felhom.eu/documentation/audits/night-fixes-2026-10-26

Night fixes 2026-10-26 → 27: live proofs (R-1220, R-1232, R-1187, R-1298)

Code on main, NOT released (the release block is Tuesday afternoon, attended). Test images were local only (0.346.0-night1/2/3, docker save/load into 9202 — never pushed to the registry); the test agent (0.167.0-night1) was a local build copied to the test VM only. Method: the endpoints the UI invokes, through the box walk tools (../catalog-sweep-2026-10-24/tools/), and the product's own installer / uninstaller.

R-1220 — an unreadable app.yaml counts as installed (controller 7e15a37)

9202, throwaway Grimmory, its app.yaml made unreadable (byte copy saved, put back): after a stack rescan the „Megőrzött adatok" page did not list its drive folder, and the controller logged the R-1220 WARN. r1187-r1220-9202-run1.txt (step 2). PASS.

R-1232 — a reinstalled box's first whole-box copy is not a week late (agent 3911cc6)

VM 9375 on demo-hp's scratch NVMe: plain Proxmox (auto-install ISO with DooPlex's key), then the product's BYO installer as Tester4 (host Tester4-b5dbbd). Tester4's ep0 space held one archive of an EARLIER box (ct/9201, 2026-10-20, key 23:58:…); this box's key is 7c:3b:….

	Agent	GET /backup/due?target=felhom-pbs
before	0.166.0 (released)	due: false, „within cadence window", age 546,807 s — the foreign archive counted
after	0.167.0-night1 (main)	due: true, „no successful backup recorded yet", age_state: absent

The controller's first-backup valve then started the first whole-box copy at 20:13:55Z; it completed at 21:15:17 CET (ct/9201/2026-10-26T20:13:55Z, this box's key) — 4 minutes after the swap. r1232/1-…, 2-…, 3-first-run.txt. PASS. Teardown: the product's uninstall ran (r1232/uninstall-console.txt, UNINSTALL_RC=0; the first try stopped at the confirmation prompt — it asks for the guest number, nothing destroyed), then VM 9375 destroyed, its ISO and work files removed. The operator deletes hub host Tester4-b5dbbd. Tester4's ep0 space keeps this box's one archive (a host delete keeps the tenancy, by design).

R-1187 — the .fab export and import (controller dfd0f8e … 90a2530)

9202, throwaway Grimmory (markers inside its bound drive folder appdata/grimmory/data/cc-r1187: a file owned 1000:1001 mode 0640, a link inside, a link to /etc/hostname):

• (a) a FIFO in the folder → the export fails, naming the FIFO's path (r1187-9202-run2.txt, -run3.txt, step 3); without it the export carries both links AS links (the tar listing, step 4).
• (b) after the import: the file is back as 1000:1001 mode 640, the inside link is back, the outside link is refused and listed in the import's WARN (run 2 and run 3).
• Two import defects found by this proof, older than tonight, fixed and re-proven: run 1 and run 2 ended „waiting for DB: timeout" and left Grimmory down: (1) the import's compose runs lacked the controller's own USERDATA_PATH/IMPORT_PATH, and compose's warning was read as the DB container id (a3ed63e); (2) the import used mysqladmin/mysql, which the MariaDB 11+ images do not ship, so EVERY MariaDB 11+ import timed out (90a2530: the import now loads through appbackup.ImportDump). Run 3 on 0.346.0-night3: the import succeeds and the app answers. r1187-9202-run3.txt.
• (g) AdventureLog (postgis): a superuser made with the app's own createsuperuser, export, the user deleted in the live app, import → the user is back (read through the app's own ORM, manage.py shell). My front-door check (the Django admin login page) answered 302 with no form both BEFORE and after — an instrument that did not reach the form, not a result. r1187g-9202.txt. PASS on the ORM readback.
• (d) and (f): their unit tests are the proof (a running restore cannot be staged safely; a crafted bundle would be a hand-made input).

R-1298 — held-app reports only for installed apps (controller b156e45)

9202 on 0.346.0-night1: the reporter skipped its four orphan holds by name („not reported (R-1298)", 0 sent). Then, the controller stopped, -clear-restore-hold for chaoscrash, chaosoom, chaosoomb, gokapi → „no restore holds in force"; PrivateBin's leftover removed through the product (volume, app.yaml, backup gone). r1298/.

Teardown

• 9202: back on 0.343.0 (image file restored, the test images removed); its standing apps only; no holds (the four orphans cleared on purpose, per the brief); the drive's appdata/ holds only paperless; no bundles in exports/.
• demo-hp: VM 9375 destroyed (own id), its ISO removed; nothing else provisioned.
• Hub: host Tester4-b5dbbd — the operator's delete. DooPlex: the local test images removed.
• Secrets: the evidence was scanned (the dashboard passwords, Tester4's passphrase, both hub tokens, the Resend key): 0 hits.