# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## CAMPAIGN-6B — unattended close-out of the C6 remainder — 2026-07-14

**controller 0.129.0 / agent 0.88.0 / hub 0.54.0 · demo + drill · findings-only, unattended**

Continuation of CAMPAIGN-6A. Drove the `.fab` full-circle (upload/download + real Cloudflare edge),
the server-observable browser/DOM planes, backup-tier + NAS integrity, and regression spot-checks.
Full audit: `documentation/audits/CAMPAIGN-6B-2026-07-14.md`. Continuation: `CAMPAIGN-6C-2026-07-14-PROMPT.md`.

### Headline finding — C6B-F1 (CRITICAL)
**`.fab` export silently produces hollow, data-free bundles for the standard `${USERDATA_PATH}`
`needs_hdd` app convention** — 12 of 13 media catalog apps (jellyfin, plex, emby, immich, sonarr,
radarr, navidrome, paperless-ngx, audiobookshelf, calibre-web, komga, romm). Live: sonarr with
**4.17 GB / 7 files** exported to a **2308-byte, config-only** bundle, reported `done` with no error,
past the v0.125.0 anti-hollow guard. Two compounding causes in the `needs_hdd` branch: `executeExport`
is either/or (`needs_hdd` apps never run `exportVolumeData`, dropping named volumes incl. the app DB),
and `ParseComposeHDDMounts` substitutes only `${HDD_PATH}`, never `${USERDATA_PATH}` → 0 mounts → all
userdata skipped. The guard only checks manifest-*claimed* tars, so 0-claimed passes. `.fab` is the
customer portability/backup-download path → fresh/cross-box restore = silent total data loss. Fix
direction in the audit; **priority for project Claude to spec.**

### What passed
- **`.fab` transport is byte-clean end-to-end** — LAN + real Cloudflare edge, upload (64 MiB chunked)
  and download, every sha256 == reference.
- **413 edge-cap re-proven** (120 MiB → CF 413 before origin; 80 MiB clears to origin).
- **Upload state machine 8/8** — wrong-ext 400, collision `(N)`, single-flight 409, strict-offset 409,
  abort cleanup, oversize (both Hungarian numbers), restart-GC, idle-15min expiry.
- **F7 atomicity** (`.tar.tmp`→rename) code-confirmed; **native `alert()`/`confirm()` absent** on all
  surfaces; CSRF stale → 403, session-expiry → 401-JSON/redirect; **F4** uid-range friendly 400;
  agent-restart per-share re-arm verdicts logged.

### Split to CAMPAIGN-6C
Supervised browser planes (escrow wizard click-through, hub 8-tab UX); deep backup tiers (live F7
6 s-cut, restic self-heal, offsite restore-to-verify, tier-2 F6, per-app toggles, snapshot coherence);
dead-app alert + email cooldown; the **C6B-F1 fix-verify** full-circle byte-compare.

### Notes
- No code changed. A temporary break-glass credential was used on the demo controller to drive the
  authed tests, then **fully reverted at cleanup** (original customer-claimed hash restored) — the box
  is back to its pre-6B credential; **Viktor rotates** that. No secret/R/blob committed.