step (box walk required, bench optional, CVE/GHSA notice), its gates + 8 decoys, the writer (--write-ladder --security), the box venue (box_walk.py --security, drill-mirror refresh); two stale tests fixed
+https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
+
@@ -0,0 +1,4 @@
+felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.341.0 Up 25 seconds (healthy)
+0
+removed-identical-save
+34
@@ -0,0 +1,25 @@
+"""chain.py — press "run tonight's chain now" (POST /api/debug/backup/night-chain, R-705) on the box and quote the update
+leg's own lines; then read Plex's four observables. D39 = B proof (felhom.eu audits/security-lane-2026-10-23)."""
+import json, re, sys, time
+sys.path.insert(0, "/mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu/scripts")
+import box_walk as w
+w.LOG = []
+w.login()
+w.refresh_box_mirror()
+w.sync_rescan("plex", "plexinc/pms-docker:1.43.5.11029-6bf8af3f0", tries=20, delay=6)
+print("before:", json.dumps(w.observables("plex")))
+print("badge before:", w.badges("plex"))
+since = w.guest("date -u +%Y-%m-%dT%H:%M:%SZ").strip()
+code, d = w.ctl("POST", "/api/debug/backup/night-chain")
+print("night chain ->", code, str(d)[:200])
+leg = ""
+for _ in range(240):
+    time.sleep(10)
+    leg = w.guest("docker logs --since %s felhom-controller 2>&1 | grep -E 'update-leg' | grep -v DEBUG | cut -c1-400" % since)
+    if re.search(r"update leg .*: done=", leg):
+        break
+print("the leg's own lines:\n" + leg)
+time.sleep(10)
+print("after:", json.dumps(w.observables("plex")))
+st = w.stack("plex")
+print("state", st.get("state"), "hold", st.get("hold_reason"), "phase", st.get("update_phase"))
@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+"""repoint.py mirror|drill|restore|status — point a box (scratch 9202; copied from audits/burndown-3-2026-10-17/tools/ for the D39 security lane, 2026-10-23) at the drill catalog WITHOUT a credential (R-992).
+
+WHY A LOCAL MIRROR. `09` §6.5's route needs a catalog credential on the box: the drill repo is private (R-992). This
+session could not mint a READ-ONLY one — the Gitea credential on DooPlex is itself a token, and Gitea answers 403 to a
+token asking to list or create tokens (measured 2026-10-14) — and the night of 2026-10-06 put the admin WRITE token
+into the box's controller.yaml, which this task forbids. The cache-staging workaround of 2026-10-12 does not hold for a
+test that lasts days: every sync (and every controller start) re-applies the live catalog over the staged templates
+and over the installed apps' compose files (Syncer.copyTemplates, no deployed check).
+
+So the drill catalog is MIRRORED onto the box: a bare git repository inside the controller's own data volume, and
+`git.repo_url: file:///opt/docker/felhom-controller/drill-catalog.git`. The controller's sync runs exactly as for a
+remote (clone/fetch/reset, the R-615 re-clone on a changed URL); no secret is on the box. DooPlex updates the mirror
+from the drill repo with a git bundle (`mirror`). The drill repo on Gitea stays the record.
+
+    SC=~/.felhom-tester1 TARGET=tester-1 python3 repoint.py mirror    # (re)load the mirror from the drill repo main
+    ... repoint.py drill     # save controller.yaml (once), set repo_url to the mirror, restart, sync, rescan
+    ... repoint.py restore   # put the saved controller.yaml back (byte-identical), restart, sync, rescan
+    ... repoint.py status
+"""
+import os, subprocess, sys, time
+sys.path.insert(0, "/mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu/scripts")
+import box_walk as w
+
+DRILL = "/mnt/5_hdd/felhom.eu/drill/app-catalog-drill"
+VOL = "/var/lib/docker/volumes/felhom-controller-data/_data"     # guest path of the controller's data volume
+CVOL = "/opt/docker/felhom-controller"                             # the same, inside the controller container
+SAVE = f"{VOL}/controller.yaml.pre-seclane1023"
+MIRROR_URL = f"file://{CVOL}/drill-catalog.git"
+
+
+def status():
+    print(w.guest(f"""grep -nE 'repo_url|sync_interval' {VOL}/controller.yaml; ls -l {SAVE} 2>&1 | tail -1
+docker exec felhom-controller sh -c 'git -C {CVOL}/drill-catalog.git log -1 --format="mirror main %h %s" main 2>&1;
+  git -C {CVOL}/data/catalog-cache log -1 --format="cache HEAD %h %s" 2>&1; git -C {CVOL}/data/catalog-cache remote get-url origin'"""))
+
+
+def mirror():
+    b = "/tmp/drill-seclane1023.bundle"
+    subprocess.run(["git", "-C", DRILL, "bundle", "create", b, "main"], check=True, capture_output=True)
+    head = subprocess.run(["git", "-C", DRILL, "rev-parse", "--short", "main"], capture_output=True, text=True).stdout.strip()
+    ssh = w.ssh_args()
+    # bundle -> PVE host -> guest -> controller volume; the bare repo is made and fetched BY the controller's own user
+    subprocess.run(["scp", "-q", "-o", "StrictHostKeyChecking=accept-new"] + (["-J", w._T["jump"]] if w._T["jump"] else [])
+                   + [b, f"{w._T['ssh']}:{b}"], check=True)
+    subprocess.run(ssh + [f"pct push {w.GUEST} {b} {VOL}/drill-seclane1023.bundle && rm -f {b}"], check=True)
+    print(w.guest(f"""set -e
+docker exec felhom-controller sh -c 'test -d {CVOL}/drill-catalog.git || git init -q --bare -b main {CVOL}/drill-catalog.git
+git -C {CVOL}/drill-catalog.git fetch -q {CVOL}/drill-seclane1023.bundle +main:main && rm -f {CVOL}/drill-seclane1023.bundle
+git -C {CVOL}/drill-catalog.git log -1 --format="mirror main %h %s" main'"""))
+    print("drill repo main:", head)
+    os.remove(b)
+
+
+def restart_sync():
+    w.guest("docker restart felhom-controller >/dev/null")
+    for _ in range(60):
+        time.sleep(3)
+        try:
+            w.login()
+            break
+        except SystemExit:
+            continue
+    w.sync_rescan()
+    time.sleep(3)
+    print(w.guest("docker logs --since 3m felhom-controller 2>&1 | grep -E '\\[sync\\]' | grep -v DEBUG | tail -8"))
+
+
+def drill():
+    print(w.guest(f"""set -e
+test -f {SAVE} || cp -p {VOL}/controller.yaml {SAVE}
+sed -i -E 's#^(\\s+repo_url: ).*$#\\1{MIRROR_URL}#' {VOL}/controller.yaml
+grep -n 'repo_url' {VOL}/controller.yaml; diff {SAVE} {VOL}/controller.yaml || true"""))
+    restart_sync()
+    status()
+
+
+def restore():
+    print(w.guest(f"""set -e
+cp -p {SAVE} {VOL}/controller.yaml
+cmp {SAVE} {VOL}/controller.yaml && echo RESTORED-IDENTICAL; grep -n repo_url {VOL}/controller.yaml"""))
+    restart_sync()
+    status()
+
+
+{"mirror": mirror, "drill": drill, "restore": restore, "status": status}[sys.argv[1]]()
@@ -26,6 +26,28 @@

 ---

+## 2026-10-23 day (later) — D39 = B: the security-fix lane
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-1239** | **The catalog has no fast lane for an urgent security fix — a decision for the operator.** (P2) | CLOSED 2026-10-23 — **D39 = B** (operator ruling by starting the D39 brief; `09` §3 decision 255): a `security_fix` ladder step, box walk required, bench optional, a CVE/GHSA notice as the authority, no operator word per incident. Catalog `3898593` (format, gates, 8 decoys, writer `--write-ladder --security`, `box_walk.py --security`); controller **0.341.0** (the leg takes it; global floor 11:24 UTC, MinAgent 0.158.1). **Reasoning kept:** a security-fix step never crosses a database engine major and is never a same-tag fix (decision 52's lane); a controller ≤ 0.340.0 skips it at night and a hand press takes it. | `audits/security-lane-2026-10-23/` (negative control `failed` and refused; Plex 1.43.4 → 1.43.5 proven on 9202; 0.340.0 night `not_proven` + hand press; rc.1 night `security fix … taken`) |
+
+## 2026-10-23 day — the releases and the DooPlex hour (the operator's „go")
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-49** | **[P2] The offsite capture set is ~90% cache and duplication — 1.1 GB of a 1.2 GB immich "photo backup".** (P3) | CLOSED 2026-10-23 — released in controller **0.340.0** (D21 = B: a template may exclude a named volume; Immich's model cache is out of every backup); the global floor 0.340.0 (MinAgent 0.158.1) since 06:41 UTC, all three test boxes on it | `audits/day-2026-10-23/` 03, 06 |
+| **R-1204** | **A box that runs once with its clock ahead loses its WireGuard tunnel to ep0 — the PBS whole-box copies and the operator's door — until the real date passes the wrong one, and nothing says why.** (P2) | CLOSED 2026-10-23 — the sign reported and the heal (D30, the agent re-keys on the existing peer path) in agent **0.163.0** (vouched by the operator 07:58 UTC; on Tester 1, demo-hp, demo-felhom by signed jobs), the alarm and its clearing in hub **0.167.0** (deployed 08:27 UTC). The live heal was proven on the test night (`audits/night-2026-10-23/P4-testnight/`) | `audits/day-2026-10-23/` 07, and the hub watch in 14 |
+| **R-1205** | **After a box death, a SECOND install that is deleted before it makes a key leaves the whole-box (PBS) tier waiting for the operator's re-issue.** (P2) | CLOSED 2026-10-23 — D31 in hub **0.167.0** (deployed 08:27 UTC, image sha256:177860a9…): the re-issue reads the newest deletion of a host that held a key | `audits/day-2026-10-23/` 14 |
+| **R-1230** | **A reinstalled box that waits for the household's recovery code was reported „stuck” after an hour: a false operator mail, a needless re-issue of the off-site login, and a controller restart on the box.** (P3) | CLOSED 2026-10-23 — hub **0.167.0** (deployed 08:27 UTC): the delivery checker stands down for `awaiting_recovery_key` | `audits/day-2026-10-23/` 14 |
+| **R-982** | **The Proxmox host accepts root password login over SSH from the LAN (measured on demo-hp), so anyone on the household network can try the root password.** (P3) | CLOSED 2026-10-23 — D4 delivered: the bundle drop-in in agent **0.163.0** (config bundle sha256 3afb88d9…, via a step bundle 0.163.0-step1 because it adds a path, R-880) on all three test boxes — `sshd -T` `permitrootlogin without-password`, sshd reloaded after the drop-in, a key login works, felhom-sshd active; new installs: installer **1.36.0** published (tag `installer-v1.36.0`, served sha256 de8bf5f3… = the tag). The real root password was not tried over SSH (CC does not hold it); the console is untouched by design | `audits/day-2026-10-23/` 07, 11 |
+| **R-985** | **Our zero-knowledge wording is stronger than the product: on a live box the operator can reach the off-site backup key (through the vaulted root credential and the operator tunnel) without the customer's recovery code.** (P3) | CLOSED 2026-10-23 — the D3 wording published on the website (felhom.eu `0bb57a4f`), read back live at phone and computer size | `audits/day-2026-10-23/` 12-website-readback |
+| **R-991** | **Nothing a buyer can read says which machines Felhom installs on, and a quarter of the forum beginners own only machines it cannot install on.** (P3) | CLOSED 2026-10-23 — the D5 minimum machine published (felhom.eu `0bb57a4f`), read back live | `audits/day-2026-10-23/` 12-website-readback |
+| **R-1225** | **The website's minimum machine (8 GB) cannot run the photo app, and the download page does not say so.** (P3) | CLOSED 2026-10-23 — D36: „8 GB runs the basics; the photo app needs 16 GB” on both download pages, published `0bb57a4f`, read back live | `audits/day-2026-10-23/` 12-website-readback |
+| **R-1226** | **Two FAQ answers say the household's data leaves the home only encrypted (the remote backup) — not true for data reached from outside.** (P2) | CLOSED 2026-10-23 — D36: both FAQ answers (visible + JSON-LD, HU + EN) now say what is opened from outside passes Cloudflare's network and is readable there; the backups leave only encrypted. Published `0bb57a4f`; live: the new sentence 2× per FAQ page, the old one 0× (control: the previous commit had it 2×) | `audits/day-2026-10-23/` 12-website-readback |
+| **R-1227** | **The container registry and the agent packages exist only on DooPlex — after its loss no box updates, reinstalls or installs.** (P2) | CLOSED 2026-10-23 — D33 built (felhom.eu `d306b8c2`): nightly 01:40 the newest 3 release tags of controller, hub, samba (skopeo `dir:`, digest-true) and the newest 5 agent versions to ep0 `/srv/felhom-release-copy` (one new user `felhom-relcopy`, rrsync-confined; cap 3 GB by the sender); first run 676 MB in 91 s; pulled back, every sha256 OK, every image re-verified; controller 0.340.0 from the copy loaded on 9202 (ID = config digest); alarm `FelhomReleaseCopyStale`; restore steps in `total-loss-of-dooplex.md`. Follow-ups: R-1235 | `audits/day-2026-10-23/` 08-release-copy-D33.txt |
+| **R-1234** | **D34's first push refused the hub's own catch-up and mailed a false „hub-db-backup failed" to admin@.** Installing the 6-hourly timer at 10:28 made systemd catch up the missed 08:30 slot at once (`Persistent=true`), while the freshly deployed hub 0.167.0 was still writing its start-up snapshot (`hub-*.db.tmp`); the only finished one was 02:00 (8 h), above the new 2-hour limit → „the hub stopped snapshotting", `OnFailure` mail id `01a167e0…`. The 2 h limit was also stricter than the hub's own 6-hour catch-up, so any restart could repeat it. (P3) | CLOSED 2026-10-23 day, the same session — the push waits (≤ 20 min) for a snapshot being written, and the limit is one slot gap + 1 h (7 h); tests `test_d34_waits_for_a_snapshot_being_written` (reproduces the 10:28 run when the wait is removed), `…_a_restart_within_one_slot_is_not_an_alarm`, `…_two_missed_slots_are_refused`, each red-proved | `audits/day-2026-10-23/13-hubdb-6h-D34.txt` |
+
 ## 2026-10-22 night — the seven decisions put into effect (full text of the rows: `git show 1100a344:documentation/backlog/OPEN-ITEMS.md`)

 | Row | What | Closed | Evidence |
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
admin	af5c005a4e	hub 0.169.0 (unreleased, not built): the upload watch's four events — allowed, operator-only, per-app cooldown, one readable Watch line in the operator mail gates / gates (push) Successful in 12m47s Details app_unexplained_upload / app_unexplained_cpu (warning) and their _cleared (info), from controller v0.342.0 (08 section 9, operator ruling 2026-10-23). Red-proved: operator-only, the render line, the allow-list.	2026-10-23 21:26:36 +02:00
admin	5277d859d5	hub 0.168.0: seal the last plain tokens in config_json (R-975, R-1241's Felhom half); decide row R-1243 for the hub's plain Longhorn copies (register 188 -> 189) gates / gates (push) Successful in 12m26s Details The Cloudflare tunnel token, Cloudflare API token and git token inside customer_configs.config_json now hold the 05 §16.2 seal (enc:v1:, OFFSITE_SECRET_KEY). Old rows sealed once at start-up without a config_version bump, then VACUUM + WAL checkpoint (an UPDATE leaves the old plaintext in a freed block). -unseal-box-secrets opens them too. Eight tests, each red-proved. Built, not deployed. Audit: documentation/audits/hub-token-seal-2026-10-23/.	2026-10-23 19:48:17 +02:00
admin	8257ff1cbe	Plex2Shell impact on Felhom: verdict NOT REACHED; R-1241 (P1), R-1242 (P3) opened (register 186 -> 188) gates / gates (push) Successful in 12m37s Details Read-only audit of whether the hacked Plex pod on DooPlex (HM-040, 2026-10-17 -> 10-23) reached Felhom's secrets. Two no-login doors existed (the Longhorn NFS export and the Longhorn API); neither was used: nfsd accepted 0 new connections in the window (positive control), no off-schedule Longhorn backup or volume. Evidence in documentation/audits/plex2shell-felhom-impact-2026-10-23/. The NFS export was narrowed from * to 10.42.0.0/16 on the operator's yes (host change, not in git). 13-threat-model.md: attacker j and one boundary row. STATUS: verdict, the P1, one do item.	2026-10-23 17:53:43 +02:00
admin	87dc50743c	D39 = B: 09 §3 decision 255 (the security-fix step) + a dated note on decision 13; capability B23; R-1239 closed, R-1240 opened, R-1238 updated (register 186 -> 186); STATUS/CONTEXT; nodes.md (9202 password, Tester 1 DHCP); evidence security-lane-2026-10-23 (controller 0.341.0, global floor 11:24 UTC) gates / gates (push) Successful in 13m49s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 13:35:38 +02:00
admin	4b9b0af3cb	Plex2Shell: the operator's 10:56 ruling in CONTEXT; demo-hp 9201 checked (clean) and updated to 1.43.5.11029; register 184 -> 186 (opened R-1238 Plex test record/fixture, R-1239 a fast lane for security fixes = D39); evidence plex-demo-boxes-2026-10-23 gates / gates (push) Successful in 13m46s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 11:27:52 +02:00
admin	2c9152d912	Day 2026-10-23 close-out: rulings D31-D36 in CONTEXT; STATUS (releases done, do list, D35 dated, D37/D38); register 191 -> 184 (closed R-49 R-982 R-985 R-991 R-1204 R-1205 R-1225 R-1226 R-1227 R-1230 R-1234; opened R-1235 R-1236 R-1237); the break-glass sheet current (D32, one A4, HU+EN); runbooks for D33/D34; poster facts; evidence day-2026-10-23 gates / gates (push) Successful in 12m53s Details	2026-10-23 11:03:45 +02:00
admin	52af38df6f	hub-db-backup: wait for a snapshot being written, limit 7 h (one slot gap + 1 h) — the 2 h limit refused the hub's own catch-up and mailed a false failure at 10:28 (R-1234, closed); tests red-proved gates / gates (push) Successful in 13m14s Details	2026-10-23 10:35:16 +02:00
admin	34979d5d25	hub manifest: 0.165.0 -> 0.167.0 (operator yes 2026-10-23: D31, the clock-ahead tunnel alarm, R-1230, D34 6-hourly snapshot; image sha256:177860a9…) gates / gates (push) Successful in 13m26s Details	2026-10-23 10:23:29 +02:00
admin	0bb57a4fee	website: publish D3/D5 (the whole truth on privacy; the minimum machine) and D36's two sentences, HU + EN (operator yes 2026-10-23; R-985, R-991, R-1225, R-1226) gates / gates (push) Successful in 13m10s Details	2026-10-23 10:16:54 +02:00
admin	2aebf1bde1	webpage: serve installer-v1.36.0 (both git-sync pins; operator yes 2026-10-23 — root SSH by key only on new installs, R-982 D4) gates / gates (push) Successful in 13m12s Details	2026-10-23 10:08:09 +02:00
admin	d306b8c2d7	release-copy: the released images (skopeo dir:, digest-true) and agent packages copied to ep0 nightly, verified by sha256 and a checksum compare, capped at 3 GB (D33, R-1227); tests red-proved gates / gates (push) Successful in 15m56s Details	2026-10-23 09:39:31 +02:00
admin	be7e97dc1a	hub 0.167.0 + DooPlex push: the hub DB snapshot every 6 hours (D34, operator yes 2026-10-23, R-232 G5) — slots 02/08/14/20, catch-up 6 h, push :30 after each, refuse a copy older than 2 h; tests red-proved gates / gates (push) Successful in 16m20s Details	2026-10-23 09:12:08 +02:00
				`@@ -0,0 +1 @@`
				REFUSED plex: the box walk is 'security' with verdict 'failed' — only a PROVEN `box_walk.py --security` walk is written as a security-fix step
				`@@ -0,0 +1 @@`
				`WROTE plex: {'plex': 'plexinc/pms-docker:1.43.4.10903-e5521bd8c'} -> {'plex': 'plexinc/pms-docker:1.43.5.11029-6bf8af3f0'} peak 10.7% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}`