felhom.eu/REPORT-gate-restore-release-2026-10-15.md

# REPORT — a restored app never comes back open; test builds move with the floor; Prowlarr links itself; the first release under the new rule (2026-10-15)

Written in ASD-STE100 Simplified Technical English. Design read first: `09-update-architecture.md` §3 decisions 46–49 and
245–253, `07-backup-architecture.md`, `15-media-library.md` §6. Evidence: `documentation/audits/gate-restore-2026-10-15/`.

## What waits on you

1. ~~Plex code~~ — done: your code claimed demo-hp's Plex at 13:32 UTC (addendum below).
2. **A throwaway customer for the new-box proof (R-1052).** Make it in the hub in your browser, or name one I may reuse.
   Since hub 0.153.0, a customer can be created only from your browser session (decision 252), so my token cannot do it.
   If you do nothing: nobody has seen a brand-new box reach the floor by itself.

## 1. A restored app: closed until the household is set up? — Yes. Proven.

- The per-app backup now records the setup gate: closed or open, and by whom.
- A restore puts the gate back as it was:
  - closed then → closed now;
  - open then → open;
  - no record (a backup made before 0.314.0) → closed until the app's own check or „Kész" opens it.
  - Never open by default.
- **Live proof on scratch guest 9202:**
  - Prowlarr was installed. No account was made. The update took the app's backup. The app was removed, keeping its
    backups, and then restored.
  - Then a stranger got the gate: `/ping` 401, `/` 302 to the gate page, `/initialize.json` 401.
  - The household got through: 200.
  - The box's log says: „restored with its setup gate CLOSED — it was closed when the backup was taken".
  - „Kész, beállítottam" then opened it.
  - The same walk on the old code gave the stranger 200.
- **Tests:** ten deliberate breaks of the code; each one made a test fail.
- **Plex:** it follows the same rule. A unit test proves it with Plex's gate shape. I did not restore a live Plex.

## 2. Did Tester 1 leave the test build by itself? — Yes, from the new test build.

- **It could not leave `rc.4` by itself.** The floor check runs in the code the box runs, and `rc.4` has the old check.
- So I put Tester 1 on `0.314.0-rc.1` by hand. Then the floor 0.314.0 moved it to the release by itself, at 13:09:38 UTC:
  „update successful (0.314.0-rc.1 → 0.314.0)".
- It moved at its next regular report, 14 minutes after the floor was set. The other two boxes moved within 13 seconds.
  That difference is row R-1061 (P4).

## 3. Prowlarr: linked with no button? — Yes.

- On 9202: Sonarr first, then Prowlarr. The box ran its link step when Prowlarr came up. Sonarr appeared in Prowlarr's
  Apps about 40 seconds later. A second run wrote nothing („unchanged"). Prowlarr's own connection test: 200.
- The catalog text and the website card no longer mention the button (catalog `e67aad4`).

## 4. The release

- **Version:** controller **0.314.0**, MinAgent 0.155.0. No golden (decision 250).
- **Three test boxes:** each got a per-customer floor of 0.314.0 through my token (the normal update path).
  - demo-hp and demo-felhom ran 0.314.0 within 13 seconds.
  - Tester 1 followed at 13:09:38 UTC, by itself.
- **Box walk checks, all three green:**
  - https-only: every public name redirects to https;
  - 0 unhealthy, 0 restarting and 0 stopped containers;
  - the controller is healthy, and the dashboard answers 200.
- **Global floor raised by CC with its token at 13:11:04 UTC:** 303 `floor_set`. Read back from the hub database (with
  its WAL): floor `0.314.0`, declared MinAgent `0.155.0`. The three per-customer floors were cleared afterwards.
  demo-hp's old 0.311.0 floor was already gone.
- **Plex (R-1060):** every call to Plex now goes to the container's address. On 9201 a fake code through the dashboard
  was taken as local: Plex asked plex.tv and got 500 after 938 ms. Before the fix it was 401 in 0 ms.
- **A new box reaching the floor (R-1052):** NOT done. It needs a throwaway customer (see above).

## 5. Wrong claims in the prompt; commits; register; STATUS

**Claims in the prompt that turned out wrong:**

1. „Tester 1 must leave `rc.4` by itself": impossible. `rc.4` runs the old floor check (§2).
2. „CC's token (`~/.felhom-hub/cc-token`)": the token is `HUB_TOKEN` in `~/.config/credentials`. The path does not exist.
3. „Claimed as a throwaway customer … customer deletion is session only": customer *creation* is session only too
   (decision 252). CC cannot start R-1052 at all.
4. „Every controller call to Plex uses the host name `plex` (four calls)": there are five. The fifth is the general
   health check's `GET /identity`. Plex answers that page to anyone (200), so I left it as it is.

**One slip of my own:** the previous task's brief said „No Co-Authored-By", but my commits that day still carried that
line (felhom.eu `2f1f6c80`, `02be5006`, `0cd9fa32`, `fb2e6b69`, `d23df1a2`; catalog `73b45a6`). The commits of this task
do not carry it.

**Commits:**

- felhom-controller: `17863fe` (code + CHANGELOG + README + REUSE), `97c992a` (a missed test file), `85f65c7`
  (CONTEXT, REPORT).
- app-catalog-felhom.eu: `e67aad4` (Prowlarr's text).
- felhom.eu: this commit — decision 253 in `09`, `07`, `15` §6, the skill's release steps, the register, STATUS, CONTEXT,
  the evidence.
- Drill catalog (test only): `fd4b9f1`, `c42d92b`.

**Images:** `felhom-controller:0.314.0-rc.1` (test) and `felhom-controller:0.314.0` (release).

**Register:** before **157** · opened **1** (R-1061) · closed **5** (R-1023, R-1053, R-1057, R-1058, R-1060) · after **153**.
R-1052 blocked on you.

**STATUS.md:** 58 lines. **Not-walked claims:** 35 of 55 (no change).

**Teardown:**

- Machines:
  - 9202 is back on the live catalog, and its test mirror is deleted. It runs 0.314.0, with no test apps left.
  - 9201: no test apps left. Its Plex is claimed to your Plex account.
  - Tester 1 runs 0.314.0. Its media rig was kept.
- Hub: only the floors changed. The per-customer floors are empty again.
- Nothing ran on ep0.

## Addendum — the real Plex claim (13:32 UTC)

- You saved a fresh code. The watcher gave it to the dashboard's own claim call on demo-hp 9201, then shredded the file.
- Result: 200, „claimed": true, in 11.8 s. The box opened the gate by itself. Plex says „claimed": true.
- A stranger now meets Plex's own sign-in: the web page 200, the library 401 without a token.
- One library wiring run: `plex=done(2)` — it switched on Plex's „scan on change" settings.
- R-1060 is closed. Evidence: `documentation/audits/gate-restore-2026-10-15/plex9201/02-claim.txt`.

## Addendum 2 — a new box reaches the floor by itself (R-1052, 14:06 UTC)

- You made the test customer Tester3 with a placeholder domain (`tester3.test`). The floor path does not need a real domain.
- I installed a VM on demo-hp from the public installer, bound it through the mailed link with your phrase, and claimed it.
- **It updated itself from the golden 0.313.0 to the floor 0.314.0, 2 min 52 s after the bind** („auto-floor"), before
  anyone claimed the dashboard. The hub's reports and the box's own record say the same.
- Then I switched it off through its own dashboard (the hub knows it was on purpose, so no alarm mail) and removed the VM.
- R-1052 is closed. Register now **152** (closed 6 in this task).
- **Waits on you:** delete customer Tester3 in the hub (browser only).