felhom.eu/REPORT-gate-restore-release-2026-10-15.md

REPORT — a restored app never comes back open; test builds move with the floor; Prowlarr links itself; the first release under the new rule (2026-10-15)

Written in ASD-STE100 Simplified Technical English. Design read first: 09-update-architecture.md §3 decisions 46–49 and 245–253, 07-backup-architecture.md, 15-media-library.md §6. Evidence: documentation/audits/gate-restore-2026-10-15/.

What waits on you

1. Plex code — done: your code claimed demo-hp's Plex at 13:32 UTC (addendum below).
2. A throwaway customer for the new-box proof (R-1052). Make it in the hub in your browser, or name one I may reuse. Since hub 0.153.0, a customer can be created only from your browser session (decision 252), so my token cannot do it. If you do nothing: nobody has seen a brand-new box reach the floor by itself.

1. A restored app: closed until the household is set up? — Yes. Proven.

• The per-app backup now records the setup gate: closed or open, and by whom.
• A restore puts the gate back as it was:
  • closed then → closed now;
  • open then → open;
  • no record (a backup made before 0.314.0) → closed until the app's own check or „Kész" opens it.
  • Never open by default.
• Live proof on scratch guest 9202:
  • Prowlarr was installed. No account was made. The update took the app's backup. The app was removed, keeping its backups, and then restored.
  • Then a stranger got the gate: /ping 401, / 302 to the gate page, /initialize.json 401.
  • The household got through: 200.
  • The box's log says: „restored with its setup gate CLOSED — it was closed when the backup was taken".
  • „Kész, beállítottam" then opened it.
  • The same walk on the old code gave the stranger 200.
• Tests: ten deliberate breaks of the code; each one made a test fail.
• Plex: it follows the same rule. A unit test proves it with Plex's gate shape. I did not restore a live Plex.

2. Did Tester 1 leave the test build by itself? — Yes, from the new test build.

• It could not leave rc.4 by itself. The floor check runs in the code the box runs, and rc.4 has the old check.
• So I put Tester 1 on 0.314.0-rc.1 by hand. Then the floor 0.314.0 moved it to the release by itself, at 13:09:38 UTC: „update successful (0.314.0-rc.1 → 0.314.0)".
• It moved at its next regular report, 14 minutes after the floor was set. The other two boxes moved within 13 seconds. That difference is row R-1061 (P4).

3. Prowlarr: linked with no button? — Yes.

• On 9202: Sonarr first, then Prowlarr. The box ran its link step when Prowlarr came up. Sonarr appeared in Prowlarr's Apps about 40 seconds later. A second run wrote nothing („unchanged"). Prowlarr's own connection test: 200.
• The catalog text and the website card no longer mention the button (catalog e67aad4).

4. The release

• Version: controller 0.314.0, MinAgent 0.155.0. No golden (decision 250).
• Three test boxes: each got a per-customer floor of 0.314.0 through my token (the normal update path).
  • demo-hp and demo-felhom ran 0.314.0 within 13 seconds.
  • Tester 1 followed at 13:09:38 UTC, by itself.
• Box walk checks, all three green:
  • https-only: every public name redirects to https;
  • 0 unhealthy, 0 restarting and 0 stopped containers;
  • the controller is healthy, and the dashboard answers 200.
• Global floor raised by CC with its token at 13:11:04 UTC: 303 floor_set. Read back from the hub database (with its WAL): floor 0.314.0, declared MinAgent 0.155.0. The three per-customer floors were cleared afterwards. demo-hp's old 0.311.0 floor was already gone.
• Plex (R-1060): every call to Plex now goes to the container's address. On 9201 a fake code through the dashboard was taken as local: Plex asked plex.tv and got 500 after 938 ms. Before the fix it was 401 in 0 ms.
• A new box reaching the floor (R-1052): NOT done. It needs a throwaway customer (see above).

5. Wrong claims in the prompt; commits; register; STATUS

Claims in the prompt that turned out wrong:

1. „Tester 1 must leave rc.4 by itself": impossible. rc.4 runs the old floor check (§2).
2. „CC's token (~/.felhom-hub/cc-token)": the token is HUB_TOKEN in ~/.config/credentials. The path does not exist.
3. „Claimed as a throwaway customer … customer deletion is session only": customer creation is session only too (decision 252). CC cannot start R-1052 at all.
4. „Every controller call to Plex uses the host name plex (four calls)": there are five. The fifth is the general health check's GET /identity. Plex answers that page to anyone (200), so I left it as it is.

One slip of my own: the previous task's brief said „No Co-Authored-By", but my commits that day still carried that line (felhom.eu 2f1f6c80, 02be5006, 0cd9fa32, fb2e6b69, d23df1a2; catalog 73b45a6). The commits of this task do not carry it.

Commits:

• felhom-controller: 17863fe (code + CHANGELOG + README + REUSE), 97c992a (a missed test file), 85f65c7 (CONTEXT, REPORT).
• app-catalog-felhom.eu: e67aad4 (Prowlarr's text).
• felhom.eu: this commit — decision 253 in 09, 07, 15 §6, the skill's release steps, the register, STATUS, CONTEXT, the evidence.
• Drill catalog (test only): fd4b9f1, c42d92b.

Images: felhom-controller:0.314.0-rc.1 (test) and felhom-controller:0.314.0 (release).

Register: before 157 · opened 1 (R-1061) · closed 5 (R-1023, R-1053, R-1057, R-1058, R-1060) · after 153. R-1052 blocked on you.

STATUS.md: 58 lines. Not-walked claims: 35 of 55 (no change).

Teardown:

• Machines:
  • 9202 is back on the live catalog, and its test mirror is deleted. It runs 0.314.0, with no test apps left.
  • 9201: no test apps left. Its Plex is claimed to your Plex account.
  • Tester 1 runs 0.314.0. Its media rig was kept.
• Hub: only the floors changed. The per-customer floors are empty again.
• Nothing ran on ep0.

Addendum — the real Plex claim (13:32 UTC)

• You saved a fresh code. The watcher gave it to the dashboard's own claim call on demo-hp 9201, then shredded the file.
• Result: 200, „claimed": true, in 11.8 s. The box opened the gate by itself. Plex says „claimed": true.
• A stranger now meets Plex's own sign-in: the web page 200, the library 401 without a token.
• One library wiring run: plex=done(2) — it switched on Plex's „scan on change" settings.
• R-1060 is closed. Evidence: documentation/audits/gate-restore-2026-10-15/plex9201/02-claim.txt.

Addendum 2 — a new box reaches the floor by itself (R-1052, 14:06 UTC)

• You made the test customer Tester3 with a placeholder domain (tester3.test). The floor path does not need a real domain.
• I installed a VM on demo-hp from the public installer, bound it through the mailed link with your phrase, and claimed it.
• It updated itself from the golden 0.313.0 to the floor 0.314.0, 2 min 52 s after the bind („auto-floor"), before anyone claimed the dashboard. The hub's reports and the box's own record say the same.
• Then I switched it off through its own dashboard (the hub knows it was on purpose, so no alarm mail) and removed the VM.
• R-1052 is closed. Register now 152 (closed 6 in this task).
• Waits on you: delete customer Tester3 in the hub (browser only).