felhom.eu/REPORT-immich-repair-2026-10-14.md

REPORT — 2026-10-14: Immich repairs its broken photos after a power cut (R-1007)

Times UTC. Baselines: catalog 8ee687e5, controller acbbf4b3 (0.310.0), felhom.eu 3e2bdda7, agent 9b749ee7 (0.156.1, not changed). Read first: 02, 05, 07, 13, FIRST-ADMIN.md, the R-1007 row. Evidence: documentation/audits/immich-repair-2026-10-14/. No key, token, password or household file name in any file.

1. How the box asks Immich (decision 236)

Through Immich's own job queue: the controller adds, inside immich-server, the same job Immich's API adds, for the photos whose small pictures are empty — nothing else. Then it runs Immich's own lost-file check and reads its report. No key into the household's account; the household sees nothing unless a photo is lost, then a note on the Immich app page (name, date taken, „upload it again from the phone", a dismiss button). The operator gets counts only. Spike A (9202): the CLI has no job command; a household-made API key repairs only the admin's photos (a family member's was refused); Immich's nightly run reads only its database. Only the queue worked for every user (5 of 5 in 1.08 s, 0 of 50 controls touched).

2. The live proof (demo-hp 9201, one real cut, 15:25:04)

41 photos had empty thumbnail and preview files. 15 min after the controller started, all 41 were repaired in 10 s; 0 empty files left; the 120 control files untouched. No original was lost, so the household note was not exercised live (tests cover it). The operator's event was recorded as info (all repaired), not mailed. No repeat cut.

3. Versions; what waits on the operator

Controller 0.311.0 (demo-hp only, by its own floor), hub 0.150.0 (deployed with the operator present), catalog Immich block, agent 0.156.1 unchanged, golden 0.310.0. Waits on the operator: golden 0.311.0 + vouch + global floor (then clear demo-hp's own floor) to bring the repair to the N100 and Tester 1; the owner of the shared checkout's leftovers (R-1021).

4. Claims in the prompt that were wrong

• The draft id_from_name: "^([0-9a-f-]{36})-": the separator is _ (<asset id>_thumbnail.webp).
• „New catalog keys need min_controller (README ~242)": that line is the family-gate rule. min_controller refuses an INSTALL on an older box; an older controller ignores this block and installs Immich correctly — so none was added.
• „vouch / floor": a controller above the golden cannot be vouched (the hub's list holds goldens); it needs a floor with a DECLARED MinAgent (done for demo-hp).
• „mail text (hu + en)" on the hub: the operator mail is the hub's English template; the hu/en sentences are the controller's event keys. The hub adds one counts line.

5. Record

• Commits: catalog 6a1bb04; controller 8d862e4, 3b85a0c; felhom.eu 5d39171e, 822d0393, 70250ffb (hub deploy), and this one.
• Fixed in the session: a security review finding (a failing command's output could reach the log and the event) — fixed before the build. New rows: R-1020 (duration reads 0), R-1021 (the hub build builds a stale checkout).
• Register: 133 before → 140 after; this session opened 2 (R-1020, R-1021), closed 1 (R-1007); another session added 6 meanwhile.
• STATUS.md: 47 lines. System poster: no listed fact changed. Capability map: F12 (PROVEN-LIVE).
• Both plugs ON (the HP back by its countdown at 15:25:14; the N100 never cut). One real cut only.
• Teardown: 9201 — Immich removed through the product, no leftovers, bench folders removed; 9202 — the spike Immich removed twice, no leftovers; host — nothing made; hub — the deploy only.