# REPORT — security night 2026-11-02/03 (unattended): the watch, the new notices, six small fixes, unproven claims

Read first: `08-alarm-ladder.md` §11, `09-update-architecture.md` decision 255, `07-backup-architecture.md`, `03-host-agent.md`, `05-hub-architecture.md`, `00-capability-map.md`.

## Decisions taken by CC (operator may reverse)

- **Uptime Kuma's step crosses 2.5.8**, which the 10-27 batch refused: 2.5.8 turns a TCP-port monitor with TLS into a plain TCP one (upstream: „never worked as expected"). The fix (admin-only code execution; unauthenticated RSS cache poisoning) outweighs it, and no box runs Kuma.
- **R-1339's written fix was not built:** a sub-folder „not skipped" would write a `userdata/` inside the app's folder. The behaviour stays; only the false line goes.
- **A brief's expectation that turned out false, said here:** the watch was not blind to Docker Hub, and R-1334's fix had held. Traefik's line was no false alarm.

## Six lines

1. **The watch was not blind; it could not be heard.** A streak is per source, so seven pins that can never be read (six private images, `minio/minio`) held `registry:docker.io` and `runtime` open for a week: no real outage could have mailed. 0 Docker Hub 429 on five nights. Fixed: those seven are a stated GAP, timeouts are retried. Proven: run 2550 (runner), dry 2555 (runner-2), night 2565 (runner-2): `FAILED-SOURCES 0`, memory `failures {}`.
2. **The notices:** Vaultwarden, Uptime Kuma, n8n, PrivateBin and Gitea are real; **Traefik is real too, high, on every box** (GHSA-xv5x, hidden behind a word-only line). Live: gitea 28.3.0, uptime-kuma 2.5.9, grafana 13.2.5, actualbudget 26.11.0, n8n 2.46.4, vaultwarden 1.37.5-alpine. PrivateBin has no 2.1.1 image.
3. **The six waiters:** ActualBudget fixed (live). Paperless and SparkyFitness have a fixed release on a new main version (proven on the drill). cal.com, Calibre-Web, RomM: none.
4. **The small fixes:** 7 done with red first. Live-proven 3 (R-1347, R-1348, R-1339); R-1351 test only (the race fired on neither image in six boots); R-1323, R-1352, R-1302 test only, by the brief.
5. **RomM's night leg:** done, 2026-10-28 03:22, 88 s (closed; demo-hp's library is small).
6. **Claims:** 8 walked (31 → 23 not walked); 2 walked and failed in part: the hub down loses events (R-1361), the LAN name has gaps (R-1364).

## The morning release list, and the one decision

STATUS has both. First the golden (R-468). Controller v0.350.0: Traefik v3.7.17 first, R-1347, R-1348, R-1339, R-1351, R-1323. Agent v0.172.0 + vouch: R-1302. Hub v0.179.0: R-1352. Catalog, drill only: Paperless 3.4.1 and n8n 3.0.1 (bench, box, undo), SparkyFitness v1.11.0 (the same, behind the licence R-784), Mealie v3.30.0 and Termix 26.11.0 (bench, box). Decision D66 (R-1365): should a source that stays down mail again every 7 days? Pick: yes.

## Commits and CI (by head_sha, the jobs endpoint)

| Repo | Commit | CI job | What |
|---|---|---|---|
| felhom.eu | `4afa8c3c` | 2548 green | the watch: stated GAP, retries, R-1310's rules |
| felhom.eu | `2f7e836f` | 2553 green | hub R-1352, commit only |
| felhom.eu | `d02c0c2c`, `17820abb` | 2557, 2561 green | evidence |
| controller | `c4b6844`, `3764445`, `13e34d4` | 2551, 2560, 2562 green | Traefik pin, five fixes, commit only |
| agent | `50eeccc`, `ecbb0cc` | 2552, 2563 green | R-1302, commit only |
| catalog | **`c760fca`, the one live push** | 2559 green | six `security_fix` steps; negative control first (`walks/_negative-control/`: `failed`) |

## Rows

Before 228, after 235. **Closed (5):** R-1303, R-1310, R-1324, R-1334, R-1336. **Opened (12):** R-1354 Traefik, R-1355 DooPlex's notices, R-1356 n8n 3, R-1357 PrivateBin, R-1358 cloudflared, R-1359 Mealie + Termix, R-1360 Meilisearch, R-1361 events lost, R-1362 Backups page, R-1363 raw JSON in a mail, R-1364 LAN DNS, R-1365 D66.

## Observations

- **FILED: R-1361, R-1362, R-1363, R-1364** (the walks); **R-1354–R-1360** (the triage).
- **Noted in R-468: the golden gate went red at midnight:** the Sunday bake of 11-01 was missed (in no brief), golden 0.344.0 is 8 days old. Baking is not this night's work; no waiver written. A code push to felhom.eu is refused until a bake and the vouch. First on the list.
- **NOT-A-FINDING: the watch's 03:20 run** is `gates`, not the watch.
- **NOT-A-FINDING: 9202's „Tárhely (…)" sources with no mount, and its refused removal of a per-app `HDD_PATH`:** legacy of its own old installs (R-839 refuses that shape); no other box holds one.
- **NOT-A-FINDING: `CT990000 stopped create` on Tester 1:** the restore test at that moment; it passed at 22:45.
- **NOT-A-FINDING: DooPlex restarted 2026-11-01 16:11 CET:** two boots, read only; its only effect here is that R-1353's log covers 31 h.
- **NOT-A-FINDING: the watch's „0 new, 63 reminders" mail of 11-03:** the 7-day reminder, as designed.
- **Fixed without a row (the size rule):** the Vaultwarden fixture (1.37's register route), the n8n fixture (`/healthz` before the routes), the box-admin guard (the drill mirror), the Actual fixture's log, the undo tool (`tools/undo_proof3.py`: a probe with a `container:` line, services read by label).
- **A mistake, said plainly:** one dead session token of a throwaway Actual reached the evidence in `d02c0c2c`; redacted in `03a71b68`; the app was already removed; it stays in git history. Dead, and the fixture no longer logs it.

## Teardown

Machine: 9202 back on its image, its yaml byte-identical, on the live catalog; bench 9401 stopped; Tester 1's routes and firewall as found, address empty. Host: the drill reset to live; local test images removed; nothing else provisioned. Hub: untouched. **Left, on purpose:** a `restore_mixed` hold for `radicale` in 9202's settings (the fence forbids CC to clear one; the command is in `part3/README.md`); `email_cleared: true` in Tester 1's settings; 9202's Paperless is a fresh install, the throwaway of 09-22 went with the walks. No VM was installed, so no hub host to delete.

Poster: no fact on it changed. Instruction files: none edited. Evidence: `documentation/audits/security-2026-11-02/`.