felhom.eu/REPORT-burndown-apps-2026-10-16.md

REPORT — apps burndown: RomM saves, the false „shared password" line, FileBrowser, the Data tab, the install address, the build guards, the Pi key (2026-10-16)

Written in ASD-STE100 Simplified Technical English. Operator brief „apps burndown", daytime, operator present. Design read first: architecture/02-controller-module-map.md „The app page" (now with the v0.321.0 notes), 07-backup-architecture.md (what an app backup holds — a fact added), 09-update-architecture.md §0. Evidence: documentation/audits/burndown-apps-2026-10-16/.

The operator's word before the start: no RomM saves need to be kept or copied on any box. So Part 1 has no one-time copy, and no stop for the N100.

1. RomM saves (R-1097) — done

• Measured first (demo-hp 9201): RomM writes saves to /romm/assets; the image keeps /romm as an anonymous volume; the compose mounted nothing there. Every RomM backup on the drive held only romm_config, romm_db_data, romm_redis_data — no saves. In the code, the app backup takes only the named volumes the compose declares. P1/p1-measure.txt.
• Fix (catalog 326f846): a named volume romm_assets:/romm/assets, in the compose and both older step files. A named volume is the catalog's normal place for app data (07 §6.2), every app backup takes it, and the restore brings it back. New catalog gate image-volumes (a measured list of image data paths that must be mounted).
• Survey: no other running app on demo-hp keeps data in an anonymous volume (PrivateBin's are temp folders). P1/anon-volumes-demo-hp.txt.
• Proof, through the product's endpoints (tools/romm_saves.py, P1/romm-saves.txt): sync → restart (the new volume mounted) → a 32 KiB save file written into /romm/assets with docker exec → the by-day backup run (night chain, 5 min 32 s; its update leg did nothing) wrote romm_romm_assets.tar → RomM removed, keeping backups (the volume went) → restored from the backups page (77 s) → the save back, byte-identical (sha256). The dummy file removed after.
• Boxes: the hub shows RomM only on demo-hp (the N100 had it once, on 2026-10-13). P1/hub-romm-boxes.txt.

2. Parts 2–7

Part	Result
2 — the false „shared password" line (R-1102, D10 = A)	Done. default_creds removed (hu + en) from the eight; copy freeze re-captured with the reason; a catalog test, red-proved. Live on demo-hp: the line is on none of their app pages or install pages (live/d10-check.txt). The user name „admin" stays in the first steps of grafana, gokapi, nzbget, transmission.
3.1 — FileBrowser's stale password (R-1101)	Done (controller 0.321.0). The „change it" line is gone for FileBrowser; the page checks the stored password with FileBrowser first and, refused, says so and offers the new-password press. Only FileBrowser's own 401/403 counts.
3.2 — FileBrowser's own banners	Done. server.disableUpdateCheck (backend/common/settings/structs.go:51, read at backend/cmd/root.go:66) and frontend.disablePWAInstall (structs.go:294, sent at backend/http/static.go:300) at the pinned tag, set in the rendered config. In the browser, logged in: no „update is available", no „Install app", disablePWAInstall: true, updateAvailable: "". Control: the 2026-10-16 screenshot logins-folders-2026-10-16/browser/cold-romm-2-after-login.png shows the banner before.
4 — the Data tab's backup part	Done. One section, rows, plain words; the value column in the UI font; the export eye is the text „Megjelenítés"/„Elrejtés" with aria-label. Changed keys: tier2_config.a_2_mentes_egy_masik, .csak_db_konfiguracio, .jelenleg_csak_a_belso_ssd, .nincs_elerheto_off_drive_cel, .nincs_masik_adatmeghajto_automatikus_cel, .rendszerlemez.vedett, note.tier2.no_space_ssd, note.tier2.reason_no_second. No eye icon exists in the dashboard's icon set, and adding one would change every page's fixture, so the button is the text the other reveal buttons use.
5 — the install address (R-1095)	Done (302 to the settings tab, GET only). The template clean-up is NOT done: the installed-only branches of app_fields.html are pinned by the R-254/R-709 guard tests, which assert a reveal control on that path; removing them means retiring those tests — filed R-1103.
6 — the build guards (R-1098)	Done. build-hub.sh 1.25.0 refuses an existing tag and an unanswered registry (6 cases, red-proved). The agent's release-agent.sh had the check but let an unreachable registry through; now only a clean 404 proceeds (5 cases, red-proved). Script changes only: no hub image, no hub deploy, no stop needed.
7 — the Raspberry Pi key (R-1067)	Not done, as the brief says: Tester-2 still reports controller 0.292.0 (newest report 2026-10-04). Its name is in the row. P7-pi-fleet.txt.

3. Browser check (headless Chrome through https://felhom.enkisfelhom.hu) — browser/

tools/cdp_burndown.py. Calibre-Web's Data tab: one backup section, rows nightly/second/target, no off-drive/PBS, value font Plus Jakarta Sans, the export toggle with its label. FileBrowser's page: the reveal, no „change it" line. /apps/calibre-web/install landed on /apps/calibre-web/settings. FileBrowser itself: no banners. No console error; no page wider than the window.

4. Versions and commits

• felhom-controller c02c9d8 → 7e791d9 → docs. 0.321.0-rc.1 (demo-hp), release 0.321.0, MinAgent 0.158.1. Tester 1, demo-hp and the N100 took it through per-box floors; nothing unhealthy, restarting, exited or created; the three dashboards 200; https-only 35 names OK; each box's FileBrowser config carries both switches. Global floor 0.321.0 / MinAgent 0.158.1, the per-box floors cleared (release/).
• app-catalog-felhom.eu 5630979 → 326f846 (RomM volume, gate image-volumes, D10) → docs.
• felhom-agent 3835224 → dd8b2ac (script and test only; no release).
• felhom.eu 11fa13ee → this commit (build-hub.sh 1.25.0, its test, the register, design notes, STATUS, evidence).
• Fixtures replaced (13): app_data_deployed, app_data_export, app_data_files_media, app_data_not_hdd, _not_hdd_absent, _not_hdd_protected, _not_hdd_same_disk, _notarget_disabled, _target_auto, _target_ssd, app_settings_deployed, app_settings_operator_creds, app_settings_infra_filebrowser. New (1): app_settings_infra_filebrowser_stale. Every other fixture, the install page's included, byte-identical.
• Red-proofs: redproof/ (controller 6 + 1 redo, catalog 2 gates + 1 test, hub build, agent).

5. Rows

Before 179, after 175. Closed 5: R-1097, R-1102, R-1101, R-1095, R-1098. Opened 1: R-1103. R-1067 stays BLOCKED, now naming Tester-2.

System poster: no listed fact changed — none of the three was needed.

6. Observations

1. The install form keeps branches no page serves any more. FILED: R-1103
2. Reading the hub's database by copying its three files one by one gave a STALE floor (0.320.0, 30 s after 0.321.0 was set); one tar of the three files and the hub's own page both read 0.321.0. NOT-A-FINDING: an evidence technique, not a product defect; the memory recipe is corrected to one tar.
3. The by-day backup run (night chain) also runs the update leg and the off-site push. NOT-A-FINDING: it is the sanctioned trigger, documented as „the night chain, by day"; here the update leg did nothing (kimai held).
4. No live control exists for the „known, shared password" line any more: the eight apps were the only ones that showed it. NOT-A-FINDING: known_login_test.go is the mechanism control and passes.

7. Teardown (three layers)

• Machine: demo-hp 9201 — RomM removed and restored (it runs, healthy, with its new saves volume); the dummy save file removed. FileBrowser recreated once on each box by the config change (the password survives: its database is in its volume). Nothing else changed. The N100: only the normal release update.
• Host: nothing.
• Hub: the three per-box floors set and cleared; the global floor raised to 0.321.0 (the release).