felhom.eu/REPORT-logins-nvme-2026-09-28.md

REPORT — 2026-09-28 evening: no app goes live with a login a stranger knows; demo-hp's restore test on the NVMe; an empty backup is an alarm; ep0; small leftovers

Architecture read first: 09 §3 (decisions 11–43, and the new 44–45), 01 §5, 03 (restore storage), 07 §6, 06 + R-600. Controller v0.279.0 (one release). Scope ruled mid-session by the operator: the brief as written for all 40 apps, across several sessions; this session starts it and hands over.

The Parts

Part	Step	State	Note
A	audit of 53 apps	done	app-catalog-felhom.eu/FIRST-ADMIN.md; linked from 01 §5 and 09 decision 45. Measured: claper, bookstack, calibre-web, calcom (9202); bookstack, calibre-web, romm (demo-hp). The rest is marked "read"
A	measure every class-3/4 app on 9202	partly	4 of 39 measured today; the rest is R-707
B1	route (a)/(b) per app	2 done	claper, bookstack: fresh-install proof (default fails, generated works, wrong fails); claper after a restore too. calibre-web: route found, blocked by our generator (no special character)
B2	route (c) sentence	done (mechanism)	shown for every template with default_creds and no working after_install — today bookstack(installed)/calibre-web/mealie/romm/wger/zipline pages; class-4 apps have no default to name
B3	demo boxes read-only	done	demo-hp: bookstack + calibre-web defaults still log in (page now warns); romm's note is stale (401). Nothing changed
B4	box-side mechanism	done	after_install: in v0.279.0, tests + red-proofs; failures recorded and shown, app stays running
C	demo-hp restore test on NVMe	done, changed	"set restore_storage, nothing else" did not work: 403 without a grant; operator approved the grant; one test passed in 8m46s; local-lvm unchanged. Next scheduled cycle: see below
D	empty-backup alarm	done	measured before: a WARN line only (demo-hp, yesterday). Built: digest once/app/tier/day + page sentence; tests + red-proofs; live negative on 9202 (no false alarm). Live positive not reproducible (its known cause, R-704, is fixed)
E	ep0 peer	done — nothing to remove	the peer was already gone (the hub's sync)
F1	R-706	done	v0.279.0, red-proofed; not seen live
F2	R-705 controller half	done	proven on 9202
G	night watch	not done	optional; not run (see STATUS)

Claims in the brief that turned out wrong

• "Six apps ship a hard-coded default" — wrong: 5 (bookstack, calibre-web, claper, mealie, wger); romm's and zipline's notes are stale (romm's does not log in). And 34 more have an open first-run screen.
• "The box publishes every app on the internet at install" — right (the tunnel's *.domain route).
• "No architecture document covers default logins" — right (only 10-localisation.md mentions default_creds for translation); the audit's home is now FIRST-ADMIN.md, linked from 01 and 09.
• "nvme-scratch can hold a restored guest" — the disk and content types could; the agent could not use it without a storage grant (403). Granted with the operator's word.
• "The test-install peer is still on ep0" — wrong: gone.
• "Nothing flags a running app with an empty backup today" — right for yesterday's controller (a WARN line only).

Rows

Opened: R-707 (37 apps), R-708 (grafana admin fallback), R-709 (password fields in the page HTML). Closed: R-701, R-702. Narrowed: R-705 (agent half left). Watching: R-706. R-600 annotated. Register 342 → 345 rows.

Teardown

Machines: 9202 — claper, bookstack, calibre-web installed and removed through the product; back on the live catalog; drill catalog = live. demo-hp 9201 — nothing changed (read-only logins). Host: demo-hp agent config (restore_storage, saved agent.json.pre-d44) and one ACL grant — both kept (decision 44). Hub: floor 0.279.0. ep0: read only.