felhom.eu/REPORT-day3-2026-10-08.md

# REPORT — 2026-10-08 (evening): the operator's ten answers (D1–D10) built — code and tests, no delivery

(`REPORT-day3-…` because other sessions write in this clone today.) Rulings recorded first: `09` §3 decisions 185–194
(commit `4510dd7d`), and in each row.

| Part | Result |
|---|---|
| **A** — operator actions (D1; R-314, R-279) | **Done on main.** Controller `internal/report/opactions.go` + `scheduler.RunNow`; hub table `operator_actions`, four buttons, reply field `operator_actions`, result field `operator_action_results`. Closed list both sides (`TestOpActions_ClosedList`, `TestOperatorActions_ClosedList`); unknown → `refused`, nothing called; once per id; cross-customer result ignored. Fixed on the way: `ExtendAbandon` could move a deletion earlier or edit the box date in the hub phase; `StopAbandon` reported success while the hub's deletion stayed pending; reply read limit 4 → 64 KiB. Review fix: a `run_job` „done" says it ran, not what it found. |
| **B** — delete a switched-off box at once (D2; R-30) | **Done on hub main.** Presence from the wait channel (connected / not connected since T / unknown), shown on the host page; the delete goes ahead at once only with the tick AND ≥ 360 s not connected, re-checked at the POST. 7 mutations red-proved. |
| **C** — health mail + dashboard (D3; R-79) | **Done on main, both halves.** Hub: the household's health mail drops the raw note and points to the dashboard (operator mail unchanged). Controller: the last six health producers carry a key; wire text unchanged. |
| **D** — signed in across a restart (D4; R-35) | **Done on controller main.** Only sha256(cookie) on disk (0600). Review fixes: rows written under another password are dropped at load; a failed revoking save removes the file. 8 tests. |
| **E** — Cloudflare key check (D6; R-138) | **Done on hub main.** Fake Cloudflare in tests only; the token is never logged. Review fixes: the token's one zone must BE the customer's domain (a parent zone was accepted, and checking it against today's customers was order-dependent). Limit filed: R-913 (read scope ≠ write scope). |
| **F** — one lost off-site copy is an error (D7; R-435) | **Done on hub main.** Review fixes: each window explains at most its hub-set cap; each window explains one fall only; a window stuck open explains nothing; unreadable windows fall back to the half-rule. `08` §6.5 written (count from the box, net count). |
| **G** — failed restore keeps the app stopped (D8; R-893) | **Done on controller main.** Review fixes: the hold now covers every failure after the definition or a volume moved (not only a failed replay); the hold is persisted before the stop. R-893 stays open, NARROWED to the second half („put back exactly as it was") — no new row needed. |
| **H** — D5, D10 | **R-717 closed** (D5). **wger `mem_request` 256M pushed** (catalog `31e9651`, CI 1559 success), after a hub read showed no box runs wger (app-telemetry page 12:22 UTC: `wger` 0; controls `paperless`, `bentopdf` present). |
| R-554, R-462 | **Not done.** R-554 is still stopped on a customer promise (decision 2 below). R-462 not started (no time left after the review fixes). |

**Rows: 132 before → 136 after. Opened 1 (R-913). Closed 1 (R-717).** The other +4 are another session's (R-909, R-910,
R-911, R-912: dashboard layout and logos). State changes: R-314, R-279, R-30, R-79, R-35, R-138, R-435 → VERIFY (built, ships tomorrow,
closes after the live proof); R-893 → NARROWED.

**Commits.** Controller: `ee8a526`…`d3e17e9` (cherry-picked from the helper branches onto main), `3f84f82` (review
fixes). Hub/felhom.eu: `4510dd7d` (rulings), then the integration push (this report's commit). Catalog: `31e9651`.

## Security review — what it found and what happened

Automatic commit reviews plus two read-only review helpers. Fixed and red-proved the same evening (10): Cloudflare
parent zone; order-dependence of the zone check; R-435 fail-open on unreadable windows; a box's `count_after`
widening a window; one window explaining several falls; a stale open window; D4 revocation lost on a failed save
(two shapes); D8 earlier failure branches started the app on a mix; the hold written after the stop; `run_job`
„done" read as a pass. **Written as limits, not fixed:** D2 — presence is the guest controller's, so a live host
with a stopped guest reads „not connected" (the cost accepted with decision 186; noted on R-30); D8 — placed files
alone still restart after a successful rollback (option C as ruled; option A is next); D6 — tokens saved before the
check were never checked (R-138 closes only after each is checked once); D6 — read scope ≠ write scope (R-913).

## Waits for tomorrow's releases

- **hub:** the morning's items (R-243, R-901 one-year deletion, R-304 mail, R-415 guard) + D1 hub half, D2, D3 mail, D6, D7.
- **controller:** the morning's R-899/R-304 + the afternoon's R-304 mail, R-298 button + another session's dashboard
  layout fixes + D1, D3 dashboard, D4, D8. MinAgent unchanged (0.131.0). **Release the hub and the controller the
  same day** (D1's wire fields; an older hub sends no actions, an older controller ignores them and the rows expire).
- **agent:** the morning's R-899 + ring label + R-304 424 (nothing new tonight).
- **catalog:** already pushed (wger 256M; reaches a box at its next sync).
- **DooPlex:** the `ep0-copy` clean-up job (D9) — dry run, then daily — after the releases are read back.

## Live proofs tomorrow's session must run (scratch 9202 only, after the releases)

1. **D1:** from the hub's host page, `run_job fill-watch` → the hub's result row; control from another channel: the
   controller log pull's „checked N filesystem(s)" line. `offsite_backup_now` → result; control: the off-site snapshot
   list on 9202's backup page. `abandon_stop` / `abandon_extend` only if 9202 has a countdown.
2. **D2:** stop guest 9202; time until the host page says „not connected"; control: the ingress log's last
   `/api/v1/wait` line from 9202. **Do NOT tick-delete demo-hp** — the fast delete removes the Proxmox host; prove it
   only through `GET /hosts/<id>/delete-impact` (`off_tick_required`). Evidence off before 9202 starts again.
3. **D3:** a `health_critical` on 9202 → the household mail in the catch-all has no `{`, has the dashboard line; the
   operator mail still has the note. The dashboard banner in English for an English household.
4. **D4:** sign in on 9202, restart the controller, the next page needs no login; then change the password → the old
   cookie is refused after the next restart.
5. **D6:** re-save each customer's config once with its current token (operator present): each must pass; a refusal
   keeps the old token. Then close R-138.
6. **D7:** a hand-granted window on 9202 removes N → no alarm; control: the hub's own window row.
7. **D8:** design slice 0 on 9202 with a throwaway app (version N snapshot, update to N+1, restore with a truncated
   dump) → the app held, the page sentence, the operator line. Evidence off before teardown.
8. **D9:** install the DooPlex job, dry run first, then daily.

## Machines

demo-hp, demo-felhom, Tester 1: not touched. 9202 and the bench: not touched. Hub: read only (three page reads with
the operator password: `/apps`, `/hosts`, `/configs`). DooPlex: no change (helper work ran in git worktrees under
`/mnt/5_hdd/felhom.eu/worktrees/`; no Docker command). No release, no deploy, no reboot, no prune. Provisioned nothing.

## Small fixes without a row

`scripts/test_gate_decoys.py` crashed in a linked git worktree (lock path); controller `TestR650_NoBareDockerExec`
raced a vanishing temp file; the three D1 abandon fixes above.

Instruction files: no edit.

## Decisions for the operator

1. **R-913 — how sure must the Cloudflare key check be?** The hub can see what a pasted key may READ, not what it may
   CHANGE. A key made by hand with „read one zone, change all zones" would pass. **Pick: (a) you always make the key
   with the one recipe** („Edit zone DNS", Zone Resources: Include → Specific zone); it costs nothing. (b) The hub
   makes the key itself: safest, but the hub then holds a key that can make keys. *If you do nothing:* the check stays
   as built, and the limit stays written down.
2. **R-554 — what should the household's recovery note say once the old setup wizard is deleted?** Today the note on
   the box tells the household to run a setup script on port 8081 to restore. **Pick: the note says „Call Felhom; we
   restore your box from its backup"**, and CC deletes the wizard. *If you do nothing:* the wizard stays, unused, and a
   box whose first start cannot reach the hub shows it to the household.