felhom.eu/REPORT-catalog-sweep-2026-10-24.md

# REPORT — every catalog app on a fresh box, the way a family uses it (2026-10-24 → 25 night, unattended)

**Plain words first.**
- 65 apps: **52 work, 10 work with a problem, 0 broken**; 2 are not offered for a new install (by design); Wanderer
  cannot run on a box without DNS (known, R-739).
- **The three worst:** (1) after „remove — keep backups" and a reinstall, restoring that backup breaks the app — the
  household's item is gone from view (Tandoor, AdventureLog; R-1269, P2); (2) that restore still says it worked (R-1270,
  P2); (3) „use my kept data" loaded another box's newer-dated database for Paperless-ngx, Nextcloud and Immich, and
  Immich never answered again (R-1271, P2). In all three the data is not deleted.
- **Fixes made in the drill catalog, not live:** n8n stops sending usage data out; OpenGist gets 256 MB (at 128 MB one
  sign-in hit the limit 443 times and swapped 98 MB). Both proven on the sweep box pointed at the drill.
- **Morning:** say yes to the two catalog fixes (in Monday's release list); decide D46 (Homepage behind the family gate —
  CC's pick: yes); delete hub host Tester4-aa9466.

**Safest readings taken (the brief allowed no question):** ISO 1.30.0 (the current public one, not 1.36.0); 12 GiB VM
(the brief's minimum; demo-hp had 14 free); the kept-data question exists only for drive-folder apps, so volume apps
were checked by a unit restore after the reinstall (that made a unit restore on every seeded app, not every fifth);
„Mentés most" is local-only by design; backup/storage findings filed in their own category, not „Apps & catalog". All in
the audit's head.

**Table and evidence:** `documentation/audits/catalog-sweep-2026-10-24/README.md` (the 65-row table, the findings, the
R-1269 proof, D22 put-back PASS on PrivateBin and Vikunja, the drill proofs, teardown).

**Architecture read:** `07-backup-architecture.md` §6.5 (kept data) and §8, `16-storage-physical-identity.md` §5 (the
internal place is the default drive — F3 NOT-A-FINDING), `10-localisation.md`.

**Two mistakes of this session, both caught and kept in the evidence:**
1. The first drill pass ran on the live templates: I had believed the drill repo public; the box's clone failed and the
   controller kept its templates. Re-run through the box's local mirror (R-992's method) with a positive check before
   any install (`DRILL-CONFIRMED`). Memory note written.
2. I reverted the OpenGist fix on a wrong reading („it grows into its limit"); an automated security review flagged the
   lowered cap; a cgroup measurement proved the fix needed and it went back in.

**Commits:** drill catalog (never live) `a601950` (n8n), `fd23571` → `c420053` (wrong revert) → `405077f` + `492a17f`
(OpenGist). felhom.eu: this commit (audit + tools + evidence, register, STATUS, STATUS-HISTORY, capability map B1 +
detail). CI by hash: in the final report.

**Register:** at the sweep's start 190 (other sessions filed 18 since); before this commit 208, after 217; opened 9
(R-1269–R-1277), closed 0. Notes added to R-739 (Wanderer, no DNS) and R-1267 (anonymous volumes: OnlyOffice and RomM
too; 52 left after every app was removed with data).

**Observations:**
- FILED: R-1269 (reinstall's capture rewrites the kept unit), R-1270 (restore says ok while the app never starts),
  R-1271 (kept data loads another box's future-dated database), R-1272 (Homepage has no gate — operator, D46), R-1273
  (registry rate limit shown as „exit code 1"), R-1274 (restore refusal advice when tiers exist but have not copied),
  R-1275 (drive names in Hungarian on English pages), R-1276 (empty parent folder after remove with data), R-1277 (box
  fixtures drifted: OpenGist, Calibre-Web, Mealie, Papra, Rallly, Vaultwarden 1.37).
- FIXED (drill, morning list): n8n usage data (`a601950`); OpenGist memory (`405077f`, `492a17f`).
- NOTE on existing rows: R-739 (Wanderer), R-1267 (anonymous volumes).
- NOT-A-FINDING: F3 install default is the internal place (`16` §5, by design); F4 English guide labels (the app's own
  words; the Hungarian copy is frozen by the copy gate); F5 Kimai in English (a Hungarian browser lands on `/hu/`); F6
  AdventureLog 95 % (docker stats with cache; anon 75 %); database first-start lines in SparkyFitness and Dawarich (no
  restart, item back); Radicale IP redirect (curl without Host); NZBGet/Transmission basic-auth prompt in screenshots (the
  apps' own login); Vaultwarden stranger 200 (its own login page; sign-up closed).

**Teardown:** machine — VM 9360 and LXC 9361 (both this session's) destroyed with `--purge`, no disk left on
`nvme-scratch`; Tester 1, 9201, 9202, the thin pool and the ISO untouched; the box's logs copied off first. Host —
DooPlex: the session's secret files shredded. Hub — host Tester4-aa9466 left for the operator to delete. ep0 — listed,
nothing removed: the host's PBS link was set up, no whole-box copy went to it; the app copies went to the Tester4 restic
repository on the storage box.

**Secrets:** read by name through `sec`; the evidence was scanned for every known secret value (positive control seen) and
for token shapes; one Actual Budget session token (a throwaway app) was blanked; screenshots spot-checked (passwords sit
behind „Show", never pressed). No password, key or token is in this commit.

**System poster:** no fact on it changed. **Instruction files:** none edited. **No** release, deploy, floor, vouch,
publish or live catalog push.