# Dashboard pictures for the website — evidence (2026-10-08)

## The scene, and why it moved

1. **9202 updated to the fleet's controller** (operator's word, 2026-10-08): `/etc/felhom-controller-image`
   `…:0.301.0` → `…:0.303.0` (old line kept as `/etc/felhom-controller-image.bak-0.301.0` in the guest), bootstrap
   restarted; `felhom-controller … 0.303.0 Up 13 seconds (healthy)`.
2. **On 9202:** Vaultwarden, Jellyfin, Nextcloud and Immich installed through the product (Immich's first pull was
   refused by ghcr.io „toomanyrequests"; the second try deployed). One whole-box backup press and one Tier-2 run:
   `db_dump success, count 3`; „Tier 2 run complete: 6 app(s)".
3. **The 9202 pictures were not used.** Every page carried a banner „+ 5 további figyelmeztetés" — nine
   `disk-not-separate` warnings (9202's „second drive" is a folder on the host's NVMe, plus earlier sessions' leftover
   app folders) and the hub-off warning. True for a scratch guest, not a household's normal state. The banner itself
   showed none of the five warnings it counted on those pages: **R-906**.
4. **Pictures taken on demo-hp's household guest 9201** (operator: the physical boxes are test boxes too): controller
   0.303.0, 10 standing apps, hub connected, **no alerts** (`/api/debug/dump` → `alerts: []`), last night's app backup
   `success` at 04:16. Read only; the household language was switched to English for the English pictures and back to
   Hungarian right after (both POSTs 302; read back `lang="hu"`). Headless Chrome ran on 9202, reaching 9201's traefik
   at `192.168.0.155`; nothing ran on 9201.

## The pictures (`website/assets/`, 1440 × 900, WebP q82)

| File | Bytes |
|---|---|
| dashboard-start-hu.webp / -en | 34,024 / 31,948 |
| dashboard-apps-hu.webp / -en | 59,018 / 54,156 |
| dashboard-app-hu.webp / -en (Paperless-ngx) | 83,124 / 78,992 |
| dashboard-backups-hu.webp / -en (Backup → Apps) | 52,638 / 45,292 |

Taken but not published: the backups overview, the System page, the phone view (`captions-claims.md` says why).
The full-size PNGs stay out of the repository.

## Privacy

`privacy-scan.txt` — every published picture's page text: 0 e-mails, 0 IPv4 addresses, 0 serials, no domain except the
test domain `enkisfelhom.hu` and `felhom.eu`; the one long hex value is the hidden CSRF field (not visible). Positive
control: an app name known to be on each page, found 8 of 8. By eye: the pictures show the test domain, app names and
backup sizes/times; no person's name (the household is „Demo HP", shown only on the unpublished System page).

## Clean-up (three layers)

- **9202:** Vaultwarden, Jellyfin, Nextcloud, Immich removed through the product (stop + remove with drive data and
  backups; volumes gone, stack folders back to their template files). Paperless-ngx (running) and PrivateBin
  (stopped) — there before this task — left as found; the whole-box backup restarted Paperless and it came back healthy.
  `/root/dash` removed; the session cookie file shredded on both sides. The `userdata/{immich,jellyfin,nextcloud}`
  folders on the scratch drive hold earlier sessions' content (`kept/`, `backups/`) and were left. **9202 stays on
  0.303.0** (operator-approved).
- **9201:** nothing changed except the language round trip (ends Hungarian, as found).
- **demo-hp host:** only `pct exec 9202/9201 -- …` and `pct list`. **Hub:** nothing touched.

## Decoy

`decoy.txt` — gate 19, mutation and failure line.