felhom.eu/REPORT-tester1-limits-filebrowser-2026-10-17.md

# REPORT — Tester 1 back on the live catalog, decoy suites in every runner, memory limits, FileBrowser (2026-10-17)

Written in ASD-STE100 Simplified Technical English. Brief: „Tester 1 back on the live catalog (R-1022), decoy suites in
every runner, memory limits, FileBrowser's default password" (2026-10-17, operator „yes" 10:47). Design read first:
`runbooks/target-selection.md` (demo-hp), `09-update-architecture.md` (corrections L156, ladder L2259–2263, frozen
L2662), `01-topology-and-trust.md`, `03-host-agent.md`, `04-control-plane-authorization.md`, `06-offsite-connectivity.md`;
the private security-review notes (lead C1-4, read in place, nothing copied). Evidence:
`documentation/audits/tester1-limits-filebrowser-2026-10-17/`.

## Plain words first

- **Tester 1 is clean and on the live app list.** The seven test apps and four test drives are gone; bookstack,
  paperless-ngx and privatebin stay. Today's Redis change reached it.
  **Your step:** remove „plex-k6" on plex.tv (Settings → Authorized Devices).
- **Every gate runner now runs its own test cases** (controller, agent; felhom.eu already did).
- **Six memory limits raised; the 23 memory requests wait** — your answer at the STOP (they would refuse the household
  set's sixth app on an 8 GB box). Immich waits for a bigger measurement.
- **FileBrowser's default password is checked at every FileBrowser start** (controller 0.326.0, the floor for every
  box since 09:55 UTC). Measured on the scratch box before: the default came back and stayed open; after: replaced in
  2 seconds.
- **The tunnel before the claim is a design question for you, not a change** — R-1126, two options below.
- **A collision:** another session (cc-creds) filed R-1118–R-1122 while I filed mine, and its local commit carried my
  uncommitted register edits. My rows are now R-1123–R-1128; nothing was lost. Its commit is not pushed yet — I asked it
  and did not push its work.

## 1. Tester 1 (R-1022) — each step, read back (`P1/`)

| Step | Read-back |
|---|---|
| 1 apps | Sonarr, Radarr, qBittorrent, Transmission, Plex, Jellyfin, Prowlarr: stop 200, remove (keep data, keep backups) 200 each; `userdata_kept` names the media folders. Stay: **bookstack, paperless-ngx, privatebin** |
| 2 drives | `POST /api/storage/decommission` media_a, b, c, d → 200 each (`stopped_apps: null`); settings: four „decommissioned", adatlemez live |
| 3 repoint | `RESTORED-IDENTICAL`; only `repo_url` differed (diff by key); `repo_url` = live; sync `6589376 → 5d9450b` (64 stack dirs); `drill-catalog.git` (11 MB) removed |
| 4 disks | the four host mounts stopped cleanly inside the VM; `qm set 341 --delete scsi2,scsi3,scsi4,scsi5` rc 0; `pvesm free nvme-scratch:341/vm-341-disk-3/-4/-5/-6.raw` rc 0 each; the four stale `unused` lines removed; `qm config 341`: scsi0 + scsi1 only; `pvesm list`: disk-0/1/2 only |
| 5 memory | `memory: 8192` |
| 9 release | `/etc/felhom-controller-image` = 0.325.0 by the floor (no hand pin), then 0.326.0 by today's release |
| 6/7 drill | no box follows the drill (all four guests read the live URL); drill tree = live main, commit `6723057` — a normal commit, NOT a force-push (the brief's standing rule); the old drill commits stay in its history, unused |
| 8 Redis | paperless-ngx restarted: `["redis-server","--appendonly","no"]`, `aof_enabled:0`, healthy |
| walk | 10 containers, none unhealthy; dashboard 200 |

Left on Tester 1: the agent's four mount units for the removed disks (R-1124).

## 2. Decoy suites (R-1116)

| Repo | Suite | Where | Red-proof | Commit |
|---|---|---|---|---|
| controller | 22.3 s, 53 cases | full run, blocking (not `--fast`: over 20 s, and it edits real files for a moment) | one decoy flipped → `CONVICTED: gate-decoys` | `55868cb` |
| agent | 20.6 s here (5.5 s in CI), 30 cases | full run; CI runs the full set on every push | one decoy flipped → convicted | `c52d591` (script only, no release) |
| felhom.eu | 56 s, 86 cases | already in `--fast` through `script-tests` (R-885) | — | no change |

The memory index was at 202 lines (two of my morning notes); the helper removed two blank lines and I merged two lines:
199 now.

## 3. Memory (R-994) — catalog `bff82f9`

| App | Limit old → new | Peak → share |
|---|---|---|
| docmost | 512M → 768M (total 896M → 1152M) | 475 MB → 62 % |
| romm | 768M → 1024M (1280M → 1536M) | 703 MB → 69 % |
| termix | 128M → 256M | 117 MB → 46 % |
| uptime-kuma | 256M → 384M | 227 MB → 59 % |
| grafana | 512M → 768M | 435 MB → 57 % |
| tandoor | 1024M → 1280M (1280M → 1536M; its header said a stale 512M) | 827 MB → 65 % |

**Sizing effect read first:**
- The box refuses an install when its committed requests plus the new one exceed guest memory minus 384 MB
  (`stacks/deploy.go:1549`).
- The website estimator reads the measurement, not the catalog (`scripts/build_sizing_web.py:5`).
- An 8 GB box's guest is 4,096 MiB, so 3,712 MB is usable.
- The 23 measured requests would take the household set from 3,622 to 3,910 MB.

**STOP → your answer: limits now, requests wait** (R-1125, values in `P3/requests-proposed.txt`).

- **Step files:** unchanged; the same reading as for Redis holds for a limit change.
- **Live:** on 9201, after the sync and the dashboard's restart, Docmost runs with `805306368` bytes (768 MiB) and is
  healthy.
- **Immich:** not changed; R-994 is narrowed to it.

## 4. FileBrowser (R-977) and the tunnel (R-1126)

**What the box checked, and why only once:**
- At every base-stack round, the box tried FileBrowser's default login one time.
- **Accepted:** it set a generated password, checked it, and stored it encrypted.
- **Refused:** it wrote „someone set it" and never looked again.
- Why once: to leave a password the household set by hand alone.

**Measured on scratch 9202 (`P4/`):**
- **0.324.0:** I removed FileBrowser and its data volume, and the box brought them back. The default login then answered
  200 for 10 minutes, while the box still recorded „generated".
- **0.326.0-rc.1:**
  - At the controller start, the default was replaced in 1 s.
  - After a second re-create, it was replaced only 5 minutes later. The round that started FileBrowser probed it while
    it was still starting.
- **rc.2:** a new run gets ~20 s to answer. Replaced 2 s after FileBrowser came back.

**The fix:** the check runs once per FileBrowser start. A default that comes back is replaced. The household's own
password is never touched. Two tests, each red-proved.

**The tunnel before the claim:**
- **What the code and docs say:**
  - The claim needs the tunnel: the claim mail links `https://felhom.<domain>` (`hub/internal/notify/templates.go:27`).
  - The box starts the tunnel when it has a token, with no claim check (`controller` `stacks/infra.go:85-90`).
  - `01-topology-and-trust.md:119` and `:248` describe the tunnel and who runs it.
  - **No document says whether the tunnel may run before the claim** — that is the finding.
- **What a stranger can reach before the claim:**
  - the claim page: a code, 72 h life, 5 tries, 15-minute lockout;
  - FileBrowser on its default login, from its first start until the box replaces it: now 2 seconds.
- **Option A (recommended):** keep the tunnel; publish FileBrowser's address only after its default is replaced.
  Small; no promise changes.
- **Option B:** start the tunnel only after a claim at home on the local network. The claim mail and flow change, and
  the household must be at home.

## 5. Versions, commits, fixtures

- **Controller 0.326.0** (MinAgent 0.158.1, no golden), built from `334df7d`.
  - Test builds: rc.1 (`3f01277`), rc.2 (`30956aa`, the short wait).
  - Release timeline:
    - per-box floors 09:54:10 UTC;
    - all three boxes on 0.326.0 by 09:54:23;
    - box walk green (demo-hp 24, demo-felhom 9, Tester 1 10 containers, none unhealthy; dashboards 200; https-only OK);
    - global floor 09:55:58 UTC (303 `floor_set`), read back from `hub.db` + WAL (`0.326.0=0.158.1`, no per-box floor)
      and from the hub page.
  - 9202 moved to 0.326.0 by hand (it is set by hand on purpose).
  - Row-number fix: `3e8d027`.
- **Catalog:** `bff82f9` (limits), `356659d` (row number).
- **Agent:** `c52d591` (script only).
- **felhom.eu:** `fae80645` (register, evidence) and this report's commit, both waiting on the cc-creds session's push.
- **i18n:** no page changed; every fixture byte-identical.

## 6. Rows

**Before 168 (this session's start).**
- **Opened by me: 7.**
  - R-1123 (`reuse_refs` searches stray clones)
  - R-1124 (kept mount units)
  - R-1125 (requests, yours)
  - R-1126 (tunnel, yours)
  - R-1127 (no automatic full run)
  - R-1128 (the controller suite edits files without a lock)
  - R-1129 (CI's failure mail was never sent — P2, yours or mine with your word)
- **Closed: 3** (R-1022, R-1116, R-977). R-994 narrowed.
- **Opened by the parallel cc-creds session: 5** (R-1118–R-1122).
- **After: 177.**

## 7. Observations

1. A decommissioned and unplugged drive keeps its agent mount unit. FILED: R-1124
2. The 23 requests would refuse the household set's sixth app on an 8 GB box. FILED: R-1125
3. No document says whether the tunnel may run before the claim. FILED: R-1126
4. The controller and catalog decoy suites run only in a manual full run. FILED: R-1127
5. The controller decoy suite edits real tracked files without a lock. FILED: R-1128
6. `reuse_refs_check` treats stray clones beside the repo as sibling repos. FILED: R-1123
7. FileBrowser's window on rc.1 was 5 minutes, not seconds. NOT-A-FINDING: fixed in rc.2, the same release.
8. The R-513 code comment said „before a claim there is no tunnel". NOT-A-FINDING: corrected in 0.326.0; the question itself is R-1126.
9. The memory index reached 202 lines and would block every push. NOT-A-FINDING: two blank lines removed and two of my lines merged (199); the gate works as meant.
10. R-1116's felhom.eu part was already covered by `script-tests`. NOT-A-FINDING: recorded in the close.
11. The first sync on 9201 answered 429. NOT-A-FINDING: the sync's own debounce; the next try worked.
13. CI's failure mail fails in every failed run (back to 2026-09-22, three repos): „RESEND_API_KEY is empty". FILED: R-1129
12. Another session's local commit carried my uncommitted register edits, and our numbers collided. NOT-A-FINDING: the shared-clone risk is known (`felhom.eu-shared-worktree` memory); fixed by renumbering mine and asking before any push.

## 8. Teardown (three layers)

- **Machine:**
  - Tester 1: as in §1; nothing of mine left.
  - 9202: FileBrowser re-created three times (its old shares and users on that scratch box are gone by design of the
    test); the probe script removed; it runs 0.326.0.
  - 9201: Docmost restarted once.
- **Host (demo-hp):** four volumes of VM 341 deleted by name, as the row lists; nothing else.
- **Hub:** per-box floors set and cleared; global floor 0.326.0 / MinAgent 0.158.1.