felhom.eu/REPORT-catalog-sweep-2026-10-24.md

REPORT — every catalog app on a fresh box, the way a family uses it (2026-10-24 → 25 night, unattended)

Plain words first.

• 65 apps: 52 work, 10 work with a problem, 0 broken; 2 are not offered for a new install (by design); Wanderer cannot run on a box without DNS (known, R-739).
• The three worst: (1) after „remove — keep backups" and a reinstall, restoring that backup breaks the app — the household's item is gone from view (Tandoor, AdventureLog; R-1269, P2); (2) that restore still says it worked (R-1270, P2); (3) „use my kept data" loaded another box's newer-dated database for Paperless-ngx, Nextcloud and Immich, and Immich never answered again (R-1271, P2). In all three the data is not deleted.
• Fixes made in the drill catalog, not live: n8n stops sending usage data out; OpenGist gets 256 MB (at 128 MB one sign-in hit the limit 443 times and swapped 98 MB). Both proven on the sweep box pointed at the drill.
• Morning: say yes to the two catalog fixes (in Monday's release list); decide D46 (Homepage behind the family gate — CC's pick: yes); delete hub host Tester4-aa9466.

Safest readings taken (the brief allowed no question): ISO 1.30.0 (the current public one, not 1.36.0); 12 GiB VM (the brief's minimum; demo-hp had 14 free); the kept-data question exists only for drive-folder apps, so volume apps were checked by a unit restore after the reinstall (that made a unit restore on every seeded app, not every fifth); „Mentés most" is local-only by design; backup/storage findings filed in their own category, not „Apps & catalog". All in the audit's head.

Table and evidence: documentation/audits/catalog-sweep-2026-10-24/README.md (the 65-row table, the findings, the R-1269 proof, D22 put-back PASS on PrivateBin and Vikunja, the drill proofs, teardown).

Architecture read: 07-backup-architecture.md §6.5 (kept data) and §8, 16-storage-physical-identity.md §5 (the internal place is the default drive — F3 NOT-A-FINDING), 10-localisation.md.

Two mistakes of this session, both caught and kept in the evidence:

1. The first drill pass ran on the live templates: I had believed the drill repo public; the box's clone failed and the controller kept its templates. Re-run through the box's local mirror (R-992's method) with a positive check before any install (DRILL-CONFIRMED). Memory note written.
2. I reverted the OpenGist fix on a wrong reading („it grows into its limit"); an automated security review flagged the lowered cap; a cgroup measurement proved the fix needed and it went back in.

Commits: drill catalog (never live) a601950 (n8n), fd23571 → c420053 (wrong revert) → 405077f + 492a17f (OpenGist). felhom.eu: this commit (audit + tools + evidence, register, STATUS, STATUS-HISTORY, capability map B1 + detail). CI by hash: in the final report.

Register: at the sweep's start 190 (other sessions filed 18 since); before this commit 208, after 217; opened 9 (R-1269–R-1277), closed 0. Notes added to R-739 (Wanderer, no DNS) and R-1267 (anonymous volumes: OnlyOffice and RomM too; 52 left after every app was removed with data).

Observations:

• FILED: R-1269 (reinstall's capture rewrites the kept unit), R-1270 (restore says ok while the app never starts), R-1271 (kept data loads another box's future-dated database), R-1272 (Homepage has no gate — operator, D46), R-1273 (registry rate limit shown as „exit code 1"), R-1274 (restore refusal advice when tiers exist but have not copied), R-1275 (drive names in Hungarian on English pages), R-1276 (empty parent folder after remove with data), R-1277 (box fixtures drifted: OpenGist, Calibre-Web, Mealie, Papra, Rallly, Vaultwarden 1.37).
• FIXED (drill, morning list): n8n usage data (a601950); OpenGist memory (405077f, 492a17f).
• NOTE on existing rows: R-739 (Wanderer), R-1267 (anonymous volumes).
• NOT-A-FINDING: F3 install default is the internal place (16 §5, by design); F4 English guide labels (the app's own words; the Hungarian copy is frozen by the copy gate); F5 Kimai in English (a Hungarian browser lands on /hu/); F6 AdventureLog 95 % (docker stats with cache; anon 75 %); database first-start lines in SparkyFitness and Dawarich (no restart, item back); Radicale IP redirect (curl without Host); NZBGet/Transmission basic-auth prompt in screenshots (the apps' own login); Vaultwarden stranger 200 (its own login page; sign-up closed).

Teardown: machine — VM 9360 and LXC 9361 (both this session's) destroyed with --purge, no disk left on nvme-scratch; Tester 1, 9201, 9202, the thin pool and the ISO untouched; the box's logs copied off first. Host — DooPlex: the session's secret files shredded. Hub — host Tester4-aa9466 left for the operator to delete. ep0 — listed, nothing removed: the host's PBS link was set up, no whole-box copy went to it; the app copies went to the Tester4 restic repository on the storage box.

Secrets: read by name through sec; the evidence was scanned for every known secret value (positive control seen) and for token shapes; one Actual Budget session token (a throwaway app) was blanked; screenshots spot-checked (passwords sit behind „Show", never pressed). No password, key or token is in this commit.

System poster: no fact on it changed. Instruction files: none edited. No release, deploy, floor, vouch, publish or live catalog push.