felhom.eu/REPORT-evening-2026-10-18.md

REPORT — evening → night 2026-10-18

How I read the brief

• Part 5, R-1135: the brief says the mail should use the public Gitea URL — the register row says the same, and that is what was done (the CI helper first read the brief's wording the other way round and followed the row).
• R-1052 was already closed (2026-10-15); Part 1 proves R-1148 and re-proves R-1052's path with tonight's golden.
• Part 6, Immich: 9202's Immich lives on /mnt/sizing-bench, a hand-made bench folder outside /mnt/felhom-drives/, so the allow-list refuses its definition (see Observations); the restore half of the measurement ran on Nextcloud.
• The operator kept Tester4 (asked at 21:20): not deleted; its old host must go before its next install (R-1154).

In plain words

• The morning list: vouch golden 0.331.0; say yes or no to the agent release with three fixes; two decisions (one sign-in, local backup retention).
• A brand-new box from nothing works end to end with installer 1.34.0: emergency password saved in the hub first, then set, then the web login took it; the approved golden and agent; the box moved itself to the floor.
• OnlyOffice now really works from FileBrowser and from Nextcloud. Before tonight FileBrowser could not open a document and Nextcloud lost every save while saying „saved". Fixed in controller 0.331.0, now the floor for every box.
• One sign-in for the file manager can be built safely, but only with two safeguards — measured, design note written.
• Three agent fixes are written and tested, not released.
• CI: the failure mail's link opens from outside; the 5-minute CI timeout never worked (filed); a rerun hides the first try's log, and the check now looks for it.
• Redis for Immich and Nextcloud has no disk volume any more, after a test; the test found that removing an app left an old volume behind — fixed too.
• Golden 0.331.0 is baked (not vouched).
• The old-restic check: §9.

1. The morning list

1. Vouch golden 0.331.0 — sha256 3881de62b0986ccbe5e55580e3f1bb9765d65b8d898f67c6339bac105244f84f (registry round trip = the bake), agent 0.159.2 unchanged, Min agent 0.158.1.
2. Agent release (R-978, R-973, R-1093) — may I? If yes: release, prove on demo-hp, ask for the vouch.
3. Decide D16 (R-1100: build one sign-in with the two safeguards?) and D17 (R-1149: local whole-box backups „last 3" or „one per day, 3 days"?). STATUS has both.
4. Before Tester4's next install: delete its old host Tester4-31fa0e (Hosts page).

2. Fresh install from nothing (R-1148, R-1052) — audits/newbox-2026-10-18/

UTC	Step	Result
17:42:21	Tester4 created by the operator	bind mail sent
17:43:15	VM 9302 newbox-r1148 on demo-hp, ISO 1.29.0 (sha = published)	8 GB / 4 cores / 120 GB on /mnt/hdd_1 root
17:50:19	Install pressed (graphical, Hungarian keyboard kept)	installed, rebooted, pairing code on the console
18:02:58	bind: mailed link + pairing code + owner phrase (operator's 0600 file, shredded)	„Sikeres összekötés"
18:03:43	step 4b: vault → chpasswd → PVE login	[OK] … vaulted, set, and the PVE login takes it; hub set_at same second
18:03:44	step 5: the hub manifest	agent 0.159.2, golden 0.329.0 — the vouched pair, both sha-verified
18:05:37 → 18:05:51	first controller reports	0.329.0, then 0.330.0 (initiated_by: auto-floor at 18:05:38) — 2 min 47 s after the bind
18:17:14	CC's PVE login from DooPlex	vaulted value 200, installer value 401
18:18:32 → 18:20:05	claim (setup code mail), BentoPDF	claimed; BentoPDF healthy
18:24:15	household „turn off"	hub deliberate_off_at set; VM stopped
—	teardown	name read twice, VM 9302 destroyed, disk gone; other VMs untouched; Tester4 kept (operator)

3. OnlyOffice (R-1018) — audits/onlyoffice-2026-10-18/

On 0.330.0: FileBrowser → the editor loaded, the document never did (OnlyOffice fetched https://files.<domain> → 403); Nextcloud → edit and „All changes saved", but the file kept the old text (http://onlyoffice:80cache/…). Switching the link on/off left files. 502 for 4 min 8 s / 3 min 38 s. Fixed (controller 0.331.0): FileBrowser server.internalUrl, Nextcloud's slash, the gate after a FileBrowser restart. On rc.1: both open, edit, save, read back („… RC1-FB-OK", „… RC1-NC-OK"); the stop revokes both (no editor; Nextcloud 404); the stop's outage one 2-s sample.

4. One sign-in spike (R-1100 → READY) — audits/proxyauth-spike-2026-10-18/DESIGN-NOTE.md

Traefik forwardAuth strips a client's header (any case, twice) and its own value wins — measured. But an app container reaching FileBrowser directly logs in with a forged header (200), and the dashboard cookie never reaches files.. Verdict: build only with a files-only ticket cookie and a per-box secret header name. Everything on 9202 removed (users, routes, stand-in container, config).

5. Agent fixes (committed, NOT released) — felhom-agent REPORT.md

R-1093 f7b7308 + 0963bae (and a fail-open hole closed after a background review), R-978 8561dc8, R-973 f17e197; tests and red-proofs for each; CI job 2062 success. R-1093 live: a loop disk on demo-hp showed the probe's condition holds.

6. CI (R-1135, R-1136, R-1137 closed)

Link public and by run id (forced mail 18:46:01Z, job 2067, one mail). The runner's real limit is 3 h; the job-level 5-minute timeout is not enforced (R-265 corrected; R-1152 for the step-level one). A rerun replaces the job's attempt; the pull-check recipe in CLAUDE.md now reads actions/tasks (instruction-file edit by the CI helper: felhom.eu CLAUDE.md CI recipe, item 3 added — a proven fact, stricter; b9b56c47).

7. Redis volumes (R-1117 closed) — audits/redis-volumes-2026-10-18/

(a) Both apps healthy on the new shape; Immich's metadata job ran (0 → 11, 0 failed); Nextcloud cron.php rc 0, WebDAV 200. (b) The dump skips the dropped volume (the old tar gone from the unit); a second-drive restore from a copy made WITH the volume: 3/3 volumes, 1/1 database, healthy — it brings back that copy's compose (by design). (c) The old volume stays attached under the tmpfs; a removal left it behind — fixed (controller 0.331.0, red-proofed). Templates changed (catalog 30eea97); Nextcloud on 9202 took it through the sync + restart (tmpfs, save "").

8. Controller release and golden — audits/evening-2026-10-18/P7/, tests/golden-0.331.0-2026-10-18/

0.331.0 (digest 1b11d25a…): per-box floors 20:44:00 → all three on 0.331.0 within 20 s; box walk green (0 refusals, 0 unhealthy, FileBrowser re-published in 5–6 s, public pages 200 after one 20-s blip each on two names, https-only 28 OK); global floor 0.331.0 / 0.158.1 at 20:48:56 UTC, read back with the WAL; per-box floors cleared. Golden 0.331.0 baked after it, round trip = bake sha, token checks 0 with a working control, teardown clean. No controller push after the bake.

9. The old-restic check (Part 8)

PENDING — filled in when demo-hp's clean-up window has run (after its 04:15 CEST night run). A watcher runs the check by itself; at 20:57 UTC both restics listed 310 snapshots (audits/evening-2026-10-18/P8-precheck.txt).

10. Versions, commits, fixtures, rows

• Controller 0.331.0 — 772ef36, 8ae9178 (+ 615940d CI); rc.1 on 9202 only. Agent main f7b7308 8561dc8 0963bae f17e197 79ba884 1693da4 — unreleased. Catalog c97eb1c, 30eea97. felhom.eu 1fe9f848, b9b56c47, this commit. Golden 0.331.0 baked. Hub unchanged (0.158.0).
• Fixtures: none changed — no page changed.
• Register: 168 before, 168 after; closed 6 (R-1148, R-1018, R-1117, R-1135, R-1136, R-1137), opened 6 (R-1149, R-1150, R-1151, R-1152, R-1153, R-1154). Updated: R-1100 (READY), R-978, R-973, R-1093 (fixed in agent main), R-265 (corrected).

Observations

1. Installer password, golden and agent all proven in one fresh install. — closes R-1148 (not a finding).
2. FileBrowser's office preview answered 500 with the link on. FILED: R-1153.
3. A reinstall reuses an old host and skips two re-issues; now recurring with the kept Tester4. FILED: R-1154.
4. The R-973 cap leaves the local keep-last 3 floodable within a day. FILED: R-1149.
5. The cap's refusal reaches the operator with a misleading event text. FILED: R-1150.
6. R-978's typed-back confirmation is browser-only. FILED: R-1151.
7. The CI job timeout is inert. FILED: R-1152.
8. 9202's Immich sits on /mnt/sizing-bench, outside /mnt/felhom-drives/, so the allow-list refuses its definition every 15 minutes since 0.328.0 and a restore of it is refused. NOT-A-FINDING: the check works as designed; the folder is a hand-made bench artifact (R-994), not a shape a real box has.
9. A restore brings back the backup's own compose (the old Redis volume with it). NOT-A-FINDING: by design (R-47: the unit's compose becomes the live one); the older shape works.
10. My commit 7f7081d1 (day session) carries a „Co-Authored-By" trailer, against both briefs' rule 10. NOT-A-FINDING: my slip; it is pushed and cannot be rewritten without a force-push (forbidden); no later commit has one.
11. I started the catalog's FULL gate run on DooPlex, whose third gate starts containers. NOT-A-FINDING: stopped at gate 2 (a network check), no container was made (checked), the fast run used instead.
12. One OnlyOffice „Connection is lost" on the first rc.1 attempt, after two blind clicks. NOT-A-FINDING: not reproduced; the next attempt saved; no container restarted in between.
13. Two public names answered 000 once in the box walk. NOT-A-FINDING: 18 of 18 retries answered 200 in < 0.2 s.
14. The R-1100 row named the config key proxyAuth; it is auth.methods.proxy. NOT-A-FINDING: corrected in the row.

Teardown — three layers

• Machines: VM 9302 destroyed (its disk gone). 9202: OnlyOffice and Nextcloud removed through the product (their volumes, data and backup copies), the test documents deleted, the spike's route file, container, FileBrowser users and proxy setting removed, helper files and the Immich scratch password shredded; Immich keeps the new Redis shape by hand (= the template); 9202 on controller 0.331.0. nextcloud_nextcloud_redis_data (the orphan the pre-fix removal left) removed by name afterwards; no Nextcloud volume remains. demo-hp host: the loop-disk file removed. Drill VM: CT 9100 purged, VM off, disk virgin.
• Hub: global floor 0.331.0 / 0.158.1, no per-box floor; Tester4 and its host Tester4-31fa0e kept (operator); no vouch, no deploy.
• DooPlex: builds and the golden bake only; the headless browser as a test client; no Docker cleanup.

Architecture read: 01, 02, 03 §8a, 04, 05, 07 §6/§8, 09 §3 decisions 162/250; target-selection.md, nightly-rotation.md, RUNBOOK-manual-build.md §4. Documents changed: 03 §8a, 07 §6.1 and §8 row 10, target-selection.md (Tester4). System poster: none of the three (no listed fact changed). unproven.py --summary: not walked 35 of 55 — unchanged.