felhom.eu/REPORT-burndown-3-2026-10-17.md

# REPORT — burndown 3 (2026-10-17): the translation gate's lost case, two limiters, family sessions, three small fixes, Redis

Written in ASD-STE100 Simplified Technical English. Brief: „burndown 3" (2026-10-17). Design read first:
`architecture/04-control-plane-authorization.md` (it had no section on the box's own password doors — added as §6.3),
`07-backup-architecture.md` (app classes, the nightly volume dump), `09-update-architecture.md` (ladder format L2257–2263,
decision 4 L156, part 5 L2325, „frozen WHOLE" L2662). Evidence: `documentation/audits/burndown-3-2026-10-17/`.

## Plain words first

- Everything in the brief is done. No STOP fired. Nothing waits on you.
- Controller 0.325.0 is the floor for every box since 08:21 UTC, after Tester 1, demo-hp and demo-felhom updated by
  themselves and passed the box walk.
- Five apps' Redis now saves snapshots. It was proven first on the scratch box, then switched on demo-hp. Every other box
  switches at the app's next start, normally the same night's backup. Tester 1 does not get it yet: it still follows the
  drill catalog (R-1022, waits on your word).
- Two findings came from live tests and were fixed before the release: the family list was converted only on the first
  family visit (now at start), and the off-site wizard said „Hibás jelszó." to English boxes too.
- One mistake of mine, fixed: my Samba test tool wrote the throwaway test-share password into its log. I removed it from
  the evidence, replaced the password before turning sharing off, and changed the tool to redact it.

## 1. Each part

| Part | Done | Note |
|---|---|---|
| 1 R-1115 | yes | the decoy moved; fixed; the decoy suite is now a gate (full run) |
| 2 R-1111 | yes | one limiter body for three doors, parallel tests red-proved |
| 3 R-1112, R-1113 | yes | fingerprints + conversion at start (found live); one household session |
| 4 R-1109, R-1110, R-1114 | yes | samba label; guard over 42 calls; one resolver for the sibling |
| 5 release | yes | 0.325.0, per-box floors, box walk, global floor, read back |
| 6 R-1096 | yes | 6a proof passed; 6b reading confirmed; 6c pushed and checked |

## 2. R-1115 — what moved

- **The decoy moved, not the gate.** Commit `326f846` (R-1102, 2026-10-16) removed gokapi's Hungarian login line. The
  case appended an English login to gokapi, so the gate had nothing to compare and rightly said OK (rc 0).
- **Fixed side: the decoy.** It now rewrites wger's existing English login in place (when the line is gone, the suite
  stops, so it cannot pass on a lost premise again). New case: calibre-web `admin123` → `admin1234`. Both: rc 1, token named.
- **Gate run time:** the decoy suite takes 196 s (measured twice). So it joined `catalog_gates.py`'s full run as
  `gate-decoys`, not `--fast`.
- **Also found:** `test_catalog_gates.py` was red on main since the night before (it counted 18 gates; 19 were registered —
  my miss last night). Fixed; now 21 with today's two.
- **Whole catalog after the fix:** the copy gate says OK. No real template convicted.

## 3. R-1110 — each call site and its verdict (42 calls, `P2-P4/r1110-census.txt`)

| Calls | Where | Verdict |
|---|---|---|
| 14 | `stacks/migrate.go` (copy, verify, cleanup, size, validate, skip set) | correct — `j.SourceNS`/`j.TargetNS` are set only by `NamespaceRoot` (accepted by name) |
| 4 + 3 | `appbackup/paths.go`, `backup/appbackup_bridge.go` | correct — `nsRoot` parameters |
| 15 | `backup/` capture, restore, tier-2, update guard, prune, kept load | correct — `nsRoot`, `sourceNsRoot` or `m.namespaceRoot(...)` |
| 1 | `api/router.go` removeStack | correct — `nsRoot` |
| 2 + 1 + 1 | `backup/removed_units.go`, `offbox_placement.go`, `offbox.go` | correct — the loop variable came from `namespaceRoot`; renamed `nsRoot` |
| 1 | `stacks/delete.go` GetStackBackupData | correct (its caller passes `AppNamespaceRoot`); parameter renamed `drivePath` → `nsRoot` |
| 1 | `web/handlers.go` appDetailsForPath | correct only while the system drive is never a storage path — now through `NamespaceRootFor` (same path on an enrolled drive) |

No live defect. Red-proofs: the six named sites before the fix; a bare call inside package `backup`.

## 4. Redis (R-1096)

**6a — the proof on 9202 (docmost, the throwaway).** The new line reached the box through a catalog (the drill, copied
into the box; no password on the box) and the dashboard's restart:
- 100/100 probe keys back;
- `aof_enabled:0`, `rdb_last_bgsave_status:ok`;
- Redis log: „Loading RDB … keys loaded: 133".
- Then the nightly volume dump, FLUSHALL (0 keys) and the backups page's restore: 100/100 back.

**Damage:**
- Old form, 64 zero bytes written into the AOF 400 bytes before its end: exit 1, „Bad file format reading the append only
  file … use ./redis-check-aof --fix". Control (undamaged copy): starts.
- New form on a full disk (1 MiB tmpfs): BGSAVE `err` („No space left on device"), the old `dump.rdb` byte-identical (same
  sha256), and after a stop without saving Redis starts on it with 50 keys.
- New form, a half-cut `dump.rdb`: Redis also refuses to start („RDB ERROR DETECTED"). The write path never leaves one
  (temp file, then rename).

**6b — the step-file reading, confirmed:**
- `09` L2259–2263: every step but the last has its own complete definition in `steps/<to>.yml`.
- `09` L2325: one press applies ONE step with its OWN definition; the last step is the current template.
- Code: `stacks/ladder.go:152` `nextLadderStep`, `:110` the step file path, `stacks/pin.go:336` `advancePinTo` pins that file.
- A frozen app gets nothing: `09` L2662; `sync/sync.go:545–546` (pinned and equal → the catalog template, fixes flow;
  pinned and different → the stored definition, frozen whole).
- Nothing says a step file must change with its final template. `check-test-record.py` rule 4 checks only that a step
  file names its step's images. **Step files unchanged** (romm 2, docmost 1, nextcloud 2, immich 2).

**6c — the change** (catalog `5d9450b`, pushed 07:31 UTC). Boxes read from the hub right before the push:
- demo-hp: romm, docmost, paperless-ngx;
- Tester 1: paperless-ngx;
- demo-felhom: none of the five;
- scratch 9202 (not hub-reporting): paperless-ngx, immich.

Checks after the push:
- **demo-hp 9201:** sync, then the dashboard's restart of each app. All three run `--appendonly no`, `aof_enabled:0`,
  `rdb_last_bgsave_status:ok`, and are `running`. Keys stayed: RomM 153→150, Docmost 54→58, paperless 2→4 (the apps add
  and drop their own keys).
- **9202:** the compose holds the new line; it switches at the next start.
- **Tester 1:** not reached. It syncs from a drill copy inside the box (R-1022); its paperless still runs AOF.

**One finding for the record:** sync alone does not restart a running app. The new line runs from the app's next start,
which the nightly backup gives every app.

Also done:
- gate `redis-persistence` (`--fast`, 9 decoy cases, red-proved);
- a `07` [DESIGN] paragraph;
- the research file updated;
- R-1117 opened for the deferred volume removal.

## 5. Versions, commits, fixtures

- **Controller 0.325.0** (MinAgent 0.158.1, no golden), built from `68af0e9`.
  - Test builds: rc.1 (`94f4493`), rc.2 (`6ed2238`, the family store opens at start).
  - Docs: `88aa65d`. Census correction: `85d60a1` (no new image).
  - CI green: 1979, 1981, 1982.
- **Catalog:** `33a4b3b` (R-1115, CI 1977) and `5d9450b` (Redis, CI 1978).
- **felhom.eu:** `0314b8e7` (`reuse_refs_check.py`, R-1114, CI 1980), then this report's commit.
- **i18n:** no page changed; every parity fixture byte-identical. The escrow fix reuses the existing key
  `login.msg.wrong_password` (same Hungarian bytes).
- **Drill catalog repo** (scratch): `9bad48a` (its tree set to live main), `daff3d2` (docmost's Redis line, for 6a).
- **Release timeline:**
  - per-box floors 08:20:02 UTC;
  - all three boxes on 0.325.0 by 08:20:16;
  - box walk green (24 / 9 / 17 containers, none unhealthy; dashboards 200; https-only check OK);
  - global floor 08:21:31 UTC (303 `floor_set`), read back from `hub.db` + WAL (integrity ok, `0.325.0=0.158.1`, no per-box floor) and from the hub's page.

**Instruction file edit** (allowed by §5): `app-catalog-felhom.eu/CLAUDE.md` L54–56.
- Before: „every gate except `image-resolvable` and `volume-persistence`".
- After: the same, plus `gate-decoys` with its ~3 minutes.
- Why: that gate is new today and is not in `--fast`.

**Poster:** no fact on `felhom-system-poster.facts.md` changed.

## 6. Rows

**Before 174. Opened 2** (R-1116, R-1117). **Closed 8** (R-1115, R-1111, R-1112, R-1113, R-1109, R-1110, R-1114, R-1096).
**After 168.** R-1022 got one dated sentence (the drill repo's state). `unproven.py`: NOT WALKED 35 of 55, unchanged.

## 7. Observations

1. The catalog's own runner test was red on main since 2026-10-16 night. NOT-A-FINDING: fixed today (count 18 → 21).
2. The controller, agent and felhom.eu runners do not run their own decoy suites. FILED: R-1116
3. The family store opened (and converted an old file) only on the first family request, so a box nobody visits through a family gate kept the old values. NOT-A-FINDING: found live on rc.1, fixed in 0.325.0 before release.
4. The escrow re-auth answered a wrong password in Hungarian only. NOT-A-FINDING: fixed in 0.325.0 (small).
5. A stacks test wrote the update journal into its package folder; the R-578 walk tripped on it once. NOT-A-FINDING: fixed (small); a probe run proved no other test does it.
6. Through the dashboard a share rename already applied before R-1109 (delete and add each change the compose). NOT-A-FINDING: recorded in R-1109's close; the label covers a controller update that changes smb.conf alone.
7. Sync alone does not restart a running app; a catalog fix runs from the app's next start. NOT-A-FINDING: by design (decision 4 keeps fixes flowing; the nightly backup restarts every app).
8. Tester 1 did not take the Redis change. NOT-A-FINDING: it follows the drill catalog by your ruling (R-1022, note added).
9. On 9202 a catalog URL change to the private drill repo made the clone fail and left the box with no templates until I pointed it back. NOT-A-FINDING: my own setting change on a scratch box; the running apps kept their definitions; the next good sync restored them.
10. Immich and Nextcloud keep a Redis volume they do not need. FILED: R-1117
11. My Samba tool logged the throwaway test-share password. NOT-A-FINDING: my tooling; scrubbed, the password replaced, the tool redacts now.
12. `setup-gate.key` sits beside `family.json`, so someone who reads the data folder could still forge a family app cookie. NOT-A-FINDING: reading that folder already gives every key of the box; R-1112 removed the one value that worked without a key.
13. The launcher asks for SVG logos that do not exist (404). NOT-A-FINDING: as last night — it falls back to the PNG.

## 8. Teardown (three layers)

- **Machine:**
  - 9202: docmost removed through the product (no volume left), the catalog setting put back (live catalog, controller
    restarted), the damage-test folder removed, no `r1096-*` container left. 9202 now runs controller 0.324.0 → it was
    0.314.0 before; I moved it to 0.324.0 by hand for the proof (it is set by hand on purpose, `nodes.md`).
  - 9201: MeTube removed through the product (its empty media folder removed by hand), sharing turned off, the test
    shares and their folder removed, the test password replaced first. 9201 runs 0.325.0.
- **Host:** nothing.
- **Hub:** per-box floors set and cleared; the global floor raised to 0.325.0 / MinAgent 0.158.1.