2.6 KiB
REPORT — review round 2 (2026-10-24, unattended): the documents against the code, data loss and security
Plain words first.
- The 17 design documents were checked against the code: 493 claims, 121 out of date. About 130 places are corrected or marked with a dated note; no rule, fence or promise was changed.
- About 30 things the code does that no document named are now written down for you to confirm (D44), and seven places where a document's ruling or promise says something the code does not do are waiting for you (D45).
- The worst data-loss finding: a power cut during a restore of an app on a drive can later pour old data over the household's new data (R-1251, P1). Proven with the real recovery code; it needs a fix in an attended run.
- Also proven, on the scratch box: one wrong line in an app's backup settings deletes that app's second-drive copy (R-1252, P2).
- The worst security finding: the „root logs in by key only" SSH rule also reaches a host the household owns (BYO), where we promised to change nothing (R-1257, D43). Nothing serious was found in the hub's or the controller's new routes.
Evidence and the full tables: documentation/audits/review-round-2-2026-10-24/README.md; every document edit with
its file:line in EDITS.md; the reviewers' candidates in reviewers/; the two proofs in proofs/.
Commits (CI read by hash): controller b01bb4b (two small fixes, red-proved; unreleased) — CI 2294 / #480 success;
controller 2449223 (REUSE.md) — 2298 / #481 success; felhom-agent f5c3d77 — 2296 / #261 success and catalog
227a544 — 2297 / #256 success (the rule-file alignment); felhom.eu 77015997 (documents batch 1) — 2295 / #1253
success; felhom.eu 876d9236 (batch 2, the register, STATUS, CONTEXT) — 2299 / #1254 success.
Register: before 190, after 207; opened 17 (R-1251–R-1267), closed 0.
Instruction files edited (facts only, named here): .claude/rules/unprompted-work.md in felhom-agent, the catalog
and the workspace root — the missing „A version number is pushed once" paragraph (before 95 lines, md5 3b071ad2; after
byte-identical to the other two, b1891bd4); felhom.eu/.claude/rules/live-probes.md:41 — /opt/felhom/stacks/<name> →
/opt/docker/stacks/<name>/app.yaml (the real path, and the folder stays after a clean remove).
System poster: the facts file and the html changed together (text only, the hub-DB push times); no new drawing.
Machines: 9202 used for the R-1252 proof and put back (one difference: Immich's new empty volume, R-1267). DooPlex, ep0, household boxes and the hub: not changed. No release, deploy, vouch or publish.