# REPORT — CAMPAIGN 7 (felhom.eu side: docs only)

> Written as `REPORT-campaign7.md`, **not** the shared `REPORT.md`, per the convention this run
> added to `CLAUDE.md`: `REPORT.md` is overwritten, so a second concurrent session in this repo
> would clobber it. This session's implementation work was in `app-catalog-felhom.eu`; here it only
> touched documentation.

**Run:** 2026-07-18 evening → 2026-07-19 morning. **Class:** campaign (record-and-rank + a defined
allowed-fix set). **Implementation repo:** `app-catalog-felhom.eu` (see its `REPORT.md`).

## What changed in this repo

| file | change |
|---|---|
| `documentation/audits/CAMPAIGN-7-catalog-sweep-2026-07-19.md` | **new** — method, uninstall-semantics map, trio detail, full 53-app matrix, ranked findings, coverage |
| `documentation/backlog/ROADMAP.md` | **+3 items** — R-40 (multi-hop major upgrade path), R-41 (no standing catalog deployability check), R-42 (sidecar-major ruling) |
| `CLAUDE.md` | REPORT.md parallel-session rule: the second session writes `REPORT-<topic>.md` |

No hub/agent/scripts/website code was touched (campaign scope: catalog + docs).

## Headline for this repo's readers

1. **Uninstall semantics map row PARTIAL → PROVEN** (campaign doc §2), with live evidence from all
   three trio apps: remove requires stop first; named docker volumes are **always destroyed**
   (including the app's database); HDD bind-mount data and `backups/primary/<app>` survive unless
   explicitly ticked; images are kept; `app.yaml` goes, the template stays; the per-app **offsite
   toggle survives** the uninstall while tier-2 config is cleared. The confirmation modal does warn
   about the volumes, so there is **no consent gap**.
2. **A lying healthcheck takes an app OFF-LINE, it does not merely mislead.** Traefik will not route
   to an `unhealthy` container, so a probe that cannot execute → permanent unhealthy → **404 to the
   customer while the app serves 200 on its own port**. 7 of 53 apps were in that state.
3. **The pre-flight gate's own signal is missing:** the 0.145.0 → 0.146.0 floor-lift emitted no
   `controller_updated` event, though the identical bootstrap path emitted one for 0.143.0 → 0.145.0
   two hours earlier (§0, finding F1). The box did converge — golden, floor and runtime all agreed —
   but the event trail under-reports version transitions.

## Open items owned outside this repo

- **plant-it / wanderer** — images do not resolve at all (neither the new tag nor the one the
  catalog already ships). Upstream research needed; recorded as findings, not deletions.
- **gokapi** — pinned back to v1.9.6; v2 needs the seeded `config.json` regenerated. Security-
  relevant, should not sit on a superseded line indefinitely.
- **glance** — never had a seeded `glance.yml`; proven pre-existing.