REPORT — the Monday release, run on Sunday 2026-10-25 (attended)

Plain words first.

Fix A and fix B are proven. A restore whose app does not start says so and keeps both copies (D49 = A); the old copy goes only after 3 minutes of stable running. A .fab import that cannot download its version refuses and touches nothing.
Hub 0.170.0 is live. Tester 1's recovery package went to the hub in one transaction; no alarm mail after.
Agent 0.165.0 is vouched (18:38:49 CET). It runs on all four hosts; on a BYO host our SSH file is removed — one bundle run late (R-1285).
Controller 0.343.0 is on every box: 4 of 4 hosts (Tester 1, demo-hp, demo-felhom, the BYO test host) and the scratch guest 9202. None stayed behind.
The catalog is pushed: n8n sends no usage data, OpenGist has 256 MiB, Homepage is behind the family gate.

The D47 upgrade count: Tester 1 3 of 3 apps got an install id, demo-felhom 5 of 5, demo-hp 11 of 12 (kimai is held stopped since 2026-10-14 and the start-up step skips a held app — R-1286). 0 units set aside on any box.

The dated checks: R-232 — DONE (last night's DooPlex database copy reached the restic sweep, snapshot 3973450f, folder 20261024-220001, no alarm mail since 2026-10-23 22:20Z). R-1183 — partial today (one hub snapshot file per slot, 07:00Z and 13:00Z; the hub restarted at 15:50Z for 0.170.0, so the morning log is gone); the full read stays due 2026-10-26.

What ran, in order

Part 1, fix A (R-1270 follow-up): one helper, „started" = running on every sample of a 45 s window, no RestartCount growth, every healthcheck healthy; the undo copy released after 3 more minutes (10 s samples, 30 min watch; only a restore begun after the watch ends it). Found live and fixed on the way: docker's -f template failed on every app without a healthcheck (now the JSON is read). Live on 9202 rc.6: an image that exits after 20 s → „még nem indult el", copy kept, one operator line; the original unit back → released 3 min later.
Part 2, fix B (R-1279): the D48 helper before step 1 of the import. Live: a bundle copy with a missing tag → refused with the D48 sentence, the app running, its volumes untouched.
Part 3, hub 0.170.0 (R-1254): asked → yes → manifest bump, hard refresh, sync of Deployment/hub alone, Synced/Healthy, digest sha256:6478498d…. Tester 1 ran the escrow ceremony through the page's endpoints (the new code stored by the operator as a CC secret); the hub logged „the new package is on the hub". No alarm mail after the deploy (the mailbox as the second channel; a bind mail to Tester4 arrived, the control).
Part 4, agent 0.165.0 (R-1257, R-1250): release-agent.sh from a clean clone; signed jobs to the three boxes (76/76, the appliance drop-in in force by sshd -T). No BYO host existed, so one was built on demo-hp: VM 9371, a plain Proxmox VE 9.2 from an answer-file ISO, Felhom installed with --mode byo as Tester4 (the operator deleted the old host and stored the retrieval passphrase as a CC secret). Our 0.164.0 drop-in planted first; after 0.165.0 still there; a second config bundle removed it, wrote nothing, sshd -T read the owner's own setting. Vouched by the operator.
Part 5, controller 0.343.0: rc.6/rc.7 on 9202; the set-aside alarm added and red-proved (Part 5.2); 0.343.0 pushed after CI 2330; per-box floors → the three boxes at 17:17Z; box checks: 0 ERROR lines, all containers up, https-only green; the D47 count above; on Tester 1 a unit restore and a set-aside restore — the item back, the copy released after 3m0s each. Asked → yes → global floor 17:53:42Z (MinAgent 0.158.1, read back in the hub log; the BYO host moved 18 s later); per-box floors cleared; a 30-minute watch: the hub sent 0 alarms (global-floor-watch.txt) and no alarm mail arrived (the mailbox as the second channel).
Part 6, catalog: Homepage's family gate tried on the drill on 9202 (stranger 302/401, household 200); asked → yes → ebbf1f4 pushed; demo-hp read it 8 minutes later.
Part 7, D44/D45 = all picks: confirm lines tagged, text-follows-code changes made (old words struck through), the four code picks became R-1280–R-1283; R-1265 and R-1266 closed.
R-1250: released, but its live proof cannot run before the agent's next due window (Tuesday 10:00–15:59 local; all boxes measured on 2026-10-24) — a dated check on 2026-10-27 with the operator's yes for DooPlex's qBittorrent as peer.

Versions, digests, CI by commit

Hub 0.170.0 sha256:6478498d….
Agent 0.165.0 binary e9d04a47ee85222ce6c472633ecdcebe1baa88d6836848f9a7da6435a9adb7d3, bundle 8dea1f34d77ba40aa44c5461c3728c2ca94bab46854a6bd8b86191f520dfe85a; agent CI by commit: c8d3c17 2306 ✓, 4a1a849 2325 ✓, 4697f8a 2326 ✓, 6b6ba0c 2334 ✗ (R-1290 — the registry, not the code).
Controller 0.343.0 sha256:bb3da72a054c45751e3baf6e4bad43d1561a952717c5f426d65a5aeed0413a3b from e2a9761. CI: 7720439 2319 ✓, 2149a13 2321 ✓, 35232de 2322 ✓, 1ee0353 2324 ✓, 3a1f09d 2327 ✓, 935e624 2328 ✓, e2a9761 2330 ✓, fe98377 2333 ✓.
Catalog ebbf1f4 2332 ✓, cd0cf48 (REPORT).
felhom.eu ade357a1 2329 ✓, 36ef8dcd 2331 ✓, this commit (CI by hash in the final message).
Installer 1.36.1 on main, NOT published (R-1284).

Register

Before 219, after 219; opened 11 (R-1280–R-1290), closed 11 (R-1251, R-1252, R-1253, R-1269, R-1270, R-1271, R-1279, R-1257, R-1272, R-1265, R-1266). R-1254: the hub half closed in its row, the ceremony half open. R-1250: VERIFY with a dated check. unproven.py --summary: no number moved (35 of 55 not walked).

Observations

FILED: R-1284 — the installer's preflight printed every refusal code twice („401401"), so its 401/404/409 sentences never showed (R-1167's 409 sentence included); fixed on main (1.36.1, red-proved), the publish is the operator's.
FILED: R-1285 — BYO: our drop-in is removed one bundle run late (the old wrapper plans the run that installs the new one).
FILED: R-1286 — demo-hp's kimai held since 2026-10-14, no row named it.
FILED: R-1287 — a set-aside mails „1 of 1 apps failed to back up" (red); nothing failed.
FILED: R-1288 — after a set-aside restore, the next backup sets the reinstall's own unit aside too (a second copy and alarm).
FILED: R-1289 — the hub's „fleet's newest controller" can be a dev build no box runs (0.343.0-dev.r1251a).
FILED: R-1280–R-1283 — the four D44 code picks.
FILED: R-1290 — the agent's CI is RED since ~18:00Z: four old agent packages (0.159.0–0.160.0) were removed from the registry by something outside the repos, and the published gate still expects the newest 10 (6b6ba0c, job 2334). Not the release's code (job 2326 on the release commit was green); the keep rule is the operator's.
NOT-A-FINDING: the BYO host's first bundle read 71/76 (pve:store-grant:felhom-pbs) — the PBS storage was being added; 76/76 two seconds later and on every run after.
NOT-A-FINDING: the .fab import status reads "ok": true beside its error — ok is the HTTP envelope, the job's result is error and the steps.
NOT-A-FINDING: 9202's alarms read „DROPPED … notifier disabled" — 9202 has no hub; the line is the positive observable that the event was raised (one per case).

Teardown (three layers)

Machine: every throwaway app removed through the product (9202: Vikunja, Tandoor, Homepage; Tester 1: Tandoor — no container, volume, app.yaml or set-aside left). 9202 back on the released 0.343.0, its drill mirror and my saved controller.yaml copy removed, my 0.343.0-rc.3…7 images removed (older rc images of earlier sessions left as found). Tester 1 keeps its new escrow package on purpose (the old recovery code no longer works; the new one is a CC secret).
Host: the BYO VM uninstalled through the product's --uninstall (rc 0), then VM 9371 destroyed with its disk; its ISO removed from demo-hp's local; demo-hp lists only VM 341 and its old ISO, as found. DooPlex: only the hub deploy; the BYO ISO work folder deleted; the session's password, session and job files shredded.
Hub: the three per-box floors cleared; the global floor 0.343.0 and the vouched manifest stay (the release). The host record Tester4-f967d4 stays until the operator deletes it (session only — in STATUS); customer Tester4 is kept.

Secrets: used only through sec; the evidence scanned for every stored value used (0 hits) and the BYO root password (0 hits); one CSRF token blanked in a saved page snippet. System poster: no fact changed. Instruction files: none edited.

8.7 KiB Raw Blame History Unescape Escape