Files
felhom.eu/documentation/audits/the-28-2026-09-22/TABLE.md
T
admin 186546d562
gates / gates (push) Successful in 27s
THE TWENTY-EIGHT: every app no drill had touched, walked in one night
All 28 walked on scratch guest 9202 against the private drill catalog. 26 deployed, 6 proven,
5 inconclusive, 14 with no upstream edge, 1 failed honestly (outline 1.9.1->1.10.1, HELD with the
right sentence), 2 undeployable - one (plant-it) by design, refused by the lifecycle gate, proven
live for the first time. Each app also got the half the update night skipped: a restore from its own
copy with the seed read back again - 21 restored, 2 correctly REFUSED per 07 6.2.

R-630 RAISED TO P1 by measurement: a stack with NO probe container does not skip verifying - it
waits out the full health timeout and HOLDS, stopping an app whose three containers read healthy.
The controller's own words: "not healthy within 5m0s (last: no probe container)".

R-633 opened: a remove sent during a restore reports success and leaves a container restarting with
a live public route. The product already refuses that clash for update and for restore, naming the
blocker; remove has no such guard.

R-634 opened: an app can be running, healthy and serving while recorded as deployed=false, and is
then unremovable. Reproducible alone on sparkyfitness; concurrency-linked on two others.

R-631 and R-632 CLOSED. Register 321 -> 323. Seven interventions, six of them my own harness -
named, with what each cost. No product code. The live catalog's image: lines are byte-identical to
the start of the night.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-22 16:00:56 +02:00

3.8 KiB

app class deployed seeded backup edge update restore removed clean s evidence
calcom B volumes-only + postgres yes no route 1 copy none upstream — failed yes 675.8 apps/calcom/
calibre-web A file-leg yes no route 1 copy none upstream — failed yes 187.5 apps/calibre-web/
claper B volumes-only + postgres yes no route 1 copy none upstream — ok yes 255.3 apps/claper/
code-server B volumes-only yes route failed 1 copy 4.129.0 → 4.138.0 done ok yes 299.9 apps/code-server/
crafty-controller B volumes-only yes no route 1 copy 4.10.7 → 4.11.0 done ok yes 288.5 apps/crafty-controller/
emby B volumes-only yes yes 1 copy 4.10.0.20 → 4.11.0.1 done ok yes 198.7 apps/emby/
ghost B volumes-only yes yes 1 copy 6.53.0-alpine → 6.64.0-alpine done ok yes 289.6 apps/ghost/
gokapi B volumes-only yes no route 1 copy none upstream — ok no 132.3 apps/gokapi/
gramps-web B volumes-only yes route failed 1 copy none upstream — ok yes 334.1 apps/gramps-web/
homebox B volumes-only yes route failed 1 copy none upstream — ok yes 127.9 apps/homebox/
homepage B volumes-only yes no route 1 copy none upstream — ok yes 137.1 apps/homepage/
immich A file-leg + postgres+redis yes yes 1 copy v3.0.3 → v3.2.2 done refused-with-a-sentence yes 375.0 apps/immich/
jellyfin B volumes-only yes route failed 1 copy none upstream — ok yes 220.7 apps/jellyfin/
kimai B volumes-only + mariadb yes route failed 1 copy none upstream — ok yes 311.3 apps/kimai/
komga A file-leg yes route failed 1 copy 1.25.0 → 1.27.1 done ok yes 251.9 apps/komga/
onlyoffice B volumes-only yes route failed 1 copy none upstream — ok yes 227.3 apps/onlyoffice/
outline B volumes-only + postgres+redis yes route failed 1 copy 1.9.1 → 1.10.1 failed failed yes 1389.6 apps/outline/
paperless-ngx A file-leg + postgres+redis yes no route 1 copy none upstream — refused-with-a-sentence yes 253.2 apps/paperless-ngx/
plant-it B volumes-only no no route — none upstream — not-attempted yes 78.2 apps/plant-it/
plex B volumes-only yes route failed 1 copy 1.41.4.9463-630c9f557 → 1.43.4.10903-e5521bd8c done ok yes 262.1 apps/plex/
radarr B volumes-only yes yes 1 copy 6.3.0 → 6.4.4 done ok yes 227.8 apps/radarr/
rallly B volumes-only + postgres yes route failed 1 copy 4.11.1 → 4.15.2 done ok yes 230.1 apps/rallly/
recipe-importer B volumes-only yes no route 1 copy none upstream — ok yes 123.0 apps/recipe-importer/
seerr B volumes-only yes no route 1 copy none upstream — ok yes 218.8 apps/seerr/
sonarr B volumes-only yes yes 1 copy 4.0.19 → 4.0.20 done ok yes 216.6 apps/sonarr/
sparkyfitness B volumes-only + postgres no no route — none upstream — not-attempted no 534.0 apps/sparkyfitness/
termix B volumes-only yes yes 1 copy 2.5.0 → 2.8.0 done ok no 232.5 apps/termix/
wanderer B volumes-only + meilisearch yes no route 1 copy none upstream — ok yes 400.5 apps/wanderer/

Totals: 14 no-edge · 6 proven · 5 inconclusive · 2 could-not-deploy · 1 failed — 28 of 28 recorded.