felhom.eu/REPORT.md

REPORT — the first "be a customer for the night" run: adventurelog on demo-hp (2026-09-13/14)

Overwritten each session. Every finding below has a register row. The controller report is felhom-controller/REPORT.md, the catalog's app-catalog-felhom.eu/REPORT.md.

One app walked end to end as a household would; seven product defects found; a controller release (v0.240.0) shipped the same night by the managed floor; two catalog fixes; two docs fixes. The morning note is the top block of STATUS.md.

Step 0 — the rules file

.claude/rules/unprompted-work.md is in none of the three repos and the brief's text block did not reach this session (searched the workspace, the transcript and memory). Not created — the operator's rules cannot be invented byte-identically. The brief's own fences were applied instead.

What changed here

• documentation/runbooks/nightly-rotation.md — new: the tick list (standing nine first, blocked on R-481; then the catalog); actualbudget recorded (no non-browser front door), adventurelog ticked.
• scripts/observations_gate.py — R-471: every observations section is read (scripts/CHANGELOG.md).
• documentation/runbooks/target-selection.md — R-461: /mnt/hdd_1 is the NVMe; drill-r50 exists on neither box (measured), fence kept with the fact beside it; R-93 carries the fact.
• 09-update-architecture.md §6.1 + §8.2 (R-452 lifted), 07-backup-architecture.md §6, CONTEXT.md — v0.240.0 notes.
• Catalog (app-catalog-felhom.eu): the catalog-since gate (R-452), see its REPORT.
• Register: R-465 (audited: five readers fall back, one is inert and unreachable → R-490), R-452, R-473, R-474, R-466, R-471, R-453, R-461, R-477, R-478, R-480, R-482, R-484, R-485, R-486 closed and compressed; R-481, R-482..R-489 opened (R-482 closed the same night). 212 → 206 open, 177 → 189 closed (byte sizes: see the commit).
• Evidence: documentation/audits/nightly-2026-09-13-adventurelog/ (01–08), audits/v0240-2026-09-13/ (release log, floor, validation, red-proofs incl. R-471).

Observations

1. The brief's rules block was not delivered; the file is absent in all repos. NOT-A-FINDING: an input gap for the operator, recorded in STATUS "needs you", not a product defect.
2. No scratch guest on demo-hp; the standing nine cannot be throwaways on 9201. FILED: R-481
3. adventurelog ran Django DEBUG=True on the public origin. FILED: R-482
4. Photo upload fails 500 from every non-browser client (frontend proxy body-length bug). FILED: R-483
5. PostGIS not recognised as a database. FILED: R-484
6. The backup card reads dead paths. FILED: R-485
7. Removal with backups kept forgot the Tier-2 record; the restore was refused. FILED: R-486
8. A removed app is on neither backup page. FILED: R-487
9. The backup test package takes 5½ minutes of real waits. FILED: R-488
10. volumes_removed: null over removed volumes, five times. FILED: R-489
11. The monitoring page's memory-distribution card never renders — /api/system/info is shadowed by ServeSystemAPI (found by the R-465 audit). FILED: R-490