5148fe1e11
gates / gates (push) Successful in 6m29s
The arr stack had no download client: radarr/sonarr/seerr decide what to fetch and hand it to one, and there was none. Both templates are written and measured on the bench (LXC 9401) and on 9202 through the product. Neither is published - the onboarding records are not complete and the gate refuses a template without one. Found by measuring, each fixed: - qBittorrent was unreachable on its own public name: WebUI\ServerDomains takes SEMICOLONS; a comma list answers 401 Invalid Host header to everything. Undocumented upstream; measured four ways through the app's own API. - Both clients asked the household's router to open a port (qBittorrent UPnP/NAT-PMP ON, Transmission port-forwarding-enabled true). The box opens no port at home. qBittorrent ignores the seeded Session\UseUPnP=false at first start but honours the same setting through its API, so it goes through after_install: ON at 17:21:51, OFF at 17:21:56. - Transmission could never go healthy (401 on every path, curl -f exit 22). - Transmission's host whitelist refused its own healthcheck. - The apparent lock-out was a measurement artefact: with stranger and household on two different addresses, the stranger is banned and the household signs in at the same instant (204). qBittorrent reads the real visitor address. Downloads work with no inbound port, measured: 34 seeds / 4 MB/s (qBittorrent), 48 peers (Transmission), both complete, port confirmed closed. 9202 is back on the live catalog with both apps removed; bench 9401 stopped as found; the live catalog's main untouched.