felhom.eu/documentation/audits/night-2026-09-25/REPORT-DRAFT-C.md

Part C — the proof on 9202: six simulated nights

Controller v0.271.0 on 9202 only (C/C0-deploy-9202.txt), drill catalog (C/C0-repoint-drill.txt, health timeout 90 s). Four apps installed through the product at the ladder's first from, then the drill put back at the head: wishlist 1 step behind, navidrome 2, romm 3, vikunja 1 with a failing step (its head probe on port 8999). Marks set in the drill: navidrome step 1 needs_person, wishlist's step files_may_change. Data seeded through each app's own front door and read back after EVERY night (C/data-readback.txt: 8 of 8 rounds, 4 of 4 apps, each fixture with its negative control). The window was moved through the product's own form (POST /backups/window) so the off-site job — and the leg chained to it — fired two minutes later.

night	what it proved	leg summary (the box's own line)	pages (hu + en)
1	the chain on a box with NO off-site target ("the off-site leg does nothing; the update leg runs now"); one step per app; needs_person skipped; files_may_change taken WITH a whole copy (wishlist); a failing step undone	done=2 undone=1 held=0 failed=0 skipped=1 in 3m6s [skipped: navidrome=needs_person] — romm 60.1 s, vikunja undone 105.2 s, wishlist 20.1 s	„Automatikus frissítés 2026-09-24 22:31-kor — sikeres." / "Automatic update at … — done."; vikunja's undone sentence in both
2	R-680 live: the undone step is NOT pressed again; navidrome's files_may_change step taken (its music folder is excluded, so its own unit is whole)	done=2 undone=0 … skipped=1 in 1m10s [skipped: vikunja=failed_before]	badges current / behind as expected
3 — accident	controller killed (kill -9) the moment navidrome's step ended	the leg had pressed romm IN THE SAME SECOND; the kill landed before romm's up → pin and definition put back, romm runs its previous version, page: „A frissítés megszakadt, mert a vezérlő újraindult…" / "The update was interrupted…"; the leg was not resumed (R-686)	all data read back
4 — accident	power cut (pct stop/pct start of 9202) while romm's step was verifying	box up in 13 s; "resumed 1 interrupted update(s)"; romm healthy after 30 s, DONE in 1 m 32 s; no automatic-update line on the page (the leg died — R-686)	all data read back
5	the switch OFF (POST /settings/app-update, page reads unchecked)	done=0 … stopped=switched_off in 0s — nothing pressed	—
6	the switch ON again; the catalog RE-TESTED vikunja's step (probe fixed, new tested_at) → the ladder print changed → R-680's record no longer binds	done=1 … in 10s — vikunja done	„Automatikus frissítés … 22:58-kor — sikeres."

Not run live, and why (R-687): W+5h reached with steps left (the leg starts at W+105m; needs a 3-hour leg — unit test TestLeg_NoStepAtOrAfterW5h); the off-site leg FAILING (9202 has no off-site tier — unit test TestChainUpdateLeg_EveryPath covers error and panic); a files_may_change step WITHOUT a whole copy (every app given the mark was whole on 9202); the full-system gate's deferral (9202 has no agent, so no quiesce loop).

Verdict: Part C passed — every accident that could run on 9202 ended with the app healthy, the data read back, and a true sentence on its page; the four not-runnable cases are named, unit-proven and in the register.