felhom.eu/REPORT-rulings-2026-10-01.md

REPORT — the operator's three rulings of 2026-10-01 built (day session)

Evidence: documentation/audits/rulings-2026-10-01/ (A–D, T, tools) · documentation/audits/retest-2026-10/ (the monthly run) · golden: documentation/tests/golden-0.285.0-2026-10-01/. Architecture read: 09 §3 decisions 30, 45, 52, 53 and §6.5; 03-host-agent.md (the controller swap) with agent internal/localapi/controllerswap.go; 07 (R-698); runbooks/monthly-floating-retest.md; audits/night-rulings-2026-09-30/. Baselines (live Gitea ~07:10 CEST): controller a70c398 (0.284.2), agent d766666 (0.138.0), felhom.eu 3159892, catalog efd492d. Register 383 rows by register_shape_gate's method; highest id R-748; last decision 53.

The Part table

Part	done / not done / changed	why
Rulings 54–56	done — recorded first in 09 §3 and CONTEXT (2076bf9)	before any work
A — the full re-test	done — nextcloud 3b59dfb and sonarr 1a37032 re-tested on both venues and written, pushed through the pre-push gates	first start refused in one minute: the script checked the bench for its own files before copying them (R-749, fixed 9e53205)
A1 runbook	done — every app by default, --engines-only the switch, the standing brief, cost	—
A4 linuxserver cost	done — see below	—
A5 STATUS standing line	done — "last run 2026-10-01, next due ~2026-11-01"	—
B — two controller versions	done — controller v0.285.0, floor 0.285.0 (MinAgent 0.131.0 declared)	measured first: the agent rolls back to the RUNNING image
B3 live	done on 9202 (version-order fallback) and both demo boxes (the swap record)	9202's self-update is off (no hub), so the record path was shown on the demo boxes
— R-751	added — a nil-stack panic in the update clean-up, found by the full suite, fixed in the same release	a panic in a goroutine ends the controller
C — mealie	done — decided by CC unattended (decision 57): SECURITY_USER_LOCKOUT_TIME=1, catalog a4597cd; 9202 proof 120 min	no fix stops an hourly renewal without changing the login name (option d, left open)
C other apps	done (read, not measured) — four more lockable: R-752	source reading by a sub-agent at each pinned tag
D1 — R-746	done 804884a, red-proofed (unit + live registry)	—
D2 — R-744	done 9fc7052, proven on 9202 at 1.10.1	outline has no newer release, so no step
E — release, floor, golden	done — demo boxes on 0.285.0 within ~6 s; golden 0.285.0 baked, round-trip identical, vouched; the gate prints OK	—

Claims in the brief that turned out wrong (or right)

1. "previousImage … handed to the agent's SwapController" — wrong. SwapController(ctx, target) carries the target only; previousImage goes into update-state.json. The agent reads /etc/felhom-controller-image when the swap begins and rolls back to THAT — the running image. On all three boxes it equals <image>:<current version>, so the practical outcome matches; the mechanism does not.
2. "The sweep skips every controller image today" — right, twice over: the sweep's repositories never include the controller's, and it skips any repo containing felhom-controller.
3. "nextcloud and sonarr still differ" — right, and only those two (bookstack, radarr, code-server did not differ today).
4. "mealie's lock is per account" — right (login_attemps / locked_at on the user). Also: the lock outlives its hours until mealie's HOURLY job resets the counter, so 1 means 1–2 h (measured 120 min).
5. "The golden's image is not needed after first boot" — right after the first swap; until then it IS the running image (kept as such). A whole-guest restore brings its own Docker store (mp0 backup=1).
6. "Is an old controller tag still in the registry?" — no, below 0.213.0 (2026-08-12): 0.201.0 answers 404. Nobody recorded what removed them (R-750). This session deleted no registry tag.
7. "Live on 9202 … after the release" for the record path — 9202 has self-update off; the record path ran on the demo boxes.

Part A — the run

app	result	bench	box
nextcloud 34.0.4-apache	DONE — written 3b59dfb	05:19–05:32 UTC (proven, peak 23.7 %)	~5 min: old digest installed, seeded, the guarded Update ran the re-test step, new digest running, read back, badge "Naprakész"
sonarr 4.0.20 (linuxserver)	DONE — written 1a37032	05:38–05:50 (proven, peak 13.9 %)	~3 min, same steps

Monthly cost. ~17 min per app (bench ~13 incl. the 10-minute watch, box ~4) plus ~15 min to set up and tear down. The four linuxserver apps with ladders (bookstack, radarr, sonarr, code-server) are rebuilt weekly, but the monthly run tests only the day's digest — at most 4 re-tests a month from them (~70 min of bench, ~16 min of 9202), not 16. Acceptable.

Part B — images before → after

box	controller images	Docker images (system df)	/var/lib/docker used
9202	5 → 2	3.17 → 3.10 GB (layers are shared)	3.5 → 3.4 GB
demo-hp 9201	84 → 2 (82 deleted)	15.2 → 11.65 GB	18 → 15 GB
N100 9201	76 → 2 (74 deleted)	6.07 → 1.11 GB	6.0 → 1.2 GB

Each kept 0.285.0 (running) and 0.284.2 (previous). Red-proofs (B/B1-red-proofs.txt): previous dropped → 0.284.2 deleted; record ignored → 0.283.1 deleted; no swap check → deleted while swapping; no in-use check → a used image deleted; no success check → a failed swap's image named previous; no nil-stack check → panic. The first in-use red attempt removed a line and did not build; redone with the condition disabled (recorded).

Part C — mealie

Settings (v3.28.0 source): SECURITY_MAX_LOGIN_ATTEMPTS 5, SECURITY_USER_LOCKOUT_TIME 24 (hours), per account, lifted by an hourly job; POST /api/admin/users/unlock exists but the only admin is the locked account. Fix and 9202 proof: see decision 57 (C/C1-mealie-lockout-1h.txt: right password 200 → 5 wrong 401 → 423 → right password 423 for 120 min → 200; a wrong one 401 after). Other apps (R-752): calibre-web-automated (per username, 3/min and 40/day), wger (per IP = traefik's, 30 min, everyone), Grafana (per account, 5 min), BookStack (e-mail|IP, 60 s); gokapi and claper cannot.

Rows

383 → 387. Opened R-749 (re-test start), R-750 (old registry tags gone), R-751 (update clean-up crash), R-752 (four lockable apps). Closed R-743, R-744, R-745, R-746, R-749, R-751. Narrowed R-747.

Teardown

• Machine: 9202 back on the live catalog (repo_url read back), the same six containers as at the start, controller 0.285.0 (the release); the apps this session installed (nextcloud, sonarr, outline, mealie) removed through the product. Bench 9401 destroyed with its template. Drill VM: CT 9100 destroyed, token/runner/log shredded, qemu exited, reverted to virgin. Drill catalog reset to live (a4597cd), image lines identical.
• Host: demo-hp pct list = 9201, 9202 (as at the start); the N100 untouched except the floor's controller update.
• Hub: two form saves — the floor (0.285.0, MinAgent 0.131.0) and the vouch (golden 0.285.0); one floor attempt without the credential answered 302 /login and stored nothing.