felhom.eu/REPORT-evening-2026-10-18.md

# REPORT — evening → night 2026-10-18

## How I read the brief

- **Part 5, R-1135:** the brief says the mail should use the public Gitea URL — the register row says the same, and that
  is what was done (the CI helper first read the brief's wording the other way round and followed the row).
- **R-1052** was already closed (2026-10-15); Part 1 proves R-1148 and re-proves R-1052's path with tonight's golden.
- **Part 6, Immich:** 9202's Immich lives on `/mnt/sizing-bench`, a hand-made bench folder outside `/mnt/felhom-drives/`,
  so the allow-list refuses its definition (see Observations); the restore half of the measurement ran on Nextcloud.
- **The operator kept Tester4** (asked at 21:20): not deleted; its old host must go before its next install (R-1154).

## In plain words

- **The morning list:** vouch golden 0.331.0; say yes or no to the agent release with three fixes; two decisions (one
  sign-in, local backup retention).
- **A brand-new box from nothing works end to end** with installer 1.34.0: emergency password saved in the hub first,
  then set, then the web login took it; the approved golden and agent; the box moved itself to the floor.
- **OnlyOffice now really works** from FileBrowser and from Nextcloud. Before tonight FileBrowser could not open a
  document and Nextcloud lost every save while saying „saved". Fixed in controller 0.331.0, now the floor for every box.
- **One sign-in for the file manager can be built safely**, but only with two safeguards — measured, design note written.
- **Three agent fixes are written and tested, not released.**
- **CI:** the failure mail's link opens from outside; the 5-minute CI timeout never worked (filed); a rerun hides the
  first try's log, and the check now looks for it.
- **Redis for Immich and Nextcloud has no disk volume any more**, after a test; the test found that removing an app left
  an old volume behind — fixed too.
- **Golden 0.331.0 is baked** (not vouched).
- **The old-restic check:** §9.

## 1. The morning list

1. **Vouch golden 0.331.0** — sha256 `3881de62b0986ccbe5e55580e3f1bb9765d65b8d898f67c6339bac105244f84f` (registry round
   trip = the bake), agent 0.159.2 unchanged, **Min agent 0.158.1**.
2. **Agent release (R-978, R-973, R-1093) — may I?** If yes: release, prove on demo-hp, ask for the vouch.
3. **Decide D16** (R-1100: build one sign-in with the two safeguards?) and **D17** (R-1149: local whole-box backups
   „last 3" or „one per day, 3 days"?). STATUS has both.
4. Before Tester4's next install: delete its old host `Tester4-31fa0e` (Hosts page).

## 2. Fresh install from nothing (R-1148, R-1052) — `audits/newbox-2026-10-18/`

| UTC | Step | Result |
|---|---|---|
| 17:42:21 | Tester4 created by the operator | bind mail sent |
| 17:43:15 | VM 9302 `newbox-r1148` on demo-hp, ISO 1.29.0 (sha = published) | 8 GB / 4 cores / 120 GB on `/mnt/hdd_1` root |
| 17:50:19 | Install pressed (graphical, Hungarian keyboard kept) | installed, rebooted, pairing code on the console |
| 18:02:58 | bind: mailed link + pairing code + owner phrase (operator's 0600 file, shredded) | „Sikeres összekötés" |
| 18:03:43 | step 4b: vault → chpasswd → PVE login | `[OK] … vaulted, set, and the PVE login takes it`; hub `set_at` same second |
| 18:03:44 | step 5: the hub manifest | agent **0.159.2**, golden **0.329.0** — the vouched pair, both sha-verified |
| 18:05:37 → 18:05:51 | first controller reports | 0.329.0, then **0.330.0** (`initiated_by: auto-floor` at 18:05:38) — 2 min 47 s after the bind |
| 18:17:14 | CC's PVE login from DooPlex | vaulted value **200**, installer value **401** |
| 18:18:32 → 18:20:05 | claim (setup code mail), BentoPDF | claimed; BentoPDF healthy |
| 18:24:15 | household „turn off" | hub `deliberate_off_at` set; VM stopped |
| — | teardown | name read twice, VM 9302 destroyed, disk gone; other VMs untouched; Tester4 kept (operator) |

## 3. OnlyOffice (R-1018) — `audits/onlyoffice-2026-10-18/`

On 0.330.0: FileBrowser → the editor loaded, the document never did (OnlyOffice fetched `https://files.<domain>` → 403);
Nextcloud → edit and „All changes saved", but the file kept the old text (`http://onlyoffice:80cache/…`). Switching the
link on/off left files.<domain> 502 for 4 min 8 s / 3 min 38 s. **Fixed (controller 0.331.0):** FileBrowser
`server.internalUrl`, Nextcloud's slash, the gate after a FileBrowser restart. On rc.1: both open, edit, save, read back
(„… RC1-FB-OK", „… RC1-NC-OK"); the stop revokes both (no editor; Nextcloud 404); the stop's outage one 2-s sample.

## 4. One sign-in spike (R-1100 → READY) — `audits/proxyauth-spike-2026-10-18/DESIGN-NOTE.md`

Traefik forwardAuth strips a client's header (any case, twice) and its own value wins — measured. But an app container
reaching FileBrowser directly logs in with a forged header (200), and the dashboard cookie never reaches `files.`. Verdict:
build only with a files-only ticket cookie and a per-box secret header name. Everything on 9202 removed (users, routes,
stand-in container, config).

## 5. Agent fixes (committed, NOT released) — felhom-agent `REPORT.md`

R-1093 `f7b7308` + `0963bae` (and a fail-open hole closed after a background review), R-978 `8561dc8`, R-973 `f17e197`;
tests and red-proofs for each; CI job 2062 success. R-1093 live: a loop disk on demo-hp showed the probe's condition holds.

## 6. CI (R-1135, R-1136, R-1137 closed)

Link public and by run id (forced mail 18:46:01Z, job 2067, one mail). The runner's real limit is 3 h; the job-level
5-minute timeout is not enforced (R-265 corrected; R-1152 for the step-level one). A rerun replaces the job's attempt; the
pull-check recipe in `CLAUDE.md` now reads `actions/tasks` (instruction-file edit by the CI helper: felhom.eu `CLAUDE.md`
CI recipe, item 3 added — a proven fact, stricter; `b9b56c47`).

## 7. Redis volumes (R-1117 closed) — `audits/redis-volumes-2026-10-18/`

(a) Both apps healthy on the new shape; Immich's metadata job ran (0 → 11, 0 failed); Nextcloud `cron.php` rc 0, WebDAV
200. (b) The dump skips the dropped volume (the old tar gone from the unit); a second-drive restore from a copy made WITH
the volume: 3/3 volumes, 1/1 database, healthy — it brings back that copy's compose (by design). (c) The old volume stays
attached under the tmpfs; **a removal left it behind** — fixed (controller 0.331.0, red-proofed). Templates changed
(catalog `30eea97`); Nextcloud on 9202 took it through the sync + restart (tmpfs, `save ""`).

## 8. Controller release and golden — `audits/evening-2026-10-18/P7/`, `tests/golden-0.331.0-2026-10-18/`

0.331.0 (digest `1b11d25a…`): per-box floors 20:44:00 → all three on 0.331.0 within 20 s; box walk green (0 refusals,
0 unhealthy, FileBrowser re-published in 5–6 s, public pages 200 after one 20-s blip each on two names, https-only 28 OK);
**global floor 0.331.0 / 0.158.1 at 20:48:56 UTC**, read back with the WAL; per-box floors cleared. Golden 0.331.0 baked
after it, round trip = bake sha, token checks 0 with a working control, teardown clean. No controller push after the bake.

## 9. The old-restic check (Part 8)

**Done 2026-10-19 by the watcher** (filled in by the day session, `audits/evening-2026-10-18/P8/old-restic-check.txt`):
demo-hp's clean-up window 12 ran at 02:17:53–02:18:24 UTC after the night run — „63 of 193 planned snapshot(s) removed,
324 -> 261" (the hub's row: `pruned`, 324 → 261). Then `rx.sh` (read-only): the new restic (0.19.1) and the OLD one (image
0.322.0, restic 0.14.0) both list **261**; both restore `c0b6299c` (made by 0.19.1, 02:17:48) to the same content hash
`d808e6537c7bcdb6` (7 files) and `05c3346a` (2026-08-31) to `8df241f4cf889265` (10 files). The old restic still reads and
restores demo-hp's store after its first real 0.19.1 prune. (Pre-check at 20:57 UTC: 310 and 310.)

## 10. Versions, commits, fixtures, rows

- Controller **0.331.0** — `772ef36`, `8ae9178` (+ `615940d` CI); rc.1 on 9202 only. Agent `main` `f7b7308` `8561dc8`
  `0963bae` `f17e197` `79ba884` `1693da4` — unreleased. Catalog `c97eb1c`, `30eea97`. felhom.eu `1fe9f848`, `b9b56c47`,
  this commit. Golden **0.331.0** baked. Hub unchanged (0.158.0).
- Fixtures: none changed — no page changed.
- **Register: 168 before, 168 after; closed 6** (R-1148, R-1018, R-1117, R-1135, R-1136, R-1137), **opened 6**
  (R-1149, R-1150, R-1151, R-1152, R-1153, R-1154). Updated: R-1100 (READY), R-978, R-973, R-1093 (fixed in agent
  `main`), R-265 (corrected).

## Observations

1. Installer password, golden and agent all proven in one fresh install. — closes R-1148 (not a finding).
2. FileBrowser's office preview answered 500 with the link on. FILED: R-1153.
3. A reinstall reuses an old host and skips two re-issues; now recurring with the kept Tester4. FILED: R-1154.
4. The R-973 cap leaves the local keep-last 3 floodable within a day. FILED: R-1149.
5. The cap's refusal reaches the operator with a misleading event text. FILED: R-1150.
6. R-978's typed-back confirmation is browser-only. FILED: R-1151.
7. The CI job timeout is inert. FILED: R-1152.
8. 9202's Immich sits on `/mnt/sizing-bench`, outside `/mnt/felhom-drives/`, so the allow-list refuses its definition every
   15 minutes since 0.328.0 and a restore of it is refused. NOT-A-FINDING: the check works as designed; the folder is a
   hand-made bench artifact (R-994), not a shape a real box has.
9. A restore brings back the backup's own compose (the old Redis volume with it). NOT-A-FINDING: by design (R-47: the
   unit's compose becomes the live one); the older shape works.
10. My commit `7f7081d1` (day session) carries a „Co-Authored-By" trailer, against both briefs' rule 10. NOT-A-FINDING:
    my slip; it is pushed and cannot be rewritten without a force-push (forbidden); no later commit has one.
11. I started the catalog's FULL gate run on DooPlex, whose third gate starts containers. NOT-A-FINDING: stopped at gate 2
    (a network check), no container was made (checked), the fast run used instead.
12. One OnlyOffice „Connection is lost" on the first rc.1 attempt, after two blind clicks. NOT-A-FINDING: not reproduced;
    the next attempt saved; no container restarted in between.
13. Two public names answered 000 once in the box walk. NOT-A-FINDING: 18 of 18 retries answered 200 in < 0.2 s.
14. The R-1100 row named the config key `proxyAuth`; it is `auth.methods.proxy`. NOT-A-FINDING: corrected in the row.

## Teardown — three layers

- **Machines:** VM 9302 destroyed (its disk gone). 9202: OnlyOffice and Nextcloud removed through the product (their
  volumes, data and backup copies), the test documents deleted, the spike's route file, container, FileBrowser users and
  proxy setting removed, helper files and the Immich scratch password shredded; Immich keeps the new Redis shape by hand
  (= the template); 9202 on controller 0.331.0. `nextcloud_nextcloud_redis_data` (the orphan the pre-fix
  removal left) removed by name afterwards; no Nextcloud volume remains. demo-hp host: the loop-disk file removed. Drill VM: CT 9100 purged, VM off,
  disk `virgin`.
- **Hub:** global floor 0.331.0 / 0.158.1, no per-box floor; Tester4 and its host `Tester4-31fa0e` kept (operator); no
  vouch, no deploy.
- **DooPlex:** builds and the golden bake only; the headless browser as a test client; no Docker cleanup.

Architecture read: `01`, `02`, `03` §8a, `04`, `05`, `07` §6/§8, `09` §3 decisions 162/250; `target-selection.md`,
`nightly-rotation.md`, `RUNBOOK-manual-build.md` §4. Documents changed: `03` §8a, `07` §6.1 and §8 row 10,
`target-selection.md` (Tester4). System poster: none of the three (no listed fact changed). `unproven.py --summary`:
not walked 35 of 55 — unchanged.