felhom.eu/REPORT-calibre-name-and-prune-2026-10-01.md

# REPORT — rulings 61 (calibre-web's generated login name) and 62 (the registry prune rule) — 2026-10-01 late afternoon

Evidence: `documentation/audits/calibre-name-and-prune-2026-10-01/` (A, B, T); tools in `audits/lockouts-2026-10-01/tools/`
(`a_calibre_name.py`, `lk.py`, `walk.py`, `repoint.py`).
Read: `09` §3 decisions 45, 57–60; `FIRST-ADMIN.md`; rows R-752, R-750, R-753; `audits/lockouts-2026-10-01/` B1, C1;
homelab-manifests HM-024. Baselines (~12:55 CEST): controller `c1b123c64955`, felhom.eu `8dab40c7a786`, catalog
`ed6df4b46b93` — matched. Register 390; highest R-755; last decision 60 → the rulings are **61 and 62**.

## The Part table

| Part | done / not done / changed | why |
|---|---|---|
| Rulings 61, 62 | **done** — recorded first (`09` §3, CONTEXT) | numbered 61/62: 58–60 were taken by the lockouts session |
| **A1 measure** | **done** — `hex:N` + `type: secret` already exist; calibre-web has no rename command | — |
| **A2 build** | **done** — catalog `e9f50b5` (template, hu + en copy, the freeze for those 5 strings, FIRST-ADMIN) | no controller change |
| **A3 proof on 9202** | **done** | — |
| **A4 installed apps** | **done — and a defect found** (R-757); demo-hp renamed TWICE | the box invented a name for the installed app |
| **B prune rule** | **done** — `admin/misc-scripts` `c9d5ed5`; test red-proofed; live dry-run | the running hub added to "in use" (a version in use the ruling did not name) |
| B4 runbook line | **done** — `RUNBOOK-manual-build.md` §4.1a | HM-024 lives in homelab-manifests (outside the felhom fence) |
| **C release / golden** | **not needed** | A1 needed no controller change |

## Claims in the brief that turned out wrong (or right)

1. **"The controller can generate a login name"** — right: `generate: "hex:N"` (deploy.go:1187) gives lowercase a–f and
   digits; `type: secret` is filled when empty and shown behind „Megjelenítés".
2. **"calibre-web can rename a user"** — **no command does**: `cps/cli.py` offers only `-s user:password`
   (`ub.py:1350 password_change`). Its admin page renames by setting `user.name` (`admin.py:2789`, column `ub.py:264`,
   unique). So `after_install` updates that column itself, then uses Calibre-Web's own `-s` for the password.
3. **"The OPDS door uses the same name"** — right: OPDS is limited per name (`cps/main.py:75`, `request_username`); a
   stranger's tries on `admin` never touch the real name (measured: OPDS with the real name ok after 40 tries on `admin`).
4. **Where the prune script lives** — in a repo already: Gitea `admin/misc-scripts` (`~/git/misc-scripts`). The August
   run is in its own log: `2026-08-22T16:02:20Z RUN action=prune … apply=true keep='7'`.
5. **"A template change reaches an installed calibre-web only through an Update"** — wrong in a way that matters: the
   template reached demo-hp at the next sync (images equal), and the box then INVENTED the new field's value
   (`InjectMissingFields`, R-757). My own first CHANGELOG line said "frozen until an Update" — also wrong.

## Part A — calibre-web

**9202 (drill catalog `4e18b3a`, identical to live `e9f50b5`)** — `A/A1-9202-calibre-generated-name.txt`:
install hold before the first start, opened by `after_install` at 11:02:17; a stranger polling `admin/admin123` from the
deploy press got in **0 of 31** times; `after_install` record `ok: true`; the name 10 lowercase hex characters (read
through the page's reveal); app.db: 2 users, 0 named `admin`; name + password: form ok, OPDS ok; `admin` + the right
password refused; **40 wrong tries on `admin` at 3/min (11:02–11:16) → the household at once: form ok, OPDS ok**; a wrong
password on the real name refused. Removed (drive data kept: R-756).

**demo-hp** — `A/A2-demo-hp-rename.txt`: renamed by the same method (values through stdin, never printed); a real login
over its traefik: name ok (form, OPDS), `admin` wrong. Then the box's sync injected a DIFFERENT `ADMIN_USER` into its
app.yaml (R-757, `A/A3…`); renamed again to the box's recorded value; verified (the earlier name and `admin` refused).
**The name is in `~/.config/credentials` as `DEMO_HP_CALIBRE_USER`** (backup `credentials.bak-20261001-calibre`); never in a repo.

**What any other installed calibre-web gets, and when:** at the next catalog sync (≤ 15 min) its `.felhom.yml` gains the
field and the box invents an `ADMIN_USER` for it; its login stays `admin` (after_install runs only after a fresh install).
No other box has calibre-web today (the N100 does not; Tester-2 has not registered).

## Part B — the prune rule

`tests/test-prune-plan.sh`: 7 checks pass (an in-use version older than the newest 20 is kept, with its reason; `--keep`
defaults to 20; dry-run; an unreadable in-use list → exit 3). Red-proofs: the same plan with an empty in-use list deletes
0.262.0; the in-use check removed from `is_protected` → 3 checks fail (`B/B1-test-and-red-proof.txt`).
Live dry-run (`B/B2-live-dry-run.txt`): in use — controller 0.285.0 (floor, golden's, baked), golden 0.285.0, agent
0.138.0 and 0.131.0, hub 0.126.0, felhom-samba 1.1.0. Would delete: felhom-controller 70, felhom-hub 8; every other
package nothing. **No `--apply`.** No token or password in any output (grepped for each value).

## Rows

**390 → 392.** Closed R-750, R-752. Opened R-756 (9202 remove-with-data refused), R-757 (the box invents a new secret
field's value for installed apps).

## Teardown

- **Machine:** 9202 back on the live catalog (`repo_url` read back), the same six containers; calibre-web removed through
  the product (drive data kept, R-756). demo-hp: calibre-web's user renamed (the only change there).
- **Host:** nothing. **Hub:** read only (the Configuration page, for the dry-run). **Gitea:** read only; one repo push
  (`misc-scripts`). Drill catalog reset to live (`e9f50b5`).