7.7 KiB
7.7 KiB
D44 and D45 — one line per note, with CC's pick (prepared 2026-10-24 night)
Answer „all picks" or name the ones you disagree with. Rows: D44 = R-1265 (decisions the code takes that no document named), D45 = R-1266 (rulings or promises the code does not do as written). Count: 25 + 7 = 32 (the review said „about 30" for D44; 25 is the number of notes actually written). Each line: what the code does · the risk if it is wrong · the pick · the cost. „Confirm" = the note loses its „undocumented" tag and stays as written.
D44 — safe to confirm (21)
| # | Where | What the code does | Risk if wrong | Pick | Cost |
|---|---|---|---|---|---|
| 1 | 03 local API |
41 routes; 24 are not listed in 03 (one starts a host action: the 55 s line test) |
a review that reads 03 misses what a guest can ask the host |
change the document (list every route) | docs only |
| 2 | 07 §8.2c |
a second-drive copy stops at 60 min; a stray copy blocks restores; one copy per destination at a time | a first copy of a very large library takes several nights | confirm | none (rsync resumes each night) |
| 3 | 07 §8.2c |
„Eltávolítás" of a kept copy is refused while a backup, restore or copy runs | none — a refusal, said on the page | confirm | none |
| 4 | 07 §8.2c |
a start that fails AFTER a good put-back leaves the app stopped, not held | none — the data is as before; Start is safe | confirm | none |
| 5 | 07 §8.2c |
the hub's off-site delivery check skips a box that waits for the recovery code | a box stuck there is not alarmed as „stuck" | confirm | none (the box says it waits) |
| 6 | 07 §8.2c |
the nightly release copy to ep0 (D33) has no row in the recovery matrix | a reader of §8 does not find it | change the document (add the row) | docs only |
| 7 | 09 §6.4.x |
build.sh --push also refuses a dirty tree, a HEAD not at origin/main, a non-git directory |
none | confirm | none |
| 8 | 09 §6.4.x |
the night leg retries a „busy" refusal once in the same night | none | confirm | none |
| 9 | 09 §6.4.x |
the night leg skips an app the household stopped (an update would start it) | none — R-721's own rule | confirm | none |
| 10 | 09 §6.4.x |
a manual chain run gives the leg its normal length as the deadline, not W+5 h | none | confirm | none |
| 11 | 09 §6.4.x |
already_current and engine_no_test are plain skips |
none | confirm | none |
| 12 | 09 §6.4.x |
an unreadable catalog template leaves the app's compose alone that cycle | none — the safe side | confirm | none |
| 13 | 09 §6.4.x |
the R-971 image allow-list runs before ANY compose write | none — the safe side | confirm | none |
| 14 | 14 |
a re-enroll during the power-off hold counts as „gone" (a reinstall) | none known | confirm | none |
| 15 | 14 |
setting and clearing the off time each make an info event, not mailed | none | confirm | none |
| 16 | 14 |
the confirmation word is accepted as „KIKAPCSOLÁS", „KIKAPCSOLAS" and „TURN OFF" | none | confirm | none |
| 17 | 15 |
the Sonarr/Radarr API key is read from /config/config.xml |
an upstream format change breaks the wiring (loud, not silent) | confirm | none |
| 18 | 16 |
systemd-detect-virt is read once per agent process; empty → „unknown" |
none — fail-closed | confirm | none |
| 19 | 16 |
a path the controller cannot read counts as the SAME disk (no second copy claimed) | none — fail-closed | confirm | none |
| 20 | 16 |
the internal place refuses eject, decommission and wipe; moving its data is allowed | none | confirm | none |
| 21 | 16 |
the internal place's size subtracts every thin volume already promised | none — the safe side | confirm | none |
D44 — the few that matter (4)
| # | Where | What the code does | Risk if wrong | Pick | Cost |
|---|---|---|---|---|---|
| 22 | 04 §2 |
a signed operation's window has no maximum length (felhom-opsign defaults to 30 min) |
a signed job made with a long window by mistake stays usable for that whole time | change the code: the agent and the root wrapper refuse a window longer than 24 h | one small agent change + test; rides an agent release |
| 23 | 13 (file manager sign-in) |
FileBrowser trusts its proxy header; the only guard is that the header NAME is a per-box secret, and every app container can reach filebrowser:80 |
an app that learns the name (a hacked app on the box) reads and writes every household file | change the code: FileBrowser joins only the network traefik uses, so no app container reaches it directly | a compose/network change in the controller + a live check; one release |
| 24 | 15 |
the „Később" 03:30 media restart is an in-memory timer — a controller restart forgets it (only the notice stays) | media apps do not see the new drives until the household presses „now" | change the code: store the due time and run it after a restart | small controller change |
| 25 | catalog c50adfc (R-1019) |
MeTube, NZBGet and SABnzbd downloads are excluded from every backup, like qBittorrent and Transmission | MeTube downloads may be gone from their source site — on a drive failure they cannot be fetched again | change the catalog for MeTube only: optional (the second-drive copy carries it; off-site does not); NZBGet/SABnzbd stay excluded (re-downloadable) |
second-drive space for MeTube's folder |
D45 — the text or the code (7)
The default pick is „the text follows the code" wherever the code is the safer or the decided behaviour; CC then rewrites each passage and you read the diff.
| # | Where | The document says | The code does | Risk | Pick | Cost |
|---|---|---|---|---|---|---|
| 1 | 09 decision 13 |
the tag rule moves to the catalog gate | it stays in the controller (updateorder.go:134) |
none — the controller check is the safe one | text follows code | docs only |
| 2 | 09 decision 14 |
a box „never jumps" versions | a PERSON's press on an app older than the ladder takes the catalog's current definition; the night leg never jumps | a big jump can fail — the guarded update undoes it | text follows code (say: the night never jumps; a person's press may) | docs only |
| 3 | 09 decision 250 item 5 |
the golden gate judges by AGE while the floor is above it | the gate cannot read the floor; it uses „release ahead" | none — the gate is stricter | text follows code | docs only |
| 4 | 01 §1/§4 |
„the hub never connects into a box", „no inbound control endpoint", „no standing operator backdoor" | the hub sends a UDP poke (no command) through ep0; the operator's WireGuard peer reaches the operator door (felhom-sshd) | a household reads a promise that is not exact | text follows code, with the exact words: a poke carries no command, the box still pulls; the operator door is the documented break-glass | docs + the website check (R-985 style) |
| 5 | 03 §5, 06 §6 |
break-glass „via the Cloudflare Tunnel behind Access"; „no inbound listener" | old text — the break-glass is the operator door over WireGuard | none in code; the text misleads | text follows code | docs only |
| 6 | 01 §8 |
the operator „cannot open / read" the off-site backup | the operator holds the retained escrow key and can open an old store (R-985 already softened the website) | a promise to the household that is not exact | text follows code, in the words the website already uses | docs only |
| 7 | 06 §8 |
the agent will manage cloudflared | 03 §2: it will not |
none | text follows code (03 wins) |
docs only |
What happens if you do nothing: the 25 notes stay tagged „undocumented" and the 7 passages keep saying something the code does not do. Nothing in a box changes either way until you answer.