# REPORT — the four evening items before the second night (2026-09-13)

*Overwritten each session. The night's own report (adventurelog rotation, v0.240.0) is preserved as
`audits/nightly-2026-09-13-adventurelog/` and the register; the controller report is
`felhom-controller/REPORT.md`, the catalog's `app-catalog-felhom.eu/REPORT.md`.*

## 1. The rules file

`.claude/rules/unprompted-work.md` copied byte-identical into `felhom-controller`, `felhom.eu` and
`app-catalog-felhom.eu` (documents-only pushes). `instructions_gate.py` refused the first push: a rule
file needs `paths:` or `unconditional: true`; all four copies (root included) now start with the
three-line `unconditional: true` frontmatter — sha256 `d1aa3af83ae3b220…` everywhere.

## 2. R-481 — the scratch guest (ruled; NOT built, and why)

The ruling ("a second enrolled LXC … enrolled as a scratch customer") collides with the model: the hub
keys a host to one customer (`hosts.host_id` PK) and the box runs one agent with one host identity;
re-running the installer with another customer-id would rewrite demo-hp's enrolment. Options and a
recommendation are in the row and STATUS; 9201's shape and the disk placement (`pct move-volume`
onto a `dir` storage at `/mnt/hdd_1`) are recorded for whichever is chosen.

## 3. R-483 — photos (re-ranked P2, catalog)

Diffed against `homelab-manifests` `adventurelog-system/adventurelog.yaml`: the k3s ingress sends
`/media`, `/static`, `/admin`, `/accounts` to the backend **service port 80**; the catalog sent
everything to the frontend. Two catalog cuts (`3172258`, `ed62cfd`): a backend traefik router for the
four prefixes, then port 80 instead of 8000 — the backend image runs nginx in front of gunicorn and
Django serves a photo by `X-Accel-Redirect`, so port 8000 returned 200 with an empty body. Applied to
the operator's own instance through the guarded Update; proven without a browser
(`audits/nightly-2026-09-13-adventurelog/11-R483-repro.txt`): `GET /media/images/<id>.webp` with a
session → 200 `image/webp`, RIFF/WEBP magic; anonymous 403 (the app's rule). **Confirmed by the operator in a browser at 21:49 — closed.** The frontend's 500 on scripted multipart uploads is upstream and
recorded in the row; browser uploads work.

## 4. R-479 — tier order for bind-data apps (ruled; controller v0.241.0)

Ruling 9 in `09-update-architecture.md` §3. Built, tested, red-proofed; delivered by the floor and
live-checked on a nextcloud throwaway — see `felhom-controller/REPORT.md` and
`audits/v0241-2026-09-13/`.

## Observations

0. **A removed app keeps its update hold; a reinstall would start held.** FILED: R-491

1. **The controller's evening release rides the same session as the night's — two releases in one calendar day, one per session.** NOT-A-FINDING: the rule is per session; both are recorded with their MinAgent lines.
2. **`homelab-manifests` is not in the workspace; its manifests were read from Gitea's API.** NOT-A-FINDING: the workspace CLAUDE.md says non-felhom repos are unrelated; a read-only fetch was enough.