felhom.eu/REPORT-night-rulings-2026-09-30.md

REPORT — the operator's two rulings built (2026-09-30, late evening)

Evidence: documentation/audits/night-rulings-2026-09-30/ · golden: documentation/tests/golden-0.284.2-2026-09-30/. Architecture read: 09 §3 decisions 13, 14, 17, 30, 40, 45–47, §5.3, §6.4 parts 4–7, §6.5; 07 (R-698); 01 §5. Baselines (live Gitea 21:48): controller d48da6c (0.283.1), agent d766666 (0.138.0), felhom.eu 42bf40b, catalog d181165. Register 377 rows by the method "every table row that starts with an R-id, bold or not, unique ids" (the reviewer's regex and mine agree on 377 today).

The Part table

Part	done / not done / changed	why
Rulings 52, 53	done — recorded first (09 §3, 07, CONTEXT; decision 30 note) 1de0f7c	before any work
A — same-tag re-tests	done — catalog 6a3ead9: the entry shape, the gates (+8 decoys, seen red), upgrade-test.py --retest, the ONE command retest-floating.py	spike note A/A0-spike.md first: the move gate never looked at a re-test (it changes .felhom.yml only)
A4 end to end on 9202	done — docmost at an older redis:7-alpine digest, "run tonight's chain now", the leg's step pressed … step ended done after 95.0 s, new digest running, read back, badge current	the first attempt (outline) stopped at outline's fixture on both venues (R-744)
A5 the real run	done — nothing to re-test on the engine lines; two EXACT tags were rebuilt upstream (R-743)	--engines-only is decision 52's start
A6 scheduling	changed: a runbook, not a cron job — runbooks/monthly-floating-retest.md; a standing monthly step in STATUS	it needs a fresh bench, 9202 on the drill, a drill force-reset, pushes to the live catalog
B — image retention	done — controller v0.284.2 (0.284.0 and 0.284.1 never floored)	two faults found LIVE on 9202: the Remove button runs RemoveStack (only DeleteStack was wired); docker image ls without -a hides the untagged digest-pulled app images
B3 one-time sweep	done — 9202 26.6 → 5.7 GB (26 images), demo-hp 24.3 → 13.5 GB (24), the N100 6.15 → 6.07 GB (1); every app healthy	old controller images stay by design (R-745)
B4 red-proofs	done at unit level (shared image, undo's image, stopped app's compose, update in flight, unreadable keep set, both wirings, untagged images); the live "update → failure → undo with no pull" was NOT run	no failing edge was built tonight; the previous image is in the keep set (red-proofed)
C — the install hold	done — controller v0.284.x — the setup gate's door in front of an after_install app until the login is replaced	the brief expected 404 until the change; it is the gate's 401 (the household still passes)
C3 live on 9202	done — calibre-web 0 of 192 stranger tries with the default login got in; mealie 0 of 97	the positive control with the generated password was NOT obtained (a backup stopped calibre-web at that moment; mealie locked itself — R-747)
D1 wger's key	done — catalog 45d8482; bench: right password 200 with a token that reads the API; wrong password 400 (not 401)	not proven on a box
D2 wanderer	changed: the bench runs it; no step — web/sign-up/login 200 with a bench-only override; meilisearch v1.54 needs MEILI_UPGRADE_DB=true (then the indexes survive)	a list could not be created (PocketBase refused) — no fixture, so no step (R-739)
E — release, floor, golden	done — floor 0.284.2 (MinAgent 0.131.0 declared), both demo boxes on 0.284.2 within a minute; golden 0.284.2 baked, round-trip identical, vouched (agent 0.138.0, min_agent 0.131.0); the gate prints OK (not WAIVED)	no agent release: MinAgent unchanged

Claims in the brief that turned out wrong (or right)

1. "The box needs no change to press a same-tag re-test" — right (unit walk; the e2e leg on 9202).
2. "No tested digest differs from the registry today" — right for the database/redis lines; wrong for two exact tags: nextcloud:34.0.4-apache, linuxserver sonarr:4.0.20 (R-743).
3. "--rmi local never removes a registry-tagged image" — right, and the Remove button does not even use it: RemoveStack runs down --volumes; only the older DeleteStack had --rmi local.
4. "Images are shared between apps" — right: postgres:18-alpine and redis:7-alpine served docmost and paperless; a remove of docmost kept both.
5. "The route is published before after_install runs" — right (measured earlier; now held).
6. "Wanderer's web server needs the public DB name" — right: PUBLIC_POCKETBASE_URL is the only address both images read.
7. Also: the brief expected 404 during the hold (it is the gate's 401) and 401 for wger's wrong password (it is 400); "hub — read only" and Part E's floor + vouch conflict — the two form saves were done, nothing else on the hub.

Rows

377 → 383 (every | **R-<n>[letter]** | row; the register-shape gate skipped the 3 lettered ids until tonight — R-748). Opened R-743 (exact tags rebuilt), R-744 (outline fixture at 1.10.1), R-745 (old controller images), R-746 (image_digest.resolve ignores a digest), R-747 (mealie lockout by strangers), R-748 (the gate's lettered-id blind spot — fixed). Closed R-736, R-737, R-740, R-741, R-748. Narrowed R-739, R-698, R-446.

Teardown

• Machine: 9202 back on the live catalog (repo_url read back), its drill update: override removed, the same containers as at the start, controller 0.284.2; the apps this run installed removed through the product. Bench LXC 9401 destroyed with its template. Drill VM: CT 9100 destroyed, secrets shredded, qemu exited, drill.qcow2 reverted to virgin. The drill catalog reset to live (6a3ead9), image lines identical.
• Host: demo-hp pct list = 9201, 9202 (as at the start); the N100 untouched except the floor's controller update.
• Hub: two form saves only — the floor (0.284.2, MinAgent 0.131.0) and the vouch (golden 0.284.2).