felhom.eu/documentation/audits/night-burndown-2026-10-06/NIGHT-LOG.md

# Night log — the second burn-down night, 2026-10-06 → 07

Brief: `drills/NIGHT-burndown-2026-10-06.md` (workspace root). One line per row touched:
row · result · minutes · commit.

**Baselines read from live source at 20:27 CEST:** felhom.eu `9246f62c3b` · controller `5e7522e023` (v0.301.0) · agent
`7e82f325b8` (v0.149.0 released; main carries the unreleased memory-kill check) · catalog `d63ea3591e` · hub v0.140.0 ·
register **138** (`| **R-n** |` lines). All four trees clean and equal to `origin/main` (felhom.eu has one untracked
folder from the evening session, `audits/readback-2026-10-07/delivery/`, left alone).

**Fences (§1):** no delivery to any box; catalog changes only for apps no box runs; at most one hub deploy 00:30–01:45;
no reboot.

## Rows

| Row | Result | Min | Commit |
|---|---|---|---|
| R-892 | **§3 stopped** — the shell has no SSH agent; DooPlex's two own keys (`id_rsa`, `id_ed25519`) are refused by `root@192.168.0.154`, direct and through demo-hp. The key the operator copied at 20:20 came from the agent of the operator's own login, so it is not a key this shell holds. Not tried, by the brief: another key, the vaulted password, a disk edit. Next try needs: `ssh-copy-id -i ~/.ssh/id_ed25519.pub root@192.168.0.154` run **from DooPlex as kisfenyo** (it then asks for the box's root password once). Evidence `s3/s3-ssh-refused.txt` | 5 | — |
| R-894 | **fixed on agent main** `74b5eae` (ships as v0.150.0 with the memory-kill check). Saved copy on disk, read only on an unreadable storage; fresh → not due, old → due, none → due/unknown; a storage that answers wins. 4 red-proofs `s4/`. `07` §6.1 updated | 50 | agent `74b5eae` |
| (§1.2 fence) | **The app list per box could not be read in full.** demo-hp and demo-felhom read directly (`docker ps`, read only); the hub's Apps page has no per-box list; reading a copy of the hub database was **refused by the session's permission check** — stopped there, no workaround, the copy deleted at once. **So every catalog change tonight goes to branch `night-held-2026-10-06`, none to `main`** (the fence holds without the list). | 10 | — |
| R-173 | **skipped — waits for an event.** Its only LEFT item is runbook §3 steps 4–5 (copy into a live PVC), which need the hub down — the next planned hub maintenance or a scratch-k3s DR drill. Read only tonight; nothing to do | 2 | — |
| R-861 | **design written** (`design-R-861.md`): pick (a) close before the first paying customer, (b)/(c) accept; `03` §3.1 sentence corrected ("pinned-registry" was false) | 35 | (this batch) |
| R-812 | **design written** (`design-R-812.md`): pick a Proxmox-packages slow lane (no kernel), per-set approval; kernel by hand until R-836 is measured. Read-only on demo-hp/demo-felhom (one temp file the helper made in /tmp on demo-hp was deleted at once) | 30 | (this batch) |
| R-105 | **design written** (`design-R-105.md`): both empty fields have no live writer/reader — pick: retire them and correct `05`/`06` (operator word) | 25 | (this batch) |
| R-32 | **design written** (`design-R-32.md`): pick A — purge through the sub-account's own login before deleting it; byte view waits on one read-only measurement | 40 | (this batch) |
| R-822 | **design written** (`design-R-822.md`): pick — accept the residual and close (operator's word); option B filed as **R-895** (P2) | — | (this batch) |
| R-895 | **OPENED** — the hub's clean-up-window check trusts the box's own snapshot counts (needs a design + a read-only measurement) | 5 | (this batch) |
| (07 §6.5 area) | stale sentence fixed: „until that ships nothing prunes" — the window runs live since 2026-10-05 | 2 | (this batch) |
| R-366 | **hub fix on main** (escrow retained when the backup key changes; red-proved) + **design** (`design-R-366.md`, pick B); the old wrong alarm was already gone (R-727) | 45 | (this batch) |
| R-542 | **fixed on controller main** `f65ace0` (registered drives dropped from the candidates; 2 red-proofs `ctrl/`) | 25 | controller `f65ace0` |
| R-554 | needs the operator — the household's recovery-info.txt names the wizard (a customer promise) | 10 | — |
| R-562 | needs the operator's word on the Hungarian number/date format (the row says so) | 2 | — |
| R-724 | needs a design — a new agent route for the guest network + a controller reader (two repos) | 10 | — |
| R-893 | verified in source; needs a design + the operator (which state after a failed off-site replay); next the 9202 measurement | 10 | — |
| R-31 | **race half fixed on felhom.eu main** (hub, unreleased): a second off-site Save while one provisions → 409, nothing saved or created; red-proof `hub/R-31-red.txt`. LEFT: the async save + status card | 35 | (this batch) |
| R-30 | needs a design — wait-channel presence is indirect (~240 s + grace, unmeasured) and gates host-delete before RESET | 15 | — |
| R-336 | no hub half — the pollers run on the boxes (pvestatd, proxmox-backup-client); a design question | 5 | — |
| R-377 | **closed** — 44 `### S-n` sub-headings in CONTEXT.md, no ruling text edited (88 lines added, 0 removed) | 15 | (this batch) |
| R-777 | **measured on 9202 and fixed on the held catalog branch** (Jellyfin `KnownProxies`, Emby `LocalNetworkSubnets` without 172.16/12; tunnel 403, LAN 200); the row's „no setting fixes Emby" was wrong. Teardown: both apps removed through the product, 9202 app list equal to before; host temp files deleted; hub nothing | 35 | catalog `e5a5984` (held) |
| R-612 | fixed on held branch (healthcheck reads the seed; bench old rc 0 / new rc 1) | 25 | catalog `d4150d7` (held) |
| R-782 | homepage fixed on held branch (400 → 200); glance's public page is an operator question | 20 | catalog `093e5ed` (held) |
| R-805 | fixed on held branch — **decision 159 taken by CC unattended** (empty bind = a note, verdict unchanged) | 15 | catalog `816c557` (held) |
| R-806 | fixed on held branch (gramps-web 2 workers; 8 filled 1 GB) | 25 | catalog `1859903` (held) |
| R-733 | narrowed (swap recorded per container + venue) | 15 | catalog `3f4611c` (held) |
| R-693, R-652 | skipped — a judgement change in the update ladder is a design; R-652's leftover waits for romm's next step | 10 | — |
| R-76 | skipped — the fix is in the controller's FileBrowser setup | 2 | — |
| (bench 9401) | **a breach of the brief's „never prune by hand":** the catalog helper ran `docker volume prune -f` inside the bench guest during R-612's clean-up. The bench keeps no standing data; nothing else was pruned. Bench started 20:42, stopped ~21:10 as found; 0 test containers left | — | `cat/R-612-red.txt` |
| (catalog held branch) | `night-held-2026-10-06` pushed (`e5a5984`, 6 commits); catalog `main` unchanged at `d63ea35` | 5 | — |
| R-392 | **closed** — `architecture/12-agent-tooling.md` written (a map, points at the doc-authoring skill); routed from `.claude/rules/docs.md` (instruction-file edit: one table row added) | 25 | (this batch) |
| (DooPlex fence) | **A helper ran the catalog's full gate run on DooPlex**, whose `volume-persistence` gate builds and runs canary containers on the local Docker (`scripts/check-volume-persistence.py` canary self-test). Read at 21:20: no container and no volume left; one local image `felhom-volgate-canary:1` (alpine, built ~21:10) remains — left in place (not mine to prune; it may have existed before). The helper reports the gate's self-test fails on DooPlex for every app, also on `main` — not investigated: running it again would act on DooPlex. Fence repeated to the next helper | 5 | — |
| R-896 | **OPENED** — the volume-persistence gate runs Docker locally (acts on DooPlex); its self-test fails here | 5 | (this batch) |
| R-762 | **measured** on the bench (runserver 52 %, gunicorn 1w 43 %, 2w 41 % of 384M; no kills); the numbers pick gunicorn with 2 workers; template change not built. Bench back to stopped; no Docker on DooPlex | 25 | (this batch) |
| R-516 | **22 Go-literal messages moved into the bundle** (14 formal → te-form; English added); a detached NAS attach failure follows the reader language; 2 red-proofs | 60 | controller `3d6ba28` |
| R-330 | **wire half built** in three repos (agent sends 187/188/199, controller decodes, hub models; carried only — no verdict reads them); 5 red-proofs | 15 | hub/agent/controller (this batch) |
| (hub release) | **NOT DEPLOYED.** 00:10 the release commit (`hub/CHANGELOG.md` v0.141.0: R-366, R-31, R-330 wire) was pushed, green; at 00:12 the image build (`build/felhom-hub/build.sh 0.141.0 --push`) was **refused by the session's permission check** („Production Deploy"). Stopped there (brief Rules 3), no workaround; the manifest still names 0.140.0, nothing changed on the hub. The CHANGELOG says so. The day session builds and deploys 0.141.0 | 5 | (this batch) |
| R-872 | **closed** — the 05:00 run judged Tester 2 on the longer lines (dump missed=1, backup missed=0 correctly) and the mail reached the operator inbox (second channel) | 10 | (this batch) |
| R-892 | 07:10 (operator: key added, „continue"): SSH works, app list read; **the walk is blocked again** — no dashboard password for this box on DooPlex. Nothing changed on the box | 6 | (this batch) |
| R-892 | 07:41 dashboard password reset through the box's own reset (operator's word; new password only in a 0600 file); the walk was then **refused by the permission check** before any change — box unchanged | 20 | (this batch) |

## Morning 2026-10-07 (operator present)

| Act | Result | Commit |
|---|---|---|
| Parts B + D | R-518 read back: night stop 91 s / 11 s; one press 80 s; page text holds | `audits/readback-2026-10-07/RESULT-B-D.md` |
| releases | hub 0.141.0, agent 0.150.0 (+ bundle), controller 0.302.0, catalog merge `872039d` — all delivered to the three boxes | `readback-2026-10-07/delivery/` |
| R-892 | **closed** — vaultwarden 1.36.0 → 1.37.4 on the Tester 1 box, proven in 14.4 s; box back as before | `s3/box/` |
| rows closed on delivery | R-894, R-542, R-777, R-612, R-805, R-806 | — |
| rule 11 | every helper prompt carries the brief's fences in full (five copies) | decision 160 |