REPORT — the four evening items before the second night (2026-09-13)

Overwritten each session. The night's own report (adventurelog rotation, v0.240.0) is preserved as audits/nightly-2026-09-13-adventurelog/ and the register; the controller report is felhom-controller/REPORT.md, the catalog's app-catalog-felhom.eu/REPORT.md.

1. The rules file

.claude/rules/unprompted-work.md copied byte-identical into felhom-controller, felhom.eu and app-catalog-felhom.eu (documents-only pushes). instructions_gate.py refused the first push: a rule file needs paths: or unconditional: true; all four copies (root included) now start with the three-line unconditional: true frontmatter — sha256 d1aa3af83ae3b220… everywhere.

2. R-481 — the scratch guest (ruled; NOT built, and why)

The ruling ("a second enrolled LXC … enrolled as a scratch customer") collides with the model: the hub keys a host to one customer (hosts.host_id PK) and the box runs one agent with one host identity; re-running the installer with another customer-id would rewrite demo-hp's enrolment. Options and a recommendation are in the row and STATUS; 9201's shape and the disk placement (pct move-volume onto a dir storage at /mnt/hdd_1) are recorded for whichever is chosen.

3. R-483 — photos (re-ranked P2, catalog)

Diffed against homelab-manifests adventurelog-system/adventurelog.yaml: the k3s ingress sends /media, /static, /admin, /accounts to the backend service port 80; the catalog sent everything to the frontend. Two catalog cuts (3172258, ed62cfd): a backend traefik router for the four prefixes, then port 80 instead of 8000 — the backend image runs nginx in front of gunicorn and Django serves a photo by X-Accel-Redirect, so port 8000 returned 200 with an empty body. Applied to the operator's own instance through the guarded Update; proven without a browser (audits/nightly-2026-09-13-adventurelog/11-R483-repro.txt): GET /media/images/<id>.webp with a session → 200 image/webp, RIFF/WEBP magic; anonymous 403 (the app's rule). Confirmed by the operator in a browser at 21:49 — closed. The frontend's 500 on scripted multipart uploads is upstream and recorded in the row; browser uploads work.

4. R-479 — tier order for bind-data apps (ruled; controller v0.241.0)

Ruling 9 in 09-update-architecture.md §3. Built, tested, red-proofed; delivered by the floor and live-checked on a nextcloud throwaway — see felhom-controller/REPORT.md and audits/v0241-2026-09-13/.

Observations

A removed app keeps its update hold; a reinstall would start held. FILED: R-491
The controller's evening release rides the same session as the night's — two releases in one calendar day, one per session. NOT-A-FINDING: the rule is per session; both are recorded with their MinAgent lines.
homelab-manifests is not in the workspace; its manifests were read from Gitea's API. NOT-A-FINDING: the workspace CLAUDE.md says non-felhom repos are unrelated; a read-only fetch was enough.

3.0 KiB Raw Blame History