# REPORT — the operator's two rulings built (2026-09-30, late evening)

Evidence: `documentation/audits/night-rulings-2026-09-30/` · golden: `documentation/tests/golden-0.284.2-2026-09-30/`.
Architecture read: `09` §3 decisions 13, 14, 17, 30, 40, 45–47, §5.3, §6.4 parts 4–7, §6.5; `07` (R-698); `01` §5.
Baselines (live Gitea 21:48): controller `d48da6c` (0.283.1), agent `d766666` (0.138.0), felhom.eu `42bf40b`, catalog
`d181165`. Register 377 rows by the method "every table row that starts with an R-id, bold or not, unique ids" (the
reviewer's regex and mine agree on 377 today).

## The Part table

| Part | done / not done / changed | why |
|---|---|---|
| **Rulings 52, 53** | **done** — recorded first (`09` §3, `07`, CONTEXT; decision 30 note) `1de0f7c` | before any work |
| **A — same-tag re-tests** | **done** — catalog `6a3ead9`: the entry shape, the gates (+8 decoys, seen red), `upgrade-test.py --retest`, the ONE command `retest-floating.py` | spike note `A/A0-spike.md` first: the move gate never looked at a re-test (it changes `.felhom.yml` only) |
| A4 end to end on 9202 | **done** — docmost at an older `redis:7-alpine` digest, "run tonight's chain now", the leg's `step pressed … step ended done after 95.0 s`, new digest running, read back, badge current | the first attempt (outline) stopped at outline's fixture on both venues (R-744) |
| A5 the real run | **done — nothing to re-test on the engine lines**; two EXACT tags were rebuilt upstream (R-743) | `--engines-only` is decision 52's start |
| A6 scheduling | **changed: a runbook, not a cron job** — `runbooks/monthly-floating-retest.md`; a standing monthly step in STATUS | it needs a fresh bench, 9202 on the drill, a drill force-reset, pushes to the live catalog |
| **B — image retention** | **done — controller v0.284.2** (0.284.0 and 0.284.1 never floored) | two faults found LIVE on 9202: the Remove button runs `RemoveStack` (only `DeleteStack` was wired); `docker image ls` without `-a` hides the untagged digest-pulled app images |
| B3 one-time sweep | **done** — 9202 26.6 → 5.7 GB (26 images), demo-hp 24.3 → 13.5 GB (24), the N100 6.15 → 6.07 GB (1); every app healthy | old controller images stay by design (R-745) |
| B4 red-proofs | **done at unit level** (shared image, undo's image, stopped app's compose, update in flight, unreadable keep set, both wirings, untagged images); **the live "update → failure → undo with no pull" was NOT run** | no failing edge was built tonight; the previous image is in the keep set (red-proofed) |
| **C — the install hold** | **done — controller v0.284.x** — the setup gate's door in front of an `after_install` app until the login is replaced | the brief expected 404 until the change; it is the gate's 401 (the household still passes) |
| C3 live on 9202 | **done** — calibre-web 0 of 192 stranger tries with the default login got in; mealie 0 of 97 | the positive control with the generated password was NOT obtained (a backup stopped calibre-web at that moment; mealie locked itself — R-747) |
| **D1 wger's key** | **done** — catalog `45d8482`; bench: right password 200 with a token that reads the API; wrong password **400** (not 401) | not proven on a box |
| **D2 wanderer** | **changed: the bench runs it; no step** — web/sign-up/login 200 with a bench-only override; meilisearch v1.54 needs `MEILI_UPGRADE_DB=true` (then the indexes survive) | a list could not be created (PocketBase refused) — no fixture, so no step (R-739) |
| **E — release, floor, golden** | **done** — floor **0.284.2** (MinAgent 0.131.0 declared), both demo boxes on 0.284.2 within a minute; golden **0.284.2** baked, round-trip identical, vouched (agent 0.138.0, min_agent 0.131.0); the gate prints **OK** (not WAIVED) | no agent release: MinAgent unchanged |

## Claims in the brief that turned out wrong (or right)

1. **"The box needs no change to press a same-tag re-test"** — **right** (unit walk; the e2e leg on 9202).
2. **"No tested digest differs from the registry today"** — right for the database/redis lines; **wrong for two exact
   tags**: `nextcloud:34.0.4-apache`, linuxserver `sonarr:4.0.20` (R-743).
3. **"`--rmi local` never removes a registry-tagged image"** — right, and **the Remove button does not even use it**:
   `RemoveStack` runs `down --volumes`; only the older `DeleteStack` had `--rmi local`.
4. **"Images are shared between apps"** — right: `postgres:18-alpine` and `redis:7-alpine` served docmost and paperless;
   a remove of docmost kept both.
5. **"The route is published before `after_install` runs"** — right (measured earlier; now held).
6. **"Wanderer's web server needs the public DB name"** — right: `PUBLIC_POCKETBASE_URL` is the only address both images read.
7. Also: the brief expected 404 during the hold (it is the gate's 401) and 401 for wger's wrong password (it is 400);
   "hub — read only" and Part E's floor + vouch conflict — the two form saves were done, nothing else on the hub.

## Rows

**377 → 383** (every `| **R-<n>[letter]** |` row; the register-shape gate skipped the 3 lettered ids until tonight — R-748). Opened R-743 (exact tags rebuilt), R-744 (outline fixture at 1.10.1), R-745 (old controller images),
R-746 (`image_digest.resolve` ignores a digest), R-747 (mealie lockout by strangers), R-748 (the gate's lettered-id blind spot — fixed). Closed R-736, R-737, R-740, R-741, R-748.
Narrowed R-739, R-698, R-446.

## Teardown

- **Machine:** 9202 back on the live catalog (`repo_url` read back), its drill `update:` override removed, the same
  containers as at the start, controller 0.284.2; the apps this run installed removed through the product. Bench LXC 9401
  destroyed with its template. Drill VM: CT 9100 destroyed, secrets shredded, qemu exited, `drill.qcow2` reverted to
  `virgin`. The drill catalog reset to live (`6a3ead9`), image lines identical.
- **Host:** demo-hp `pct list` = 9201, 9202 (as at the start); the N100 untouched except the floor's controller update.
- **Hub:** two form saves only — the floor (0.284.2, MinAgent 0.131.0) and the vouch (golden 0.284.2).