felhom.eu/REPORT-tester1-limits-filebrowser-2026-10-17.md

REPORT — Tester 1 back on the live catalog, decoy suites in every runner, memory limits, FileBrowser (2026-10-17)

Written in ASD-STE100 Simplified Technical English. Brief: „Tester 1 back on the live catalog (R-1022), decoy suites in every runner, memory limits, FileBrowser's default password" (2026-10-17, operator „yes" 10:47). Design read first: runbooks/target-selection.md (demo-hp), 09-update-architecture.md (corrections L156, ladder L2259–2263, frozen L2662), 01-topology-and-trust.md, 03-host-agent.md, 04-control-plane-authorization.md, 06-offsite-connectivity.md; the private security-review notes (lead C1-4, read in place, nothing copied). Evidence: documentation/audits/tester1-limits-filebrowser-2026-10-17/.

Plain words first

• Tester 1 is clean and on the live app list. The seven test apps and four test drives are gone; bookstack, paperless-ngx and privatebin stay. Today's Redis change reached it. Your step: remove „plex-k6" on plex.tv (Settings → Authorized Devices).
• Every gate runner now runs its own test cases (controller, agent; felhom.eu already did).
• Six memory limits raised; the 23 memory requests wait — your answer at the STOP (they would refuse the household set's sixth app on an 8 GB box). Immich waits for a bigger measurement.
• FileBrowser's default password is checked at every FileBrowser start (controller 0.326.0, the floor for every box since 09:55 UTC). Measured on the scratch box before: the default came back and stayed open; after: replaced in 2 seconds.
• The tunnel before the claim is a design question for you, not a change — R-1126, two options below.
• A collision: another session (cc-creds) filed R-1118–R-1122 while I filed mine, and its local commit carried my uncommitted register edits. My rows are now R-1123–R-1128; nothing was lost. Its commit is not pushed yet — I asked it and did not push its work.

1. Tester 1 (R-1022) — each step, read back (P1/)

Step	Read-back
1 apps	Sonarr, Radarr, qBittorrent, Transmission, Plex, Jellyfin, Prowlarr: stop 200, remove (keep data, keep backups) 200 each; userdata_kept names the media folders. Stay: bookstack, paperless-ngx, privatebin
2 drives	POST /api/storage/decommission media_a, b, c, d → 200 each (stopped_apps: null); settings: four „decommissioned", adatlemez live
3 repoint	RESTORED-IDENTICAL; only repo_url differed (diff by key); repo_url = live; sync 6589376 → 5d9450b (64 stack dirs); drill-catalog.git (11 MB) removed
4 disks	the four host mounts stopped cleanly inside the VM; qm set 341 --delete scsi2,scsi3,scsi4,scsi5 rc 0; pvesm free nvme-scratch:341/vm-341-disk-3/-4/-5/-6.raw rc 0 each; the four stale unused lines removed; qm config 341: scsi0 + scsi1 only; pvesm list: disk-0/1/2 only
5 memory	memory: 8192
9 release	/etc/felhom-controller-image = 0.325.0 by the floor (no hand pin), then 0.326.0 by today's release
6/7 drill	no box follows the drill (all four guests read the live URL); drill tree = live main, commit 6723057 — a normal commit, NOT a force-push (the brief's standing rule); the old drill commits stay in its history, unused
8 Redis	paperless-ngx restarted: ["redis-server","--appendonly","no"], aof_enabled:0, healthy
walk	10 containers, none unhealthy; dashboard 200

Left on Tester 1: the agent's four mount units for the removed disks (R-1124).

2. Decoy suites (R-1116)

Repo	Suite	Where	Red-proof	Commit
controller	22.3 s, 53 cases	full run, blocking (not --fast: over 20 s, and it edits real files for a moment)	one decoy flipped → CONVICTED: gate-decoys	55868cb
agent	20.6 s here (5.5 s in CI), 30 cases	full run; CI runs the full set on every push	one decoy flipped → convicted	c52d591 (script only, no release)
felhom.eu	56 s, 86 cases	already in --fast through script-tests (R-885)	—	no change

The memory index was at 202 lines (two of my morning notes); the helper removed two blank lines and I merged two lines: 199 now.

3. Memory (R-994) — catalog bff82f9

App	Limit old → new	Peak → share
docmost	512M → 768M (total 896M → 1152M)	475 MB → 62 %
romm	768M → 1024M (1280M → 1536M)	703 MB → 69 %
termix	128M → 256M	117 MB → 46 %
uptime-kuma	256M → 384M	227 MB → 59 %
grafana	512M → 768M	435 MB → 57 %
tandoor	1024M → 1280M (1280M → 1536M; its header said a stale 512M)	827 MB → 65 %

Sizing effect read first:

• The box refuses an install when its committed requests plus the new one exceed guest memory minus 384 MB (stacks/deploy.go:1549).
• The website estimator reads the measurement, not the catalog (scripts/build_sizing_web.py:5).
• An 8 GB box's guest is 4,096 MiB, so 3,712 MB is usable.
• The 23 measured requests would take the household set from 3,622 to 3,910 MB.

STOP → your answer: limits now, requests wait (R-1125, values in P3/requests-proposed.txt).

• Step files: unchanged; the same reading as for Redis holds for a limit change.
• Live: on 9201, after the sync and the dashboard's restart, Docmost runs with 805306368 bytes (768 MiB) and is healthy.
• Immich: not changed; R-994 is narrowed to it.

4. FileBrowser (R-977) and the tunnel (R-1126)

What the box checked, and why only once:

• At every base-stack round, the box tried FileBrowser's default login one time.
• Accepted: it set a generated password, checked it, and stored it encrypted.
• Refused: it wrote „someone set it" and never looked again.
• Why once: to leave a password the household set by hand alone.

Measured on scratch 9202 (P4/):

• 0.324.0: I removed FileBrowser and its data volume, and the box brought them back. The default login then answered 200 for 10 minutes, while the box still recorded „generated".
• 0.326.0-rc.1:
  • At the controller start, the default was replaced in 1 s.
  • After a second re-create, it was replaced only 5 minutes later. The round that started FileBrowser probed it while it was still starting.
• rc.2: a new run gets ~20 s to answer. Replaced 2 s after FileBrowser came back.

The fix: the check runs once per FileBrowser start. A default that comes back is replaced. The household's own password is never touched. Two tests, each red-proved.

The tunnel before the claim:

• What the code and docs say:
  • The claim needs the tunnel: the claim mail links https://felhom.<domain> (hub/internal/notify/templates.go:27).
  • The box starts the tunnel when it has a token, with no claim check (controller stacks/infra.go:85-90).
  • 01-topology-and-trust.md:119 and :248 describe the tunnel and who runs it.
  • No document says whether the tunnel may run before the claim — that is the finding.
• What a stranger can reach before the claim:
  • the claim page: a code, 72 h life, 5 tries, 15-minute lockout;
  • FileBrowser on its default login, from its first start until the box replaces it: now 2 seconds.
• Option A (recommended): keep the tunnel; publish FileBrowser's address only after its default is replaced. Small; no promise changes.
• Option B: start the tunnel only after a claim at home on the local network. The claim mail and flow change, and the household must be at home.

5. Versions, commits, fixtures

• Controller 0.326.0 (MinAgent 0.158.1, no golden), built from 334df7d.
  • Test builds: rc.1 (3f01277), rc.2 (30956aa, the short wait).
  • Release timeline:
    • per-box floors 09:54:10 UTC;
    • all three boxes on 0.326.0 by 09:54:23;
    • box walk green (demo-hp 24, demo-felhom 9, Tester 1 10 containers, none unhealthy; dashboards 200; https-only OK);
    • global floor 09:55:58 UTC (303 floor_set), read back from hub.db + WAL (0.326.0=0.158.1, no per-box floor) and from the hub page.
  • 9202 moved to 0.326.0 by hand (it is set by hand on purpose).
  • Row-number fix: 3e8d027.
• Catalog: bff82f9 (limits), 356659d (row number).
• Agent: c52d591 (script only).
• felhom.eu: fae80645 (register, evidence) and this report's commit, both waiting on the cc-creds session's push.
• i18n: no page changed; every fixture byte-identical.

6. Rows

Before 168 (this session's start).

• Opened by me: 7.
  • R-1123 (reuse_refs searches stray clones)
  • R-1124 (kept mount units)
  • R-1125 (requests, yours)
  • R-1126 (tunnel, yours)
  • R-1127 (no automatic full run)
  • R-1128 (the controller suite edits files without a lock)
  • R-1129 (CI's failure mail was never sent — P2, yours or mine with your word)
• Closed: 3 (R-1022, R-1116, R-977). R-994 narrowed.
• Opened by the parallel cc-creds session: 5 (R-1118–R-1122).
• After: 177.

7. Observations

1. A decommissioned and unplugged drive keeps its agent mount unit. FILED: R-1124
2. The 23 requests would refuse the household set's sixth app on an 8 GB box. FILED: R-1125
3. No document says whether the tunnel may run before the claim. FILED: R-1126
4. The controller and catalog decoy suites run only in a manual full run. FILED: R-1127
5. The controller decoy suite edits real tracked files without a lock. FILED: R-1128
6. reuse_refs_check treats stray clones beside the repo as sibling repos. FILED: R-1123
7. FileBrowser's window on rc.1 was 5 minutes, not seconds. NOT-A-FINDING: fixed in rc.2, the same release.
8. The R-513 code comment said „before a claim there is no tunnel". NOT-A-FINDING: corrected in 0.326.0; the question itself is R-1126.
9. The memory index reached 202 lines and would block every push. NOT-A-FINDING: two blank lines removed and two of my lines merged (199); the gate works as meant.
10. R-1116's felhom.eu part was already covered by script-tests. NOT-A-FINDING: recorded in the close.
11. The first sync on 9201 answered 429. NOT-A-FINDING: the sync's own debounce; the next try worked.
12. CI's failure mail fails in every failed run (back to 2026-09-22, three repos): „RESEND_API_KEY is empty". FILED: R-1129
13. Another session's local commit carried my uncommitted register edits, and our numbers collided. NOT-A-FINDING: the shared-clone risk is known (felhom.eu-shared-worktree memory); fixed by renumbering mine and asking before any push.

8. Teardown (three layers)

• Machine:
  • Tester 1: as in §1; nothing of mine left.
  • 9202: FileBrowser re-created three times (its old shares and users on that scratch box are gone by design of the test); the probe script removed; it runs 0.326.0.
  • 9201: Docmost restarted once.
• Host (demo-hp): four volumes of VM 341 deleted by name, as the row lists; nothing else.
• Hub: per-box floors set and cleared; global floor 0.326.0 / MinAgent 0.158.1.