felhom.eu/STATUS.md

STATUS — what works, what's broken, what's next

Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.

Updated 2026-10-14 (night). Agent 0.155.0 on all three boxes; controller 0.310.0 on demo-felhom, 0.309.0 on the other two until the floor is raised. Open items: see documentation/backlog/OPEN-ITEMS.md. Older notes, day by day: documentation/backlog/STATUS-HISTORY.md. Reports: REPORT-night-power-2026-10-13.md, REPORT-poweroff.md.

What works

• A household can switch the machine off; the hub holds alarms for 14 days and clears the state by itself (N100).
• A real power cut on demo-hp: it started by itself after all 8 cuts of the night (with the BIOS set), every app back in ~4 min; stale and recovered mails true and paired.
• The machine estimator is public (/gepigeny, /en/sizing); sizing measured for 61 apps on the N100.
• 62 apps in the catalog, the Usenet and torrent clients included. OS updates, the kernel lane too, run at night.
• The hub is closed again after the 2026-10-12 security review; one box cannot read another's data.

What is broken

• Several root-level weaknesses wait on your four decisions below (R-954, R-971, R-982, R-985).
• DooPlex: a failed disk with its alarms silenced (R-934); CI jobs still get lost (R-887); something sets the shared checkout to „bare" (R-935); a Longhorn volume at 91 %.
• Tester 2 has never made an off-site check (R-862). The scratch box cannot read the drill catalog (R-992).
• After a power cut: the half-backup that blocked every later backup (R-1006) is fixed in agent 0.156.1 — waits on your vouch; Immich keeps photos with empty previews or no original until its own repair job runs (R-1007, your decision).

What we work on

• Agent 0.156.1 (the power-cut clean-up) and the power-off button reach the boxes when you vouch and raise the floor (below); then CC proves the clean-up with one more cut on demo-hp.
• The power-cut findings (R-1004 to R-1008) and the estimator figures (R-1009, your choice).

Waiting on you — decide

#	Row	Question	Pick	The other option costs	If you do nothing	Blocked
D1	R-954	Change every box's break-glass root password, since we cannot see if the old key was used?	Yes — about one hour, one box at a time, through the vault	Accept: no work, a password that may have been read stays valid	the old root passwords stay; if they were read, they still open the boxes from the LAN or console	—
D2	R-971	Should the box refuse a catalog change that asks for dangerous container rights?	Yes — an allow-list on the box (one controller release)	Keep trusting the catalog repo: whoever can push to it reaches every box	a catalog push keeps reaching every box's apps with no check	—
D3	R-985	„Zero-knowledge": change the wording, or remove the operator's root reach to the key?	Change the wording now; revisit after the first sale	Remove the reach: a design change to break-glass	the promise stays stronger than the product	the website text
D4	R-982	Root SSH with a password from the LAN?	No — key only; the password stays for the console	Keep it: anyone on the household network can try it	the host keeps accepting root password logins from the LAN	—
D5	R-993 (R-991)	Approve the minimum machine (audits/sizing-2026-10-13/SIZING.md §5: x86-64, 4 cores, 8 GB, 256 GB SSD)?	Approve	Change it: one edit	no hardware page; a buyer with a Raspberry Pi can still download the installer	the hardware page
D6	R-992	The scratch box cannot read the private drill catalog: give it a read-only login, or make that copy readable?	A read-only login	Readable copy: the drill catalog becomes public	every new-app test needs hand-staging	new-app tests
D7	R-990, R-989	Rule yes / no / later on the forum ideas (audits/forum-research-2026-10-12/FELHOM.md §5) and the selfh.st ideas (audits/selfhst-survey-2026-10-12/FELHOM.md §6)	—	—	nothing changes; the research ages	—
D8	R-206	Install DooPlex's Docker settings from git (restarts Docker), and prune the build cache weekly: yes or no?	Yes, in a quiet window	—	a rebuild of DooPlex still has the settings in git	—
D9	R-1007	After an unclean boot, should Immich run its own repair: the „missing files" check (report a lost photo) and „thumbnails: all" (fix empty previews) in the night window?	Yes	CPU in proportion to the library (a big one: hours, at night)	broken previews stay; a lost original stays unnoticed	—
D10	R-1009	The „raise only" estimator update changes ONE verdict: 5 apps without Immich on 8 GB, fits well → tight (0.5 MB over). Publish anyway (A), round down first (B), or keep today's figures (C)?	A — the page stays truthful, one line reads stricter	B: one rule sentence, may still flip; C: nothing	the page keeps today's figures; Immich, Jellyfin, Home Assistant, Paperless read low	—

Waiting on you — do

• Vouch agent 0.156.1 + its bundle (NOT 0.156.0 — superseded; 0.156.1 includes 0.155.0); raise the floor to controller 0.310.0 with min_agent 0.155.0. If not: only the N100 has the power-off button, a fresh install gets 0.154.0, and a power cut mid-backup still blocks every later backup.
• Golden bake at the weekly slot (R-468). If not: the waiver ends 2026-10-20 and pushes stop at the gate.
• N100 BIOS: read „After Power Loss" (the HP's „Previous State" made it start after 8 of 8 cuts). HP BIOS: „Bypass F1 Prompt on Configuration Changes" → Enable.
• Pull the failed disk Z6A07P2G (R-934; the twin Z6A070XZ is /mnt/3_hdd). If not: its alarms return on 11 November.
• Hub master key into the password manager, then shred -u the key file (security review 2026-10-12, in the history).
• 12 reused homelab logins to rotate, and the repo-visibility decision (R-925, P1).
• Before the first paying customer: Tandoor permission (R-789); a lawyer for the licence list (R-802) and the terms (R-813); SparkyFitness (R-784 — its author replied on 2026-10-13); print the break-glass sheet (R-923).
• Smaller: pin the first Facebook post (R-917); Tester 2's bootstrap (R-862); look at the uncommitted deny-list edit in homelab-manifests/.claude/settings.json; the rest of „Your own tasks" (T6–T19) is in the history, 2026-10-10.