felhom.eu/REPORT.md

REPORT — test-box check after a week away, and the old website copy retired (2026-11-07, attended)

Plain words first. All three test boxes (N100, HP, Tester 1) run, report to the hub, and all apps are healthy. Two faults were found. demo-hp made no local whole-box copy for 9 days because its system disk was too full; CC freed space with the operator's yes. The N100 refused its nightly Proxmox updates three nights in a row; agent 0.172.1 fixes it and waits for the operator's vouch and signed jobs (commands in felhom-agent/REPORT.md).

Method. Two channels: the hub's database copied from the running pod WITH its WAL (events since 2026-10-31, hosts, reports, OS releases), and SSH to each box (agent journal, pct list, docker ps in guest 9201, df, apt-get -s). The two agree. The DB copy was deleted from the scratchpad after reading.

What the week shows.

• Every night: DB dumps and drive copies done on all three. Both hosts rebooted 2026-10-29 ~05:00 for the kernel step.
• 2026-11-01 14:19: all three hosts stale together for ~1 h, then recovered — same minute on all three, so a line or hub-side gap, not a box fault.
• Tester4 (2026-11-03): CC's proof VM, its host already deleted from the hub — the STATUS do-item is removed.
• Tester 1 (2026-11-02): radicale stopped as unhealthy twice, and a disk warning at 89 %; it is at 15 % now.
• All three: „Root files behind" (bundle 0.170.0). The 0.172.1 bundle job clears it.

Done.

• demo-hp: whole journal saved off-git (/mnt/5_hdd/felhom.eu/evidence/demo-hp-space-2026-11-07/), then journalctl --vacuum-size=500M (freed 3.3 GB) and pvesm free of the 2026-08-21 archive of guest 9100: / 9.5 → 14 GB free; the preflight asks 12.4 GiB. Recorded under R-548. The journal will grow back (journald default cap).
• felhom-agent v0.172.1 released; the operator vouched it and sent both signed jobs; all three boxes run it (bundle self-check ok, capability probe 77/77). See that repo's REPORT.
• R-1228 closed (operator yes): DooPlex's copy of the website retired. The installer pin moved first to INSTALLER-TAG (publish script + hostinstall_gates.py 6c, red on five mutants; dry run = the public installer's sha256). Then a deliberate ArgoCD sync pruned exactly six objects (webpage Deployment, Service, Ingress, two ConfigMaps, and the orphan felhom.eu/api Ingress — a number: 80--- typo had glued it to the next YAML document); live objects saved first (/mnt/5_hdd/felhom.eu/evidence/r1228-retire-2026-11-07/); the unused felhom-webpage-tls Secret deleted. After: felhom.eu 200, api.felhom.eu preflight 204.
• Security review follow-up: the old nginx sent X-Frame-Options: SAMEORIGIN and /scripts/ as text/plain; Cloudflare did neither since 2026-10-30. website/_headers restores both; uploaded; measured from outside (both headers present, installer sha256 unchanged e18cdd17…, /_headers itself 404).
• N100 diary entry; STATUS updated (new do-list, the Tester4 item removed).

Not yet observed. demo-hp's next local-tier try (every ~4 h) has not run since the cleanup. Positive observable: backup: completed … target=local in its agent journal.

Registers. R-1228 closed (to CLOSED-ITEMS); none opened (the GRUB fault is fixed in the session, size rule). Evidence: documentation/audits/demo-check-2026-11-07/. System poster: the facts file updated (the old copy retired); the drawing refresh was already listed in STATUS.

Instruction files edited (stale facts, no rule loosened): CLAUDE.md R-110 fence (where the tag is pinned, what gate 6 checks), .claude/rules/manifests.md (section replaced: no installer in a manifest), .claude/rules/website.md (the way back retired), the felhom-build-deploy skill (same). Why: the pin moved from manifests/webpage.yaml to INSTALLER-TAG.