ignore ephemeral Docker network identity in Stage 3

.dockerignore

@@ -0,0 +1,16 @@
+.git
+.worktrees
+.migration-source
+.migration.env
+**/*.sql
+**/*.sql.gz
+**/node_modules
+**/.next
+payload/migration/generated
+**/uploads
+**/media
+**/migration/generated
+**/test-results
+**/playwright-report
+**/blob-report
+**/.auth

.gitignore

@@ -53,3 +53,10 @@ app/components/account.zip
 
 # Accidental root lockfile; applications have their own lockfiles
 /package-lock.json
+
+# Local migration inputs and isolated worktrees
+.worktrees/
+.migration-source
+.migration-source/
+.migration.env
+payload/migration/generated/

.node-version

@@ -0,0 +1 @@
+24.18.0

.nvmrc

@@ -0,0 +1 @@
+24.18.0

app/.dockerignore

@@ -17,3 +17,14 @@ debug
 *.bak
 *.zip
 .DS_Store
+
+.migration-source
+.migration.env
+.worktrees
+*.sql
+*.sql.gz
+uploads
+media
+migration/generated
+test-results
+playwright-report

app/app/api/auth/register/route.ts

@@ -1,13 +1,12 @@
 // app/api/auth/register/route.ts
 import { NextResponse } from "next/server";
 import { rateLimit, requestIp } from "@/lib/rate-limit";
+import {
+    createDirectusUser,
+    directusUserExists,
+    loginDirectus,
+} from "@/lib/directus";
 
-const DIRECTUS = (process.env.DIRECTUS_URL || process.env.NEXT_PUBLIC_API_BASE_URL || "").replace(/\/$/, "");
-const SERVICE_TOKEN =
-process.env.DIRECTUS_SERVICE_TOKEN ||
-process.env.DIRECTUS_ADMIN_TOKEN ||
-process.env.DIRECTUS_TOKEN_ADMIN_REGISTER || "";
-const DEFAULT_ROLE = process.env.DIRECTUS_DEFAULT_ROLE || undefined;
 const SECURE = process.env.NODE_ENV === "production";
 
 function bad(message: string, status = 400) {
@@ -15,16 +14,18 @@ function bad(message: string, status = 400) {
 }
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
-async function directusLogin(email: string, password: string) {
+function isConflict(error: any): boolean {
-    const r = await fetch(`${DIRECTUS}/auth/login`, {
+    const code = error?.detail?.errors?.[0]?.extensions?.code;
-        method: "POST",
+    const message = error?.detail?.errors?.[0]?.message || error?.message || "";
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
+    return error?.status === 409 || code === "RECORD_NOT_UNIQUE" || /unique|already exists/i.test(message);
-        body: JSON.stringify({ email, password }),
+}
-                          cache: "no-store",
+
+function logDirectusFailure(stage: string, error: any) {
+    console.error(`[auth/register] Directus ${stage} failed`, {
+        status: error?.status,
+        code: error?.detail?.errors?.[0]?.extensions?.code,
+        message: error?.detail?.errors?.[0]?.message || error?.message,
     });
-    const j = await r.json().catch(() => ({}));
-    if (!r.ok) throw new Error(j?.errors?.[0]?.message || j?.message || `Login failed (${r.status})`);
-    return j?.data || j;
 }
 
 export async function POST(req: Request) {
@@ -32,9 +33,6 @@ export async function POST(req: Request) {
         if (!rateLimit(`register:${requestIp(req)}`, 5, 60 * 60_000)) {
             return bad("Too many registration attempts. Please try again later.", 429);
         }
-        if (!DIRECTUS) return bad("Missing DIRECTUS_URL/NEXT_PUBLIC_API_BASE_URL", 500);
-        if (!SERVICE_TOKEN) return bad("Missing DIRECTUS_SERVICE_TOKEN / admin token", 500);
-
         const body = await req.json().catch(() => ({} as any));
         const email = String(body?.email ?? "").trim().toLowerCase();
         const username = String(body?.username ?? "").trim();
@@ -46,53 +44,35 @@ export async function POST(req: Request) {
         if (password.length < 8) return bad("Password must be at least 8 characters");
         if (password !== confirm) return bad("Passwords do not match");
 
-        // Optional pre-check to return a friendly 409 instead of a generic Directus error
+        try {
-        const existsRes = await fetch(
+            if (await directusUserExists(email, username)) {
-            `${DIRECTUS}/users?filter[_or][0][email][_eq]=${encodeURIComponent(email)}` +
-            `&filter[_or][1][username][_eq]=${encodeURIComponent(username)}` +
-            `&fields=id,email,username&limit=1`,
-            {
-                headers: {
-                    Authorization: `Bearer ${SERVICE_TOKEN}`,
-                    Accept: "application/json",
-                },
-                cache: "no-store",
-            }
-        );
-        const existsJson = await existsRes.json().catch(() => ({}));
-        if (Array.isArray(existsJson?.data) && existsJson.data.length > 0) {
                 return bad("Email or username already in use", 409);
             }
-
+        } catch (error: any) {
-        // Create user with sane defaults
+            logDirectusFailure("duplicate lookup", error);
-        const createPayload: any = {
+            return bad("Sign-up is temporarily unavailable.", 503);
-            email,
-            username,
-            password,
-        };
-        if (DEFAULT_ROLE) createPayload.role = DEFAULT_ROLE;
-
-        const createRes = await fetch(`${DIRECTUS}/users`, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${SERVICE_TOKEN}`,
-                "Content-Type": "application/json",
-                Accept: "application/json",
-            },
-            body: JSON.stringify(createPayload),
-                                      cache: "no-store",
-        });
-
-        const cj = await createRes.json().catch(() => ({}));
-        if (!createRes.ok) {
-            const msg = cj?.errors?.[0]?.message || cj?.message || `User create failed (${createRes.status})`;
-            return bad(msg, createRes.status || 500);
         }
 
-        // Auto-login (email-based; directus expects "email" even though it's an identifier)
+        let user: { id: string };
-        const tokens = await directusLogin(email, password);
+        try {
+            // Resolves the production Users role through the Registration Bot
+            // policy, then creates an active local-auth account in that role.
+            user = await createDirectusUser({ email, username, password });
+        } catch (error: any) {
+            if (isConflict(error)) return bad("Email or username already in use", 409);
+            logDirectusFailure("user creation", error);
+            return bad("Sign-up is temporarily unavailable.", 503);
+        }
 
-        const res = NextResponse.json({ ok: true, id: cj?.data?.id || null }, { status: 201 });
+        let tokens: any;
+        try {
+            tokens = await loginDirectus(email, password);
+        } catch (error: any) {
+            logDirectusFailure("post-registration login", error);
+            return bad("Your account was created, but automatic sign-in failed. Please sign in.", 502);
+        }
+
+        const res = NextResponse.json({ ok: true, id: user.id }, { status: 201 });
         if (tokens?.access_token) {
             res.cookies.set("ma_at", tokens.access_token, {
                 path: "/",

app/lib/directus.ts

@@ -4,14 +4,31 @@
 // ⚠️ NOTE: Do NOT import `headers()` / `cookies()` from "next/headers" here.
 // Next 15's types can make those async and break build-time type checks in shared libs.
 
-const BASE = (process.env.DIRECTUS_URL || "").replace(/\/$/, "");
+const BASE = (
-const TOKEN_ADMIN_REGISTER = process.env.DIRECTUS_TOKEN_ADMIN_REGISTER || ""; // server-only
+  process.env.DIRECTUS_URL ||
+  process.env.NEXT_PUBLIC_API_BASE_URL ||
+  ""
+).replace(/\/$/, "");
+// DIRECTUS_TOKEN_ADMIN_REGISTER is the canonical credential for the production
+// Registration Bot policy. Keep older aliases as independently tested fallbacks:
+// a configured but stale token must not hide a later valid credential.
+const REGISTRATION_CREDENTIALS = [
+  ["DIRECTUS_TOKEN_ADMIN_REGISTER", process.env.DIRECTUS_TOKEN_ADMIN_REGISTER],
+  ["DIRECTUS_SERVICE_TOKEN", process.env.DIRECTUS_SERVICE_TOKEN],
+  ["DIRECTUS_ADMIN_TOKEN", process.env.DIRECTUS_ADMIN_TOKEN],
+].filter(
+  (entry, index, entries): entry is [string, string] =>
+    Boolean(entry[1]) && entries.findIndex((other) => other[1] === entry[1]) === index
+);
 const ROLE_MEMBER_NAME = process.env.DIRECTUS_ROLE_MEMBER_NAME || "Users";
 const PROJECTS_COLLECTION = process.env.DIRECTUS_PROJECTS_COLLECTION || "projects";
 
-if (!BASE) console.warn("[directus] Missing DIRECTUS_URL");
+if (!BASE) console.warn("[directus] Missing DIRECTUS_URL / NEXT_PUBLIC_API_BASE_URL");
-if (!TOKEN_ADMIN_REGISTER)
+if (!REGISTRATION_CREDENTIALS.length)
-  console.warn("[directus] Missing DIRECTUS_TOKEN_ADMIN_REGISTER (used for registration and username login)");
+  console.warn(
+    "[directus] Missing DIRECTUS_TOKEN_ADMIN_REGISTER (or legacy service-token alias) " +
+      "used for registration and username login"
+  );
 
 export function bytesFromMB(mb: number) {
   return Math.round(mb * 1024 * 1024);
@@ -119,17 +136,34 @@ export async function dxDELETE<T = any>(path: string, bearer: string): Promise<T
 // ─────────────────────────────────────────────────────────────
 
 export async function directusAdminFetch<T = any>(path: string, init?: RequestInit): Promise<T> {
-  if (!TOKEN_ADMIN_REGISTER) throw new Error("Missing DIRECTUS_TOKEN_ADMIN_REGISTER");
+  if (!BASE) throw new Error("Missing Directus base URL");
+  if (!REGISTRATION_CREDENTIALS.length) throw new Error("Missing Directus registration credential");
+
+  let lastAuthorizationError: any = null;
+  for (const [credentialName, credential] of REGISTRATION_CREDENTIALS) {
     const res = await fetch(`${BASE}${path}`, {
       ...init,
       headers: {
         Accept: "application/json",
-      Authorization: `Bearer ${TOKEN_ADMIN_REGISTER}`,
+        Authorization: `Bearer ${credential}`,
         ...(init?.headers || {}),
       },
       cache: "no-store",
     });
+
+    try {
       return (await throwIfNotOk(res)) as T;
+    } catch (error: any) {
+      if (error?.status !== 401 && error?.status !== 403) throw error;
+      lastAuthorizationError = error;
+      console.warn(`[directus] Registration credential rejected: ${credentialName}`, {
+        status: error.status,
+        code: error?.detail?.errors?.[0]?.extensions?.code,
+      });
+    }
+  }
+
+  throw lastAuthorizationError ?? new Error("No authorized Directus registration credential");
 }
 
 // ─────────────────────────────────────────────────────────────
@@ -231,13 +265,25 @@ export async function createDirectusUser(input: {
 }
 
 export async function emailForUsername(username: string): Promise<string | null> {
-  const q = `/users?filter[username][_eq]=${encodeURIComponent(username)}&fields=email&limit=1`;
+  const clean = username.trim();
+  if (!clean) return null;
+  const q = `/users?filter[username][_eq]=${encodeURIComponent(clean)}&fields=email&limit=1`;
   const { data } = await directusAdminFetch<{ data: Array<{ email?: string }> }>(q);
   const em = data?.[0]?.email;
   return em ? String(em) : null;
 }
 
+export async function directusUserExists(email: string, username: string): Promise<boolean> {
+  const q =
+    `/users?filter[_or][0][email][_eq]=${encodeURIComponent(email)}` +
+    `&filter[_or][1][username][_eq]=${encodeURIComponent(username)}` +
+    `&fields=id&limit=1`;
+  const { data } = await directusAdminFetch<{ data: Array<{ id: string }> }>(q);
+  return Array.isArray(data) && data.length > 0;
+}
+
 export async function loginDirectus(email: string, password: string) {
+  if (!BASE) throw new Error("Missing Directus base URL");
   const res = await fetch(`${BASE}/auth/login`, {
     method: "POST",
     headers: { Accept: "application/json", "Content-Type": "application/json" },

bgbye/.dockerignore

@@ -0,0 +1,21 @@
+.git
+.gitignore
+.worktrees
+.migration-source
+.migration.env
+node_modules
+.next
+.cache
+.u2net
+.ormbg
+.models
+temp_videos
+uploads
+media
+migration
+test-results
+playwright-report
+*.sql
+*.sql.gz
+*.log
+*.bak

directus/README.md

@@ -0,0 +1,34 @@
+# Directus production reference
+
+This directory documents how the Next.js application integrates with the production Directus instance. It is evidence for development and review; it is not an automated migration source and must not be applied to production without a separate, reviewed change process.
+
+## Evidence and authority
+
+- `schema.yaml` is the fresh schema snapshot collected from production Directus 12.1.1 on 2026-07-10. It is the authoritative schema evidence in this directory for that collection time.
+- `reference/` contains immutable, sanitized source evidence collected from the same deployment: deployment inventory, Compose and Nginx summaries, environment-variable names, roles, policies, access assignments, permissions, settings metadata, flows, operations, user-field metadata, and system-table layouts.
+- `../app/schema.yaml` is an older Directus 11.12.0 snapshot. It remains useful as historical application evidence, but it is not the current production schema. It must remain in place alongside the current snapshot.
+- The Markdown files directly under `directus/` are human-readable interpretations of the application source and raw evidence. When prose conflicts with raw evidence, re-check the evidence and update the prose.
+- `env.example` is a names-and-placeholders contract. It contains no production values.
+
+The exports intentionally exclude users, user-specific access assignments, credentials, sessions, uploaded data, and flow option values. Consequently, a static credential's actual user/role binding and the detailed behavior inside flows cannot be proven from this material.
+
+## Documents
+
+- `deployment.md`: production topology and explicitly configured versus unobserved settings.
+- `auth-contract.md`: application-to-Directus authentication and account operations.
+- `permissions.md`: role, policy, field, filter, validation, and preset matrix.
+- `flows.md`: flow and operation graphs, with unresolved behavior called out.
+- `schema-differences.md`: structural comparison with `../app/schema.yaml`.
+- `integration-testing.md`: proposed disposable integration-test environment.
+
+## Refresh procedure
+
+1. Collect from the running production instance without changing it.
+2. Sanitize the result before it enters the repository. Exclude secret values, credentials, user rows, email addresses, sessions, cookies, uploaded files, and sensitive flow options.
+3. Store a new schema snapshot under `snapshots/`, using a date or version, for example `snapshots/schema-directus-12.1.1-2026-07-10.yaml`. Do not overwrite `schema.yaml` or `../app/schema.yaml` as part of a historical refresh.
+4. Store supporting sanitized exports in a correspondingly dated reference location, or clearly record which snapshot they describe.
+5. Record the Directus version, database vendor, collection time, and checksums.
+6. Compare the new snapshot to the preceding production snapshot and update the human-readable documents only from observed differences.
+7. Run a sensitive-data scan and `git diff --check`, then review the complete diff before committing.
+
+The current collection process is described only by its outputs; the exact export commands are not present. That part of the refresh procedure is therefore **unresolved** and should be documented when a repeatable sanitized collection script is added.

directus/auth-contract.md

@@ -0,0 +1,37 @@
+# Authentication and account contract
+
+Status labels mean:
+
+- **Verified**: directly supported by application source plus the sanitized production exports.
+- **Inferred**: the source intends the behavior, but a runtime binding, omitted value, or live test is missing.
+- **Unresolved**: the required implementation or evidence is absent.
+
+The app uses a Directus access token as a user bearer, normally stored in the HTTP-only `ma_at` cookie. It stores a refresh token in HTTP-only `ma_rt` and a five-minute recent-authentication marker in HTTP-only `ma_ra`. In production these cookies are `Secure`, `SameSite=Lax`, and path `/` where set by the current auth routes.
+
+## Operation matrix
+
+| Operation | Application route/module | Directus endpoint | Credential and required permission | Success and important failures | Status |
+| --- | --- | --- | --- | --- | --- |
+| Signup | `POST /api/auth/register`; `app/app/api/auth/register/route.ts` | `GET /users` duplicate lookup; `GET /roles` Users-role lookup; `POST /users`; then `POST /auth/login` | The canonical static server credential is `DIRECTUS_TOKEN_ADMIN_REGISTER`, with legacy service/admin names as fallbacks. It must represent the Registration Bot role/policy or an equivalent identity. Registration policy grants the required role read and user read/create permissions. | Validates all fields, email shape, password length >=8, and confirmation. Resolves the `Users` role, creates an active account with email/username/password, and performs email-based auto-login. Successful login sets `ma_at` and possibly `ma_rt`. Permission/configuration failures are logged server-side and returned as generic temporary-unavailable responses. | Application flow, build, mocked request contract, and policy are **verified**; production static credential-to-role binding still requires deployment verification because users/values were omitted. |
+| Duplicate-user check | Same route | `GET /users?filter[...]&fields=id&limit=1` | Registration policy requires `directus_users.read` for `id`, which is exported. | A returned row or create-time uniqueness conflict produces the same generic email-or-username 409. A failed lookup stops signup with a generic 503 instead of continuing with uncertain permissions. | **Verified** source and mocked request behavior; production credential capability requires a live test. |
+| Email login | `POST /api/auth/login`; `app/app/api/auth/login/route.ts` | `POST /auth/login` | No bearer is supplied; local email/password credentials are sent to Directus. No collection permission is used for the auth endpoint itself. | On success sets one-hour `ma_at`, optional 30-day `ma_rt`, and optionally five-minute `ma_ra` for a reauth request. Authentication failures are deliberately collapsed to a generic 401. App IP limiter allows 20 attempts/minute per process. | **Verified** implementation; live Directus local-auth behavior is **inferred** pending integration tests. |
+| Username login | Same login route; `emailForUsername()` in `app/lib/directus.ts` | Static-token `GET /users` lookup, then `POST /auth/login` with resolved email | The same registration credential used by signup must read `directus_users.username,email`; Registration policy exports those fields. | Missing username gives generic 401. Lookup errors give 503. Resolved email follows email-login behavior. The shared helper accepts `DIRECTUS_URL` with `NEXT_PUBLIC_API_BASE_URL` fallback. | Source, build, required policy, and mocked request contract are **verified**; credential binding and end-to-end production success require a deployment test. |
+| Current user | `GET /api/account`, `GET /api/me`, proxy `/api/dx/users/me`, middleware; relevant modules under `app/app/api/` and `app/middleware.ts` | `GET /users/me` with varying field lists | Current user's access token. Users Self Access policy permits own-row read of `id,username,first_name,last_name,email,password,avatar,location,title,description,tags,language,tfa_secret,email_notifications`; Users policy additionally permits public-like `id,username,first_name,avatar,location`. | Returns requested profile fields if field permissions allow. Middleware checks `id` at most once per minute and redirects to reauth on failure. `/api/me` requests `display_name`, which is not present in the exported custom user-field metadata or allowed-field lists, so that field's behavior is unresolved. | Own-row permissions and route calls are **verified**. |
+| Token refresh | Token storage occurs in register/login and `app/lib/auth-cookies.ts` | Expected Directus endpoint would be `/auth/refresh`, but no call exists | `ma_rt` is stored, but no application route consumes it. | There is no implemented refresh behavior. Expired/invalid `ma_at` causes middleware to clear `ma_at`/`ma_v` and redirect to sign-in. | **Verified missing implementation**. |
+| Logout | `POST` or `GET /api/auth/logout`; `app/app/api/auth/logout/route.ts` | None | No Directus call and no credential required by the handler. | Expires only `ma_at`. It does not revoke the Directus session and does not clear `ma_rt`, `ma_ra`, or `ma_v`. | **Verified**. |
+| Password change | `POST`/`PATCH /api/account/password`; `app/app/api/account/password/route.ts` | `GET /users/me`; optionally static-token `GET /users`; `POST /auth/login`; `PATCH /users/me` | Current user token needs own-row read and `directus_users.update` for `password`; Users Self Access grants both. Username verification additionally needs Registration read permission. | Requires current/new values and an eight-character new password. Verifies the current password through local login, then patches only `password`. External-provider rejection depends on reading `provider`, but `provider` is not in the Users Self Access read fields, so this guard may not receive the field. Successful change does not rotate or clear existing app tokens. | Main path and permissions **verified**; provider guard and session effects **unresolved**. |
+| Profile changes | `PATCH /api/account` and `PATCH /api/account/profile`; UI primarily uses the latter | `PATCH /users/me` | Current user token. Users Self Access update permits `first_name,last_name,email,avatar,location,password`; it does not permit `username`. | First/last name and location update directly. Email requires `ma_ra=1`; the marker is cleared after a successful sensitive update. UI always includes email in its payload, so its normal save path requests reauthentication even when email is unchanged. Username is classified sensitive but is never added to the patch payload and is not update-permitted. | **Verified**. |
+| Avatar change | `POST /api/account/avatar`; `app/app/api/account/avatar/route.ts` | `POST /files`, then `PATCH /users/me` | Current user token. Users policy permits `directus_files.create` on all fields; Users Self Access permits own `avatar` update. | Requires a configured avatar folder, <=10 MB JPEG/PNG/WebP/GIF, and recognized signature. Uploads file then links its ID. If linking fails, the uploaded file is not cleaned up. | **Verified** except folder value and folder-specific enforcement, which are **unresolved**. |
+| Reauthentication | `POST /api/auth/reconfirm`; `app/app/api/auth/reconfirm/route.ts`, or login with `reauth=true` | Optional static-token `GET /users`, then `POST /auth/login` | Local credentials; username form also requires Registration `directus_users.read`. | Successful reconfirm replaces `ma_at` and sets `ma_ra` for five minutes. It does not set/replace `ma_rt`. Login's reauth path sets `ma_ra` alongside normal token cookies. Failures are generic 401. | **Verified** implementation; end-to-end username path remains unresolved. |
+
+## Permission identity model
+
+The export verifies these role-to-policy assignments:
+
+- Registration Bot role -> Registration policy.
+- Users role -> Users Self Access policy and Users policy, in that sort order.
+- Administrator role -> Administrator policy.
+- Supporter Bot role -> Supporter policy.
+- Public policy has a role-less access assignment.
+
+Because user rows and user-specific access assignments were intentionally omitted, the evidence cannot prove which identity owns any configured static credential. A deployment test must verify each credential's effective policy rather than relying on its environment-variable name.

directus/deployment.md

@@ -0,0 +1,54 @@
+# Production deployment
+
+Unless marked **inferred** or **unresolved**, facts below are verified by `reference/deployment-inventory.md`, `reference/docker-compose.sanitized.yml`, `reference/environment-variable-names.txt`, `reference/nginx-summary.txt`, or `reference/exports/settings.json`.
+
+## Runtime and topology
+
+| Item | Production observation |
+| --- | --- |
+| Directus version | 12.1.1 |
+| Container image | `directus/directus:latest` |
+| Compose service and container | `directus` |
+| Restart policy | `unless-stopped` |
+| Database client | MySQL; host, database, and credential values were intentionally omitted |
+| Public URL | `https://forms.lasereverything.net` |
+| Container port | Directus listens on 8055; Compose binds it to host loopback `127.0.0.1:8056` |
+| Networks | Private `directus_net` bridge with IPv4/IPv6 subnets, plus external `backend_net` |
+| Upload mount | Host `./uploads` to `/directus/uploads`, read/write |
+| Extension mount | Host `./extensions` to `/directus/extensions`, read/write |
+
+Production currently uses the mutable `directus/directus:latest` image tag. This document records that fact and does not change it. The running version was separately observed as 12.1.1, so a future container recreation could select a different image unless deployment controls outside the supplied evidence pin it.
+
+The extensions directory is mounted, but its contents were not exported. Whether custom extensions are installed or active is **unresolved**.
+
+## Reverse proxy
+
+Nginx terminates TLS for `forms.lasereverything.net` and proxies to host loopback port 8056. It forwards the original host, client IP, forwarding chain, scheme, and WebSocket upgrade headers. Proxy read and send timeouts are 300 seconds. The request body limit is 100 MB. TLS 1.2 and 1.3 are enabled and HSTS is emitted for one year with subdomains.
+
+The sanitized Nginx summary shows reflected-origin CORS response headers with credentials enabled and permits the common API methods and request headers. Directus-specific CORS environment variables are not explicitly set. The exact Nginx origin allow-list or surrounding condition that governs the reflected origin was not included, so whether arbitrary origins are accepted is **unresolved**.
+
+## Mail
+
+Directus is explicitly configured for SMTP transport. The observed categories are sender, SMTP host, port, secure mode, username, and password. Port 465 and secure mode `true` are verified; sender, host, and credential values were omitted. Delivery behavior was not tested.
+
+The Next.js application separately references its own SMTP variable names for supporter-claim mail. Those names are documented in `env.example`; whether they point to the same SMTP service is **unresolved**.
+
+## Authentication and security configuration
+
+| Area | Explicit production evidence | Default or unresolved behavior |
+| --- | --- | --- |
+| Bootstrap administrator | `ADMIN_EMAIL` and `ADMIN_PASSWORD` names are present | Values and whether bootstrap variables still affect an initialized database are intentionally unknown |
+| Signing/encryption material | `KEY` and `SECRET` names are present | Values omitted |
+| Public registration | No registration environment variables are explicit; settings export has `public_registration=0` | Public `/users/register` is disabled; the app instead uses a privileged `/users` create flow |
+| Registration verification | Settings export has `public_registration_verify_email=0` and no public registration role/filter | Inactive while public registration is disabled |
+| Auth providers | `AUTH_PROVIDERS` is not explicitly set | Available/default providers were not exported; application code assumes local email/password auth |
+| Login-attempt setting | Column layout reports a database default of 25 | The live `auth_login_attempts` value was not exported; the app also applies an in-memory 20-per-minute IP limit |
+| Password policy | Column exists and defaults to null in the exported table layout | The live setting was not exported; the app enforces only an eight-character minimum on registration/change |
+| CORS | No Directus CORS environment variables are explicit | Nginx adds CORS headers; effective origin policy is unresolved as noted above |
+| Cookies | No Directus cookie environment variables are explicit | The app stores Directus tokens in its own `ma_at` and `ma_rt` cookies; effective Directus defaults are not proven here |
+| TFA | All exported policies have `enforce_tfa=0` | Per-user TFA state was intentionally not exported |
+| Policy IP restrictions | All exported policies have `ip_access=null` | No policy-level IP restriction is evidenced |
+| Admin/app access | Administrator policy has both; all other exported policies have neither | Verified from policy export |
+| MCP/AI/new 12.x settings | System-table columns exist | Live values were not included in the sanitized settings export and must not be inferred from column defaults |
+
+Environment absence proves only that a setting was not explicitly supplied to the collected container. It does not prove behavior controlled by the database, an extension, another configuration source, or a Directus default that may vary by version.

directus/env.example

@@ -0,0 +1,71 @@
+# Names-and-placeholders contract only. Never place production values in this file.
+# Classification: public-build = embedded/exposed by Next.js; server = Next.js server only;
+# deployment = Directus container/bootstrap only.
+
+# Shared Directus location
+NEXT_PUBLIC_API_BASE_URL=<public-directus-base-url> # Next.js; public-build
+NEXT_PUBLIC_ASSET_URL=<public-directus-assets-base-url> # Next.js; public-build
+DIRECTUS_URL=<server-directus-base-url> # Next.js; server
+
+# Next.js privileged Directus identities
+DIRECTUS_TOKEN_ADMIN_REGISTER=<registration-static-credential> # Next.js; server
+DIRECTUS_SERVICE_TOKEN=<legacy-service-credential-if-still-supported> # Next.js; server
+DIRECTUS_ADMIN_TOKEN=<legacy-admin-credential-if-still-supported> # Next.js; server
+DIRECTUS_TOKEN_ADMIN_SUPPORTER=<supporter-static-credential> # Next.js and backfill script; server
+DIRECTUS_TOKEN_SUBMIT=<settings-submission-credential> # Next.js; server
+
+# Next.js Directus role, collection, folder, and upload configuration
+DIRECTUS_ROLE_MEMBER_NAME=<registered-user-role-name> # Next.js helper; server
+DIRECTUS_PROJECTS_COLLECTION=<projects-collection-name> # Next.js helper; server
+DIRECTUS_AVATAR_FOLDER_ID=<avatar-folder-id> # Next.js; server
+DX_FOLDER_FIBER_PHOTOS=<folder-id> # Next.js; server
+DX_FOLDER_FIBER_SCREENS=<folder-id> # Next.js; server
+DX_FOLDER_GALVO_PHOTOS=<folder-id> # Next.js; server
+DX_FOLDER_GALVO_SCREENS=<folder-id> # Next.js; server
+DX_FOLDER_GANTRY_PHOTOS=<folder-id> # Next.js; server
+DX_FOLDER_GANTRY_SCREENS=<folder-id> # Next.js; server
+DX_FOLDER_UV_PHOTOS=<folder-id> # Next.js; server
+DX_FOLDER_UV_SCREENS=<folder-id> # Next.js; server
+FILE_MAX_MB=<positive-number> # Next.js project uploads; server
+SETTINGS_IMAGE_MAX_MB=<positive-number> # Next.js settings uploads; server
+
+# Directus container identity and cryptographic configuration
+KEY=<directus-key> # Directus; deployment
+SECRET=<directus-secret> # Directus; deployment
+PUBLIC_URL=<public-directus-base-url> # Directus; deployment
+ADMIN_EMAIL=<bootstrap-admin-address> # Directus bootstrap; deployment
+ADMIN_PASSWORD=<bootstrap-admin-credential> # Directus bootstrap; deployment
+
+# Directus database
+DB_CLIENT=mysql # Directus; deployment
+DB_HOST=<database-host> # Directus; deployment
+DB_PORT=<database-port> # Directus; deployment
+DB_DATABASE=<database-name> # Directus; deployment
+DB_USER=<database-user> # Directus; deployment
+DB_PASSWORD=<database-credential> # Directus; deployment
+DB_FILENAME=<unused-for-mysql-or-database-file> # Directus environment name observed; deployment
+
+# Directus mail
+EMAIL_TRANSPORT=smtp # Directus; deployment
+EMAIL_FROM=<sender-address> # Directus and Next.js supporter mail; deployment/server
+EMAIL_SMTP_HOST=<smtp-host> # Directus; deployment
+EMAIL_SMTP_PORT=465 # Directus; deployment
+EMAIL_SMTP_SECURE=true # Directus; deployment
+EMAIL_SMTP_USER=<smtp-user> # Directus; deployment
+EMAIL_SMTP_PASSWORD=<smtp-credential> # Directus; deployment
+
+# Next.js supporter mail uses a separate naming convention
+SMTP_HOST=<smtp-host> # Next.js; server
+SMTP_PORT=<smtp-port> # Next.js; server
+SMTP_SECURE=<true-or-false> # Next.js; server
+SMTP_USER=<smtp-user> # Next.js; server
+SMTP_PASS=<smtp-credential> # Next.js; server
+
+# Runtime classification
+NODE_ENV=<production-or-development> # Directus and Next.js; deployment/server
+
+# The production Directus environment also contains runtime-provided NODE_VERSION,
+# NPM_CONFIG_UPDATE_NOTIFIER, PATH, and YARN_VERSION. They are not application
+# integration configuration and therefore have no configurable placeholders here.
+# AUTH_PROVIDERS, Directus CORS/cookie variables, and public-registration variables
+# were explicitly reported as not set and are intentionally not implied here.

directus/flows.md

@@ -0,0 +1,47 @@
+# Directus flows
+
+Two active event-triggered flows were exported. Both run with accountability `all`. The export deliberately replaces every operation's options with only `options_keys`; code, filters, collections, queries, keys, error messages, status codes, and event scopes are not available. The graphs below are therefore structural, not behavioral proofs.
+
+## `unique_key_claims`
+
+Description: “A flow for setting a unique key for each claim to prevent duplicates.”
+
+```text
+Run Script (exec_5dli5)
+  resolve -> Read Data (item_read_e4myo)
+               resolve -> Condition (condition_s458i)
+                            resolve -> Throw Error (throw_error_22tpm)
+                            reject  -> end
+               reject  -> end
+  reject  -> end
+```
+
+- Trigger: event.
+- Flow option keys: `type`, `scope`, `collections`, `return`.
+- Script option key: `code`.
+- Read option keys: `permissions`, `emitEvents`, `collection`, `query`.
+- Condition option key: `filter`.
+- Error option keys: `status`, `message`, `code`.
+
+**Unresolved:** the triggering collection/event, how the unique key is calculated, what data is queried, the condition's polarity, error response, and whether the graph handles races atomically. The description suggests duplicate prevention, but omitted options prevent verification.
+
+## `claim_auto_assign`
+
+Description: “Assigns a claimant to owner and rejects other pending claims.”
+
+```text
+Condition (condition_dl7cj)
+  resolve -> Read Data (item_read_oyges) -> end
+  reject  -> end
+```
+
+- Trigger: event.
+- Flow option keys: `type`, `scope`, `collections`.
+- Condition option key: `filter`.
+- Read option keys: `permissions`, `emitEvents`, `collection`, `key`.
+
+**Unresolved:** the triggering collection/event, condition, item key, read collection, and any mutation that performs the assignment or rejection. The exported graph contains only a condition followed by an item-read operation; no update operation is visible. The description's assignment behavior therefore cannot be reconciled with the sanitized graph without the omitted options or additional extension/hook behavior.
+
+## Refreshing flow documentation
+
+A future sanitized export should retain non-sensitive structural option values such as event type, collection name, and graph routing when safe, while continuing to remove credentials, destination addresses, headers, code containing secrets, and personal data. Each retained value must be reviewed rather than copied wholesale.

directus/integration-testing.md

@@ -0,0 +1,61 @@
+# Proposed disposable Directus integration testing
+
+No tests described here have been implemented or run. This is a future design that must never target production.
+
+## Environment
+
+Use a dedicated Compose project with:
+
+- A version-pinned Directus image matching production (currently 12.1.1), not the production `latest` deployment reference.
+- A disposable MySQL database matching the production database family.
+- Ephemeral uploads and a test-only extensions mount populated only when production extensions have been reviewed and are needed.
+- Random per-run signing secrets and test-only static credentials.
+- A loopback-only port and an unmistakable test public URL.
+- Mail captured by a local sink; no external delivery.
+- No production database, network, credentials, host mounts, or URLs.
+
+Provision schema and access configuration from reviewed test fixtures derived from `schema.yaml` and the sanitized role/policy exports. Do not apply the production snapshot automatically until a reviewed fixture process accounts for system collections and version compatibility.
+
+## Test identities
+
+Create only synthetic records:
+
+- Registration Bot with Registration policy and a test-only static credential.
+- Supporter Bot with Supporter policy if cross-feature checks need it.
+- A normal Users-role account with both Users policies.
+- An administrator used only for fixture setup/teardown, never by application requests.
+
+Have the test harness assert each identity's effective permissions before auth scenarios. This catches a valid credential attached to the wrong role/policy.
+
+## Required scenarios
+
+| Area | Cases and assertions |
+| --- | --- |
+| Registration | Valid account creates an active, login-capable Users-role account; app cookies have expected flags; omitted/default role behavior is explicit; whitespace in passwords is preserved. |
+| Duplicate accounts | Duplicate email and duplicate username return the same non-enumerating conflict; mixed case behavior is recorded; failed pre-check cannot turn into a permission disclosure. |
+| Email login | Correct credentials succeed; incorrect password and unknown account have indistinguishable responses; rate-limit behavior is isolated per test process. |
+| Username login | Registration credential resolves username using only permitted fields; correct credentials succeed; unknown username is generic; missing/mis-scoped credential fails clearly without exposing Directus internals. |
+| Current user | `/users/me` and application wrappers return only expected fields; another user's private fields cannot be queried; middleware validation accepts a valid token and rejects expired/revoked tokens. |
+| Refresh | Once implemented, valid refresh rotates/returns expected tokens and cookies; expired/revoked/reused tokens fail; the endpoint never accepts an access token in place of refresh. Until then, assert/document that no application refresh endpoint exists. |
+| Logout | Once strengthened, clears all auth state and invokes Directus revocation as designed. Until then, characterize the current local-only `ma_at` clearing and retained refresh cookie as a known failing contract. |
+| Profile changes | Own first/last name and location succeed; email requires recent reauth; username update is denied; other-user updates are denied; the recent-auth marker expires and is single-use. |
+| Password changes | Correct current password succeeds; incorrect current password fails; minimum length is enforced; username identifier path works; external-provider behavior is tested if enabled; existing token/session behavior is explicitly asserted. |
+| Avatar changes | Allowed image succeeds into the test folder and links to self; bad type/signature/size fails; other-user linking and unauthorized folder behavior fail; partial upload cleanup behavior is characterized. |
+| Least privilege | Registration identity can read only required role/user fields and create only permitted user fields; cannot update/delete users, read unrelated collections, administer settings, or access the Data Studio. Test whether exported sensitive read fields can be narrowed. |
+
+## Permission-focused negative tests
+
+- Remove Registration `directus_users.read`: username resolution and duplicate checks should fail predictably while the effect on create is separately asserted.
+- Remove Registration `directus_users.create`: signup must fail without leaking permission internals.
+- Attach the static credential to the wrong role to prove deployment validation catches it.
+- Attempt to override role, status, policy, ID, and authentication data through the public app payload; the server must ignore or reject every override.
+- Verify Users updates are limited to `id=$CURRENT_USER` and permitted fields.
+- Exercise the exported `user_rigs` `%CURRENT_USER` update filter and record actual Directus 12.1.1 behavior.
+
+## Harness and lifecycle
+
+Run tests from outside the Next.js process against its HTTP interface, with a smaller Directus-level suite for permission diagnostics. Wait for both MySQL and Directus health, seed fixtures idempotently, run serial auth tests where rate limiting or cookie state matters, then destroy containers and volumes.
+
+Log method, path template, status, Directus error code, and synthetic fixture ID only. Redact credentials and cookie values at the logging boundary. Never snapshot response bodies containing private profile fields.
+
+CI should fail if the configured Directus version differs from the fixture version, a required permission assertion changes, a sensitive environment name lacks a test placeholder, or teardown leaves the disposable project running.

directus/permissions.md

@@ -0,0 +1,90 @@
+# Roles, policies, and permissions
+
+This is a readable rendering of `reference/exports/roles.json`, `policies.json`, `access.json`, and `permissions.json`. `C/R/U/D` mean create/read/update/delete. An absent action means no permission row was exported; it does not establish permissions inherited from an omitted user-specific policy.
+
+## Role and policy assignments
+
+| Role/access subject | Assigned policy | Admin access | Data Studio app access | Enforced TFA | IP restriction |
+| --- | --- | --- | --- | --- | --- |
+| Administrator | Administrator | Yes | Yes | No | None |
+| Registration Bot | Registration | No | No | No | None |
+| Supporter Bot | Supporter | No | No | No | None |
+| Users | Users Self Access (sort 1), Users (sort 2) | No | No | No | None |
+| Public/role-less | Public | No | No | No | None |
+
+No user-specific access assignments appear in the sanitized export because user data was intentionally omitted. The Administrator policy's collection permissions are implicit in `admin_access`; no individual rows were exported for it.
+
+## High-level matrix
+
+| Collection group | Public | Users | Users Self Access | Registration | Supporter |
+| --- | --- | --- | --- | --- | --- |
+| Public catalog/content collections listed below | R | R | - | - | - |
+| `directus_fields` | R: `id,collection,field` | R: metadata fields listed below | - | - | - |
+| `directus_files` | R all fields | C/R all fields | - | - | - |
+| `directus_users` | - | R public profile fields | own-row R/U | R/C broad registration fields | - |
+| Projects and settings collections | R | C/R/U/D | - | - | - |
+| `projects_files` | R | C/R | - | - | - |
+| `user_claims` | - | C/R/U/D with presets and own/pending filters | - | - | - |
+| `user_rigs` | - | C/R/U/D with owner controls | - | - | - |
+| `user_rig_type` | - | C/R | - | - | - |
+| `user_memberships` | - | - | - | - | C/R/U all fields |
+| `directus_roles` | - | - | - | R selected role fields | - |
+
+## Public policy
+
+Unrestricted read, all fields, is exported for:
+
+`bg_cat`, `bg_entries`, `bg_sub_cat`, `directus_files`, `hazard_danger`, `hazard_severity`, `hazard_source`, `hazard_tags`, `laser_focus_lens`, `laser_focus_lens_config`, `laser_focus_lens_diameter`, `laser_scan_lens`, `laser_scan_lens_apt`, `laser_scan_lens_config`, `laser_scan_lens_exp`, `laser_software`, `laser_source`, `material`, `material_cat`, `material_coating`, `material_coating_hazard_tags`, `material_color`, `material_hazard_tags`, `material_opacity`, `material_status`, `projects`, `projects_files`, `settings_co2gal`, `settings_co2gan`, `settings_fiber`, and `settings_uv`.
+
+Public can also read `directus_fields`, restricted to `field,collection,id`. There are no exported public create, update, or delete permissions.
+
+## Users policy
+
+Users have unrestricted, all-field read for every public content collection above. Additional or expanded permissions are:
+
+| Collection | Actions | Row filter | Fields/presets |
+| --- | --- | --- | --- |
+| `directus_fields` | R | None | `id,collection,field,special,interface,options,readonly,hidden,required,sort,width,group,note` |
+| `directus_files` | C/R | None | All fields; no folder/owner filter or preset exported |
+| `directus_users` | R | None | `username,first_name,avatar,location,id` |
+| `projects` | C/R/U/D | U/D require `owner=$CURRENT_USER`; C/R unrestricted | All fields; C presets `owner` and `uploader` to `$CURRENT_USER` |
+| `projects_files` | C/R | None | All fields; no ownership filter exported |
+| `settings_co2gal` | C/R/U/D | U/D require `owner=$CURRENT_USER`; C/R unrestricted | All fields; C presets owner/uploader to current user |
+| `settings_co2gan` | C/R/U/D | Same as above | Same as above |
+| `settings_fiber` | C/R/U/D | Same as above | Same as above |
+| `settings_uv` | C/R/U/D | U/D require `owner=$CURRENT_USER`; C/R unrestricted | C/R/U all fields and owner/uploader presets on C; D has `fields=null` in the export |
+| `user_claims` | C/R/U/D | R: claimant is current user. U/D: claimant is current user and status is `pending`. C unrestricted. | C fields omit `claimant` and `status` but preset them to current user/`pending`; R selected fields; U only `note`; D `fields=null` |
+| `user_rigs` | C/R/U/D | R/D require owner current user. U filter contains `owner _eq "%CURRENT_USER"` exactly as exported. C unrestricted. | All fields; C presets owner to `$CURRENT_USER` |
+| `user_rig_type` | C/R | None | All fields |
+
+The `%CURRENT_USER` update filter on `user_rigs` differs from the `$CURRENT_USER` token used everywhere else. This is a **verified exported value** and is likely ineffective, but its Directus runtime interpretation has not been tested.
+
+No validation rules are present on any exported Users permission row.
+
+## Users Self Access policy
+
+Both rows require `id=$CURRENT_USER`:
+
+- Read fields: `username,last_name,first_name,email,password,avatar,location,title,description,tags,language,tfa_secret,email_notifications,id`.
+- Update fields: `first_name,last_name,email,password,avatar,location`.
+
+There are no presets or validation rules. Username is readable but not updateable. The exported read list includes sensitive field names such as `password` and `tfa_secret`; Directus may suppress stored secret values independently, but that behavior is **not proven by this export** and should be tested.
+
+## Registration policy
+
+- `directus_users.create`: unrestricted rows; fields `email,username,password,role,status,auth_data,first_name,last_name,avatar,id`.
+- `directus_users.read`: unrestricted rows; a broad field list including `username,email,id,password,auth_data,token,policies,role,status,tfa_secret` and UI/theme fields.
+- `directus_roles.read`: unrestricted rows; fields `id,name,icon,description,parent,children`.
+
+No validation rules or presets are exported. Least privilege therefore depends on the static credential being held only by the server and the application strictly controlling submitted fields. The application registration route currently uses email, username, password, and optionally role; username-to-email login resolution uses read access.
+
+## Supporter policy
+
+`user_memberships` has unrestricted create, read, and update permissions on all fields. No delete row, row filters, validation rules, or presets are exported. The policy is assigned to Supporter Bot.
+
+## Validation and preset summary
+
+- Every exported `validation` value is null.
+- Presets exist only for Users creates on projects/settings (`owner`/`uploader`), user claims (`claimant`/`pending`), and user rigs (`owner`).
+- Row filters exist only for Users updates/deletes and selected reads described above, plus own-row filters in Users Self Access.
+- Null permissions mean no row filter in these exports; null fields on delete rows are preserved as observed rather than interpreted as all/no fields.

directus/reference/deployment-inventory.md

@@ -0,0 +1,29 @@
+# Directus Deployment Inventory
+
+Generated from the running production container.
+
+- Directus version: 12.1.1
+- Container image: directus/directus:latest
+- Public URL: https://forms.lasereverything.net
+- Host binding: 127.0.0.1:8056
+- Database client: mysql
+- Database service and database names: intentionally omitted
+- Email transport: smtp
+- SMTP port: 465
+- SMTP secure mode: true
+- Explicit AUTH_PROVIDERS variable: not set
+- Explicit CORS variables: not set
+- Explicit cookie variables: not set
+- Explicit registration environment variables: not set
+
+## Persistent mounts
+
+- `/directus/extensions` is mounted from the host, mode `rw`
+- `/directus/uploads` is mounted from the host, mode `rw`
+
+## Notes
+
+- Secret values are intentionally excluded.
+- Registration behavior also depends on fields stored in the Directus settings table.
+- Role, policy, and permission exports are stored separately.
+- Flow option values are excluded because they may contain credentials, headers, addresses, or other sensitive configuration.

directus/reference/docker-compose.sanitized.yml

@@ -0,0 +1,28 @@
+services:
+  directus:
+    image: directus/directus:latest
+    container_name: directus
+    ports:
+      - "127.0.0.1:8056:8055"
+    env_file:
+      - .env
+    volumes:
+      - ./uploads:/directus/uploads
+      - ./extensions:/directus/extensions
+    networks:
+      - default
+      - backend_net
+    restart: unless-stopped
+
+networks:
+  default:
+    name: directus_net
+    driver: bridge
+    enable_ipv6: true
+    ipam:
+      config:
+        - subnet: 10.40.0.0/16
+        - subnet: fd00:40::/64
+  backend_net:
+    external: true
+

directus/reference/environment-variable-names.txt

@@ -0,0 +1,24 @@
+ADMIN_EMAIL
+ADMIN_PASSWORD
+DB_CLIENT
+DB_DATABASE
+DB_FILENAME
+DB_HOST
+DB_PASSWORD
+DB_PORT
+DB_USER
+EMAIL_FROM
+EMAIL_SMTP_HOST
+EMAIL_SMTP_PASSWORD
+EMAIL_SMTP_PORT
+EMAIL_SMTP_SECURE
+EMAIL_SMTP_USER
+EMAIL_TRANSPORT
+KEY
+NODE_ENV
+NODE_VERSION
+NPM_CONFIG_UPDATE_NOTIFIER
+PATH
+PUBLIC_URL
+SECRET
+YARN_VERSION

directus/reference/exports/access.json

@@ -0,0 +1,44 @@
+[
+  {
+    "id": "45b5000f-f495-4940-935a-d4bf2e409844",
+    "role": "a6d3c757-a96b-4f0c-b96b-a6109d60a7ba",
+    "policy": "93fc7a9e-16de-45d4-89b1-9fa129e81442",
+    "sort": null,
+    "user": null
+  },
+  {
+    "id": "2ddbc9da-e0f5-4dff-a952-c3d7586ab706",
+    "role": "296a28bc-60ab-4251-8bef-27f6dfb67948",
+    "policy": "80b3902c-06e6-480c-9d29-d2a46552f60e",
+    "sort": 1,
+    "user": null
+  },
+  {
+    "id": "767277dd-3b08-4d72-9bde-437af91e1d88",
+    "role": "a2a695be-88f9-4948-b2a4-e0e22b01b32e",
+    "policy": "2e4acc56-7f7e-4a10-9775-1c0dd9f47ded",
+    "sort": 1,
+    "user": null
+  },
+  {
+    "id": "abfa5434-1ace-4e1f-9a93-7d84aabb0a95",
+    "role": "00e518e3-75b3-4c6f-b57d-51a4f1af4781",
+    "policy": "494e10a0-03ec-40b9-a7a5-c3a1e2b95001",
+    "sort": 1,
+    "user": null
+  },
+  {
+    "id": "c1480ea2-ca4d-46c9-8034-09b76d0a41cf",
+    "role": null,
+    "policy": "abf8a154-5b1c-4a46-ac9c-7300570f4f17",
+    "sort": 1,
+    "user": null
+  },
+  {
+    "id": "cf8e40bd-3fbe-4df5-a845-01802a3e7e1c",
+    "role": "296a28bc-60ab-4251-8bef-27f6dfb67948",
+    "policy": "536f020c-4f05-497d-8a6c-54e13f62c694",
+    "sort": 2,
+    "user": null
+  }
+]

directus/reference/exports/directus-user-fields.json

@@ -0,0 +1,19 @@
+[
+  {
+    "field": "username",
+    "special": null,
+    "interface": "input",
+    "options": null,
+    "display": "raw",
+    "display_options": null,
+    "readonly": 0,
+    "hidden": 0,
+    "required": 1,
+    "sort": 1,
+    "width": "full",
+    "note": null,
+    "conditions": null,
+    "validation": null,
+    "validation_message": null
+  }
+]

directus/reference/exports/flows.json

@@ -0,0 +1,35 @@
+[
+  {
+    "id": "fdc2d675-e365-4431-9cd0-27e571c89e04",
+    "name": "claim_auto_assign",
+    "icon": "bolt",
+    "color": null,
+    "description": "Assigns a claimant to owner and rejects other pending claims.",
+    "status": "active",
+    "trigger": "event",
+    "accountability": "all",
+    "options_keys": [
+      "type",
+      "scope",
+      "collections"
+    ],
+    "root_operation": "e19723a6-e75c-4bc8-92aa-be06bb0528af"
+  },
+  {
+    "id": "99cc3ea5-3ab7-431f-a4f6-ce4e7677b092",
+    "name": "unique_key_claims",
+    "icon": "bolt",
+    "color": null,
+    "description": "A flow for setting a unique key for each claim to prevent duplicates.",
+    "status": "active",
+    "trigger": "event",
+    "accountability": "all",
+    "options_keys": [
+      "type",
+      "scope",
+      "collections",
+      "return"
+    ],
+    "root_operation": "2245466f-8178-4e5c-b058-819eb421de47"
+  }
+]

directus/reference/exports/operations.json

@@ -0,0 +1,94 @@
+[
+  {
+    "id": "03c6582f-800d-4e94-9fea-f77a9ea5e3aa",
+    "name": "Condition",
+    "key": "condition_s458i",
+    "type": "condition",
+    "position_x": 55,
+    "position_y": 1,
+    "resolve": "d4266993-ceae-452a-9b7d-664c11bf1013",
+    "reject": null,
+    "flow": "99cc3ea5-3ab7-431f-a4f6-ce4e7677b092",
+    "options_keys": [
+      "filter"
+    ]
+  },
+  {
+    "id": "cb7101fc-e2c5-4cfc-b1d6-486ac70d286f",
+    "name": "Read Data",
+    "key": "item_read_e4myo",
+    "type": "item-read",
+    "position_x": 37,
+    "position_y": 1,
+    "resolve": "03c6582f-800d-4e94-9fea-f77a9ea5e3aa",
+    "reject": null,
+    "flow": "99cc3ea5-3ab7-431f-a4f6-ce4e7677b092",
+    "options_keys": [
+      "permissions",
+      "emitEvents",
+      "collection",
+      "query"
+    ]
+  },
+  {
+    "id": "2245466f-8178-4e5c-b058-819eb421de47",
+    "name": "Run Script",
+    "key": "exec_5dli5",
+    "type": "exec",
+    "position_x": 19,
+    "position_y": 1,
+    "resolve": "cb7101fc-e2c5-4cfc-b1d6-486ac70d286f",
+    "reject": null,
+    "flow": "99cc3ea5-3ab7-431f-a4f6-ce4e7677b092",
+    "options_keys": [
+      "code"
+    ]
+  },
+  {
+    "id": "d4266993-ceae-452a-9b7d-664c11bf1013",
+    "name": "Throw Error",
+    "key": "throw_error_22tpm",
+    "type": "throw-error",
+    "position_x": 73,
+    "position_y": 1,
+    "resolve": null,
+    "reject": null,
+    "flow": "99cc3ea5-3ab7-431f-a4f6-ce4e7677b092",
+    "options_keys": [
+      "status",
+      "message",
+      "code"
+    ]
+  },
+  {
+    "id": "e19723a6-e75c-4bc8-92aa-be06bb0528af",
+    "name": "Condition",
+    "key": "condition_dl7cj",
+    "type": "condition",
+    "position_x": 19,
+    "position_y": 1,
+    "resolve": "ebd0e644-1be0-4200-89c4-844b06c7d788",
+    "reject": null,
+    "flow": "fdc2d675-e365-4431-9cd0-27e571c89e04",
+    "options_keys": [
+      "filter"
+    ]
+  },
+  {
+    "id": "ebd0e644-1be0-4200-89c4-844b06c7d788",
+    "name": "Read Data",
+    "key": "item_read_oyges",
+    "type": "item-read",
+    "position_x": 37,
+    "position_y": 1,
+    "resolve": null,
+    "reject": null,
+    "flow": "fdc2d675-e365-4431-9cd0-27e571c89e04",
+    "options_keys": [
+      "permissions",
+      "emitEvents",
+      "collection",
+      "key"
+    ]
+  }
+]

directus/reference/exports/policies.json

@@ -0,0 +1,62 @@
+[
+  {
+    "id": "abf8a154-5b1c-4a46-ac9c-7300570f4f17",
+    "name": "$t:public_label",
+    "icon": "public",
+    "description": "$t:public_description",
+    "admin_access": 0,
+    "app_access": 0,
+    "enforce_tfa": 0,
+    "ip_access": null
+  },
+  {
+    "id": "93fc7a9e-16de-45d4-89b1-9fa129e81442",
+    "name": "Administrator",
+    "icon": "verified",
+    "description": "$t:admin_description",
+    "admin_access": 1,
+    "app_access": 1,
+    "enforce_tfa": 0,
+    "ip_access": null
+  },
+  {
+    "id": "494e10a0-03ec-40b9-a7a5-c3a1e2b95001",
+    "name": "Registration",
+    "icon": "robot",
+    "description": "Registration Bot",
+    "admin_access": 0,
+    "app_access": 0,
+    "enforce_tfa": 0,
+    "ip_access": null
+  },
+  {
+    "id": "2e4acc56-7f7e-4a10-9775-1c0dd9f47ded",
+    "name": "Supporter",
+    "icon": "robot_2",
+    "description": "Supporter Bot",
+    "admin_access": 0,
+    "app_access": 0,
+    "enforce_tfa": 0,
+    "ip_access": null
+  },
+  {
+    "id": "536f020c-4f05-497d-8a6c-54e13f62c694",
+    "name": "Users",
+    "icon": "badge",
+    "description": "Registered Users",
+    "admin_access": 0,
+    "app_access": 0,
+    "enforce_tfa": 0,
+    "ip_access": null
+  },
+  {
+    "id": "80b3902c-06e6-480c-9d29-d2a46552f60e",
+    "name": "Users Self Access",
+    "icon": "badge",
+    "description": "Registered Users Self Access",
+    "admin_access": 0,
+    "app_access": 0,
+    "enforce_tfa": 0,
+    "ip_access": null
+  }
+]

directus/reference/exports/roles.json

@@ -0,0 +1,30 @@
+[
+  {
+    "id": "a6d3c757-a96b-4f0c-b96b-a6109d60a7ba",
+    "name": "Administrator",
+    "icon": "verified",
+    "description": "$t:admin_description",
+    "parent": null
+  },
+  {
+    "id": "00e518e3-75b3-4c6f-b57d-51a4f1af4781",
+    "name": "Registration Bot",
+    "icon": "robot",
+    "description": "Registers accounts.",
+    "parent": null
+  },
+  {
+    "id": "a2a695be-88f9-4948-b2a4-e0e22b01b32e",
+    "name": "Supporter Bot",
+    "icon": "supervised_user_circle",
+    "description": "Registers supporters.",
+    "parent": null
+  },
+  {
+    "id": "296a28bc-60ab-4251-8bef-27f6dfb67948",
+    "name": "Users",
+    "icon": "accessibility_new",
+    "description": "Registered users.",
+    "parent": null
+  }
+]

directus/reference/exports/settings.json

@@ -0,0 +1,11 @@
+[
+  {
+    "project_name": "Directus",
+    "project_url": null,
+    "default_language": "en-US",
+    "public_registration": 0,
+    "public_registration_verify_email": 0,
+    "public_registration_role": null,
+    "public_registration_email_filter": null
+  }
+]

directus/reference/nginx-summary.txt

@@ -0,0 +1,33 @@
+3:    listen 80;
+4:    server_name forms.lasereverything.net;
+5:    client_max_body_size 100M;
+8:    location /.well-known/acme-challenge/ {
+13:    location / {
+20:    listen 443 ssl;
+22:    server_name forms.lasereverything.net;
+23:    client_max_body_size 100M;
+28:    ssl_protocols TLSv1.2 TLSv1.3;
+31:    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+33:    location / {
+34:        proxy_pass http://127.0.0.1:8056;
+37:        proxy_set_header Host                $host;
+38:        proxy_set_header X-Real-IP           $remote_addr;
+39:        proxy_set_header X-Forwarded-For     $proxy_add_x_forwarded_for;
+40:        proxy_set_header X-Forwarded-Proto   $scheme;
+43:        proxy_set_header Upgrade $http_upgrade;
+44:        proxy_set_header Connection "upgrade";
+46:        proxy_read_timeout        300;
+48:        proxy_send_timeout        300;
+57:            add_header Access-Control-Allow-Origin  "$http_origin" always;
+58:            add_header Access-Control-Allow-Credentials "true" always;
+59:            add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With" always;
+60:            add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" always;
+61:            add_header Vary "Origin" always;
+66:            add_header Access-Control-Max-Age 1728000 always;
+67:            add_header Content-Type "text/plain; charset=utf-8" always;
+68:            add_header Content-Length 0 always;
+71:            add_header Access-Control-Allow-Origin  "$http_origin" always;
+72:            add_header Access-Control-Allow-Credentials "true" always;
+73:            add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With" always;
+74:            add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" always;
+75:            add_header Vary "Origin" always;

directus/reference/schema-comparison.txt

@@ -0,0 +1,8 @@
+Live schema SHA-256:
+709c5f5fa6c239406085e8c7e5959d2d096d36ad1d8676727a0ca473536498e6  /root/directus-codex-context-20260710-102253/schema.yaml
+
+Existing repository schema SHA-256:
+8e21cd555b297e729a39f387eadbf4d32621c986516c9d3cc896b01d02efdf8b  /srv/codex-work/lasereverything.net.db/app/schema.yaml
+
+Comparison:
+The live and repository schema files differ.

directus/reference/system-table-columns/directus_access-columns.tsv

@@ -0,0 +1,5 @@
+id	char(36)	NO	PRI	NULL	
+role	char(36)	YES	MUL	NULL	
+user	char(36)	YES	MUL	NULL	
+policy	char(36)	NO	MUL	NULL	
+sort	int(11)	YES		NULL	

directus/reference/system-table-columns/directus_fields-columns.tsv

@@ -0,0 +1,20 @@
+id	int(10) unsigned	NO	PRI	NULL	auto_increment
+collection	varchar(64)	NO	MUL	NULL	
+field	varchar(64)	NO		NULL	
+special	varchar(64)	YES		NULL	
+interface	varchar(64)	YES		NULL	
+options	longtext	YES		NULL	
+display	varchar(64)	YES		NULL	
+display_options	longtext	YES		NULL	
+readonly	tinyint(1)	NO		0	
+hidden	tinyint(1)	NO		0	
+sort	int(10) unsigned	YES		NULL	
+width	varchar(30)	YES		full	
+translations	longtext	YES		NULL	
+note	text	YES		NULL	
+conditions	longtext	YES		NULL	
+required	tinyint(1)	YES		0	
+group	varchar(64)	YES		NULL	
+validation	longtext	YES		NULL	
+validation_message	text	YES		NULL	
+searchable	tinyint(1)	NO		1	

directus/reference/system-table-columns/directus_flows-columns.tsv

@@ -0,0 +1,12 @@
+id	char(36)	NO	PRI	NULL	
+name	varchar(255)	NO		NULL	
+icon	varchar(64)	YES		NULL	
+color	varchar(255)	YES		NULL	
+description	text	YES		NULL	
+status	varchar(255)	NO		active	
+trigger	varchar(255)	YES		NULL	
+accountability	varchar(255)	YES		all	
+options	longtext	YES		NULL	
+operation	char(36)	YES	UNI	NULL	
+date_created	timestamp	YES		current_timestamp()	
+user_created	char(36)	YES	MUL	NULL	

directus/reference/system-table-columns/directus_operations-columns.tsv

@@ -0,0 +1,12 @@
+id	char(36)	NO	PRI	NULL	
+name	varchar(255)	YES		NULL	
+key	varchar(255)	NO		NULL	
+type	varchar(255)	NO		NULL	
+position_x	int(11)	NO		NULL	
+position_y	int(11)	NO		NULL	
+options	longtext	YES		NULL	
+resolve	char(36)	YES	UNI	NULL	
+reject	char(36)	YES	UNI	NULL	
+flow	char(36)	NO	MUL	NULL	
+date_created	timestamp	YES		current_timestamp()	
+user_created	char(36)	YES	MUL	NULL	

directus/reference/system-table-columns/directus_permissions-columns.tsv

@@ -0,0 +1,8 @@
+id	int(10) unsigned	NO	PRI	NULL	auto_increment
+collection	varchar(64)	NO	MUL	NULL	
+action	varchar(10)	NO		NULL	
+permissions	longtext	YES		NULL	
+validation	longtext	YES		NULL	
+presets	longtext	YES		NULL	
+fields	text	YES		NULL	
+policy	char(36)	NO	MUL	NULL	

directus/reference/system-table-columns/directus_policies-columns.tsv

@@ -0,0 +1,8 @@
+id	char(36)	NO	PRI	NULL	
+name	varchar(100)	NO		NULL	
+icon	varchar(64)	NO		badge	
+description	text	YES		NULL	
+ip_access	text	YES		NULL	
+enforce_tfa	tinyint(1)	NO		0	
+admin_access	tinyint(1)	NO		0	
+app_access	tinyint(1)	NO		0	

directus/reference/system-table-columns/directus_roles-columns.tsv

@@ -0,0 +1,5 @@
+id	char(36)	NO	PRI	NULL	
+name	varchar(100)	NO		NULL	
+icon	varchar(64)	NO		supervised_user_circle	
+description	text	YES		NULL	
+parent	char(36)	YES	MUL	NULL	

directus/reference/system-table-columns/directus_settings-columns.tsv

@@ -0,0 +1,66 @@
+id	int(10) unsigned	NO	PRI	NULL	auto_increment
+project_name	varchar(100)	NO		Directus	
+project_url	varchar(255)	YES		NULL	
+project_color	varchar(255)	NO		#6644FF	
+project_logo	char(36)	YES	MUL	NULL	
+public_foreground	char(36)	YES	MUL	NULL	
+public_background	char(36)	YES	MUL	NULL	
+public_note	text	YES		NULL	
+auth_login_attempts	int(10) unsigned	YES		25	
+auth_password_policy	varchar(100)	YES		NULL	
+storage_asset_transform	varchar(7)	YES		all	
+storage_asset_presets	longtext	YES		NULL	
+custom_css	text	YES		NULL	
+storage_default_folder	char(36)	YES	MUL	NULL	
+basemaps	longtext	YES		NULL	
+mapbox_key	varchar(255)	YES		NULL	
+module_bar	longtext	YES		NULL	
+project_descriptor	varchar(100)	YES		NULL	
+default_language	varchar(255)	NO		en-US	
+custom_aspect_ratios	longtext	YES		NULL	
+public_favicon	char(36)	YES	MUL	NULL	
+default_appearance	varchar(255)	NO		auto	
+default_theme_light	varchar(255)	YES		NULL	
+theme_light_overrides	longtext	YES		NULL	
+default_theme_dark	varchar(255)	YES		NULL	
+theme_dark_overrides	longtext	YES		NULL	
+report_error_url	varchar(255)	YES		NULL	
+report_bug_url	varchar(255)	YES		NULL	
+report_feature_url	varchar(255)	YES		NULL	
+public_registration	tinyint(1)	NO		0	
+public_registration_verify_email	tinyint(1)	NO		1	
+public_registration_role	char(36)	YES	MUL	NULL	
+public_registration_email_filter	longtext	YES		NULL	
+visual_editor_urls	longtext	YES		NULL	
+project_id	char(36)	YES		NULL	
+mcp_enabled	tinyint(1)	NO		0	
+mcp_allow_deletes	tinyint(1)	NO		0	
+mcp_prompts_collection	varchar(255)	YES		NULL	
+mcp_system_prompt_enabled	tinyint(1)	NO		1	
+mcp_system_prompt	text	YES		NULL	
+project_owner	varchar(255)	YES		NULL	
+project_usage	varchar(255)	YES		NULL	
+org_name	varchar(255)	YES		NULL	
+product_updates	tinyint(1)	YES		NULL	
+project_status	varchar(255)	YES		NULL	
+ai_openai_api_key	text	YES		NULL	
+ai_anthropic_api_key	text	YES		NULL	
+ai_system_prompt	text	YES		NULL	
+ai_google_api_key	text	YES		NULL	
+ai_openai_compatible_api_key	text	YES		NULL	
+ai_openai_compatible_base_url	text	YES		NULL	
+ai_openai_compatible_name	text	YES		NULL	
+ai_openai_compatible_models	longtext	YES		NULL	
+ai_openai_compatible_headers	longtext	YES		NULL	
+ai_openai_allowed_models	longtext	YES		NULL	
+ai_anthropic_allowed_models	longtext	YES		NULL	
+ai_google_allowed_models	longtext	YES		NULL	
+collaborative_editing_enabled	tinyint(1)	NO		0	
+ai_translation_default_model	text	YES		NULL	
+ai_translation_glossary	longtext	YES		NULL	
+ai_translation_style_guide	text	YES		NULL	
+license_key	varchar(255)	YES		NULL	
+license_token	text	YES		NULL	
+mcp_oauth_enabled	tinyint(1)	NO		0	
+mcp_oauth_dcr_enabled	tinyint(1)	NO		0	
+mcp_oauth_cimd_enabled	tinyint(1)	NO		0	

directus/schema-differences.md

@@ -0,0 +1,55 @@
+# Production versus older schema snapshot
+
+Compared files:
+
+- Current production evidence: `directus/schema.yaml`, Directus 12.1.1, MySQL.
+- Older repository snapshot: `app/schema.yaml`, Directus 11.12.0, MySQL.
+
+The supplied hashes differ. A structural YAML comparison found 36 versus 34 collection entries, 394 versus 379 field entries, and 138 versus 136 relation entries. Neither snapshot was modified.
+
+## Meaningful additions
+
+### `directus_users` collection metadata
+
+The current snapshot includes `directus_users` as a collection with display template `{{ username }} ({{ email }})`. The older snapshot contains the custom `directus_users.username` field and relations to the system collection but omits the collection entry itself.
+
+The username field remains a unique nullable `varchar(255)` at the database layer while Directus metadata marks it required, visible, editable, and searchable. The older snapshot has the same database and required-field characteristics; current metadata additionally contains the Directus 12 `searchable` property.
+
+### `user_memberships`
+
+Production adds the `user_memberships` collection with 15 fields:
+
+- Integer auto-increment primary key: `id`.
+- Provider/account data: `provider`, `external_user_id`, `email`, `username`, `status`, `tier`.
+- Timing: `started_at`, `renews_at`, `last_event_at`.
+- Claim/support data: `claim_token`, `claim_expires_at`, `raw`.
+- User relations: `app_user`, `claim_user_id`.
+
+`app_user` and `claim_user_id` are nullable indexed M2O foreign keys to `directus_users.id`; both use `SET NULL` on delete and `RESTRICT` on update. The schema does not mark `claim_token` unique. Provider choices are Ko-Fi, Patreon, and LMA/Mighty; status choices are active, canceled, refunded, and one-time. These are metadata choices, not database constraints.
+
+### Settings raster metadata
+
+The `settings_co2gal.raster_settings` repeater gained three nested metadata fields: `angle` (integer), `auto` (boolean), and `increment` (integer). These are changes inside the JSON/repeater field definition, not new top-level database columns.
+
+### Display metadata
+
+- `settings_co2gal.owner` changed from no display renderer to related-values with template `{{username}}`.
+- `bg_entries.scores` changed its display formatting template from `{{ cat }}` to `{{ body }}`.
+
+## Version-generated metadata differences
+
+Most raw differences are serialization changes rather than business-schema changes:
+
+- All 34 pre-existing collection entries gained `meta.autosave_revision_interval: null` and `meta.status: active`.
+- All 379 pre-existing field entries gained `meta.searchable: true`.
+
+These additions are consistent across the snapshots and correspond to newer snapshot metadata emitted by Directus 12. They do not by themselves show database-column changes.
+
+## Unchanged structural areas
+
+- No older collection, field, or relation key was removed.
+- All 136 relations present in the older snapshot compare equal structurally.
+- The two added relations are the new `user_memberships` links described above.
+- Database vendor remains MySQL and snapshot format version remains 1.
+
+This comparison is structural and does not compare data, permissions, policies, flows, settings-table values, indexes not represented by the snapshot, extension behavior, or migration history.

docs/le-app-database-migration/architecture-proposal.md

@@ -0,0 +1,152 @@
+# Laser Everything database transition architecture
+
+Status: pre-implementation decision record. No production changes are authorized by this document.
+
+## Objective and Milestone 0
+
+The target is a unified, reproducible application environment, not merely a database conversion. Unified means one repository, one versioned orchestration model, shared service contracts, consistent application images, and documented promotion from development through production. Services remain separate processes and containers.
+
+**Milestone 0: complete reproducible application environment** must be accepted and implemented before the large Payload/data-migration phase. It delivers:
+
+- complete service and persistence inventory for the `4884b5d` application;
+- common Compose core plus mode-specific overlays/profiles;
+- rootless, Codex-controlled nonproduction containers and volumes;
+- production-like local HTTPS routing and cookie behavior;
+- fixture and scrubbed-snapshot data modes using identical application images;
+- safe captured email and outbound-network safeguards;
+- optional isolated legacy Directus reference environment;
+- deterministic one-command lifecycle, migration, validation, smoke, and browser-test workflows;
+- image-by-digest promotion to staging and production.
+
+The detailed runtime inventory, orchestration design, repository tree, and test matrix are in [`environment-parity.md`](./environment-parity.md). The access audit, recommended account boundary, exact host prerequisites, ingress integration, storage, networking proof, and rollback plan are in [`host-runtime-plan.md`](./host-runtime-plan.md). The gated delivery sequence is in [`implementation-plan.md`](./implementation-plan.md).
+
+Milestone 0 host rule: nonproduction container isolation is not treated as a substitute for host filesystem permissions. The chosen daemon owner must be unable to read production paths and secrets, because a container controller can bind-mount anything readable to that daemon account.
+
+## Verified baseline
+
+The migration branch initially started from `main` at `0a7ee5f`. A tree and history comparison against the final pre-utilities production commit `4884b5d` established:
+
+- `main` is an ancestor of `4884b5d`.
+- `4884b5d` contains exactly two later commits: `92ce8bc` and `4884b5d`.
+- Those commits repair production registration/authentication behavior and add the verified Directus deployment contract, policies, flows, exports, and schema snapshot.
+- The application was not replaced or reduced in those commits.
+
+Conclusion: `main` is a complete application tree, but `4884b5d` is the correct and more complete pre-utilities production baseline. The dedicated `migration/le-app-database` branch has therefore been fast-forwarded to `4884b5d`. The temporary utilities branch is not an ancestor of the migration work.
+
+## Service boundary
+
+The default architecture is three independent services:
+
+```text
+browser
+   |
+   v
+existing Next.js application (frontend + compatibility API)
+   |                                      |
+   | server-to-server HTTP                | background-removal calls
+   v                                      v
+dedicated Payload service              existing bgbye service
+   |
+   v
+dedicated PostgreSQL database
+```
+
+Payload owns content administration, authentication records, media metadata, access policy, hooks, and its generated APIs. The existing application remains the public frontend and initially retains its public API routes. Those routes become a compatibility layer backed by Payload, permitting endpoint-by-endpoint cutover and response-shape comparison.
+
+Deeply embedding Payload into the existing frontend would reduce one network boundary and allow direct Local API calls. It would also force the frontend onto Payload's exact Next.js dependency range, combine release and failure domains, increase the blast radius of admin changes, and make rollback harder. That integration is deferred pending explicit approval.
+
+The complete topology adds a reverse proxy, PostgreSQL, captured mail, migration/test jobs, and optional local-only Directus reference services around this accepted boundary. Payload remains independently deployable and is never merged into the frontend process by Milestone 0.
+
+## Runtime and dependency matrix
+
+| Component | Pinned version | Basis |
+|---|---:|---|
+| Node.js | 24.18.0 LTS (Krypton) | Development, Docker, CI, and production target |
+| npm | 11.16.0 | Version shipped with the pinned Node line |
+| Payload | 3.86.0 | Exact package version |
+| `@payloadcms/next` | 3.86.0 | Must exactly match Payload |
+| `@payloadcms/db-postgres` | 3.86.0 | Must exactly match Payload |
+| Next.js (Payload service only) | 15.4.11 | Explicitly accepted by `@payloadcms/next@3.86.0` peer range |
+| React / React DOM | 19.1.0 | Accepted by Next.js 15.4.11 and conservative relative to the existing app |
+
+The existing frontend's Next.js 15.3.2 is outside Payload 3.86.0's accepted ranges. This is another reason to keep Payload in a dedicated workspace. Package metadata was checked with exact-version `npm view`; the official Payload installation documentation lists 15.4.11 as an accepted line. Node 26 on the host is not a target runtime and must not be used to create authoritative lockfiles or release builds.
+
+References:
+
+- https://payloadcms.com/docs/getting-started/installation
+- https://payloadcms.com/docs/database/postgres
+- https://payloadcms.com/docs/database/migrations
+- https://nodejs.org/en/blog/release/v24.18.0
+
+## Schema lifecycle
+
+Schema push is permitted only while prototyping against the disposable database. Before the first authoritative rehearsal:
+
+1. Disable push in the PostgreSQL adapter.
+2. Commit a generated initial Payload migration.
+3. Keep four separate commands with single responsibilities:
+   - `migration:reset`: destructively empties only the disposable destination.
+   - `migration:schema`: applies committed Payload/Drizzle migrations.
+   - `migration:import`: imports source records and files.
+   - `migration:validate`: performs read-only cross-system checks.
+4. Define `migration:rehearse` only as deterministic composition of those commands.
+
+Database credentials are loaded by database-specific scripts only. Installation, builds, linting, and type checking do not read `.migration.env`.
+
+## Collection strategy
+
+Payload will expose first-class collections for:
+
+- users and media;
+- buying-guide categories, subcategories, and entries;
+- hazards and material taxonomy;
+- materials, coatings, colors, opacity, status, and their junctions;
+- laser sources, software, scan lenses, focus lenses, configurations, apertures, expanders, and diameters;
+- fiber, UV, CO2 galvo, and CO2 gantry settings;
+- projects and project files;
+- user rigs, rig types, preferences, memberships, and claims.
+
+Directus junction tables become Payload relationships where doing so preserves ordering and ownership semantics. A junction remains an explicit collection when it carries its own meaningful fields or permissions.
+
+## ID preservation decision
+
+Source identifiers will be preserved as the actual Payload document IDs, not merely copied into an auxiliary legacy field.
+
+- UUID primary keys remain UUID/string IDs.
+- Integer and medium-integer primary keys remain numeric custom IDs.
+- Collections whose Directus primary key is named `submission_id` use that numeric value as Payload's custom `id`; the compatibility layer returns it as `submission_id` to existing consumers.
+- Payload's PostgreSQL adapter will enable `allowIDOnCreate` for controlled migration imports.
+- Every relationship is imported using the preserved target ID, avoiding translation tables and making verification direct.
+- New numeric IDs must begin above the migrated maximum. Sequence values are explicitly advanced after import.
+- The import rejects duplicate, null, lossy, or out-of-range identifiers before inserting records.
+
+This mixed per-collection custom-ID approach is preferable to globally converting every integer to UUID, which would break public URLs, foreign keys, and API assumptions. Payload officially supports explicit custom ID fields, and the PostgreSQL adapter supports IDs supplied during controlled create operations.
+
+References:
+
+- https://payloadcms.com/docs/fields/overview#custom-id-fields
+- https://payloadcms.com/docs/database/postgres
+
+## File strategy
+
+All 535 database-referenced originals and all 2,411 currently unreferenced physical files remain retained. Referenced files become Payload media documents while preserving the Directus file UUID, original filename, MIME type, size, timestamps, ownership where valid, and checksum. Derived variants are classified separately from originals.
+
+Unreferenced files are not imported as editorial media until classified, but they remain in a migration-retention manifest with path, size, type, and checksum. No file is deleted by reset or migration tooling.
+
+The repository's separate curated file library (`app/files`, 282 files and approximately 461 MB at the baseline) is not Directus upload storage. It remains a distinct, read-only application asset volume in normal operation. Payload media and retained migration uploads use separate volumes and permissions.
+
+## Production promotion rule
+
+CI builds the frontend, Payload, BGBye, and proxy images once from reviewed commits under their pinned runtimes. Integration tests run those exact digests. Staging and production consume the same core Compose definitions and immutable image digests; they do not rebuild from source or use separately maintained service definitions. Environment overlays may change secrets, hostnames, resource policies, external storage/database endpoints, replica counts, and production TLS integration, but not application image contents or service contracts.
+
+The permanent production checkout and deployment root is `/var/www/lasereverything.net.db`. It contains the complete versioned stack: frontend, Payload, BGBye, Compose definitions, migrations, deployment scripts, internal gateway contract, health checks, and validation tooling. No production checkout or application deployment may run from `/srv`, `/opt`, a Codex workspace, a temporary worktree, or another project root. Operational Docker layers, declared database/media volumes, and server-wide proxy files may live elsewhere, but the deployment rooted at the canonical production checkout declares and controls their contracts.
+
+The sole persistent nonproduction project root is `/srv/le-app-codex`, with the checkout at `/srv/le-app-codex/lasereverything.net.db`. The dedicated account design does not retain the current nested `.worktrees/payload-migration` layout. Temporary worktrees may be created under the canonical nonproduction root for a specific documented task and must be removed when that task ends.
+
+Production database schema changes use committed Payload migrations as an explicit release job before application rollout. Imports are migration-only jobs and are not part of ordinary application startup. Promotion requires recorded image digests, migration status, validation results, rollback compatibility, and health checks.
+
+Promotion never copies the nonproduction checkout or filesystem into production. A reviewed commit/release manifest is fetched into a clean checkout or unpacked as a verified release artifact at `/var/www/lasereverything.net.db`; production then pulls the already-tested immutable image digests. Development caches, local secrets, scrubbed snapshots, reports, test artifacts, rootless state, and disposable volumes are never promotion inputs.
+
+## Directus metadata disposition
+
+See `metadata-disposition.md` for the explicit include, translate, archive-only, and exclude decisions. Exclusion means “not imported into Payload runtime tables,” never “destroyed from the frozen snapshot or archive.”

docs/le-app-database-migration/environment-parity.md

@@ -0,0 +1,281 @@
+# Milestone 0: reproducible application environment
+
+Status: proposal for review. It describes future files and services; it does not authorize production changes or privileged host configuration.
+
+## Complete baseline runtime inventory
+
+The inventory is based on commit `4884b5d`, its checked-in Compose/Dockerfiles, application routes, Directus deployment exports, and the frozen structural migration manifests.
+
+| Component | Responsibility and dependencies | Persistence / lifecycle |
+|---|---|---|
+| `frontend` | Existing Next.js UI, middleware, server-rendered public pages, authenticated portal, compatibility APIs, file browser, SVGnest iframe, upload validation, Ko-fi webhook and claim endpoints, and BGBye proxy | Stateless image; Next cache on tmpfs; reads curated files; uses secure HTTP-only auth cookies |
+| `payload` | Dedicated Payload admin, auth, content/media API, access control, hooks, jobs, and migrations | PostgreSQL plus Payload media volume; independent image and release lifecycle |
+| `postgres` | Payload relational database | Named volume in nonproduction; managed/dedicated storage may replace it in production |
+| `bgbye` | FastAPI image/video background removal with CUDA models, FFmpeg video processing, status polling, and ten-minute temporary-file cleanup task | Model caches are persistent; video/frame/output workspace is ephemeral; GPU is optional only if a functional CPU test profile is implemented |
+| `proxy` | Single browser entrypoint, local TLS, host routing, forwarded headers, redirects, body limits, timeouts, and security headers | Configuration is versioned; certificates are mode-specific and never baked into application images |
+| `mailpit` | Captures registration, recovery, verification, supporter-claim, and notification mail in nonproduction | Disposable by default; optional named volume for debugging; never deployed as the production relay |
+| `migration` job image | Structural inventory, schema application, source import, file copy, sequence repair, checksums, and reports | Reads authorized source mount read-only; writes disposable PostgreSQL/media and non-personal summary reports |
+| `validation` job image | Read-only source/destination comparison: counts, IDs, relationships, timestamps, ownership, permissions, files, checksums, and API contracts | No source writes; generated detailed reports are local and excluded from Git/build contexts |
+| `e2e` job image | Browser and API tests against proxy-visible hostnames | Ephemeral browser artifacts; traces/screenshots are excluded when they may contain personal data |
+| optional `legacy-directus` | Local reference for Studio presentation, permissions, flows, relations, files, and legacy API shapes | Uses a fresh writable MariaDB clone and copied uploads; never connects to the authoritative read-only source |
+| optional `legacy-mariadb` | Writable database solely for the legacy reference service | Disposable named volume populated from the scrubbed dump |
+| `fixture-seed` job | Loads deterministic synthetic users, content, ownership cases, and representative tiny files | Runs only against disposable fixture PostgreSQL/media |
+| curated file library | Existing `app/files` manuals, specifications, software/reference files, and file-server routes | Separate read-only volume in runtime; approximately 461 MB / 282 files at baseline |
+| Payload media | Migrated Directus uploads and future CMS uploads | Dedicated persistent volume/object-storage contract; not mixed with curated files |
+| retained unreferenced uploads | 2,411 files pending classification | Read-only retention input; never deleted by application reset/import jobs |
+| external Ko-fi | Sends signed webhook events and is the source for historical membership backfill | Nonproduction uses fixtures; no real webhook secret or outbound calls |
+| production SMTP | Sends account and notification mail | Replaced by Mailpit in every nonproduction mode; credentials only in production secret scope |
+| reverse-proxy/TLS provider | Public TLS and routing | Production-specific infrastructure around the same proxy contract |
+
+### Existing application processes and integrations
+
+- Authentication currently uses `ma_at`, `ma_rt`, `ma_ra`, and `ma_v` cookies, middleware redirects, periodic token validation, username-to-email lookup, recent-auth confirmation, registration, login, logout, and password change. Payload must add recovery and verification endpoints and mail templates because the baseline UI does not yet provide a complete recovery journey.
+- Public/catalog consumers cover laser sources, four settings families, materials/coatings/hazards, buying guides, and projects.
+- Authenticated consumers cover profile/avatar/password, projects and attachments, rigs, settings submission/deletion, claims, memberships/supporter badges, and account linking.
+- Upload paths include avatars, project hero/attachments, settings photos/screenshots, Payload media, curated file downloads, and background-removal inputs/outputs.
+- `app/scripts/backfill-kofi.mjs` is a remaining Directus consumer and becomes an idempotent Payload membership import job.
+- `/api/webhooks/kofi`, supporter claim start/verify/unlink, and badge derivation become Payload-backed compatibility routes. Nonproduction uses signed fixture events only.
+- Directus's two event flows (`unique_key_claims`, `claim_auto_assign`) must be reconstructed as transactional Payload hooks/jobs after behavior is resolved in the isolated legacy reference.
+- BGBye has an in-process startup cleanup loop every ten minutes. There is no verified host cron/systemd job in the repository. Future scheduled Payload work must be an explicit worker/job service, not an undocumented host cron.
+- SVGnest is vendored static client code embedded through the frontend. The separate `dashboard/` is a static legacy/operations dashboard in the monorepo but is not in the baseline Compose runtime; Milestone 0 must either add an explicit static service/profile or formally classify it as non-required. Default proposal: keep it as an optional `dashboard` profile, not part of the public application critical path.
+- External links such as image hosting, paste, Forgejo, and community/support sites are navigation dependencies, not services required for the core stack to start. Smoke tests verify links are rendered but do not require those external systems.
+
+## Common Compose architecture
+
+The repository will use a project-name-scoped Compose model:
+
+```text
+infra/compose/compose.yaml              # core networks, services, health contracts
+infra/compose/compose.dev.yaml          # bind mounts/watch/debug ports
+infra/compose/compose.snapshot.yaml     # authorized read-only snapshot mounts
+infra/compose/compose.staging.yaml      # staging hosts/resources/secrets/storage
+infra/compose/compose.production.yaml   # production hosts/resources/external infrastructure
+infra/compose/profiles/*.yaml           # legacy Directus, GPU/CPU, dashboard, test tooling
+```
+
+Core service definitions and Dockerfiles are shared. Mode selection composes files and profiles rather than copying service definitions.
+
+| Mode | Services/data | Intended use |
+|---|---|---|
+| `fixture` | proxy, frontend, Payload, PostgreSQL, Mailpit, BGBye, fixture seed; optional dashboard | Daily development, CI, API tests, deterministic browser tests |
+| `snapshot` | Same application images plus read-only scrubbed source/uploads and import/validation jobs | Realistic edge cases and file/API compatibility checks |
+| `rehearsal` | Snapshot topology with destination reset, committed schema migration, full import, validation, then smoke/e2e gates | Repeatable cutover rehearsal; destructive only to project-scoped destination volumes |
+| `staging` | Exact promoted image digests, staging PostgreSQL/media/secrets, capture or allow-listed staging SMTP | Production-shape acceptance and release candidate verification |
+| `production` | Exact accepted digests, production PostgreSQL/media/SMTP/TLS/resources | Live service; no source snapshot, legacy Directus, fixture seed, Mailpit, or migration credentials mounted |
+
+Compose health dependencies use explicit checks rather than startup order:
+
+- proxy: configuration valid and HTTPS route responds;
+- frontend: `/api/health/live` and `/api/health/ready` (Payload/BGBye dependency status separated);
+- Payload: liveness plus database-backed readiness;
+- PostgreSQL: `pg_isready`;
+- BGBye: existing `/health`, expanded to distinguish model readiness;
+- Mailpit: HTTP health endpoint;
+- jobs: finite exit status and machine-readable summary.
+
+No application service receives `.migration.env`. Only explicitly invoked inventory/import/validation jobs receive migration variables. Package installation, linting, builds, unit tests, fixture mode, frontend, Payload, proxy, Mailpit, and BGBye do not load it.
+
+## Two nonproduction data modes
+
+### Fixture mode
+
+- A small, deterministic, non-personal dataset committed as factories/fixtures.
+- Stable IDs exercise numeric IDs, UUIDs, ownership, public/private content, junctions, nulls, Unicode, timestamp boundaries, and authorization failures.
+- Tiny generated fixtures cover JPEG, PNG, WebP/AVIF where supported, SVG rejection/handling, PDF, ZIP, plain text, and an executable-signature rejection case.
+- Synthetic mailbox addresses use reserved domains and never identify real users.
+- Resets remove only Compose-project-scoped PostgreSQL, media, mail, and temporary volumes.
+
+### Snapshot mode
+
+- Uses the credential-scrubbed MariaDB endpoint and authorized source/upload mounts read-only.
+- Uses the same frontend, Payload, proxy, BGBye, and job images as fixture mode.
+- Destination PostgreSQL and copied destination media are disposable and writable.
+- Detailed validation artifacts stay local and ignored; committed reports contain structural summaries only.
+- Outbound SMTP is forced to Mailpit and outbound network policy denies real SMTP/OAuth/Ko-fi delivery.
+
+## Optional legacy Directus reference
+
+The `legacy-reference` profile is local-only and off by default:
+
+1. Verify the archived Directus image by immutable image ID/digest before use; never pull `latest` as a substitute.
+2. Create a new project-scoped MariaDB volume and restore the scrubbed dump into it.
+3. Copy uploads into a new writable project-scoped volume; never mount `.migration-source/uploads` writable.
+4. Generate a new local `KEY`, `SECRET`, administrator address/password, and any test policy tokens. None may match production values.
+5. Disable SMTP, OAuth, external webhooks, telemetry where supported, public registration, and outbound network access.
+6. Bind only to the internal Compose network and route through the local proxy/admin hostname; do not publish its container port publicly.
+7. Label the UI and responses clearly as scrubbed, disposable, local reference data.
+
+This service is evidence, not an authoritative source. The frozen read-only MariaDB snapshot remains the migration authority. The archived image currently identified in the manifest is `sha256:dd5537…0801ce2a`; the complete value remains in the local manifest and must be supplied through an authorized local image import, not copied into a public registry without approval.
+
+## Reverse proxy and browser parity
+
+Proposed local endpoints use wildcard loopback names without editing DNS:
+
+- `https://app.le.localhost:8443` — frontend and compatibility APIs;
+- `https://cms.le.localhost:8443` — Payload admin/API;
+- `https://mail.le.localhost:8443` — Mailpit UI;
+- optional `https://legacy.le.localhost:8443` — isolated Directus reference.
+
+The versioned proxy configuration must:
+
+- set `Host`, `X-Forwarded-Host`, `X-Forwarded-Proto=https`, `X-Forwarded-Port`, `X-Real-IP`, and `X-Forwarded-For` consistently;
+- support upgrade headers where an application endpoint needs them;
+- reproduce legacy redirects and canonical-host behavior;
+- set explicit per-route request limits: at least the verified historical 100 MB proxy ceiling, with lower application limits retained for avatars/settings/projects/BGBye;
+- use 300-second upstream timeouts only where file/background processing requires them, with shorter defaults elsewhere;
+- preserve streaming/download headers and range behavior for representative files;
+- run application containers with fixed non-root UIDs and preflight media/file permissions;
+- derive cookie `Secure`, `HttpOnly`, `SameSite`, domain, path, expiry, refresh, and recent-auth behavior from one shared auth contract.
+
+Local HTTPS is required to test secure cookies. A repository-controlled development CA/certificate generator may create ignored local certificates, but trusting that CA in the host browser is a host change and requires user approval. Port 8443 avoids privileged rootless port binding; cookie semantics do not depend on port. Production uses the same routing contract with its real TLS termination and standard port 443.
+
+## Safe email
+
+- Mailpit is the only SMTP host supplied to fixture, snapshot, rehearsal, and default staging modes.
+- Nonproduction secrets/config validation fails closed if an SMTP hostname, sender domain, or port matches a production allow/deny signature.
+- Egress policy blocks TCP 25/465/587 from application containers in snapshot/rehearsal modes except to the internal Mailpit service.
+- Tests retrieve messages through Mailpit's API and follow recovery/verification links through the local HTTPS proxy.
+- Snapshot users are never sent messages automatically. Tests create synthetic accounts or redirect recipients at the mail transport boundary.
+- Production SMTP credentials are provided only by the production secret mechanism and are never stored in Compose YAML, `.env` examples, images, test traces, or migration reports.
+
+## Rootless Codex-controlled runtime
+
+Required target: a genuine per-user rootless Docker service owned by `le_app_codex` and managed through the explicitly root-started `user@1200.service`. Root applies the filesystem, network-namespace, device, and resource boundary to the complete user manager so Codex, RootlessKit, Docker, and containers inherit it. The only accepted endpoint is `unix:///run/user/1200/docker.sock`; the daemon socket is not shared broadly. A system service running `dockerd` with `User=le_app_codex` is prohibited.
+
+Codex must be able to build images, create/remove only its project containers/networks/volumes, inspect their logs, reset disposable PostgreSQL, run finite jobs, and execute integration/browser tests. It must not access `/var/run/docker.sock`, the production daemon/context, production containers/volumes/networks, `/var/www`, or `/srv/directus-archive`.
+
+Current host observation and planning checkpoint:
+
+- `sol6_vi` is not in the Docker group but can read the production application's world-readable environment files under `/var/www`;
+- Docker and Docker Compose clients exist;
+- no Podman client is installed;
+- the default Docker context does not provide a usable daemon/security result to this user;
+- no enabled user-level rootless Docker service was detected;
+- no persistent `le-app-codex` namespace or project nftables policy is deployed;
+- root inventory is complete; Quad9 IPv4 `9.9.9.9` and `149.112.112.112` are approved, while observed LAN resolver `192.168.10.1` remains denied with no LAN exception;
+- numerous existing Docker IPv4 and IPv6 bridge ranges must be dynamically inventoried and denied rather than represented only by a stale list.
+
+Therefore a `sol6_vi`-owned daemon is rejected: it could bind-mount those readable production secrets. Milestone 0 requires the isolated account and host changes described in `host-runtime-plan.md`, and work must stop before performing them. An administrator must approve/provision:
+
+1. dedicated `le_app_codex` identity and restricted filesystem ACLs;
+2. the completed and verified Phase 2A package-maintenance baseline, without rerunning that transaction;
+3. a checksum-pinned Moby rootless launcher matched to the installed Docker release, not the unmodified AUR extras package or its global sysctl hook;
+4. instance-specific containment on `user@1200.service`, the proposed `user-1200.slice` resource limits, and no lingering;
+5. a root-created IPv4-only namespace with default-deny egress and dynamic denial of host, LAN, WireGuard, metadata, private, loopback, Docker bridge, SMTP, and IPv6 access;
+6. inert acceptance tests before starting the user manager, Docker, or Codex;
+7. deterministic CPU BGBye first; optional GPU access only after core acceptance;
+8. user/browser-profile-scoped development CA trust;
+9. deferred hard disk-growth enforcement for images, caches, snapshots, media, PostgreSQL, and test artifacts; this is not a Phase 2B installation blocker and existing visibility/resource controls are not a hard quota.
+
+Lingering must remain disabled. No production socket forwarding, Docker-group membership, broad sudo rule, daemon TCP exposure, system-service `dockerd`, or bind mount into production paths is acceptable. See `host-runtime-plan.md` for the approval-gated lifecycle, deferred nonblocking storage quota, and unresolved authentication decision.
+
+## One-command workflows
+
+The repository-root commands will be thin, reviewed wrappers around Compose and finite job containers:
+
+```text
+./scripts/stack-up fixture
+./scripts/stack-up snapshot
+./scripts/stack-down
+./scripts/reset
+./scripts/schema
+./scripts/import
+./scripts/validate
+./scripts/smoke-test
+```
+
+Each wrapper validates the selected rootless context, project name, mode, required mounts, and forbidden production paths before doing work. `reset` requires an explicit nonproduction project label and refuses unknown database hosts. `stack-down` does not delete volumes by default. A separate explicit disposable purge command may remove only labeled project volumes.
+
+From a clean checkout, fixture mode requires only the rootless runtime, ignored local secrets generated from examples, and cached/built images. Snapshot mode additionally requires the authorized read-only source path and migration environment. There are no undocumented restore, chmod, hostname, secret, or database steps.
+
+## Build context and secret isolation
+
+Every context (`app`, `payload`, `bgbye`, proxy, jobs/tests, and repository root where used) excludes:
+
+- `.git`, `.worktrees`, `.migration-source`, `.migration.env`;
+- `*.sql`, `*.sql.gz`, database dumps and snapshot manifests containing data;
+- source and destination uploaded user files;
+- migration-generated detailed reports/logs;
+- browser traces/screenshots/videos from snapshot mode;
+- local secrets, certificates/private keys, dependency trees, and build outputs.
+
+Build verification inspects image histories and filesystems for forbidden names and secret fingerprints. Compose configuration tests assert that migration mounts/variables appear only on authorized finite jobs and never in production output.
+
+## Proposed final repository layout
+
+```text
+/
+├── apps/
+│   ├── web/                         # current Next.js frontend + compatibility APIs
+│   └── payload/                     # dedicated Payload admin/API
+├── services/
+│   ├── bgbye/                       # FastAPI GPU/CPU worker
+│   ├── proxy/                       # versioned local/production routing contract
+│   └── dashboard/                   # optional static dashboard profile
+├── packages/
+│   ├── contracts/                   # API DTOs, auth/cookie, errors, health contracts
+│   ├── config/                      # validated environment schemas, no secret values
+│   ├── fixtures/                    # deterministic synthetic factories and tiny files
+│   └── test-helpers/                # API/browser/mail/file helpers
+├── migration/
+│   ├── inventory/                   # structural inventory tooling
+│   ├── mappings/                    # reviewed field/relationship mappings
+│   ├── schema/                      # committed Payload/Drizzle migrations
+│   ├── import/                      # idempotent source/file import
+│   ├── validation/                  # counts, relationships, ownership, checksums
+│   └── legacy-reference/            # isolated restore/bootstrap tooling
+├── infra/
+│   ├── compose/                     # core and mode overlays/profiles
+│   ├── proxy/                       # routes, headers, limits, local TLS config
+│   ├── health/                      # healthcheck commands/contracts
+│   └── env/                         # non-secret examples and mode schemas
+├── scripts/                         # one-command wrappers and safety guards
+├── tests/
+│   ├── unit/
+│   ├── integration/
+│   ├── contracts/
+│   ├── e2e/
+│   └── fixtures/files/
+├── docs/le-app-database-migration/
+├── directus/                        # retained legacy evidence during migration
+├── .nvmrc / .node-version
+└── Dockerfiles remain beside each build context
+```
+
+The current `app`, `bgbye`, and `dashboard` directories will be moved only in a dedicated mechanical commit after build-context and path references are covered by tests. Milestone 0 may initially implement the target logical boundaries without a risky all-at-once directory move.
+
+The repository tree above exists at exactly one persistent nonproduction checkout, `/srv/le-app-codex/lasereverything.net.db`, and at the canonical production root, `/var/www/lasereverything.net.db`. Runtime data is never placed inside either Git checkout unless it is a deliberately versioned non-secret fixture. The complete canonical host directory policy and transitional consolidation are defined in `host-runtime-plan.md`.
+
+## End-to-end test matrix
+
+| Area | Fixture mode | Snapshot/rehearsal mode | Core assertions |
+|---|---|---|---|
+| Registration | Full | Synthetic account only | validation, duplicate handling, role/status, captured verification mail |
+| Login/logout | Full | Transitional-hash synthetic/test account; no personal output | username/email login, invalid credentials, refresh/expiry, cookie clearing |
+| Password recovery | Full | Synthetic recipient only | enumeration resistance, token expiry/single use, Mailpit link, new login |
+| Cookies/sessions | Full browser matrix | Full | Secure/HttpOnly/SameSite/path/domain, proxy scheme, redirects, refresh, recent-auth |
+| Account/profile | Full | Structural/authorized test account | self-read/update, sensitive re-auth, avatar, cross-user denial |
+| Projects | CRUD/files | Counts/contracts/representative records | ownership, public reads, attachment links, delete boundaries |
+| Rigs | CRUD | Counts/contracts | owner presets and update/delete isolation |
+| Machine settings | Four families | Full counts/relationships/API parity | create/read/update/delete ownership, images, `submission_id` compatibility |
+| Claims/memberships | Full state fixtures | Flow/API parity | unique key, auto-assignment, pending transitions, supporter visibility |
+| Upload/download | Representative file matrix | Realistic files/checksums | signatures, size limits, names, MIME, ranges, traversal prevention, permissions |
+| Admin | Full | Read/controlled test writes | admin login, collections, roles, file management, forbidden member access |
+| Background removal | Tiny image; deterministic allowed method | Representative image only | proxy body limit, model readiness, output PNG, invalid method/file, cleanup |
+| Public utilities | Full | Full | toolkit, SVGnest, file browser, legacy redirects, external-link rendering |
+| Compatibility APIs | Contract fixtures | Response-shape differential tests | Directus-like filters/fields/sort/pagination/errors where still consumed |
+| Email | Mailpit | Mailpit only | no external delivery, correct recipient rewrite, recovery/verification/support flows |
+| Authorization | Full adversarial matrix | Selected real relationship topology | anonymous/member/owner/admin/bot boundaries and field-level restrictions |
+| Health/restart | Full | Full | dependency readiness, graceful restart, persistent DB/media, ephemeral temp data |
+
+Snapshot test logs report identifiers only as one-way test-local aliases or aggregates; they do not emit emails, usernames, hashes, record bodies, or user-provided content.
+
+## Promotion to staging and production
+
+1. CI under Node 24.18.0 builds each application image once and records its digest and source commit.
+2. Fixture integration/e2e tests run those digests through the common core Compose model.
+3. Authorized snapshot rehearsal runs the same digests with read-only source mounts and disposable destinations.
+4. Staging references the same digests and core services plus staging overlay values; it does not rebuild.
+5. A release manifest records digests, committed database migration set, config schema version, validation summaries, and rollback compatibility.
+6. Production references that release manifest and production overlay. Schema migration is a distinct gated job; application rollout follows readiness checks.
+7. Rollback changes image digests and only rolls schema back when the committed migration explicitly supports it. Source archives and retired Directus remain outside this deployment model until separately authorized for retirement.

docs/le-app-database-migration/host-runtime-plan.md

@@ -0,0 +1,309 @@
+# Milestone 0 host runtime and security plan
+
+Status: Phase 2A completed and verified, 2026-07-12; Phase 2B is review-only. Nothing in this document authorizes Phase 2B execution. Phase 1 created only the inert `le_app_codex` identity and directory skeleton. Phase 2B systemd changes, namespace creation, firewall changes, user-manager startup, Docker startup, Codex authentication, repository/source copying, and production changes remain separately approval-gated.
+
+This document supersedes the earlier runtime proposal. In particular, the project will not use a system service running `dockerd` with `User=le_app_codex`, will not enable lingering, and will not install the unmodified AUR `docker-rootless-extras` package.
+
+## Fixed production and trust boundaries
+
+- Production remains rooted at `/var/www/lasereverything.net.db`.
+- The complete archive remains root-only at `/srv/directus-archive/20260710-175408` and is never moved, mounted, linked, copied, or exposed to Codex.
+- The contained nonproduction root is `/srv/le-app-codex`.
+- Transitional `/srv/codex-work`, `/srv/codex-migration`, and `/srv/codex-secrets` resources remain outside the contained environment until an independently approved copy-and-verify stage.
+- The rootful Docker and containerd sockets and data directories are inaccessible to the contained environment.
+- The only accepted project daemon endpoint is `unix:///run/user/1200/docker.sock`.
+- No Docker TCP/SSH endpoint, production context, shared Docker group, socket forwarding, or fallback to `/run/docker.sock` or `/var/run/docker.sock` is accepted.
+
+## Confirmed Phase 1 state
+
+Phase 1 created:
+
+- user/group `le_app_codex`, UID/GID `1200`, primary group only;
+- locked password, `/usr/bin/nologin`, and no supplementary groups;
+- subordinate UID/GID allocation `165536:65536`;
+- inert workspace skeleton under `/srv/le-app-codex` with root-owned boundaries and dedicated-user mutable children.
+
+Phase 1 did not install packages, start `user@1200.service`, start a daemon or container, create a network namespace, change nftables, authenticate Codex, copy a repository or migration source, or touch production. Lingering was not enabled and remains prohibited. Do not rerun any Phase 1 artifact.
+
+## Correct runtime lifecycle
+
+Docker is a genuine per-user service defined below `/srv/le-app-codex/home/.config/systemd/user`. Its lifetime is managed by the systemd user manager for UID 1200.
+
+Root enforces containment around the complete user manager with instance-specific configuration for:
+
+```text
+/etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf
+/etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf
+```
+
+The user manager depends on the root-created network namespace and enters that namespace before any user unit starts. Consequently Codex, RootlessKit, `dockerd`, containerd, build processes, test jobs, and containers inherit the same root-enforced filesystem, network, device, and cgroup boundary.
+
+Root starts and stops `user@1200.service` explicitly after inert acceptance tests pass. Lingering is prohibited and must remain disabled. The Docker user unit may be enabled for the user manager's controlled lifetime, but must not cause the manager to start independently.
+
+A system unit with `User=le_app_codex` must not run `dockerd`. That model bypasses the supported per-user lifecycle and does not provide the required containment of Codex and every sibling user process.
+
+## Completed Phase 2A and pinned launcher
+
+Phase 2A host maintenance is complete and supersedes the provisional package-maintenance gate. The host booted successfully on `7.1.3-zen1-2-zen`; both standard and Zen 7.1.3 kernels and their NVIDIA DKMS modules are installed. `rootlesskit 3.0.1-1`, `slirp4netns 1.3.4-1`, `libslirp 4.9.3-1`, and `openai-codex 0.144.1-2` are installed; `/usr/bin/codex` reports `codex-cli 0.144.1`.
+
+Post-maintenance verification also established: Laser Everything HTTP 200; NoMachine removed; stale 6.19 DKMS state removed; Snapper repaired with valid Pacman pre/post snapshots; protected Directus archive checksum valid; retired Directus stopped with restart policy `no`; `/root/server-compose-runner.sh` no longer references `lasereverything.net.forms`; and no unexpected failed system units. The retained review/evidence package is under `phase2a-host-maintenance/`.
+
+Do not install the unmodified AUR `docker-rootless-extras` package. Its install hook reloads global sysctls, which exceeds this project's boundary. Do not curl an installer into a shell.
+
+Install only a reviewed Moby `contrib/dockerd-rootless.sh` matching the Docker engine installed by the completed Phase 2A maintenance. Docker is `29.6.1`; the reviewed artifact is:
+
+```text
+Moby tag:    docker-v29.6.1
+Source:      contrib/dockerd-rootless.sh
+Target:      /usr/local/libexec/dockerd-rootless-29.6.1.sh
+SHA-256:     904c9b9e35f6927c0a5e65afb4d35b6bc9eb1278c878044501281fc728c9be46
+Owner/mode:  root:root 0755
+```
+
+Docker was revalidated as Arch package `1:29.6.1-1`, client `29.6.1` build `8900f1d330`, daemon binary `29.6.1` build `8ec5ab355a`. The upstream tag, source, and checksum were re-fetched and revalidated on 2026-07-12. Revalidate all four again immediately before installation. If Docker changes, this filename and checksum are invalid until a matching launcher is reviewed. A clean-chroot package containing only the pinned launcher is acceptable; it must have no global sysctl hook, setup tool, service enablement, or post-install execution.
+
+## User-manager filesystem and device containment
+
+The proposed, not deployed, containment contract is:
+
+```ini
+# /etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf
+[Unit]
+Requires=le-app-codex-netns.service
+After=le-app-codex-netns.service
+
+[Service]
+NetworkNamespacePath=/run/netns/le-app-codex
+ProtectSystem=strict
+PrivateTmp=yes
+
+TemporaryFileSystem=/srv:ro
+BindPaths=/srv/le-app-codex:/srv/le-app-codex
+TemporaryFileSystem=/var:ro
+TemporaryFileSystem=/mnt:ro
+TemporaryFileSystem=/media:ro
+TemporaryFileSystem=/opt:ro
+
+InaccessiblePaths=/var/www
+InaccessiblePaths=/root
+InaccessiblePaths=/home
+InaccessiblePaths=/boot
+InaccessiblePaths=/efi
+InaccessiblePaths=/run/docker.sock
+InaccessiblePaths=/var/run/docker.sock
+InaccessiblePaths=/run/containerd/containerd.sock
+InaccessiblePaths=/run/podman
+InaccessiblePaths=/run/dbus/system_bus_socket
+InaccessiblePaths=/run/systemd/private
+InaccessiblePaths=/var/lib/docker
+InaccessiblePaths=/var/lib/containerd
+InaccessiblePaths=/var/lib/containers
+InaccessiblePaths=/etc/docker
+InaccessiblePaths=/etc/containers
+InaccessiblePaths=/etc/ssh
+InaccessiblePaths=/etc/NetworkManager/system-connections
+InaccessiblePaths=/etc/wireguard
+
+DevicePolicy=closed
+DeviceAllow=/dev/fuse rw
+DeviceAllow=/dev/net/tun rw
+```
+
+Expected visibility is read-only runtime content under `/usr`, `/bin`, and `/lib*`; selected nonsensitive read-only `/etc`; normal `/proc` pending acceptance tests; read-only `/sys`; a closed device policy with FUSE/TUN; `/run/user/1200`; a private `/srv` exposing only `/srv/le-app-codex`; empty private `/var`, `/mnt`, `/media`, and `/opt`; and private `/tmp`.
+
+The following are intentionally deferred because they may break subordinate-ID mapping, user-manager behavior, cgroup delegation, or container creation:
+
+```ini
+NoNewPrivileges=yes
+RestrictSUIDSGID=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+ProcSubset=pid
+```
+
+`ProtectProc=invisible` and hostname isolation remain acceptance-test candidates. Compatibility must not be assumed; they may remain only after the user manager, RootlessKit, Docker, Codex, and test containers pass with them. The final contract must prevent unrelated host-process inspection without breaking the supported runtime.
+
+## Resource boundary
+
+The proposed, not deployed, aggregate boundary for the user manager and everything below it is:
+
+```ini
+# /etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf
+[Slice]
+CPUQuota=600%
+MemoryHigh=48G
+MemoryMax=64G
+MemorySwapMax=16G
+TasksMax=4096
+```
+
+These limits cover Codex, RootlessKit, `dockerd`, containerd, builds, jobs, and all containers. Validate generated properties and cgroup delegation before relying on the limits.
+
+Hard disk-growth enforcement is deferred and is not a Phase 2B installation blocker. Btrfs quotas remain intentionally disabled. The repaired `/.snapshots` Btrfs subvolume and successful Snapper snapshots 1, 2, and 3 establish snapshot operation, not quota accounting. Do not enable quotas, run `snapper setup-quota`, trigger a rescan, or impose the earlier proposed 250 GiB qgroup limit incidentally. Mandatory filesystem visibility and resource controls constrain access and CPU/memory/tasks but do not cap growth within `/srv/le-app-codex` and are not a hard storage quota.
+
+Soft planning budgets remain useful for monitoring: 80 GiB container runtime, 25 GiB PostgreSQL, 15 GiB media, 10 GiB legacy uploads, 35 GiB BGBye models, 10 GiB temporary data, 5 GiB browser artifacts, 10 GiB migration reports, and 10 GiB checkout/home metadata. Startup should fail when host/project free-space thresholds are unsafe, but soft checks do not replace a hard quota.
+
+## Rootless Docker user service
+
+The proposed, not deployed, user unit is:
+
+```ini
+# /srv/le-app-codex/home/.config/systemd/user/docker.service
+[Unit]
+Description=Laser Everything rootless Docker
+Documentation=https://docs.docker.com/engine/security/rootless/
+
+[Service]
+Type=notify
+NotifyAccess=all
+KillMode=mixed
+Environment=HOME=/srv/le-app-codex/home
+Environment=XDG_RUNTIME_DIR=/run/user/1200
+Environment=DOCKER_HOST=unix:///run/user/1200/docker.sock
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR=/run/user/1200/dockerd-rootless
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=builtin
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=65520
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX=true
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP=true
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK=true
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS=false
+ExecStart=/usr/local/libexec/dockerd-rootless-29.6.1.sh
+ExecReload=/usr/bin/kill -s HUP $MAINPID
+Restart=always
+RestartSec=2
+TimeoutStartSec=0
+TimeoutStopSec=120
+LimitNOFILE=infinity
+LimitNPROC=infinity
+LimitCORE=infinity
+TasksMax=infinity
+Delegate=yes
+
+[Install]
+WantedBy=default.target
+```
+
+The `ExecStart` path must be updated if the installed Docker release changes. Proposed daemon configuration at `/srv/le-app-codex/home/.config/docker/daemon.json`:
+
+```json
+{
+  "data-root": "/srv/le-app-codex/container-runtime/docker",
+  "storage-driver": "fuse-overlayfs",
+  "live-restore": false,
+  "userland-proxy": false,
+  "ipv6": false,
+  "ip6tables": false,
+  "log-driver": "local",
+  "log-opts": {
+    "max-size": "20m",
+    "max-file": "5"
+  }
+}
+```
+
+Docker client configuration lives only below `/srv/le-app-codex/home/.docker`. The named `le-app-codex` context must resolve exactly to `unix:///run/user/1200/docker.sock`. Wrappers reject the `default` context, rootful sockets, TCP/SSH endpoints, and unknown contexts.
+
+## IPv4-only network containment
+
+Root creates and owns the persistent namespace `/run/netns/le-app-codex`. The complete `user@1200.service` enters it through `NetworkNamespacePath`; the user cannot replace the namespace or firewall policy.
+
+Current read-only findings from the checksummed root inventory:
+
+- the operator approved Quad9 IPv4 `9.9.9.9` and `149.112.112.112`;
+- the host resolver includes `192.168.10.1`, but it remains denied and no LAN resolver exception is proposed;
+- no persistent `le-app-codex` network namespace currently exists;
+- no project-specific nftables rules are deployed;
+- observed host public/NAT IPv4 is `74.67.173.56`, with host/LAN/WireGuard addresses `192.168.10.151`, `192.168.10.0/24`, `10.98.0.2`, and `10.98.0.0/24`;
+- all 41 Docker networks and their IPv4/IPv6 IPAM ranges are retained in the Phase 2B inventory and covered by the private/IPv6 denials.
+
+All host addresses, routes, LAN/VPN/WireGuard/management networks, public/NAT addresses, Docker bridges, resolver endpoints, nftables rules, ACLs, and mounts were inventoried by root on 2026-07-12 at 20:24 EDT. The complete checksummed record is retained with the Phase 2B artifacts. The preflight dynamically repeats this inventory immediately before installation and hard-stops on drift.
+
+The namespace is IPv4-only: assign no IPv6 address or route and reject IPv6 on the project veth. Do not change host-global IPv6 or sysctls.
+
+The nftables design is default-deny and must cover namespace egress and host-to-namespace ingress in `FORWARD`, veth-gateway traffic in host `INPUT`, established/related replies, UDP and TCP DNS, and RootlessKit port-publication attempts. Initially no inbound forwarding to the namespace is allowed; a container requesting `-p` must remain unreachable from the host, LAN, VPN, and public networks.
+
+Permit only:
+
+- established/related reply traffic;
+- UDP/TCP DNS to explicitly approved resolver IPv4 addresses;
+- TCP 80/443 to public destinations after exclusions.
+
+Explicitly reject:
+
+- namespace and host loopback ranges;
+- host veth gateway except a separately approved DNS/proxy endpoint;
+- all host addresses, LAN, management, VPN, and WireGuard addresses/subnets;
+- every current and later-inventoried Docker/Podman/container bridge range;
+- RFC1918 private ranges, carrier-grade NAT, link-local, metadata including `169.254.169.254`, multicast, benchmark, documentation, reserved, and other non-public ranges;
+- every TITANSERVER public/NAT address supplied by the operator;
+- TCP 25, 465, and 587;
+- all IPv6 traffic.
+
+Explicit coverage includes `192.168.10.151`, `10.98.0.2`, `74.67.173.56`, and `2603:7080:7500:1279:75aa:d64d:4cf0:8f10`, plus the inventoried network ranges. Public/NAT address drift is a fail-closed configuration-review condition before later namespace restarts or policy regeneration. Forge SSH is outside the sandbox; no TCP/22 or LAN exception is proposed.
+
+## Acceptance gates and order of operations
+
+Every stage stops for review. No real migration data, nonproduction credentials, or Codex authentication enters the boundary until inert tests pass.
+
+1. Verify the completed Phase 2A state and do not rerun its package transaction.
+2. If a full host upgrade was selected, reboot and complete production health verification.
+3. Install only the version-matched, checksum-pinned Moby launcher.
+4. Install the resource slice and user-manager containment files without starting `user@1200.service`.
+5. Create the namespace without Docker; inventory generated properties, mounts, routes, addresses, and namespace identity.
+6. Install the reviewed nftables fragment without Docker and test positive DNS/HTTPS plus every negative route class.
+7. Run inert one-shot processes through the proposed user-manager namespace to validate filesystem, `/proc`, devices, cgroups, symlink/bind-mount resistance, and network denial.
+8. Only after the inert gates pass, root explicitly starts `user@1200.service`.
+9. Install/start the Docker user service and validate the exact socket, rootless security, data root, storage driver, logs, resource accounting, and port-publication denial.
+10. Run a disposable container through the same positive and negative tests, then tear it down.
+11. Only after runtime acceptance, choose and perform Codex authentication.
+12. Repository cloning, scrubbed-source copying, new secret generation, and Milestone 0 implementation are later separately reviewed stages.
+
+Positive tests must prove that the user manager, Codex process, daemon, and disposable container can write only approved paths below `/srv/le-app-codex`, use only `/run/user/1200/docker.sock`, store Docker data only below `container-runtime/docker`, resolve through approved DNS, and reach approved public HTTPS endpoints.
+
+Negative tests must prove they cannot list/read `/var/www`, `/root`, real `/home`, `/srv/directus-archive`, or transitional `/srv/codex-*`; open rootful runtime sockets or data; reach host/LAN/WireGuard/private/link-local/metadata/bridge/reserved destinations; use direct SMTP or IPv6; publish a port to the host/LAN; bypass controls via symlinks or bind mounts; inspect unrelated host processes; or escape resource limits.
+
+Failure of any negative test is a hard stop, not a reason to weaken containment ad hoc.
+
+## Codex authentication decision
+
+Authentication remains unresolved. The choices are ChatGPT device authentication or a dedicated API key created specifically for `le_app_codex`. Do not copy Codex configuration, `auth.json`, tokens, SSH keys, Docker configuration, or shell state from `sol6_vi`.
+
+Use `CODEX_HOME=/srv/le-app-codex/home/.codex`. Authentication may occur only after the contained user manager, filesystem namespace, network namespace, firewall, resource slice, Codex binary, and acceptance tests are approved. Any `auth.json` must be a nonsymlink regular file owned by `1200:1200`, mode `0600`, and treated as a password.
+
+## Repository and migration-source admission
+
+After runtime acceptance and separate approval:
+
+- create a clean checkout of the reviewed remote `migration/le-app-database` branch at `/srv/le-app-codex/lasereverything.net.db`;
+- do not copy `sol6_vi` SSH credentials; the current network design grants the contained environment no Forge SSH exception;
+- copy only the credential-scrubbed authoritative source into `database-source-readonly` through an administrator-run, checksum-verified process;
+- never use the root archive as migration input;
+- generate new nonproduction credentials below `nonproduction-secrets`; never copy production or root-only administration credentials.
+
+Transitional checkouts, databases, secrets, volumes, and source paths remain intact for at least 30 days and two successful rehearsals. Every later deletion requires separate approval.
+
+## Mail and production promotion boundaries
+
+Mailpit is nonproduction-only, internal to Compose, has no relay/forwarding, and receives only synthetic or rewritten recipients. Namespace policy rejects direct SMTP on TCP 25/465/587. Production continues to use the existing SMTP service through production-only configuration.
+
+Promotion is commit/release based:
+
+```text
+/srv/le-app-codex/lasereverything.net.db
+  -> reviewed pushed commit and immutable image/release manifest
+  -> fixture -> snapshot -> rehearsal -> staging
+  -> clean checkout or verified release artifact
+  -> /var/www/lasereverything.net.db
+```
+
+Never recursively copy or `rsync` the nonproduction workspace into production. Codex stops for explicit approval before changing `/var/www`, public proxy/DNS/TLS, production SMTP, production databases, Directus, or transitional/archive resources.
+
+## Unresolved decisions checklist
+
+- Codex authentication: device authentication or dedicated API key.
+- Disk-growth enforcement: Btrfs quota policy or another separately approved mechanism.
+- Whether deferred process/hostname hardening options pass acceptance tests.
+- Any individually approved future host-to-namespace published endpoint; none is currently allowed.
+
+Until these decisions are resolved, do not proceed beyond documentation and read-only verification.

docs/le-app-database-migration/implementation-plan.md

@@ -0,0 +1,94 @@
+# Laser Everything database transition implementation plan
+
+Status: Phase 2A complete; Phase 2B contained-runtime artifacts are review-only. Work stops at the Milestone 0 Phase 2B approval gate.
+
+## Milestone 0 — complete reproducible application environment
+
+1. **Accepted architecture record**
+   - Preserve baseline `4884b5d`, dedicated Payload service, PostgreSQL, exact dependency matrix, mixed ID preservation, and committed-migration workflow.
+   - Review `architecture-proposal.md`, `environment-parity.md`, and host prerequisites.
+
+2. **Host runtime gate — requires human approval/provisioning**
+   - Preserve the completed inert `le_app_codex` Phase 1 identity/workspace; do not rerun bootstrap artifacts.
+   - Record Phase 2A host maintenance as complete and verified; its former provisional package-maintenance gate is superseded. Do not rerun it or install the unmodified AUR extras package.
+   - Use a version-matched, checksum-pinned Moby launcher and a genuine per-user Docker service managed through root-controlled `user@1200.service`; never enable lingering or run `dockerd` from a system service with `User=le_app_codex`.
+   - Apply containment and the proposed `user-1200.slice` limits to the complete user manager; accept only `unix:///run/user/1200/docker.sock`.
+   - Create an IPv4-only root-owned namespace with default-deny egress and explicit host/LAN/WireGuard/metadata/private/loopback/bridge/SMTP/IPv6 denial after DNS and complete address inventories are approved.
+   - Restrict production environment files currently readable to `sol6_vi`; verify the development account cannot traverse production paths.
+   - Use deterministic CPU BGBye initially; defer optional rootless GPU provisioning.
+   - Approve browser-profile-scoped local CA trust for HTTPS testing.
+   - Resolve authentication separately. Defer hard disk-growth enforcement without treating mandatory filesystem visibility and CPU/memory/task limits as a storage quota or Phase 2B installation blocker; confirm nonproduction storage/capacity locations.
+   - Preserve Phase 2A evidence: successful Zen 7.1.3 boot, dual-kernel NVIDIA DKMS, NoMachine removal, stale DKMS cleanup, repaired Snapper pre/post snapshots, protected archive verification, retired Directus disposition, runner cleanup, HTTP 200, and no unexpected failed units.
+   - Execute every inert positive and negative preflight in `host-runtime-plan.md` before starting the user manager, Docker, Codex, or application work.
+
+3. **Reversible canonical-path consolidation — separately approval-gated**
+   - Inventory the transitional Git roots, symlinks, credential filenames, rootful disposable containers, and volumes without reading secret values.
+   - Create the sole checkout at `/srv/le-app-codex/lasereverything.net.db` and verify `migration/le-app-database` commit/remote state.
+   - Copy and checksum the scrubbed source into root-owned read-only `/srv/le-app-codex/database-source-readonly`.
+   - Create new nonproduction-only secrets and rootless MariaDB/PostgreSQL resources; do not reuse production credentials.
+   - Preserve all old resources through the rollback period. Delete nothing without a later explicit approval.
+
+4. **Repository/environment structure**
+   - Add common Compose core, mode overlays/profiles, environment schemas/examples, proxy configuration, health contracts, and safe defaults.
+   - Complete Docker/build-context exclusions for every context.
+   - Add one-command wrappers with context/path/project safety checks.
+   - Add automated external-SMTP denial and forbidden-mount/context tests; make snapshot startup fail closed.
+
+5. **Fixture stack**
+   - Build exact pinned images under Node 24.18.0.
+   - Bring up proxy, frontend, Payload shell, PostgreSQL, Mailpit, deterministic CPU BGBye profile, and fixtures.
+   - Prove HTTPS cookies, forwarded headers, uploads, mail capture, health, logs, reset, and teardown.
+
+6. **Snapshot/rehearsal stack**
+   - Mount only authorized scrubbed source and uploads read-only on finite jobs.
+   - Add disposable destination media/PostgreSQL and detailed-report exclusions.
+   - Add isolated legacy Directus reference profile using a writable clone and local-only credentials.
+   - Prove no production SMTP/OAuth/webhook/token configuration or outbound delivery.
+   - Keep authoritative source and `.migration.env` mounted only on finite inventory/import/validation jobs.
+
+7. **Milestone 0 acceptance**
+   - Clean-checkout fixture startup and smoke test require no undocumented steps.
+   - Snapshot startup passes mount/secret/egress safety assertions.
+   - Same image digests run in fixture and snapshot modes.
+   - Rootless user can control only its nonproduction project resources.
+   - Production release dry-run proves a clean reviewed commit and immutable digests deploy only from `/var/www/lasereverything.net.db`.
+
+## Milestone 1 — structural inventory and mapping
+
+- Generate structural-only collections, fields, relationships, indexes, policies, permissions, flows, operations, row counts, and application-consumer inventory.
+- Commit reviewed field-by-field MariaDB-to-PostgreSQL mapping without record samples.
+- Classify all files and Directus metadata; retain unresolved files.
+- Record only genuine product decisions.
+
+## Milestone 2 — Payload schema and security model
+
+- Implement collections, custom IDs, indexes, relationships, media, users, roles, access functions, hooks, and jobs.
+- Prototype with schema push only on disposable development PostgreSQL.
+- Replace push with committed deterministic migrations before authoritative rehearsal.
+- Implement captured email recovery/verification and shared cookie/session contract.
+
+## Milestone 3 — deterministic migration pipeline
+
+- Implement separate reset, schema, import, and validation jobs.
+- Import in dependency order with preserved IDs/timestamps/ownership and repaired sequences.
+- Preserve password hashes for compatibility research without logging them.
+- Copy referenced media and retain/classify all unreferenced files.
+- Make imports restartable/idempotent or fail safely with explicit checkpoints.
+
+## Milestone 4 — application compatibility and end-to-end behavior
+
+- Move each Directus consumer behind shared Payload/compatibility clients.
+- Rebuild Ko-fi, claims, memberships, flows, and backfill behavior.
+- Implement API contract comparisons and the full fixture/snapshot test matrix.
+- Validate password-hash transitional login and forced rehash strategy.
+
+## Milestone 5 — full rehearsals and staging candidate
+
+- Run repeated clean destination rehearsals.
+- Verify counts, IDs, relationships, timestamps, ownership, permissions, files, checksums, API behavior, and browser workflows.
+- Produce aggregate/non-personal validation summaries and unresolved product decisions.
+- Build immutable release images and promote their digests to staging.
+
+## Production boundary
+
+Stop for explicit authorization before production deployment, reverse-proxy/DNS changes, production secrets or SMTP use, email to real users, final write freeze/cutover, Directus restart/retirement, production database mutation, or archive destruction.

docs/le-app-database-migration/metadata-disposition.md

@@ -0,0 +1,28 @@
+# Directus metadata disposition
+
+This inventory is structural and contains no example user records or user-provided content.
+
+| Directus area | Disposition | Reason |
+|---|---|---|
+| `directus_users` | Translate into Payload users | Preserve user IDs, supported profile fields, status, role mapping, timestamps, and password hashes pending compatibility findings |
+| `directus_files`, `directus_folders` | Translate into media and folder metadata | Required to retain referenced files, hierarchy, checksums, timestamps, and ownership |
+| `directus_collections`, `directus_fields`, `directus_relations` | Design input; do not import as runtime records | Re-expressed as committed Payload TypeScript collection definitions and migrations |
+| `directus_roles`, `directus_policies`, `directus_access`, `directus_permissions` | Design input and verification fixtures | Re-expressed as Payload access functions and role fields; Directus policy rows have no runtime meaning in Payload |
+| `directus_flows`, `directus_operations` | Translate behavior into hooks/jobs/endpoints | Flow graphs are implementation evidence, not portable executable definitions |
+| `directus_settings` | Selective manual mapping | Only settings with a Payload or application equivalent are relevant |
+| `directus_presets` | Archive-only pending editor review | UI bookmarks, filters, layouts, and per-user preferences are Directus Studio-specific |
+| `directus_dashboards`, `directus_panels` | Archive-only | Directus Insights configuration is not portable and both source tables are empty |
+| `directus_comments`, `directus_notifications` | Exclude from runtime | Empty in the scrubbed source; Directus collaboration internals |
+| `directus_activity`, `directus_revisions` | Exclude from working migration | Intentionally scrubbed volatile audit history; untouched root-only archive remains authoritative |
+| `directus_sessions` | Exclude | Intentionally scrubbed and cryptographically incompatible; all users receive new sessions |
+| Static tokens and user `token` values | Exclude | Revoked credential material must never be migrated |
+| TFA secrets, `auth_data` | Exclude | Intentionally scrubbed authentication secrets; users re-enroll if required |
+| OAuth clients, codes, consents, tokens | Exclude | Empty/scrubbed live authorization material; providers must be configured afresh |
+| `directus_shares` | Exclude | Scrubbed bearer-like public access grants must not survive cutover |
+| `directus_migrations` | Exclude | Records Directus's schema history, not Payload's migration history |
+| `directus_extensions` | Inspect source extension directory; do not import rows | Extension behavior must be reimplemented and reviewed; the metadata table is empty |
+| deployment project/run tables | Archive-only | Directus deployment subsystem state has no Payload runtime equivalent |
+| `directus_versions` | Exclude from initial runtime | Empty; Payload versioning will begin under its own schema if enabled |
+| translations | Archive-only pending localization decision | Empty in source; no initial runtime effect |
+
+No exclusion authorizes deletion of source data, frozen files, manifests, or the root-only archive.

docs/le-app-database-migration/phase2a-host-maintenance/MANIFEST.sha256

@@ -0,0 +1,32 @@
+d74bbe90e7b024bc650c34e4613678d7cae67ff56cb4bde721a22362bdda33b1  README.md
+28ebc7e3467d2d83539db1b75824e38b7164fbb940162064d7a9b6af50223257  approved-transaction/README.md
+6991258799bec838137470e0b9b71ed97169bbdf157896fce3e38b7ebb7d3361  approved-transaction/SHA256SUMS
+8182c9bf8b4c6830a2b930698e2e8f5fb7e5ee7849fc8500a8b4813b9292ad51  approved-transaction/backups.txt
+f41e0e38632fe2c118cd8d99fc31f9706dd7d6e2479c429580cf067719541850  approved-transaction/comparison-to-221-preview.diff
+6a0be15a3e1b6f352cf12761a847ffd5d8d18f6d30ae9064499fd98947d33e37  approved-transaction/host-hooks-inventory.txt
+13c60612112a902019a56f23267985eb37ce06159efa2c03a4be5e5d86919090  approved-transaction/installed-versions.txt
+d5711f5d3ee9ae38c336b7ae02c036b6927d1e422d72ad8a1f832dae92c41337  approved-transaction/inventory.psv
+85d04c74b984200c6d25d85c9473483cd8fc81d53c838643c47aeef2b84d7247  approved-transaction/new-packages.psv
+1844d38c86fce118017a4f39472ce58fd0c7281a5856e593a3e64a358c59e992  approved-transaction/normalized-actions.psv
+9da051f0cd8b862c9c825dec95e237f7cff2758cb83f81bca549c4c8d3c9ae23  approved-transaction/packaged-hooks.txt
+84cf71dd5da459699825c4d25975e15f58bde8fd7cfdb2839bd82441271daaed  approved-transaction/scriptlets.txt
+f5661dd480a24e6c7814fff9c0765688a4b16309176e97efa5f3e0cb10d6d05d  approved-transaction/totals.psv
+88252b0d5eaafcdb69a1865b575d44636be203075d996fad2ea6e57b2810150a  approved-transaction/upgrades.psv
+17323251ae0c0d37b2116551846866f7f4352cca2e6039be52f2b2831c4ca865  backup-readiness-plan.md
+64269e6af4b6c668737ec4f5ec4dec6a49a527a256a62644dde80b2fa356145c  container-disposition/README.md
+a98eaa5efea0d5f4a22311ff89c6055979855a4b4cf53e1e9eb5e18d08da1b54  container-disposition/SHA256SUMS
+1d9e10136d127798aa1f834ad27d6d3d81b09fb585d78aaccb869a564065b19f  container-disposition/all-containers.psv
+bca981ad79a7bb84753112f13698ebf9b72471db29c2d4096f76f72898ace6d8  container-disposition/directus-stopped.allowlist.psv
+f6d68530714567fa8e3d7391dc7eb5232f3343be5d419fb24df56c552a7cebc6  container-disposition/restart-policy-no.psv
+c635776b21da4324ee0279be026ce8b5971d516cc4573313ad153db634ad4c1a  container-disposition/running-containers.psv
+75634105ec7afcb8009c9159be3fc5631cd9993dbca131c4a651515c4244b486  container-disposition/sonarr-unhealthy.allowlist.psv
+aef1864fa108e0d8cd4af5c513f6c814d0fa24c7fb81fd7ba554ece9d895af19  execute-maintenance.sh
+e4667c83bd4e9e7de413e48cd16cc2d4b041cb09fbadace5e9f8d74a73a5a2a1  failed-unit-disposition/README.md
+e4f82fbefec4bc8c91f473ead9a70d0d0b1a4a14c54a46067127ac05cf4a6dcc  failed-unit-disposition/SHA256SUMS
+217a0fe59a3bff6c6621bcaac59dcad1c74154486cd7e75e3bba83b6909c29c4  failed-unit-disposition/drkonqi-failed-units.allowlist.psv
+17f536533aca7e0542474d91da255a25889e96c5421a6a659d26a213dfb1653a  grub-btrfs-readiness.md
+f163eca74ff5e288b0638af728072452a614ddc4430b91b70cab1429f99535eb  maintenance-worksheet.md
+aabae1940542707d197388488055987c35e4f0c05621e68993ff3f863563f096  post-reboot-validate.sh
+1afa76fd1444c408c95a2740fbe39c966d68bd69e0becd01ee7931ffef9be7ff  preflight-read-only.sh
+5b88c68da055d3578e8b19fdf7623c3de204d5ef0af4b17e113938d8bd0a2c5e  reboot-procedure.md
+0805397870c66a523f693cfdba33f7b08c94793b62ddadf720ff84c22796ea13  rollback-recovery.md

docs/le-app-database-migration/phase2a-host-maintenance/README.md

@@ -0,0 +1,179 @@
+# Phase 2A scheduled host-maintenance review package
+
+Status: **review-only and uncommitted**. Operator provisionally prefers Path A, a scheduled complete Arch host upgrade. This is not execution approval.
+
+Proposed package command:
+
+```bash
+pacman -Syu --needed rootlesskit slirp4netns openai-codex
+```
+
+This package deliberately separates:
+
+1. read-only preflight: `preflight-read-only.sh`;
+2. package execution: `execute-maintenance.sh` — generated, never run during preparation;
+3. reboot: `reboot-procedure.md` — separate approval and manual command;
+4. post-reboot validation: `post-reboot-validate.sh`;
+5. later contained rootless-Docker provisioning — explicitly outside Phase 2A.
+
+The scripts do not enable lingering, configure rootless Docker, modify systemd or nftables, authenticate Codex, copy data, or change production configuration. Package hooks may restart services during the approved upgrade; the execution script records this but does not add its own service restarts.
+
+## Required operator inputs
+
+Before execution, record site-specific values in the maintenance ticket:
+
+- independent console/recovery method and a tested root login path;
+- public health URLs, including the canonical application utility endpoint;
+- production-critical unit names beyond the conservative defaults in the scripts;
+- expected running Docker container names and health states;
+- bootloader type and known-good previous kernel entry;
+- backup identifiers and restoration instructions;
+- maintenance window, user notification, and rollback decision owner.
+
+URLs can be supplied without editing the scripts:
+
+```bash
+export PUBLIC_HEALTH_URLS='https://db.lasereverything.net/'
+```
+
+Health URLs must be non-secret public HTTPS URLs. The scripts reject user-info credentials, query strings, fragments, whitespace/control characters, and non-HTTPS schemes. Never place tokens, signed parameters, credentials, or private endpoints in `PUBLIC_HEALTH_URLS`; the scripts do not read environment files to discover URLs and do not log redirected effective URLs.
+
+Unit names can be extended similarly:
+
+```bash
+export EXTRA_CRITICAL_UNITS='example.service another.service'
+```
+
+The operator must separately verify independent recovery and restorable backups, then set the non-secret attestations:
+
+```bash
+export LE_PHASE2A_RECOVERY_READY=YES
+export LE_PHASE2A_BACKUPS_READY=YES
+```
+
+Both attestations remain unset in `maintenance-worksheet.md`. Do not set them
+until independent recovery access and the proportional backup plan are complete.
+
+## Invocation and enforced records
+
+Invoke every script as a separate process, never with `source` or `.`. Explicitly capture its return status:
+
+```bash
+sudo --preserve-env=PUBLIC_HEALTH_URLS,EXTRA_CRITICAL_UNITS,LE_PHASE2A_RECOVERY_READY,LE_PHASE2A_BACKUPS_READY \
+  bash docs/le-app-database-migration/phase2a-host-maintenance/preflight-read-only.sh
+preflight_rc=$?
+printf 'preflight_rc=%s\n' "$preflight_rc"
+```
+
+The preflight creates an atomic unique root-owned mode `0700` directory below `/var/log/le-phase2a-preflight`, prints its path, and returns nonzero on `HARD_STOP`. Its machine-readable `result.manifest` records hostname, boot ID, kernel, timestamp, result, failures, and inventory hashes. Maintenance accepts only a checksum-valid `PASS` record from the same host and boot that is no more than **1,800 seconds (30 minutes)** old:
+
+```bash
+sudo bash docs/le-app-database-migration/phase2a-host-maintenance/execute-maintenance.sh \
+  --preflight /var/log/le-phase2a-preflight/preflight.YYYYMMDDTHHMMSSZ.XXXXXXXX
+maintenance_rc=$?
+printf 'maintenance_rc=%s\n' "$maintenance_rc"
+```
+
+Maintenance and post-reboot validation create their own atomic unique root-only records below `/var/log/le-phase2a-maintenance` and `/var/log/le-phase2a-post-reboot`. Post-reboot invocation requires the exact maintenance record:
+
+```bash
+sudo bash docs/le-app-database-migration/phase2a-host-maintenance/post-reboot-validate.sh \
+  /var/log/le-phase2a-maintenance/maintenance.YYYYMMDDTHHMMSSZ.XXXXXXXX
+validation_rc=$?
+printf 'validation_rc=%s\n' "$validation_rc"
+```
+
+These records can contain IP addresses, usernames, unit/container names, package state, and limited relevant journal metadata. They never intentionally capture process/container environments, environment-file contents, private keys, credentials, secret files, or command history. Treat every record as operationally sensitive: keep it root-only, do not commit it, and disclose it only through the approved maintenance channel.
+
+## Transaction comparison limitation
+
+The maintenance script refreshes an isolated sync database, normalizes package name, old version, new version, action, count, and downgrade status, and requires exact equality with the approved retained preview. Any detectable mismatch stops execution.
+
+The final live `pacman -Syu` must refresh the live sync databases as part of the complete transaction. Pacman cannot expose that post-refresh final interactive transaction for wrapper comparison without either staging a live `pacman -Sy`-only state or replacing the transaction with an unsafe custom workflow. The script therefore requires two exact operator phrases before launch and then requires the operator to review Pacman's final package table at its native interactive `Y/n` prompt. Answer `n` on any difference. This limitation is explicit and is not represented as machine-enforced equality.
+
+## Approved package-preview evidence
+
+The refreshed post-NoMachine preview is:
+
+```text
+/tmp/le-phase2-package-decision-post-nomachine-20260712.1vyjKk
+```
+
+Its durable normalized baseline and inventories are stored in
+`approved-transaction/`. The authoritative transaction is 220 packages: 215
+upgrades, 5 new packages, 1,985.98 MiB download, and +760.30 MiB installed-size
+delta. The prior 221-package transaction is superseded.
+
+Exactly 234 failed `drkonqi-coredump-processor@…` units are reviewed as
+nonproduction desktop crash-processing failures. Their checksummed complete
+state and invocation-ID fingerprint is under `failed-unit-disposition/`. Any
+addition, removal, state or invocation change, checksum failure, or other failed
+unit is a hard stop. The scripts do not reset them. `nxserver.service` is not an
+expected critical unit; its unused `nomachine` package was removed normally.
+
+## Docker disposition and authoritative baseline
+
+The checksummed `container-disposition/` baseline contains exactly 88 containers:
+87 running, retired `directus` intentionally stopped, and `sonarr` as the sole
+unhealthy running container. Sonarr is a reviewed unrelated pre-existing fault;
+its empty configuration, absent port 8989 listener, and failing health check do
+not require repair for Phase 2A. Any identity/state drift or any additional
+unhealthy container invalidates preflight.
+
+All 87 running containers are authoritative for post-reboot validation. Healthy
+containers must return healthy; containers without health checks must return
+running. Sonarr may remain unhealthy or improve, but must remain present and
+running. Directus must remain stopped and unchanged. `castopod` and
+`castopod-redis` use restart policy `no`; failure to return is recorded as a
+validation failure requiring explicit operator attention, never an automatic
+start or restart.
+
+The protected Directus archive at `/srv/directus-archive/20260710-175408`
+verified successfully against its actual `SHA256SUMS` with return code 0.
+Preflight repeats that check silently with `sha256sum --status -c SHA256SUMS` and
+hard-stops on failure without printing archive contents.
+
+## Snapper readiness history and maintenance gate
+
+On 2026-07-12 the ordinary empty `/.snapshots` directory was replaced by Btrfs
+subvolume ID 300, owned `root:root` mode `0750`. Manual snapshot 1 succeeded and
+exact snap-pac testing created and verified snapshots 2 and 3. Btrfs quotas were
+intentionally left disabled.
+
+Preflight verifies that `/.snapshots` remains a Btrfs subvolume. After both
+operator approvals and immediately before Pacman, maintenance creates a uniquely
+described explicit Snapper snapshot, captures and validates its numeric ID,
+verifies its numbered directory and Btrfs snapshot subvolume, and records the ID
+in the result. It verifies the snapshot again after Pacman, independently of
+snap-pac's return code. Unavailable quota accounting is a warning, not evidence
+of snapshot failure. No script enables quotas or runs `snapper setup-quota`.
+
+The older preview remains at:
+
+```text
+/tmp/le-phase2-package-decision-20260712.Mn7mIx
+```
+
+It occupies approximately 2.4 GiB and must not be deleted yet. It is historical,
+not the approved baseline. Cleanup remains a later explicit action.
+
+GRUB/grub-btrfs findings and the unexecuted standalone generation procedure are
+in `grub-btrfs-readiness.md`. Snapshot coverage, external subvolumes/mounts, and
+the minimum application-consistent database/configuration backup set are in
+`backup-readiness-plan.md`.
+
+## Hard stop conditions
+
+Stop rather than improvise if any of the following occurs:
+
+- no independent recovery access or root path;
+- insufficient space or an unhealthy `/boot`;
+- degraded storage, failed backup, undispositioned failed units, or an unhealthy production service/container other than the exact reviewed Sonarr disposition;
+- unexpected package count/version, downgrade, repository error, signature error, keyring error, mirror inconsistency, or partial transaction;
+- SSH access is unstable before the OpenSSH restart hook;
+- DKMS/initramfs/kernel/bootloader generation fails;
+- package database inconsistency or unexplained `.pacnew` affecting boot, SSH, PAM, networking, PHP, database, mail, proxy, or firewall configuration;
+- production containers or public endpoints fail after the transaction;
+- the operator cannot identify a known-good previous kernel and recovery route.
+
+Do not proceed from package maintenance into rootless-Docker provisioning. That later work remains separately approval-gated by `host-runtime-plan.md`.

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/README.md

@@ -0,0 +1,20 @@
+# Approved Phase 2A transaction baseline
+
+This checksummed baseline was resolved after removal of `nomachine 9.6.3-1`,
+using an isolated Pacman sync database and cache at
+`/tmp/le-phase2-package-decision-post-nomachine-20260712.1vyjKk`. The live sync
+database and production cache were not modified.
+
+The modeled complete command is `pacman -Syu --needed rootlesskit slirp4netns
+openai-codex`. It resolves 220 packages: 215 upgrades and 5 new packages;
+2,082,454,915 bytes (1,985.98 MiB) download; +797,229,927 bytes (+760.30 MiB)
+installed-size delta; 147 backup declarations; 8 scriptlets; and 3 packaged
+hooks.
+
+Compared with the old 221-package preview, the sole removed action is
+`nomachine 9.6.3-1 -> 9.8.2-1`. Download decreases by 81,814,578 bytes. Installed
+delta increases by 403,528 bytes because that upgrade would have reduced size.
+The NoMachine scriptlet disappears; hooks and backup declarations are unchanged.
+
+`normalized-actions.psv` is the machine comparison input. `SHA256SUMS` must
+verify before this baseline is accepted.

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/SHA256SUMS

@@ -0,0 +1,12 @@
+28ebc7e3467d2d83539db1b75824e38b7164fbb940162064d7a9b6af50223257  README.md
+8182c9bf8b4c6830a2b930698e2e8f5fb7e5ee7849fc8500a8b4813b9292ad51  backups.txt
+f41e0e38632fe2c118cd8d99fc31f9706dd7d6e2479c429580cf067719541850  comparison-to-221-preview.diff
+6a0be15a3e1b6f352cf12761a847ffd5d8d18f6d30ae9064499fd98947d33e37  host-hooks-inventory.txt
+13c60612112a902019a56f23267985eb37ce06159efa2c03a4be5e5d86919090  installed-versions.txt
+d5711f5d3ee9ae38c336b7ae02c036b6927d1e422d72ad8a1f832dae92c41337  inventory.psv
+85d04c74b984200c6d25d85c9473483cd8fc81d53c838643c47aeef2b84d7247  new-packages.psv
+1844d38c86fce118017a4f39472ce58fd0c7281a5856e593a3e64a358c59e992  normalized-actions.psv
+9da051f0cd8b862c9c825dec95e237f7cff2758cb83f81bca549c4c8d3c9ae23  packaged-hooks.txt
+84cf71dd5da459699825c4d25975e15f58bde8fd7cfdb2839bd82441271daaed  scriptlets.txt
+f5661dd480a24e6c7814fff9c0765688a4b16309176e97efa5f3e0cb10d6d05d  totals.psv
+88252b0d5eaafcdb69a1865b575d44636be203075d996fad2ea6e57b2810150a  upgrades.psv

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/backups.txt

@@ -0,0 +1,147 @@
+bash-completion-2.18.0-1-any.pkg.tar.zst|etc/bash_completion.d/000_bash_completion_compat.bash
+bluez-5.87-2-x86_64.pkg.tar.zst|etc/bluetooth/input.conf
+bluez-5.87-2-x86_64.pkg.tar.zst|etc/bluetooth/main.conf
+bluez-5.87-2-x86_64.pkg.tar.zst|etc/bluetooth/network.conf
+cachyos-ananicy-rules-git-20260711.r2672.gc59d5971-1-any.pkg.tar.zst|etc/ananicy.d/ananicy.conf
+clamav-1.5.3-1-x86_64.pkg.tar.zst|etc/clamav/clamav-milter.conf
+clamav-1.5.3-1-x86_64.pkg.tar.zst|etc/clamav/clamd.conf
+clamav-1.5.3-1-x86_64.pkg.tar.zst|etc/clamav/freshclam.conf
+clamav-1.5.3-1-x86_64.pkg.tar.zst|etc/logrotate.d/clamav
+geoclue-2.8.2-1-x86_64.pkg.tar.zst|etc/geoclue/geoclue.conf
+imagemagick-7.1.2.26-2-x86_64.pkg.tar.zst|etc/ImageMagick-7/colors.xml
+imagemagick-7.1.2.26-2-x86_64.pkg.tar.zst|etc/ImageMagick-7/delegates.xml
+imagemagick-7.1.2.26-2-x86_64.pkg.tar.zst|etc/ImageMagick-7/log.xml
+imagemagick-7.1.2.26-2-x86_64.pkg.tar.zst|etc/ImageMagick-7/mime.xml
+imagemagick-7.1.2.26-2-x86_64.pkg.tar.zst|etc/ImageMagick-7/policy.xml
+imagemagick-7.1.2.26-2-x86_64.pkg.tar.zst|etc/ImageMagick-7/quantization-table.xml
+imagemagick-7.1.2.26-2-x86_64.pkg.tar.zst|etc/ImageMagick-7/thresholds.xml
+imagemagick-7.1.2.26-2-x86_64.pkg.tar.zst|etc/ImageMagick-7/type-dejavu.xml
+imagemagick-7.1.2.26-2-x86_64.pkg.tar.zst|etc/ImageMagick-7/type-ghostscript.xml
+imagemagick-7.1.2.26-2-x86_64.pkg.tar.zst|etc/ImageMagick-7/type.xml
+libreoffice-fresh-26.2.4-4-x86_64.pkg.tar.zst|etc/libreoffice/bootstraprc
+libreoffice-fresh-26.2.4-4-x86_64.pkg.tar.zst|etc/libreoffice/psprint.conf
+libreoffice-fresh-26.2.4-4-x86_64.pkg.tar.zst|etc/libreoffice/sofficerc
+libreoffice-fresh-26.2.4-4-x86_64.pkg.tar.zst|etc/profile.d/libreoffice-fresh.csh
+libreoffice-fresh-26.2.4-4-x86_64.pkg.tar.zst|etc/profile.d/libreoffice-fresh.sh
+libva-2.24.1-1-x86_64.pkg.tar.zst|etc/libva.conf
+openssh-10.4p1-2-x86_64.pkg.tar.zst|etc/pam.d/sshd
+openssh-10.4p1-2-x86_64.pkg.tar.zst|etc/ssh/ssh_config
+openssh-10.4p1-2-x86_64.pkg.tar.zst|etc/ssh/sshd_config
+php-8.5.8-1-x86_64.pkg.tar.zst|etc/php/php.ini
+php-fpm-8.5.8-1-x86_64.pkg.tar.zst|etc/php/php-fpm.conf
+php-fpm-8.5.8-1-x86_64.pkg.tar.zst|etc/php/php-fpm.d/www.conf
+samba-2:4.24.4-1-x86_64.pkg.tar.zst|etc/conf.d/samba
+samba-2:4.24.4-1-x86_64.pkg.tar.zst|etc/logrotate.d/samba
+samba-2:4.24.4-1-x86_64.pkg.tar.zst|etc/pam.d/samba
+upower-1.91.3-1-x86_64.pkg.tar.zst|etc/UPower/UPower.conf
+webmin-2.651-1-any.pkg.tar.zst|etc/logrotate.d/webmin
+webmin-2.651-1-any.pkg.tar.zst|etc/pam.d/webmin
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/acl/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/adsl-client/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/apache/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/at/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/backup-config/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/bacula-backup/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/bandwidth/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/bind8/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/change-user/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/cluster-copy/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/cluster-cron/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/cluster-passwd/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/cluster-shell/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/cluster-software/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/cluster-useradmin/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/cluster-usermin/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/cluster-webmin/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/cron/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/custom/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/dhcpd/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/dovecot/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/exim/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/exports/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/fail2ban/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/fdisk/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/fetchmail/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/filemin/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/filter/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/firewall/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/firewall6/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/firewalld/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/fsdump/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/grub2/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/heartbeat/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/htaccess-htpasswd/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/idmapd/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/init/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/inittab/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/ipsec/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/iscsi-client/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/iscsi-server/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/iscsi-target/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/iscsi-tgtd/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/kea-dhcp/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/krb5/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/ldap-client/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/ldap-server/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/ldap-useradmin/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/logrotate/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/logviewer/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/lpadmin/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/lvm/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/mailboxes/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/mailcap/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/man/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/miniserv.conf
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/miniserv.users
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/mount/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/mysql/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/net/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/nftables/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/nginx/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/nis/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/openslp/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/pam/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/pap/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/passwd/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/phpini/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/postfix/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/postgresql/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/ppp-client/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/pptp-client/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/pptp-server/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/proc/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/procmail/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/proftpd/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/qmailadmin/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/quota/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/raid/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/samba/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/sarg/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/sendmail/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/servers/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/shell/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/shorewall/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/shorewall6/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/smart-status/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/spam/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/squid/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/sshd/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/status/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/stunnel/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/syslog/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/system-status/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/systemd/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/tcpwrappers/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/time/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/tunnel/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/updown/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/useradmin/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/usermin/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/webalizer/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/webmin.acl
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/webmin/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/webmincron/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/webminlog/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/xinetd/config
+webmin-2.651-1-any.pkg.tar.zst|etc/webmin/xterm/config

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/comparison-to-221-preview.diff

@@ -0,0 +1,10 @@
+--- previous-221-package-inventory.psv
++++ refreshed-220-package-inventory.psv
+@@ -136,7 +136,6 @@
+ mesa|1:26.1.3-2|1:26.1.4-1|extra|upgrade|13893205|55149202|55243718
+ milou|6.7.1-1|6.7.2-1|extra|upgrade|104229|432387|432387
+ node-gyp|13.0.0-1|13.0.1-1|extra|upgrade|1049895|6403165|7063617
+-nomachine|9.6.3-1|9.8.2-1|chaotic-aur|upgrade|81814578|82683022|82279494
+ noto-fonts|1:2026.06.01-1|1:2026.07.01-1|extra|upgrade|29203373|111996025|111995861
+ npm|11.16.0-1|12.0.0-1|extra|upgrade|1852255|9531710|10250888
+ nvidia-settings|610.43.02-1|610.43.03-1|extra|upgrade|804309|1624248|1624248

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/host-hooks-inventory.txt

@@ -0,0 +1,954 @@
+/etc/pacman.d/hooks/90-mkinitcpio-install.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Target = usr/lib/modules/*/vmlinuz
+Target = usr/lib/initcpio/*
+
+[Trigger]
+Operation = Install
+Operation = Remove
+Operation = Upgrade
+Type = Package
+Target = *-dkms*
+
+[Action]
+Description = Updating linux initcpios...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/garuda-hooks-runner kernel
+NeedsTargets
+/etc/pacman.d/hooks/90-dracut-install.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/dracut/*
+Target = usr/lib/firmware/*
+Target = usr/src/*/dkms.conf
+Target = usr/lib/systemd/systemd
+Target = usr/bin/cryptsetup
+Target = usr/bin/lvm
+
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Target = usr/lib/modules/*/pkgbase
+
+[Trigger]
+Type = Package
+Operation = Install
+Operation = Upgrade
+Target = dracut
+
+[Action]
+Description = Updating initramfs with dracut
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/dracut-install-garuda
+NeedsTargets
+/usr/share/libalpm/hooks/05-snap-pac-pre.hook
+# snap-pac
+# https://github.com/wesbarnett/snap-pac
+# Copyright (C) 2016, 2017, 2018 James W. Barnett
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+[Trigger]
+Operation = Upgrade
+Operation = Install
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Performing snapper pre snapshots for the following configurations...
+Depends = snap-pac
+When = PreTransaction
+Exec = /usr/share/libalpm/scripts/snap-pac pre
+NeedsTargets
+AbortOnFail
+/usr/share/libalpm/hooks/10-linux-modules-post.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Path
+Target = usr/lib/modules/*/vmlinuz
+
+[Action]
+Description = Restoring Linux kernel modules...
+When = PostTransaction
+Depends = coreutils
+Depends = rsync
+Exec = /bin/sh -xc 'KVER="${KVER:-$(uname -r)}"; if test -e "/usr/lib/modules/backup/${KVER}"; then rsync -AHXal --ignore-existing "/usr/lib/modules/backup/${KVER}" /usr/lib/modules/; fi; rm -rf /usr/lib/modules/backup'
+/usr/share/libalpm/hooks/10-linux-modules-pre.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Path
+Target = usr/lib/modules/*/vmlinuz
+
+[Action]
+Description = Saving Linux kernel modules...
+When = PreTransaction
+Depends = rsync
+Exec = /bin/sh -c 'KVER="${KVER:-$(uname -r)}"; if test -e "/usr/lib/modules/${KVER}"; then rsync -AHXal --delete-after "/usr/lib/modules/${KVER}" /usr/lib/modules/backup/; fi'
+/usr/share/libalpm/hooks/10-snap-pac-removal.hook
+# snap-pac
+# https://github.com/wesbarnett/snap-pac
+# Copyright (C) 2016, 2017, 2018 James W. Barnett
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+[Trigger]
+Operation = Remove
+Type = Package
+Target = snap-pac
+
+[Action]
+Description = You are removing snap-pac. No post transaction snapshots will be taken.
+Depends = snap-pac
+When = PreTransaction
+Exec = /usr/bin/bash -c "rm -f /tmp/snap-pac-pre_*"
+/usr/share/libalpm/hooks/40-update-ca-trust.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Path
+Target = usr/share/ca-certificates/trust-source/*
+
+[Action]
+Description = Rebuilding certificate stores...
+When = PostTransaction
+Exec = /usr/bin/update-ca-trust
+/usr/share/libalpm/hooks/60-depmod.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/modules/*/
+Target = !usr/lib/modules/*/?*
+
+[Action]
+Description = Updating module dependencies...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/depmod
+NeedsTargets
+/usr/share/libalpm/hooks/dbus-reload.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = etc/dbus-1/system.d/*.conf
+Target = usr/share/dbus-1/system.d/*.conf
+Target = usr/share/dbus-1/system-services/*.service
+
+[Action]
+Description = Reloading system bus configuration...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook reload dbus
+/usr/share/libalpm/hooks/update-desktop-database.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/share/applications/*.desktop
+
+[Action]
+Description = Updating the desktop file MIME type cache...
+When = PostTransaction
+Exec = /usr/bin/update-desktop-database --quiet
+/usr/share/libalpm/hooks/zz-snap-pac-post.hook
+# snap-pac
+# https://github.com/wesbarnett/snap-pac
+# Copyright (C) 2016, 2017, 2018 James W. Barnett
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+[Trigger]
+Operation = Upgrade
+Operation = Install
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Performing snapper post snapshots for the following configurations...
+Depends = snap-pac
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/snap-pac post
+NeedsTargets
+/usr/share/libalpm/hooks/dconf-update.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = etc/dconf/db/*.d/
+
+[Action]
+Description = Updating system dconf databases...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/dconf-update
+NeedsTargets
+/usr/share/libalpm/hooks/80-cronie.hook
+[Trigger]
+Operation = Upgrade
+Type = Package
+Target = glibc
+
+[Action]
+Description = Restarting cronie for libc upgrade...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook restart cronie.service
+/usr/share/libalpm/hooks/01-snapshot-reject.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+Target = !garuda-hooks
+Target = !garuda-update
+
+[Action]
+Description = Rejecting pacman transaction if running in snapshot...
+When = PreTransaction
+Exec = /usr/share/libalpm/scripts/garuda-hooks-runner snapshot
+AbortOnFail
+/usr/share/libalpm/hooks/20-grub-btrfs-config.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Package
+Target = grub-btrfs
+
+[Action]
+Description = Enabling drop-ins for grub-btrfs
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/garuda-hooks-runner grub-btrfs-config
+/usr/share/libalpm/hooks/20-lsb-release.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Package
+Target = lsb-release
+
+[Action]
+Description = Add Garuda specific configuration...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/garuda-hooks-runner lsb-release
+/usr/share/libalpm/hooks/20-os-release.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Package
+Target = filesystem
+
+[Action]
+Description = Adding Garuda specific configurations...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/garuda-hooks-runner filesystem
+/usr/share/libalpm/hooks/80-check-broken-packages.hook
+[Trigger]
+Operation = Upgrade
+Type = Package
+Target = *
+
+[Action]
+Description = Checking for package with missing dependencies...
+Exec = /usr/bin/check-broken-packages
+When = PostTransaction
+/usr/share/libalpm/hooks/99-foreign.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Foreign/AUR package notification
+When = PostTransaction
+Exec = /usr/bin/bash -c "/usr/bin/pacman -Qm || /usr/bin/echo '=> No foreign/AUR packages found.'"
+/usr/share/libalpm/hooks/99-grub-install.hook
+[Trigger]
+Operation = Upgrade
+Type = Package
+Target = grub
+
+[Action]
+Description = Updating grub binary in EFI
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/garuda-hooks-runner grub-update
+/usr/share/libalpm/hooks/99-orphans.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Orphaned package notification...
+When = PostTransaction
+Exec = /usr/bin/bash -c "/usr/bin/pacman -Qtd || /usr/bin/echo '=> No orphans found.'"
+#/etc/pacman.d/hooks/orphans.hook
+/usr/share/libalpm/hooks/99-pacnew-check.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Checking for .pacnew and .pacsave files...
+When = PostTransaction
+Exec = /usr/bin/bash -c 'pacfiles=$(pacdiff -o); if [[ -n "$pacfiles" ]]; then echo -e "\e[1m.pac* files found:\e[0m\n$pacfiles\n\e[1mPlease check and merge\e[0m"; fi'
+#/etc/pacman.d/hooks/pacnew-check.hook
+/usr/share/libalpm/hooks/99-update-grub.hook
+[Trigger]
+Operation = Install
+Operation = Remove
+Type = Path
+Target = usr/lib/modules/*/vmlinuz
+
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Package
+Target = grub
+
+[Action]
+Description = GRUB update after transactions...
+When = PostTransaction
+Depends = grub
+Exec = /bin/sh -c "/usr/bin/update-grub"
+/usr/share/libalpm/hooks/garuda-hooks-runner.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Package
+Target = garuda-hooks
+
+[Action]
+Description = Updating Garuda specific hooks...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/garuda-hooks-runner
+/usr/share/libalpm/hooks/zzz_post.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Syncing all file systems...
+Depends = coreutils
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/garuda-hooks-runner post
+/usr/share/libalpm/hooks/grub-initrd-generation-fix.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Package
+Target = grub
+Target = grub-silent
+Target = os-prober
+Target = os-prober-btrfs
+
+[Action]
+Description = Fix 'grub' and 'os-prober' after upgrading either of them....
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/grub-initrd-generation-fix
+/usr/share/libalpm/hooks/30-update-mime-database.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/share/mime/packages/*.xml
+
+[Action]
+Description = Updating the MIME type database...
+When = PostTransaction
+Exec = /usr/bin/env PKGSYSTEM_ENABLE_FSYNC=0 /usr/bin/update-mime-database /usr/share/mime
+/usr/share/libalpm/hooks/000-garuda-config-agent-post.hook
+[Trigger]
+Type = Path
+Operation = Upgrade
+Target = etc/*
+
+[Action]
+Description = Updating configurations with garuda-config-agent...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/garuda-config-agent post
+NeedsTargets
+/usr/share/libalpm/hooks/000-garuda-config-agent-postinst.hook
+[Trigger]
+Type = Path
+Operation = Install
+Target = etc/*
+
+[Action]
+Description = Updating configurations with garuda-config-agent...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/garuda-config-agent postinst
+NeedsTargets
+/usr/share/libalpm/hooks/50-garuda-config-agent-pre.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Target = etc/*
+
+[Action]
+Description = Preparing configurations with garuda-config-agent...
+When = PreTransaction
+Exec = /usr/share/libalpm/scripts/garuda-config-agent pre
+NeedsTargets
+/usr/share/libalpm/hooks/00-garuda-migrations.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Package
+Target = garuda-migrations
+
+[Action]
+Description = Applying Garuda Linux migrations...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/garuda-migrations-runner
+/usr/share/libalpm/hooks/gtk-query-immodules-3.0.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/gtk-3.0/3.0.0/immodules/*.so
+
+[Action]
+Description = Probing GTK3 input method modules...
+When = PostTransaction
+Exec = /usr/bin/gtk-query-immodules-3.0 --update-cache
+/usr/share/libalpm/hooks/gtk-query-immodules-3.0-32.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib32/gtk-3.0/3.0.0/immodules/*.so
+
+[Action]
+Description = Probing 32-bit GTK3 input method modules...
+When = PostTransaction
+Exec = /usr/bin/gtk-query-immodules-3.0-32 --update-cache
+/usr/share/libalpm/hooks/gio-querymodules.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/gio/modules/*.so
+
+[Action]
+Description = Updating GIO module cache...
+When = PostTransaction
+Exec = /usr/bin/gio-querymodules /usr/lib/gio/modules
+/usr/share/libalpm/hooks/glib-compile-schemas.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/share/glib-2.0/schemas/*.xml
+Target = usr/share/glib-2.0/schemas/*.override
+
+[Action]
+Description = Compiling GSettings XML schema files...
+When = PostTransaction
+Exec = /usr/bin/glib-compile-schemas /usr/share/glib-2.0/schemas
+/usr/share/libalpm/hooks/20-systemd-sysusers.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Target = usr/lib/sysusers.d/*.conf
+
+[Action]
+Description = Creating system user accounts...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook sysusers
+/usr/share/libalpm/hooks/21-systemd-tmpfiles.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Target = usr/lib/tmpfiles.d/*.conf
+
+[Action]
+Description = Creating temporary files...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook tmpfiles
+/usr/share/libalpm/hooks/25-systemd-binfmt.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Target = usr/lib/binfmt.d/*.conf
+
+[Action]
+Description = Registering binary formats...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook binfmt
+/usr/share/libalpm/hooks/25-systemd-catalog.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/systemd/catalog/*
+
+[Action]
+Description = Updating journal message catalog...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook catalog
+/usr/share/libalpm/hooks/25-systemd-hwdb.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/udev/hwdb.d/*
+
+[Action]
+Description = Updating udev hardware database...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook hwdb
+/usr/share/libalpm/hooks/25-systemd-sysctl.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Target = usr/lib/sysctl.d/*.conf
+
+[Action]
+Description = Applying kernel sysctl settings...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook sysctl
+/usr/share/libalpm/hooks/30-systemd-daemon-reload-system.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/systemd/system/*
+
+[Action]
+Description = Reloading system manager configuration...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook daemon-reload-system
+/usr/share/libalpm/hooks/30-systemd-daemon-reload-user.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/systemd/user/*
+
+[Action]
+Description = Reloading user manager configuration...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook daemon-reload-user
+/usr/share/libalpm/hooks/35-systemd-enqueue-marked.hook
+[Trigger]
+Type = Path
+Operation = Upgrade
+Target = usr/lib/systemd/system/*
+
+[Action]
+Description = Enqueuing marked services...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook enqueue-marked
+/usr/share/libalpm/hooks/35-systemd-udev-reload.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/udev/rules.d/*
+
+[Action]
+Description = Reloading device manager configuration...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook udev-reload
+/usr/share/libalpm/hooks/35-systemd-update.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/
+
+[Action]
+Description = Arming ConditionNeedsUpdate...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook update
+/usr/share/libalpm/hooks/accounts-daemon-restart.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/share/accountsservice/interfaces/*
+
+[Action]
+Description = Restarting accounts-daemon...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook restart accounts-daemon.service
+/usr/share/libalpm/hooks/40-fontconfig-config.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Remove
+Target = usr/share/fontconfig/conf.default/*
+
+[Action]
+Description = Updating fontconfig configuration...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/40-fontconfig-config /etc/fonts/conf.d
+NeedsTargets
+/usr/share/libalpm/hooks/fontconfig.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = etc/fonts/conf.d/*
+Target = usr/share/fonts/*
+Target = usr/share/fontconfig/conf.avail/*
+Target = usr/share/fontconfig/conf.default/*
+
+[Action]
+Description = Updating fontconfig cache...
+When = PostTransaction
+Exec = /usr/bin/fc-cache -s
+/usr/share/libalpm/hooks/gdk-pixbuf-query-loaders.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/gdk-pixbuf-2.0/2.10.0/loaders/*.so
+
+[Action]
+Description = Probing GDK-Pixbuf loader modules...
+When = PostTransaction
+Exec = /usr/bin/gdk-pixbuf-query-loaders --update-cache
+/usr/share/libalpm/hooks/90-update-appstream-cache.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/share/app-info/*
+Target = usr/share/swcatalog/*
+
+[Trigger]
+Type = Package
+Operation = Install
+Operation = Upgrade
+Target = appstream
+
+[Action]
+Description = Updating the appstream cache...
+When = PostTransaction
+Exec = /usr/bin/appstreamcli refresh-cache --force
+/usr/share/libalpm/hooks/detect-old-perl-modules.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Path
+Target = usr/lib/perl5/*/
+
+[Action]
+Description = Checking for old perl modules...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/detect-old-perl-modules.sh
+/usr/share/libalpm/hooks/70-dkms-install.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Path
+Target = usr/src/*/dkms.conf
+Target = usr/lib/modules/*/build/include/
+Target = usr/lib/modules/*/modules.order
+
+[Action]
+Description = Install DKMS modules
+Depends = dkms
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/dkms install
+NeedsTargets
+/usr/share/libalpm/hooks/70-dkms-upgrade.hook
+[Trigger]
+Operation = Upgrade
+Type = Path
+Target = usr/src/*/dkms.conf
+Target = usr/lib/modules/*/build/include/
+Target = usr/lib/modules/*/modules.order
+
+[Action]
+Description = Remove upgraded DKMS modules
+Depends = dkms
+When = PreTransaction
+Exec = /usr/share/libalpm/scripts/dkms -D remove
+NeedsTargets
+/usr/share/libalpm/hooks/71-dkms-remove.hook
+[Trigger]
+Operation = Remove
+Type = Path
+Target = usr/src/*/dkms.conf
+Target = usr/lib/modules/*/build/include/
+Target = usr/lib/modules/*/modules.order
+
+[Action]
+Description = Remove DKMS modules
+Depends = dkms
+When = PreTransaction
+Exec = /usr/share/libalpm/scripts/dkms remove
+NeedsTargets
+/usr/share/libalpm/hooks/60-dracut-remove.hook
+[Trigger]
+Type = Path
+Operation = Remove
+Target = usr/lib/modules/*/pkgbase
+
+[Action]
+Description = Removing initramfs with dracut
+When = PreTransaction
+Exec = /usr/share/libalpm/scripts/dracut-remove
+NeedsTargets
+/usr/share/libalpm/hooks/90-dracut-install.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/dracut/*
+Target = usr/lib/firmware/*
+Target = usr/src/*/dkms.conf
+Target = usr/lib/systemd/systemd
+Target = usr/bin/cryptsetup
+Target = usr/bin/lvm
+
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Target = usr/lib/modules/*/vmlinuz
+Target = usr/lib/modules/*/pkgbase
+
+[Trigger]
+Type = Package
+Operation = Install
+Operation = Upgrade
+Target = dracut
+
+[Action]
+Description = Updating initramfs with dracut
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/dracut-install
+NeedsTargets
+/usr/share/libalpm/hooks/gtk-update-icon-cache.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/share/icons/*/
+Target = !usr/share/icons/*/?*
+
+[Action]
+Description = Updating icon theme caches...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/gtk-update-icon-cache
+NeedsTargets
+/usr/share/libalpm/hooks/gtk4-querymodules.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/gtk-4.0/4.0.0/*/
+
+[Action]
+Description = Updating GTK4 module cache...
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/gtk4-querymodules
+NeedsTargets
+/usr/share/libalpm/hooks/gio-querymodules-32.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib32/gio/modules/*.so
+
+[Action]
+Description = Updating 32-bit GIO module cache...
+When = PostTransaction
+Exec = /usr/bin/gio-querymodules-32 /usr/lib32/gio/modules
+/usr/share/libalpm/hooks/fontconfig-32.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = etc/fonts/conf.d/*
+Target = usr/share/fonts/*
+Target = usr/share/fontconfig/conf.avail/*
+Target = usr/share/fontconfig/conf.default/*
+
+[Action]
+Description = Updating 32-bit fontconfig cache...
+When = PostTransaction
+Exec = /usr/bin/fc-cache-32 -s
+/usr/share/libalpm/hooks/gdk-pixbuf-query-loaders-32.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib32/gdk-pixbuf-2.0/2.10.0/loaders/*.so
+
+[Action]
+Description = Probing 32-bit GDK-Pixbuf loader modules...
+When = PostTransaction
+Exec = /usr/bin/gdk-pixbuf-query-loaders-32 --update-cache
+/usr/share/libalpm/hooks/update-vlc-plugin-cache.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/vlc/plugins/*
+
+[Action]
+Description = Updating the vlc plugin cache...
+When = PostTransaction
+Exec = /usr/lib/vlc/vlc-cache-gen /usr/lib/vlc/plugins
+/usr/share/libalpm/hooks/70-openssh-restart-sshd.hook
+[Trigger]
+Operation = Upgrade
+Type = Package
+Target = openssh
+
+[Action]
+Description = Restart a running sshd.service
+When = PostTransaction
+Exec = /usr/share/libalpm/scripts/systemd-hook restart sshd.service
+/usr/share/libalpm/hooks/nvidia-ctk-cdi.hook
+[Trigger]
+Type = Package
+Operation = Install
+Operation = Upgrade
+Target = nvidia-utils
+Target = nvidia-container-toolkit
+Target = opencl-nvidia
+Target = egl-gbm
+Target = egl-wayland
+
+[Action]
+Description = Regenerate NVIDIA CDI (Container Device Interface)
+Exec = /usr/share/libalpm/scripts/nvidia-ctk-cdi
+When = PostTransaction
+Depends = nvidia-utils
+/usr/share/libalpm/hooks/texinfo-install.hook
+[Trigger]
+Type = Path
+Operation = Install
+Operation = Upgrade
+Target = usr/share/info/*
+
+[Action]
+Description = Updating the info directory file...
+When = PostTransaction
+Exec = /bin/sh -c 'while read -r f; do if test -f "$f"; then install-info "$f" /usr/share/info/dir 2> /dev/null; fi; done'
+NeedsTargets
+/usr/share/libalpm/hooks/texinfo-remove.hook
+[Trigger]
+Type = Path
+Operation = Remove
+Target = usr/share/info/*
+
+[Action]
+Description = Removing old entries from the info directory file...
+When = PreTransaction
+Exec = /bin/sh -c 'while read -r f; do install-info --delete "$f" /usr/share/info/dir 2> /dev/null; done'
+NeedsTargets
+/usr/share/libalpm/hooks/unbound-trusted-key.hook
+[Trigger]
+Type = Path
+Target = etc/trusted-key.key
+Operation = Install
+Operation = Upgrade
+
+[Action]
+Description = Updating trusted-key.key for unbound...
+When = PostTransaction
+Exec = /bin/cp -f /etc/trusted-key.key /etc/unbound/
+/usr/share/libalpm/hooks/vimdoc.hook
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation= Remove
+Type = Path
+Target = usr/share/vim/vimfiles/doc/
+
+[Action]
+Description = Updating Vim help tags...
+Exec = /usr/bin/vim -es --cmd ":helptags /usr/share/vim/vimfiles/doc" --cmd ":q"
+When = PostTransaction

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/installed-versions.txt

@@ -0,0 +1,16 @@
+docker 1:29.6.1-1
+containerd 2.3.2-1
+linux 7.0.14.arch1-1
+linux-headers 7.0.14.arch1-1
+linux-zen 7.0.14.zen1-1
+linux-zen-headers 7.0.14.zen1-1
+openssh 10.3p1-1
+php 8.5.7-1
+php-fpm 8.5.7-1
+php-gd 8.5.7-1
+php-pgsql 8.5.7-1
+php-sodium 8.5.7-1
+nginx 1.30.3-1
+docker-compose 5.1.4-1
+systemd 261.1-1
+mariadb-libs 12.3.2-2

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/inventory.psv

@@ -0,0 +1,220 @@
+tzdata|2026b-1|2026c-1|core|upgrade|312226|1721583|1714499
+libgcc|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|81875|186076|185836
+libstdc++|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|883329|2940043|2940043
+libevent|2.1.12-5|2.1.13-1|core|upgrade|298462|1174357|1272640
+rootlesskit|-|3.0.1-1|extra|new|6893581|0|31928317
+libffi|3.6.0-1|3.7.1-1|core|upgrade|54112|106541|113669
+libslirp|-|4.9.3-1|extra|new|72785|0|166539
+slirp4netns|-|1.3.4-1|extra|new|29689|0|69291
+openai-codex|-|0.144.1-2|extra|new|85177155|0|352545716
+hwdata|0.408-1|0.409-1|core|upgrade|1772670|10424361|10474588
+libssh2|1.11.1-5|1.11.1-6|core|upgrade|265565|514626|514626
+leancrypto|1.7.2-1|1.8.0-1|core|upgrade|1487902|6493177|6622604
+accountsservice|26.26.9-1|26.27.3-1|extra|upgrade|173172|991953|991953
+pinentry|1.3.2-2|1.3.3-1|core|upgrade|172284|784782|692067
+gnupg|2.4.9-1|2.4.9-2|core|upgrade|3028428|10781728|10912940
+gpgme|2.1.1-1|2.1.2-1|core|upgrade|339305|809005|809006
+libgomp|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|236396|447361|447361
+archlinux-keyring|20260612-1|20260707.1-1|core|upgrade|1270069|1806591|1811296
+libjpeg-turbo|3.1.4.1-1|3.2.0-2|extra|upgrade|615715|2547213|2778875
+llvm-libs|22.1.6-1|22.1.8-1|extra|upgrade|42954242|171669045|171669045
+mesa|1:26.1.3-2|1:26.1.4-1|extra|upgrade|13893205|55149202|55243718
+liburing|2.14-1|2.15-1|extra|upgrade|272523|470224|489708
+shared-mime-info|2.4-3|2.5.1-1|extra|upgrade|783748|4798765|6111065
+libasan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|533961|1974116|1974116
+libhwasan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|281807|757548|757548
+liblsan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|233779|573212|573212
+libtsan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|470867|1523548|1523548
+libubsan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|211584|520076|520076
+libatomic|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|14195|38092|38092
+libgfortran|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|948716|3684588|3684588
+libobjc|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|38430|94212|94212
+libquadmath|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|170420|316008|316008
+gcc-libs|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|2700||0
+libjxl|0.11.2-2|0.12.0-1|extra|upgrade|1947638|10121485|7111117
+libva|2.23.0-2|2.24.1-1|extra|upgrade|210646|1034965|1043980
+libtiff|4.7.1-2|4.7.2-1|extra|upgrade|422908|1316209|1387341
+bluez-libs|5.86-6|5.87-2|extra|upgrade|95069|324535|324595
+glycin|2.1.5-1|2.1.5-2|extra|upgrade|3962413|18334284|18338616
+sdl3|3.4.10-1|3.4.12-1|extra|upgrade|1791106|7290426|7303530
+ffmpeg|2:8.1.2-7|2:8.1.2-10|extra|upgrade|15546334|50350499|50309539
+poppler|26.06.0-1|26.07.0-1|extra|upgrade|1893273|7090429|7070570
+poppler-qt6|26.06.0-1|26.07.0-1|extra|upgrade|274672|915373|915373
+upower|1.91.2-1|1.91.3-1|extra|upgrade|176172|883601|891933
+ark|26.04.2-1|26.04.3-1|extra|upgrade|1505995|5298413|5298715
+kdecoration|6.7.1-1|6.7.2-1|extra|upgrade|100682|401077|401077
+aurorae|6.7.1-1|6.7.2-1|extra|upgrade|159179|647303|647303
+baloo-widgets|26.04.2-2|26.04.3-1|extra|upgrade|153469|526624|526604
+bash-completion|2.17.0-3|2.18.0-1|extra|upgrade|230258|1060727|1043228
+plasma-activities|6.7.1-1|6.7.2-1|extra|upgrade|128347|462452|462452
+libplasma|6.7.1-1|6.7.2-1|extra|upgrade|2636197|7193216|7193398
+bluez|5.86-6|5.87-2|extra|upgrade|696024|1693782|1812713
+bluedevil|1:6.7.1-1|1:6.7.2-1|extra|upgrade|683660|2708069|2708074
+bluez-hid2hci|5.86-6|5.87-2|extra|upgrade|8923|16580|16578
+bluez-utils|5.86-6|5.87-2|extra|upgrade|1169283|3746338|3865141
+breeze-cursors|6.7.1-1|6.7.2-1|extra|upgrade|1301676|30673949|30673949
+breeze|6.7.1-1|6.7.2-1|extra|upgrade|42064099|43158908|43159003
+breeze-gtk|6.7.1-1|6.7.2-1|extra|upgrade|196883|1213077|1213077
+c-ares|1.34.6-1|1.34.8-1|extra|upgrade|244660|533090|555071
+cachyos-ananicy-rules-git|20260630.r2628.gebf4fa42-1|20260711.r2672.gc59d5971-1|chaotic-aur|upgrade|425439|1894425|1982152
+clamav|1.5.2-2|1.5.3-1|extra|upgrade|32136399|187320189|190095084
+libisl|0.27-1|0.28-1|core|upgrade|980886|6034037|6191080
+gcc|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|60610338|229943007|230854455
+compiler-rt|22.1.6-1|22.1.8-1|extra|upgrade|4824931|57605800|57605800
+clang|22.1.6-1|22.1.8-1|extra|upgrade|59294452|266782095|266782637
+cmake|4.3.4-1|4.4.0-1|extra|upgrade|15655871|102747843|106399125
+signon-kwallet-extension|26.04.2-1|26.04.3-1|extra|upgrade|15636|35296|35296
+noto-fonts|1:2026.06.01-1|1:2026.07.01-1|extra|upgrade|29203373|111996025|111995861
+kaccounts-integration|26.04.2-1|26.04.3-1|extra|upgrade|156244|637488|638150
+discover|6.7.1-1|6.7.2-1|extra|upgrade|1631911|7642315|7643332
+docker-compose|5.1.4-1|5.3.1-1|extra|upgrade|8454742|29675029|29355637
+libkexiv2|26.04.2-1|26.04.3-1|extra|upgrade|162511|491526|487430
+ldb|2:4.24.3-1|2:4.24.4-1|extra|upgrade|499721|2274504|2274502
+libwbclient|2:4.24.3-1|2:4.24.4-1|extra|upgrade|38772|130413|130413
+smbclient|2:4.24.3-1|2:4.24.4-1|extra|upgrade|7684453|30393785|30385773
+kio-extras|26.04.2-1|26.04.3-1|extra|upgrade|1984190|7700750|7697171
+dolphin|26.04.2-1|26.04.3-1|extra|upgrade|5042500|16239749|16239807
+python-sentry_sdk|2.63.0-1|2.64.0-1|extra|upgrade|977194|6876700|6923234
+drkonqi|6.7.1-1|6.7.2-1|extra|upgrade|737195|3551937|3551937
+electron42|42.3.0-1|42.6.1-1|extra|upgrade|97773568|314483012|345325566
+ethtool|1:7.0-1|1:7.1-1|extra|upgrade|308249|976786|989761
+ostree|2025.7-3|2026.2-1|extra|upgrade|857240|4577682|4573416
+gstreamer|1.28.4-2|1.28.5-1|extra|upgrade|2215827|12484778|12495257
+gst-plugins-base-libs|1.28.4-2|1.28.5-1|extra|upgrade|2570881|13461176|13465336
+flatpak-kcm|6.7.1-1|6.7.2-1|extra|upgrade|218308|793524|793862
+freerdp|2:3.27.1-1|2:3.28.0-1|extra|upgrade|2824842|9579223|9710525
+fzf|0.73.1-1|0.74.0-1|extra|upgrade|1750795|5033461|5105400
+electron43|-|43.1.0-1|extra|new|99272635|0|348715206
+garuda-toolbox|5.3.2-1|5.3.2-2|garuda|upgrade|49300621|117153640|117153640
+geoclue|2.8.1-1|2.8.2-1|extra|upgrade|222462|1486901|1498397
+go|2:1.26.4-1|2:1.26.5-1|extra|upgrade|41137734|226068739|226127343
+gst-plugins-bad-libs|1.28.4-2|1.28.5-1|extra|upgrade|3336254|15439610|15443706
+gst-plugins-base|1.28.4-2|1.28.5-1|extra|upgrade|222885|659712|659712
+libkdcraw|26.04.2-1|26.04.3-1|extra|upgrade|45262|139093|139093
+gwenview|26.04.2-1|26.04.3-1|extra|upgrade|6926077|11945408|11947979
+imagemagick|7.1.2.26-1|7.1.2.26-2|extra|upgrade|9341553|25538545|25538346
+procps-ng|4.0.6-2|4.0.6-3|core|upgrade|1022125|2673185|2673185
+inxi|3.3.40.1-1|3.3.41.1-1|extra|upgrade|363272|1420915|1422148
+kactivitymanagerd|6.7.1-1|6.7.2-1|extra|upgrade|202599|770328|770328
+kde-cli-tools|6.7.1-1|6.7.2-1|extra|upgrade|930408|3992616|3992616
+xsettingsd|1.0.2-3|1.0.4-1|extra|upgrade|30563|68794|73189
+kde-gtk-config|6.7.1-1|6.7.2-1|extra|upgrade|90823|331955|331955
+kglobalacceld|6.7.1-1|6.7.2-1|extra|upgrade|135756|416155|416155
+knighttime|6.7.1-1|6.7.2-1|extra|upgrade|67737|198688|198688
+layer-shell-qt|6.7.1-1|6.7.2-1|extra|upgrade|38535|145672|145672
+libkscreen|6.7.1-1|6.7.2-1|extra|upgrade|360141|1218759|1218759
+kscreenlocker|6.7.1-1|6.7.2-1|extra|upgrade|269833|1072950|1072950
+kwayland|6.7.1-1|6.7.2-1|extra|upgrade|251494|1279721|1279721
+milou|6.7.1-1|6.7.2-1|extra|upgrade|104229|432387|432387
+kwin|6.7.1-1|6.7.2-1|extra|upgrade|11095191|33501293|33524016
+kpipewire|6.7.1-1|6.7.2-1|extra|upgrade|198596|657891|653795
+libksysguard|6.7.1-1|6.7.2-1|extra|upgrade|720832|3607942|3607977
+ksystemstats|6.7.1-1|6.7.2-1|extra|upgrade|301054|1672961|1665151
+ocean-sound-theme|6.7.1-1|6.7.2-1|extra|upgrade|2026004|2175618|2175618
+plasma-activities-stats|6.7.1-1|6.7.2-1|extra|upgrade|95452|299817|299817
+xorg-xrdb|1.2.2-2|1.2.3-1|extra|upgrade|21227|41872|41949
+libxfont2|2.0.7-1|2.0.8-1|extra|upgrade|123151|237487|253871
+xorg-server-common|21.1.23-1|21.1.24-1|extra|upgrade|28305|130326|130326
+xorg-xwayland|24.1.12-1|24.1.13-1|extra|upgrade|1031315|2459481|2459481
+qqc2-breeze-style|6.7.1-1|6.7.2-1|extra|upgrade|470391|2871912|2871912
+xdg-desktop-portal-kde|6.7.1-1|6.7.2-1|extra|upgrade|689386|2791697|2792353
+plasma-integration|6.7.1-1|6.7.2-1|extra|upgrade|134710|425855|425855
+zxing-cpp|3.0.2-1|3.1.0-1|extra|upgrade|862154|1765316|1915890
+plasma-workspace|6.7.1-1|6.7.2-1|extra|upgrade|22146328|58197663|58253276
+kdeplasma-addons|6.7.1-1|6.7.2-1|extra|upgrade|3693743|19412292|19416224
+kimageformats|6.27.0-1|6.27.0-2|extra|upgrade|663131|3052500|3048404
+systemsettings|6.7.1-1|6.7.2-1|extra|upgrade|381269|1201439|1201439
+kinfocenter|6.7.1-1|6.7.2-1|extra|upgrade|984967|3250792|3255523
+kitty-terminfo|0.47.1-1|0.47.4-1|extra|upgrade|4718|3721|3721
+kitty-shell-integration|0.47.1-1|0.47.4-1|extra|upgrade|26986|90651|90651
+kitty|0.47.1-1|0.47.4-1|extra|upgrade|19009603|67770526|68515011
+kmenuedit|6.7.1-1|6.7.2-1|extra|upgrade|1067024|2028044|2028044
+konsole|26.04.2-1|26.04.3-1|extra|upgrade|2333435|10237598|10238056
+opencv|4.13.0-11|5.0.0-6|extra|upgrade|35512409|110222236|118294340
+kquickimageeditor|0.6.2-1|0.6.2.1-2|extra|upgrade|321027|1343696|1343696
+qtkeychain-qt6|0.16.0-1|0.17.0-1|extra|upgrade|76490|270934|278370
+krdp|6.7.1-1|6.7.2-1|extra|upgrade|227269|847069|851165
+plasma5support|6.7.1-1|6.7.2-1|extra|upgrade|1251965|9592075|9588001
+kscreen|6.7.1-1|6.7.2-1|extra|upgrade|1942241|3546789|3547398
+ksshaskpass|6.7.1-1|6.7.2-1|extra|upgrade|37936|133293|133293
+kwallet-pam|6.7.1-1|6.7.2-1|extra|upgrade|13402|28402|28402
+kwrited|6.7.1-1|6.7.2-1|extra|upgrade|18885|44940|44940
+lib32-gcc-libs|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|11344430|47147884|47147884
+lib32-brotli|1.1.0-1|1.2.0-2|multilib|upgrade|348002|898138|898295
+lib32-libdatrie|0.2.13-3|0.2.14-1|multilib|upgrade|15318|26141|26141
+lib32-libffi|3.6.0-1|3.7.1-1|multilib|upgrade|20827|43795|43795
+lib32-libjpeg-turbo|3.1.4.1-1|3.2.0-1|multilib|upgrade|389607|1566179|1734544
+lib32-libssh2|1.11.1-3|1.11.1-4|multilib|upgrade|122812|303297|303297
+lib32-libthai|0.1.29-3|0.1.30-1|multilib|upgrade|17971|44716|43692
+lib32-libtiff|4.7.1-1|4.7.2-1|multilib|upgrade|228125|687551|695810
+lib32-llvm-libs|1:22.1.6-1|1:22.1.8-1|multilib|upgrade|44333543|176603193|176603193
+lib32-mesa|1:26.1.3-2|1:26.1.4-1|multilib|upgrade|13762370|55678468|55690756
+lib32-pam|1.7.1-1|1.7.2-1|multilib|upgrade|166274|793477|809861
+lib32-sdl3|3.4.10-1|3.4.12-1|multilib|upgrade|1243526|3559753|3563785
+vulkan-mesa-implicit-layers|1:26.1.3-2|1:26.1.4-1|extra|upgrade|56381|130452|130452
+lib32-vulkan-mesa-implicit-layers|1:26.1.3-2|1:26.1.4-1|multilib|upgrade|54765|127580|127580
+vulkan-intel|1:26.1.3-2|1:26.1.4-1|extra|upgrade|5079461|44221720|44357080
+lib32-vulkan-intel|1:26.1.3-2|1:26.1.4-1|multilib|upgrade|4987152|44165704|44239560
+vulkan-mesa-layers|1:26.1.3-2|1:26.1.4-1|extra|upgrade|468155|2253012|2322644
+lib32-vulkan-mesa-layers|1:26.1.3-2|1:26.1.4-1|multilib|upgrade|465274|2313704|2391528
+vulkan-radeon|1:26.1.3-2|1:26.1.4-1|extra|upgrade|3548340|18409113|18413581
+lib32-vulkan-radeon|1:26.1.3-2|1:26.1.4-1|multilib|upgrade|3540574|18437520|18437584
+libgccjit|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|core|upgrade|12882406|41430018|41430018
+librevenge|0.0.5-4|0.0.6-1|extra|upgrade|619036|9730454|9748390
+libstaroffice|0.0.7-5|0.0.8-1|extra|upgrade|793891|2363788|2396628
+libreoffice-fresh|26.2.4-3|26.2.4-4|extra|upgrade|154317022|441950779|441905723
+libxnvctrl|610.43.02-1|610.43.03-1|extra|upgrade|78002|468890|468890
+linux|7.0.14.arch1-1|7.1.3.arch1-2|core|upgrade|154459082|154614536|154831841
+linux-headers|7.0.14.arch1-1|7.1.3.arch1-2|core|upgrade|64264745|291805361|295927152
+linux-zen|7.0.14.zen1-1|7.1.3.zen1-2|extra|upgrade|160133452|160263553|160501012
+linux-zen-headers|7.0.14.zen1-1|7.1.3.zen1-2|extra|upgrade|65405662|295536438|299659274
+llvm|22.1.6-1|22.1.8-1|extra|upgrade|24306277|137300369|137300419
+luajit|2.1.1780076327+b925b3e-1|2.1.1783773675+3c4f9fe-1|extra|upgrade|344119|854974|854974
+mariadb-libs|12.3.2-2|12.3.2-3|extra|upgrade|6373469|24801390|24789104
+node-gyp|13.0.0-1|13.0.1-1|extra|upgrade|1049895|6403165|7063617
+npm|11.16.0-1|12.0.0-1|extra|upgrade|1852255|9531710|10250888
+nvidia-settings|610.43.02-1|610.43.03-1|extra|upgrade|804309|1624248|1624248
+openssh|10.3p1-1|10.4p1-2|core|upgrade|1485983|5721620|7054017
+oxygen-cursors|6.7.1-1|6.7.2-1|extra|upgrade|1063147|17949898|17949898
+oxygen|6.7.1-1|6.7.2-1|extra|upgrade|31583476|35956530|35956560
+oxygen-sounds|6.7.1-1|6.7.2-1|extra|upgrade|1936125|2165836|2165836
+perl-dbi|1.649-1|1.650-1|extra|upgrade|973765|2751714|2754728
+perl-http-date|6.07-1|6.08-1|extra|upgrade|10719|15592|16625
+php|8.5.7-1|8.5.8-1|extra|upgrade|5930025|41065264|41062319
+php-fpm|8.5.7-1|8.5.8-1|extra|upgrade|4523580|30222807|30222807
+php-gd|8.5.7-1|8.5.8-1|extra|upgrade|40448|133240|133240
+php-pgsql|8.5.7-1|8.5.8-1|extra|upgrade|80148|233728|233728
+php-sodium|8.5.7-1|8.5.8-1|extra|upgrade|28573|112768|112768
+plasma-browser-integration|6.7.1-1|6.7.2-1|extra|upgrade|191209|629051|629051
+polkit-kde-agent|6.7.1-1|6.7.2-1|extra|upgrade|75915|255832|255832
+powerdevil|6.7.1-1|6.7.2-1|extra|upgrade|1670507|6455597|6460249
+plasma-desktop|6.7.1-1|6.7.2-1|extra|upgrade|19090969|41914158|41925994
+plasma-disks|6.7.1-1|6.7.2-1|extra|upgrade|164187|639736|639736
+plasma-firewall|6.7.1-1|6.7.2-1|extra|upgrade|515921|1404582|1404582
+plasma-keyboard|6.7.1-1|6.7.2-1|extra|upgrade|304349|1616171|1616220
+plasma-login-manager|6.7.1-1|6.7.2-1|extra|upgrade|436905|1768727|1768728
+plasma-nm|6.7.1-1|6.7.2-1|extra|upgrade|2131144|13808938|13815045
+plasma-pa|6.7.1-1|6.7.2-1|extra|upgrade|510561|2202142|2202148
+plasma-systemmonitor|6.7.1-1|6.7.2-1|extra|upgrade|540594|2737379|2738210
+plasma-thunderbolt|6.7.1-1|6.7.2-1|extra|upgrade|146457|564048|564048
+plasma-vault|6.7.1-1|6.7.2-1|extra|upgrade|335384|1291838|1296901
+plasma-welcome|6.7.1-1|6.7.2-1|extra|upgrade|1071501|3662215|3661774
+plasma-workspace-wallpapers|6.7.1-1|6.7.2-1|extra|upgrade|266511331|267444293|267444361
+print-manager|1:6.7.1-1|1:6.7.2-1|extra|upgrade|597046|2833359|2839131
+python-cffi|2.0.0-2|2.1.0-1|extra|upgrade|306534|1447769|1470834
+python-numpy|2.5.0-1|2.5.1-1|extra|upgrade|8412761|51429283|51485731
+python-pillow|12.2.0-1|12.3.0-1|extra|upgrade|977436|5079139|5116215
+python-setuptools|1:82.0.1-1|1:83.0.0-1|extra|upgrade|1236098|7709707|7725238
+python-typing_extensions|4.15.0-3|4.16.0-1|extra|upgrade|98775|542558|554817
+samba|2:4.24.3-1|2:4.24.4-1|extra|upgrade|9118686|66621565|66622194
+xorg-server|21.1.23-1|21.1.24-1|extra|upgrade|1612671|4045291|4045283
+sddm-kcm|6.7.1-1|6.7.2-1|extra|upgrade|162397|622433|622433
+spectacle|1:6.7.1-1|1:6.7.2-2|extra|upgrade|2182734|6448006|6456051
+tmux|3.7-1|3.7_b-1|extra|upgrade|541272|1274062|1269966
+vulkan-swrast|1:26.1.3-2|1:26.1.4-1|extra|upgrade|2411393|14666799|14679247
+webkit2gtk-4.1|2.52.4-1|2.52.5-1|extra|upgrade|38308819|139540041|141793533
+webmin|2.610-1|2.651-1|chaotic-aur|upgrade|32160470|88877941|91454445
+weechat|4.9.1-1|4.9.3-1|extra|upgrade|3060878|30352238|30353484
+xorg-xset|1.2.5-2|1.2.6-1|extra|upgrade|20082|41029|41107
+xorg-xsetroot|1.1.3-2|1.1.4-1|extra|upgrade|11990|21845|26026
+yad|14.2-1|15.0-1|extra|upgrade|210896|613543|643911

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/new-packages.psv

@@ -0,0 +1,5 @@
+rootlesskit|3.0.1-1
+libslirp|4.9.3-1
+slirp4netns|1.3.4-1
+openai-codex|0.144.1-2
+electron43|43.1.0-1

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/normalized-actions.psv

@@ -0,0 +1,220 @@
+accountsservice|26.26.9-1|26.27.3-1|upgrade
+archlinux-keyring|20260612-1|20260707.1-1|upgrade
+ark|26.04.2-1|26.04.3-1|upgrade
+aurorae|6.7.1-1|6.7.2-1|upgrade
+baloo-widgets|26.04.2-2|26.04.3-1|upgrade
+bash-completion|2.17.0-3|2.18.0-1|upgrade
+bluedevil|1:6.7.1-1|1:6.7.2-1|upgrade
+bluez-hid2hci|5.86-6|5.87-2|upgrade
+bluez-libs|5.86-6|5.87-2|upgrade
+bluez-utils|5.86-6|5.87-2|upgrade
+bluez|5.86-6|5.87-2|upgrade
+breeze-cursors|6.7.1-1|6.7.2-1|upgrade
+breeze-gtk|6.7.1-1|6.7.2-1|upgrade
+breeze|6.7.1-1|6.7.2-1|upgrade
+c-ares|1.34.6-1|1.34.8-1|upgrade
+cachyos-ananicy-rules-git|20260630.r2628.gebf4fa42-1|20260711.r2672.gc59d5971-1|upgrade
+clamav|1.5.2-2|1.5.3-1|upgrade
+clang|22.1.6-1|22.1.8-1|upgrade
+cmake|4.3.4-1|4.4.0-1|upgrade
+compiler-rt|22.1.6-1|22.1.8-1|upgrade
+discover|6.7.1-1|6.7.2-1|upgrade
+docker-compose|5.1.4-1|5.3.1-1|upgrade
+dolphin|26.04.2-1|26.04.3-1|upgrade
+drkonqi|6.7.1-1|6.7.2-1|upgrade
+electron42|42.3.0-1|42.6.1-1|upgrade
+electron43|-|43.1.0-1|new
+ethtool|1:7.0-1|1:7.1-1|upgrade
+ffmpeg|2:8.1.2-7|2:8.1.2-10|upgrade
+flatpak-kcm|6.7.1-1|6.7.2-1|upgrade
+freerdp|2:3.27.1-1|2:3.28.0-1|upgrade
+fzf|0.73.1-1|0.74.0-1|upgrade
+garuda-toolbox|5.3.2-1|5.3.2-2|upgrade
+gcc-libs|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+gcc|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+geoclue|2.8.1-1|2.8.2-1|upgrade
+glycin|2.1.5-1|2.1.5-2|upgrade
+gnupg|2.4.9-1|2.4.9-2|upgrade
+go|2:1.26.4-1|2:1.26.5-1|upgrade
+gpgme|2.1.1-1|2.1.2-1|upgrade
+gst-plugins-bad-libs|1.28.4-2|1.28.5-1|upgrade
+gst-plugins-base-libs|1.28.4-2|1.28.5-1|upgrade
+gst-plugins-base|1.28.4-2|1.28.5-1|upgrade
+gstreamer|1.28.4-2|1.28.5-1|upgrade
+gwenview|26.04.2-1|26.04.3-1|upgrade
+hwdata|0.408-1|0.409-1|upgrade
+imagemagick|7.1.2.26-1|7.1.2.26-2|upgrade
+inxi|3.3.40.1-1|3.3.41.1-1|upgrade
+kaccounts-integration|26.04.2-1|26.04.3-1|upgrade
+kactivitymanagerd|6.7.1-1|6.7.2-1|upgrade
+kde-cli-tools|6.7.1-1|6.7.2-1|upgrade
+kde-gtk-config|6.7.1-1|6.7.2-1|upgrade
+kdecoration|6.7.1-1|6.7.2-1|upgrade
+kdeplasma-addons|6.7.1-1|6.7.2-1|upgrade
+kglobalacceld|6.7.1-1|6.7.2-1|upgrade
+kimageformats|6.27.0-1|6.27.0-2|upgrade
+kinfocenter|6.7.1-1|6.7.2-1|upgrade
+kio-extras|26.04.2-1|26.04.3-1|upgrade
+kitty-shell-integration|0.47.1-1|0.47.4-1|upgrade
+kitty-terminfo|0.47.1-1|0.47.4-1|upgrade
+kitty|0.47.1-1|0.47.4-1|upgrade
+kmenuedit|6.7.1-1|6.7.2-1|upgrade
+knighttime|6.7.1-1|6.7.2-1|upgrade
+konsole|26.04.2-1|26.04.3-1|upgrade
+kpipewire|6.7.1-1|6.7.2-1|upgrade
+kquickimageeditor|0.6.2-1|0.6.2.1-2|upgrade
+krdp|6.7.1-1|6.7.2-1|upgrade
+kscreenlocker|6.7.1-1|6.7.2-1|upgrade
+kscreen|6.7.1-1|6.7.2-1|upgrade
+ksshaskpass|6.7.1-1|6.7.2-1|upgrade
+ksystemstats|6.7.1-1|6.7.2-1|upgrade
+kwallet-pam|6.7.1-1|6.7.2-1|upgrade
+kwayland|6.7.1-1|6.7.2-1|upgrade
+kwin|6.7.1-1|6.7.2-1|upgrade
+kwrited|6.7.1-1|6.7.2-1|upgrade
+layer-shell-qt|6.7.1-1|6.7.2-1|upgrade
+ldb|2:4.24.3-1|2:4.24.4-1|upgrade
+leancrypto|1.7.2-1|1.8.0-1|upgrade
+lib32-brotli|1.1.0-1|1.2.0-2|upgrade
+lib32-gcc-libs|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+lib32-libdatrie|0.2.13-3|0.2.14-1|upgrade
+lib32-libffi|3.6.0-1|3.7.1-1|upgrade
+lib32-libjpeg-turbo|3.1.4.1-1|3.2.0-1|upgrade
+lib32-libssh2|1.11.1-3|1.11.1-4|upgrade
+lib32-libthai|0.1.29-3|0.1.30-1|upgrade
+lib32-libtiff|4.7.1-1|4.7.2-1|upgrade
+lib32-llvm-libs|1:22.1.6-1|1:22.1.8-1|upgrade
+lib32-mesa|1:26.1.3-2|1:26.1.4-1|upgrade
+lib32-pam|1.7.1-1|1.7.2-1|upgrade
+lib32-sdl3|3.4.10-1|3.4.12-1|upgrade
+lib32-vulkan-intel|1:26.1.3-2|1:26.1.4-1|upgrade
+lib32-vulkan-mesa-implicit-layers|1:26.1.3-2|1:26.1.4-1|upgrade
+lib32-vulkan-mesa-layers|1:26.1.3-2|1:26.1.4-1|upgrade
+lib32-vulkan-radeon|1:26.1.3-2|1:26.1.4-1|upgrade
+libasan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libatomic|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libevent|2.1.12-5|2.1.13-1|upgrade
+libffi|3.6.0-1|3.7.1-1|upgrade
+libgccjit|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libgcc|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libgfortran|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libgomp|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libhwasan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libisl|0.27-1|0.28-1|upgrade
+libjpeg-turbo|3.1.4.1-1|3.2.0-2|upgrade
+libjxl|0.11.2-2|0.12.0-1|upgrade
+libkdcraw|26.04.2-1|26.04.3-1|upgrade
+libkexiv2|26.04.2-1|26.04.3-1|upgrade
+libkscreen|6.7.1-1|6.7.2-1|upgrade
+libksysguard|6.7.1-1|6.7.2-1|upgrade
+liblsan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libobjc|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libplasma|6.7.1-1|6.7.2-1|upgrade
+libquadmath|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libreoffice-fresh|26.2.4-3|26.2.4-4|upgrade
+librevenge|0.0.5-4|0.0.6-1|upgrade
+libslirp|-|4.9.3-1|new
+libssh2|1.11.1-5|1.11.1-6|upgrade
+libstaroffice|0.0.7-5|0.0.8-1|upgrade
+libstdc++|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libtiff|4.7.1-2|4.7.2-1|upgrade
+libtsan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+libubsan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3|upgrade
+liburing|2.14-1|2.15-1|upgrade
+libva|2.23.0-2|2.24.1-1|upgrade
+libwbclient|2:4.24.3-1|2:4.24.4-1|upgrade
+libxfont2|2.0.7-1|2.0.8-1|upgrade
+libxnvctrl|610.43.02-1|610.43.03-1|upgrade
+linux-headers|7.0.14.arch1-1|7.1.3.arch1-2|upgrade
+linux-zen-headers|7.0.14.zen1-1|7.1.3.zen1-2|upgrade
+linux-zen|7.0.14.zen1-1|7.1.3.zen1-2|upgrade
+linux|7.0.14.arch1-1|7.1.3.arch1-2|upgrade
+llvm-libs|22.1.6-1|22.1.8-1|upgrade
+llvm|22.1.6-1|22.1.8-1|upgrade
+luajit|2.1.1780076327+b925b3e-1|2.1.1783773675+3c4f9fe-1|upgrade
+mariadb-libs|12.3.2-2|12.3.2-3|upgrade
+mesa|1:26.1.3-2|1:26.1.4-1|upgrade
+milou|6.7.1-1|6.7.2-1|upgrade
+node-gyp|13.0.0-1|13.0.1-1|upgrade
+noto-fonts|1:2026.06.01-1|1:2026.07.01-1|upgrade
+npm|11.16.0-1|12.0.0-1|upgrade
+nvidia-settings|610.43.02-1|610.43.03-1|upgrade
+ocean-sound-theme|6.7.1-1|6.7.2-1|upgrade
+openai-codex|-|0.144.1-2|new
+opencv|4.13.0-11|5.0.0-6|upgrade
+openssh|10.3p1-1|10.4p1-2|upgrade
+ostree|2025.7-3|2026.2-1|upgrade
+oxygen-cursors|6.7.1-1|6.7.2-1|upgrade
+oxygen-sounds|6.7.1-1|6.7.2-1|upgrade
+oxygen|6.7.1-1|6.7.2-1|upgrade
+perl-dbi|1.649-1|1.650-1|upgrade
+perl-http-date|6.07-1|6.08-1|upgrade
+php-fpm|8.5.7-1|8.5.8-1|upgrade
+php-gd|8.5.7-1|8.5.8-1|upgrade
+php-pgsql|8.5.7-1|8.5.8-1|upgrade
+php-sodium|8.5.7-1|8.5.8-1|upgrade
+php|8.5.7-1|8.5.8-1|upgrade
+pinentry|1.3.2-2|1.3.3-1|upgrade
+plasma-activities-stats|6.7.1-1|6.7.2-1|upgrade
+plasma-activities|6.7.1-1|6.7.2-1|upgrade
+plasma-browser-integration|6.7.1-1|6.7.2-1|upgrade
+plasma-desktop|6.7.1-1|6.7.2-1|upgrade
+plasma-disks|6.7.1-1|6.7.2-1|upgrade
+plasma-firewall|6.7.1-1|6.7.2-1|upgrade
+plasma-integration|6.7.1-1|6.7.2-1|upgrade
+plasma-keyboard|6.7.1-1|6.7.2-1|upgrade
+plasma-login-manager|6.7.1-1|6.7.2-1|upgrade
+plasma-nm|6.7.1-1|6.7.2-1|upgrade
+plasma-pa|6.7.1-1|6.7.2-1|upgrade
+plasma-systemmonitor|6.7.1-1|6.7.2-1|upgrade
+plasma-thunderbolt|6.7.1-1|6.7.2-1|upgrade
+plasma-vault|6.7.1-1|6.7.2-1|upgrade
+plasma-welcome|6.7.1-1|6.7.2-1|upgrade
+plasma-workspace-wallpapers|6.7.1-1|6.7.2-1|upgrade
+plasma-workspace|6.7.1-1|6.7.2-1|upgrade
+plasma5support|6.7.1-1|6.7.2-1|upgrade
+polkit-kde-agent|6.7.1-1|6.7.2-1|upgrade
+poppler-qt6|26.06.0-1|26.07.0-1|upgrade
+poppler|26.06.0-1|26.07.0-1|upgrade
+powerdevil|6.7.1-1|6.7.2-1|upgrade
+print-manager|1:6.7.1-1|1:6.7.2-1|upgrade
+procps-ng|4.0.6-2|4.0.6-3|upgrade
+python-cffi|2.0.0-2|2.1.0-1|upgrade
+python-numpy|2.5.0-1|2.5.1-1|upgrade
+python-pillow|12.2.0-1|12.3.0-1|upgrade
+python-sentry_sdk|2.63.0-1|2.64.0-1|upgrade
+python-setuptools|1:82.0.1-1|1:83.0.0-1|upgrade
+python-typing_extensions|4.15.0-3|4.16.0-1|upgrade
+qqc2-breeze-style|6.7.1-1|6.7.2-1|upgrade
+qtkeychain-qt6|0.16.0-1|0.17.0-1|upgrade
+rootlesskit|-|3.0.1-1|new
+samba|2:4.24.3-1|2:4.24.4-1|upgrade
+sddm-kcm|6.7.1-1|6.7.2-1|upgrade
+sdl3|3.4.10-1|3.4.12-1|upgrade
+shared-mime-info|2.4-3|2.5.1-1|upgrade
+signon-kwallet-extension|26.04.2-1|26.04.3-1|upgrade
+slirp4netns|-|1.3.4-1|new
+smbclient|2:4.24.3-1|2:4.24.4-1|upgrade
+spectacle|1:6.7.1-1|1:6.7.2-2|upgrade
+systemsettings|6.7.1-1|6.7.2-1|upgrade
+tmux|3.7-1|3.7_b-1|upgrade
+tzdata|2026b-1|2026c-1|upgrade
+upower|1.91.2-1|1.91.3-1|upgrade
+vulkan-intel|1:26.1.3-2|1:26.1.4-1|upgrade
+vulkan-mesa-implicit-layers|1:26.1.3-2|1:26.1.4-1|upgrade
+vulkan-mesa-layers|1:26.1.3-2|1:26.1.4-1|upgrade
+vulkan-radeon|1:26.1.3-2|1:26.1.4-1|upgrade
+vulkan-swrast|1:26.1.3-2|1:26.1.4-1|upgrade
+webkit2gtk-4.1|2.52.4-1|2.52.5-1|upgrade
+webmin|2.610-1|2.651-1|upgrade
+weechat|4.9.1-1|4.9.3-1|upgrade
+xdg-desktop-portal-kde|6.7.1-1|6.7.2-1|upgrade
+xorg-server-common|21.1.23-1|21.1.24-1|upgrade
+xorg-server|21.1.23-1|21.1.24-1|upgrade
+xorg-xrdb|1.2.2-2|1.2.3-1|upgrade
+xorg-xsetroot|1.1.3-2|1.1.4-1|upgrade
+xorg-xset|1.2.5-2|1.2.6-1|upgrade
+xorg-xwayland|24.1.12-1|24.1.13-1|upgrade
+xsettingsd|1.0.2-3|1.0.4-1|upgrade
+yad|14.2-1|15.0-1|upgrade
+zxing-cpp|3.0.2-1|3.1.0-1|upgrade

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/packaged-hooks.txt

@@ -0,0 +1,3 @@
+accountsservice-26.27.3-1-x86_64.pkg.tar.zst|usr/share/libalpm/hooks/accounts-daemon-restart.hook
+openssh-10.4p1-2-x86_64.pkg.tar.zst|usr/share/libalpm/hooks/70-openssh-restart-sshd.hook
+shared-mime-info-2.5.1-1-x86_64.pkg.tar.zst|usr/share/libalpm/hooks/30-update-mime-database.hook

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/scriptlets.txt

@@ -0,0 +1,8 @@
+archlinux-keyring-20260707.1-1-any.pkg.tar.zst
+gnupg-2.4.9-2-x86_64.pkg.tar.zst
+gstreamer-1.28.5-1-x86_64.pkg.tar.zst
+ksshaskpass-6.7.2-1-x86_64.pkg.tar.zst
+samba-2:4.24.4-1-x86_64.pkg.tar.zst
+shared-mime-info-2.5.1-1-x86_64.pkg.tar.zst
+webmin-2.651-1-any.pkg.tar.zst
+xorg-server-21.1.24-1-x86_64.pkg.tar.zst

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/totals.psv

@@ -0,0 +1,8 @@
+package_count|220
+upgrade_count|215
+new_count|5
+download_bytes|2082454915
+installed_delta_bytes|797229927
+backup_count|147
+scriptlet_count|8
+packaged_hook_count|3

docs/le-app-database-migration/phase2a-host-maintenance/approved-transaction/upgrades.psv

@@ -0,0 +1,215 @@
+tzdata|2026b-1|2026c-1
+libgcc|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+libstdc++|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+libevent|2.1.12-5|2.1.13-1
+libffi|3.6.0-1|3.7.1-1
+hwdata|0.408-1|0.409-1
+libssh2|1.11.1-5|1.11.1-6
+leancrypto|1.7.2-1|1.8.0-1
+accountsservice|26.26.9-1|26.27.3-1
+pinentry|1.3.2-2|1.3.3-1
+gnupg|2.4.9-1|2.4.9-2
+gpgme|2.1.1-1|2.1.2-1
+libgomp|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+archlinux-keyring|20260612-1|20260707.1-1
+libjpeg-turbo|3.1.4.1-1|3.2.0-2
+llvm-libs|22.1.6-1|22.1.8-1
+mesa|1:26.1.3-2|1:26.1.4-1
+liburing|2.14-1|2.15-1
+shared-mime-info|2.4-3|2.5.1-1
+libasan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+libhwasan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+liblsan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+libtsan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+libubsan|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+libatomic|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+libgfortran|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+libobjc|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+libquadmath|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+gcc-libs|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+libjxl|0.11.2-2|0.12.0-1
+libva|2.23.0-2|2.24.1-1
+libtiff|4.7.1-2|4.7.2-1
+bluez-libs|5.86-6|5.87-2
+glycin|2.1.5-1|2.1.5-2
+sdl3|3.4.10-1|3.4.12-1
+ffmpeg|2:8.1.2-7|2:8.1.2-10
+poppler|26.06.0-1|26.07.0-1
+poppler-qt6|26.06.0-1|26.07.0-1
+upower|1.91.2-1|1.91.3-1
+ark|26.04.2-1|26.04.3-1
+kdecoration|6.7.1-1|6.7.2-1
+aurorae|6.7.1-1|6.7.2-1
+baloo-widgets|26.04.2-2|26.04.3-1
+bash-completion|2.17.0-3|2.18.0-1
+plasma-activities|6.7.1-1|6.7.2-1
+libplasma|6.7.1-1|6.7.2-1
+bluez|5.86-6|5.87-2
+bluedevil|1:6.7.1-1|1:6.7.2-1
+bluez-hid2hci|5.86-6|5.87-2
+bluez-utils|5.86-6|5.87-2
+breeze-cursors|6.7.1-1|6.7.2-1
+breeze|6.7.1-1|6.7.2-1
+breeze-gtk|6.7.1-1|6.7.2-1
+c-ares|1.34.6-1|1.34.8-1
+cachyos-ananicy-rules-git|20260630.r2628.gebf4fa42-1|20260711.r2672.gc59d5971-1
+clamav|1.5.2-2|1.5.3-1
+libisl|0.27-1|0.28-1
+gcc|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+compiler-rt|22.1.6-1|22.1.8-1
+clang|22.1.6-1|22.1.8-1
+cmake|4.3.4-1|4.4.0-1
+signon-kwallet-extension|26.04.2-1|26.04.3-1
+noto-fonts|1:2026.06.01-1|1:2026.07.01-1
+kaccounts-integration|26.04.2-1|26.04.3-1
+discover|6.7.1-1|6.7.2-1
+docker-compose|5.1.4-1|5.3.1-1
+libkexiv2|26.04.2-1|26.04.3-1
+ldb|2:4.24.3-1|2:4.24.4-1
+libwbclient|2:4.24.3-1|2:4.24.4-1
+smbclient|2:4.24.3-1|2:4.24.4-1
+kio-extras|26.04.2-1|26.04.3-1
+dolphin|26.04.2-1|26.04.3-1
+python-sentry_sdk|2.63.0-1|2.64.0-1
+drkonqi|6.7.1-1|6.7.2-1
+electron42|42.3.0-1|42.6.1-1
+ethtool|1:7.0-1|1:7.1-1
+ostree|2025.7-3|2026.2-1
+gstreamer|1.28.4-2|1.28.5-1
+gst-plugins-base-libs|1.28.4-2|1.28.5-1
+flatpak-kcm|6.7.1-1|6.7.2-1
+freerdp|2:3.27.1-1|2:3.28.0-1
+fzf|0.73.1-1|0.74.0-1
+garuda-toolbox|5.3.2-1|5.3.2-2
+geoclue|2.8.1-1|2.8.2-1
+go|2:1.26.4-1|2:1.26.5-1
+gst-plugins-bad-libs|1.28.4-2|1.28.5-1
+gst-plugins-base|1.28.4-2|1.28.5-1
+libkdcraw|26.04.2-1|26.04.3-1
+gwenview|26.04.2-1|26.04.3-1
+imagemagick|7.1.2.26-1|7.1.2.26-2
+procps-ng|4.0.6-2|4.0.6-3
+inxi|3.3.40.1-1|3.3.41.1-1
+kactivitymanagerd|6.7.1-1|6.7.2-1
+kde-cli-tools|6.7.1-1|6.7.2-1
+xsettingsd|1.0.2-3|1.0.4-1
+kde-gtk-config|6.7.1-1|6.7.2-1
+kglobalacceld|6.7.1-1|6.7.2-1
+knighttime|6.7.1-1|6.7.2-1
+layer-shell-qt|6.7.1-1|6.7.2-1
+libkscreen|6.7.1-1|6.7.2-1
+kscreenlocker|6.7.1-1|6.7.2-1
+kwayland|6.7.1-1|6.7.2-1
+milou|6.7.1-1|6.7.2-1
+kwin|6.7.1-1|6.7.2-1
+kpipewire|6.7.1-1|6.7.2-1
+libksysguard|6.7.1-1|6.7.2-1
+ksystemstats|6.7.1-1|6.7.2-1
+ocean-sound-theme|6.7.1-1|6.7.2-1
+plasma-activities-stats|6.7.1-1|6.7.2-1
+xorg-xrdb|1.2.2-2|1.2.3-1
+libxfont2|2.0.7-1|2.0.8-1
+xorg-server-common|21.1.23-1|21.1.24-1
+xorg-xwayland|24.1.12-1|24.1.13-1
+qqc2-breeze-style|6.7.1-1|6.7.2-1
+xdg-desktop-portal-kde|6.7.1-1|6.7.2-1
+plasma-integration|6.7.1-1|6.7.2-1
+zxing-cpp|3.0.2-1|3.1.0-1
+plasma-workspace|6.7.1-1|6.7.2-1
+kdeplasma-addons|6.7.1-1|6.7.2-1
+kimageformats|6.27.0-1|6.27.0-2
+systemsettings|6.7.1-1|6.7.2-1
+kinfocenter|6.7.1-1|6.7.2-1
+kitty-terminfo|0.47.1-1|0.47.4-1
+kitty-shell-integration|0.47.1-1|0.47.4-1
+kitty|0.47.1-1|0.47.4-1
+kmenuedit|6.7.1-1|6.7.2-1
+konsole|26.04.2-1|26.04.3-1
+opencv|4.13.0-11|5.0.0-6
+kquickimageeditor|0.6.2-1|0.6.2.1-2
+qtkeychain-qt6|0.16.0-1|0.17.0-1
+krdp|6.7.1-1|6.7.2-1
+plasma5support|6.7.1-1|6.7.2-1
+kscreen|6.7.1-1|6.7.2-1
+ksshaskpass|6.7.1-1|6.7.2-1
+kwallet-pam|6.7.1-1|6.7.2-1
+kwrited|6.7.1-1|6.7.2-1
+lib32-gcc-libs|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+lib32-brotli|1.1.0-1|1.2.0-2
+lib32-libdatrie|0.2.13-3|0.2.14-1
+lib32-libffi|3.6.0-1|3.7.1-1
+lib32-libjpeg-turbo|3.1.4.1-1|3.2.0-1
+lib32-libssh2|1.11.1-3|1.11.1-4
+lib32-libthai|0.1.29-3|0.1.30-1
+lib32-libtiff|4.7.1-1|4.7.2-1
+lib32-llvm-libs|1:22.1.6-1|1:22.1.8-1
+lib32-mesa|1:26.1.3-2|1:26.1.4-1
+lib32-pam|1.7.1-1|1.7.2-1
+lib32-sdl3|3.4.10-1|3.4.12-1
+vulkan-mesa-implicit-layers|1:26.1.3-2|1:26.1.4-1
+lib32-vulkan-mesa-implicit-layers|1:26.1.3-2|1:26.1.4-1
+vulkan-intel|1:26.1.3-2|1:26.1.4-1
+lib32-vulkan-intel|1:26.1.3-2|1:26.1.4-1
+vulkan-mesa-layers|1:26.1.3-2|1:26.1.4-1
+lib32-vulkan-mesa-layers|1:26.1.3-2|1:26.1.4-1
+vulkan-radeon|1:26.1.3-2|1:26.1.4-1
+lib32-vulkan-radeon|1:26.1.3-2|1:26.1.4-1
+libgccjit|16.1.1+r346+g4e03491b401d-1|16.1.1+r346+g4e03491b401d-3
+librevenge|0.0.5-4|0.0.6-1
+libstaroffice|0.0.7-5|0.0.8-1
+libreoffice-fresh|26.2.4-3|26.2.4-4
+libxnvctrl|610.43.02-1|610.43.03-1
+linux|7.0.14.arch1-1|7.1.3.arch1-2
+linux-headers|7.0.14.arch1-1|7.1.3.arch1-2
+linux-zen|7.0.14.zen1-1|7.1.3.zen1-2
+linux-zen-headers|7.0.14.zen1-1|7.1.3.zen1-2
+llvm|22.1.6-1|22.1.8-1
+luajit|2.1.1780076327+b925b3e-1|2.1.1783773675+3c4f9fe-1
+mariadb-libs|12.3.2-2|12.3.2-3
+node-gyp|13.0.0-1|13.0.1-1
+npm|11.16.0-1|12.0.0-1
+nvidia-settings|610.43.02-1|610.43.03-1
+openssh|10.3p1-1|10.4p1-2
+oxygen-cursors|6.7.1-1|6.7.2-1
+oxygen|6.7.1-1|6.7.2-1
+oxygen-sounds|6.7.1-1|6.7.2-1
+perl-dbi|1.649-1|1.650-1
+perl-http-date|6.07-1|6.08-1
+php|8.5.7-1|8.5.8-1
+php-fpm|8.5.7-1|8.5.8-1
+php-gd|8.5.7-1|8.5.8-1
+php-pgsql|8.5.7-1|8.5.8-1
+php-sodium|8.5.7-1|8.5.8-1
+plasma-browser-integration|6.7.1-1|6.7.2-1
+polkit-kde-agent|6.7.1-1|6.7.2-1
+powerdevil|6.7.1-1|6.7.2-1
+plasma-desktop|6.7.1-1|6.7.2-1
+plasma-disks|6.7.1-1|6.7.2-1
+plasma-firewall|6.7.1-1|6.7.2-1
+plasma-keyboard|6.7.1-1|6.7.2-1
+plasma-login-manager|6.7.1-1|6.7.2-1
+plasma-nm|6.7.1-1|6.7.2-1
+plasma-pa|6.7.1-1|6.7.2-1
+plasma-systemmonitor|6.7.1-1|6.7.2-1
+plasma-thunderbolt|6.7.1-1|6.7.2-1
+plasma-vault|6.7.1-1|6.7.2-1
+plasma-welcome|6.7.1-1|6.7.2-1
+plasma-workspace-wallpapers|6.7.1-1|6.7.2-1
+print-manager|1:6.7.1-1|1:6.7.2-1
+python-cffi|2.0.0-2|2.1.0-1
+python-numpy|2.5.0-1|2.5.1-1
+python-pillow|12.2.0-1|12.3.0-1
+python-setuptools|1:82.0.1-1|1:83.0.0-1
+python-typing_extensions|4.15.0-3|4.16.0-1
+samba|2:4.24.3-1|2:4.24.4-1
+xorg-server|21.1.23-1|21.1.24-1
+sddm-kcm|6.7.1-1|6.7.2-1
+spectacle|1:6.7.1-1|1:6.7.2-2
+tmux|3.7-1|3.7_b-1
+vulkan-swrast|1:26.1.3-2|1:26.1.4-1
+webkit2gtk-4.1|2.52.4-1|2.52.5-1
+webmin|2.610-1|2.651-1
+weechat|4.9.1-1|4.9.3-1
+xorg-xset|1.2.5-2|1.2.6-1
+xorg-xsetroot|1.1.3-2|1.1.4-1
+yad|14.2-1|15.0-1

docs/le-app-database-migration/phase2a-host-maintenance/backup-readiness-plan.md

@@ -0,0 +1,94 @@
+# Proportional Phase 2A backup-readiness plan
+
+## Verified existing evidence
+
+- `/srv/directus-archive/20260710-175408/SHA256SUMS` verified with return code 0.
+- The repaired `/.snapshots` Btrfs subvolume supports Snapper; snapshots 1–3
+  succeeded.
+- Maintenance creates and directly verifies a uniquely numbered pre-upgrade root
+  snapshot before Pacman.
+
+These facts do not yet justify `LE_PHASE2A_BACKUPS_READY=YES`.
+
+## Snapshot coverage
+
+The explicit root snapshot is crash-consistent coverage of the root `@`
+subvolume, including ordinary paths below it such as `/etc`, `/usr`, `/boot`
+when `/boot` is not a separate mount, and `/var/lib/docker` unless independently
+mounted. It is not an application-consistent database backup.
+
+The following are outside root `@` and therefore outside that snapshot:
+
+- Btrfs subvolumes `@home`, `@root`, `@srv`, `@cache`, `@log`, and `@tmp`;
+- the EFI system partition mounted at `/boot/efi`;
+- ext4 mounts `/mnt/storage`, `/mnt/appdata`, `/mnt/media`, and
+  `/mnt/coldstasis`;
+- tmpfs/runtime mounts.
+
+The protected Directus archive is below `/srv`, so its independent checksum
+verification—not the root snapshot—protects that evidence. Bind-mounted database
+or application state on the separate subvolumes or ext4 mounts is likewise not
+covered by the root snapshot. Unrelated media need not be duplicated merely
+because a consuming container is running.
+
+## Minimum fresh package-maintenance backup set
+
+Before setting the backup attestation, create and test:
+
+1. application-consistent dumps of every active MariaDB/MySQL and PostgreSQL
+   production database, including the transitional `le-directus-source` and
+   `le-payload-pg` databases if they must survive the maintenance window;
+2. a root-only host-configuration archive containing package inventory, `/etc`,
+   GRUB configuration, EFI boot metadata, relevant systemd units/drop-ins,
+   nftables/network configuration, and Docker Compose/deployment definitions;
+3. the explicit root Snapper snapshot already enforced by maintenance;
+4. checksum manifests plus a documented restore test or validated restore
+   procedure for the new dumps and configuration archive.
+
+Do not copy unrelated media libraries or bulk application media solely because
+their containers are running. Database dumps provide application consistency;
+the Btrfs snapshot provides fast crash-consistent package/config rollback.
+
+## Review-only commands
+
+The operator must replace the uppercase placeholders with reviewed root-only
+paths. Credentials must come from existing root-only client configuration or an
+interactive mechanism; never place passwords in command arguments or logs.
+
+```bash
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+backup_root=/ROOT/ONLY/BACKUP/DESTINATION/le-phase2a-$stamp
+install -d -o root -g root -m 0700 "$backup_root"
+
+pacman -Q > "$backup_root/packages-before.txt"
+cp --preserve=mode,ownership,timestamps /boot/grub/grub.cfg "$backup_root/grub.cfg"
+efibootmgr -v > "$backup_root/efibootmgr.txt"
+
+tar --xattrs --acls --numeric-owner -cpf "$backup_root/host-config.tar" \
+  /etc /usr/lib/systemd/system /boot/grub
+
+mariadb-dump --defaults-extra-file=/ROOT/ONLY/MARIADB-CLIENT-CONFIG \
+  --all-databases --single-transaction --routines --events --triggers \
+  > "$backup_root/mariadb-all.sql"
+
+pg_dumpall --file="$backup_root/postgresql-all.sql"
+
+# Transitional containers: use existing non-secret local authentication only.
+docker exec le-directus-source mariadb-dump \
+  --defaults-extra-file=/ROOT/ONLY/IN-CONTAINER-CLIENT-CONFIG \
+  --all-databases --single-transaction --routines --events --triggers \
+  > "$backup_root/le-directus-source.sql"
+
+docker exec le-payload-pg pg_dumpall \
+  > "$backup_root/le-payload-pg.sql"
+
+find "$backup_root" -maxdepth 1 -type f -print0 |
+  LC_ALL=C sort -z |
+  xargs -0 sha256sum > "$backup_root/SHA256SUMS"
+
+(cd "$backup_root" && sha256sum -c SHA256SUMS)
+```
+
+These commands are a review package, not execution approval. Confirm database
+names, authentication methods, output capacity, dump return codes, nonempty
+outputs, and a restoration test before attesting readiness.

docs/le-app-database-migration/phase2a-host-maintenance/container-disposition/README.md

@@ -0,0 +1,29 @@
+# Reviewed Docker container disposition
+
+Source: root-created, checksum-verified read-only baseline
+`/tmp/le-phase2a-container-baseline.HyAW6sPg`, captured 2026-07-12 without
+container environments, mounts, secret files, or credentials.
+
+The baseline contains 88 containers: 87 running, one intentionally stopped, and
+one unhealthy. `sonarr` is the sole reviewed unhealthy running container. Its
+exact container ID, image reference and image ID, running/health state, startup
+timestamp, network mode, restart policy, Compose project, and hash of its health
+check definition are in `sonarr-unhealthy.allowlist.psv`. The operator verified
+that its `/config/config.xml` is empty, no listener exists on port 8989, and its
+health check fails. Sonarr is unrelated to Phase 2A and need not be repaired.
+Any identity change, unexpected state, or additional unhealthy container is a
+hard stop before maintenance.
+
+`directus` is the sole stopped container. It is retired and must remain stopped;
+its exact identity is in `directus-stopped.allowlist.psv`. Starting, recreating,
+replacing, or changing its recorded state invalidates preflight.
+
+`running-containers.psv` is the authoritative 87-container post-reboot baseline.
+Containers recorded healthy must return healthy. Containers without health
+checks must return running. Sonarr must remain present and running; its health
+may remain unhealthy or improve to healthy. It may not become missing, stopped,
+restarting, or dead. No script starts, restarts, or recreates a container.
+
+The running `castopod` and `castopod-redis` containers have restart policy `no`.
+If either fails to return after reboot, validation records explicit operator
+attention and fails without starting it automatically.

docs/le-app-database-migration/phase2a-host-maintenance/container-disposition/SHA256SUMS

@@ -0,0 +1,6 @@
+64269e6af4b6c668737ec4f5ec4dec6a49a527a256a62644dde80b2fa356145c  README.md
+1d9e10136d127798aa1f834ad27d6d3d81b09fb585d78aaccb869a564065b19f  all-containers.psv
+bca981ad79a7bb84753112f13698ebf9b72471db29c2d4096f76f72898ace6d8  directus-stopped.allowlist.psv
+f6d68530714567fa8e3d7391dc7eb5232f3343be5d419fb24df56c552a7cebc6  restart-policy-no.psv
+c635776b21da4324ee0279be026ce8b5971d516cc4573313ad153db634ad4c1a  running-containers.psv
+75634105ec7afcb8009c9159be3fc5631cd9993dbca131c4a651515c4244b486  sonarr-unhealthy.allowlist.psv

docs/le-app-database-migration/phase2a-host-maintenance/container-disposition/all-containers.psv

@@ -0,0 +1,88 @@
+bazarr|0c752272254cfad9aeb5a6d981a8d354c0676a18eb14008b4613c7a442ea995c|linuxserver/bazarr|sha256:71677d1a237182abf46f607d346109c5a78aae3973d01b143cd89f39569345fa|running|no-healthcheck|2026-07-02T16:22:04.651521486Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+bgbye|2d7d7a1250b29f5e66c3068a4077e2d3df801de3f0c1802882aae1e39a84b05e|lasereverythingnetdb-bgbye|sha256:fa4994a5386cd97cba309b273025478722b06a8985dae249bb80c50a170355ce|running|healthy|2026-07-02T16:23:13.15908777Z|makearmy_net|unless-stopped|lasereverythingnetdb|healthcheck_sha256=6e5884b66db6e8cc64ccec2fc861dc2ee21b1ffce0b8555fdffd69811f89eb3a
+buildx_buildkit_defaultbuilder0|6b0affe65f5e3589baa0d57169713a1d9ffa5df5c9f6484a8e32bc4070d67ee6|moby/buildkit:buildx-stable-1|sha256:fe0990fb85c4586aaa94e599905b75a2676664f065f29bea67ebcd5b2fe88acb|running|no-healthcheck|2026-06-30T17:45:39.545876028Z|bridge|unless-stopped||healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+castopod-redis|45094b8a921517979c9a8a519c7ff2fc71a540656f2309ffbd0696cf56bf5dcf|redis:7.2-alpine|sha256:b6636bae9624cba73c69fc9d21318151217a103a1db600b8012db8c460785c26|running|no-healthcheck|2026-07-02T16:21:44.78699982Z|castopod_ma_net|no|makearmyiopodcast|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+castopod|b3612901d76d0b2be752762fb1e5d49ca7b521a648ab9b6f332ff7ace61ba54a|castopod/castopod:latest|sha256:d624bd1d45a4b929b9202cae2c4290cdf2624b6bf172fe2115ce20bdb359a428|running|healthy|2026-07-02T16:21:44.790327595Z|backend_net|no|makearmyiopodcast|healthcheck_sha256=a8def15088dacf1eb21b7a57747b2113566689d9876c5d690d7c3269562ec5cc
+collabora|bcf6738bab2b22f3db163f88f28608548a748a49e6088842e6e687a968c65371|collabora/code:latest|sha256:bf688dedd8778797a551ef5f768c33993cbecc23b9d68527176a59db5c7726c0|running|no-healthcheck|2026-07-02T16:22:15.786914258Z|collabora_s6_net|always|s6vinetoffice|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+continuwuity|a22c7cef0512cefc66441cc99d2b6f4ce36c48e70177c04dfdf88a44e91396ad|forgejo.ellis.link/continuwuation/continuwuity:latest|sha256:f45ecc72598a18e69e16fa7addbb5300b6eba7cd1bf0bf423a8d0b834c8c7abf|running|no-healthcheck|2026-07-02T16:21:42.218988545Z|conduit_net|unless-stopped|makearmyiomatrix|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+dcm|1d3291029cb4f3850e43ea93d6bc3a3ceb1d12ecfea27f136b99c3af61e65d75|ghcr.io/ajnart/dcm|sha256:2a6935c5032df59d0986753a05250dacfd66522554471fd54b0d302a67d6de98|running|no-healthcheck|2026-07-02T16:21:22.600579243Z|makearmyiodcm_default|unless-stopped|makearmyiodcm|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+directus|c65e7651bfb8827b712f3ed57fff5839dc5cdc87f9f416b7a09f389c7864a1a3|directus/directus:latest|sha256:dd5537b4b35a4a980452e8160def97e63bfd0a6b92e6d81ec980a3300801ce2a|exited|no-healthcheck|2026-07-02T16:21:21.312699245Z|backend_net|no|lasereverythingnetforms|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+ergo|f0d41caf4e9ec55b0bf677d8ba622660e918c30094b643cdf09926df545ca4cb|ghcr.io/ergochat/ergo:stable|sha256:ca8d10822089ef9fd05ba5cc18049b687bc46e2e0cc5901aed4bf92da337a7a0|running|no-healthcheck|2026-07-09T17:20:10.183703547Z|irc_net|on-failure|makearmyioirc|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+flaresolverr|3ce787aacca3e92e836526c81c7e6fab2dcb7d810b04fbf521e5deba2fd3039f|ghcr.io/flaresolverr/flaresolverr|sha256:894893ed4d4557764df3e74d27c5bc1b3944e5a33ed410e62ab7c744b348f415|running|healthy|2026-07-02T16:22:04.654391107Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=5b79b0ceb45d2b3ea48a3a1ab49a3c8a7ab3d42b98e63a185986126b8f6e5b71
+forgejo|1befcad10bf9b56880c9e2b223e2dd6e0c5dd500d1453a83768e974ced54273d|codeberg.org/forgejo/forgejo:11.0.1|sha256:49388d84630e37520e7c5d4971dd94564a7a39f18f66b60d40c32b66f7ff40b9|running|no-healthcheck|2026-07-10T00:57:13.158697179Z|backend_net|unless-stopped|makearmyioforge|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+heimdall|c8bab4edf73f1265ab91dd384d8942562827f8ce2185fb65e398c8e923872e13|lscr.io/linuxserver/heimdall:latest|sha256:96a3814546b9465dbee1cce1c9547bed5b6f1a13ca751f239cf88502f396df67|running|no-healthcheck|2026-07-02T16:21:46.899952815Z|heimdall_s6_net|unless-stopped|s6vinet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+immich_machine_learning|2b6046557c314400dec23f1caae69eae07a8e07542db79957f7b7e86d41aaff6|ghcr.io/immich-app/immich-machine-learning:release|sha256:088b410d324842faeeeb69d0d5fef6b3eccee3f6fe3c68a2b1235649a86872c4|running|healthy|2026-07-02T16:22:16.356336193Z|backend_net|always|immich|healthcheck_sha256=06fc5259e91d939c46d4cf740394a5057ea58131e5df6789d7e4f5ebbb6d7a59
+immich_postgres|17889bb81cea5af9cf6ac6bafe6eba61aeb8d50cb2c0996c699560182796945e|docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:739cdd626151ff1f796dc95a6591b55a714f341c737e27f045019ceabf8e8c52|sha256:3062a7ddd658eee20fcc428853dd34c23c7ad95fb48e3181922ffef11217389a|running|healthy|2026-07-02T16:22:16.362765814Z|immich_s6_net|always|immich|healthcheck_sha256=3b85ca1ca42325d6e6d9501e2adcf04a7a80dcb42159b69d2527d6432473ff32
+immich_redis|a2d1a7bc973927e404a2576cb3de755a890f7ded3f3361a8a065eab88a0d481c|docker.io/redis:6.2-alpine@sha256:148bb5411c184abd288d9aaed139c98123eeb8824c5d3fce03cf721db58066d8|sha256:6dd588768b9ba229530de57c108536a8d6b98d53d83f217f59167981fda443ca|running|healthy|2026-07-02T16:22:16.364329237Z|immich_s6_net|always|immich|healthcheck_sha256=bd98ba333892e944c8245cd358b2946469adf44d3d8ec7cabb936197e4362807
+immich_server|2115244bab14fec49130c4a3949dfc2773871fc54928f88be963388e5e04d790|ghcr.io/immich-app/immich-server:release|sha256:de80bec4fc193605671b0f9600fe6b20f598fd2cb503ffe1a6e67f7cfd0e5233|running|healthy|2026-07-02T16:22:16.558556945Z|backend_net|always|immich|healthcheck_sha256=b7dce503cff869bbffb63034400837e1ad79981eed7722359480a50dbc96436f
+jellyfin|ba3ef59b346479f17f4c2b9fd33828db2638801e408fca115e5289b371f89eaf|jellyfin/jellyfin:latest|sha256:d57d4a0c18b3e51b913bd2f8f0f122eb7c7150ea37bb0e352df9cb329de11d24|running|healthy|2026-07-02T16:22:17.374948578Z|jellyfin_s6_net|unless-stopped|s6vinetwatch|healthcheck_sha256=a22856b3a5dfad87ecc898383d5b49daa6b4b98bca2797ea36cb422e824de47c
+jellyseerr|c00ff6cc7213669b85bc8e28a51ffc16779d2489c7378f3911735b8d983dcd05|fallenbagel/jellyseerr|sha256:2742757d9c41bcb4acb76c86c4ce23a8c54d5dbe93a698c815a9a34bed0b18d0|running|no-healthcheck|2026-07-02T16:22:04.637037538Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+kavita|578e4aa1ceeb4eb61ce094ecc862cdce7d68538a2c3e7b17cb29c3f4798597d4|jvmilazz0/kavita:latest|sha256:12ac333d6fde07c087a135dd23fa5b930a96e2a3fde9cfbb281214f040b4cbba|running|healthy|2026-07-02T16:22:04.630545121Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=256947cdccf855523b654955b26538932c2ee76e01f507ef885f1e885437ddb4
+lasereverything-manager-bus-core|791f2ef47fc1c798318b4136773672dc0f8ff08cd104f075f2f317ca0caf1817|ghcr.io/true-good-craft/tgc-bus-core:latest|sha256:e053cb452820daba308e86f456ba7d1e2b0306f058eae2c91ee7122a8634f4bb|running|healthy|2026-07-02T16:21:21.581810214Z|lasereverythingnetmanager_default|unless-stopped|lasereverythingnetmanager|healthcheck_sha256=5f70654d32c1e7e9060a6069ae4e3e8d1b94c196cd73a66ae40c93098344ec59
+lasereverythingnettv-radio-1|297e17de84c4d3c31f9cdeda9dcbefe185e6ec6c48c44c7fdae9f3e3f5ce982c|jrottenberg/ffmpeg:latest|sha256:1cf434af29091eba2d80108e28864540dc98bd3e4e5cda2b497e758d60bacba1|running|no-healthcheck|2026-06-30T17:48:55.163034213Z|lasereverythingnettv_default|unless-stopped|lasereverythingnettv|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+lasereverythingnettv-tv-1|776624328baf74b4196474c0962d2e01b1caa21e8bc3a2f6c77aece135faf30e|jrottenberg/ffmpeg:latest|sha256:1cf434af29091eba2d80108e28864540dc98bd3e4e5cda2b497e758d60bacba1|running|no-healthcheck|2026-06-30T17:48:55.161961872Z|lasereverythingnettv_default|unless-stopped|lasereverythingnettv|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+le-directus-source|6adbd503febfd8a6236fc7c941df7bfc748e76dcd510c11e69a3ff02776ff344|sha256:72311f2ba18f5530a667b9a806bb1720a8c9d95de6b20dd085a808901eb614b8|sha256:72311f2ba18f5530a667b9a806bb1720a8c9d95de6b20dd085a808901eb614b8|running|no-healthcheck|2026-07-10T23:15:59.628507071Z|bridge|unless-stopped||healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+le-payload-pg|2ee8f491397b5cbab595121f0e5e57fa5778329090d27a80b002bdd83a5ee8f2|sha256:639c86b6cacfdf788c075ffb5879286aa0e905965a4832ba6c76ccb0bca9417b|sha256:639c86b6cacfdf788c075ffb5879286aa0e905965a4832ba6c76ccb0bca9417b|running|no-healthcheck|2026-07-10T23:20:42.20954498Z|bridge|unless-stopped||healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+lemmy-pictrs|22597c5b8ac30d2d715bd538ee15e27e07d8677c9a191c2af741c57b1adbe08d|asonix/pictrs:0.5.17-pre.9|sha256:9a5411f20149156b2bbbcc69b63918e9259d8d4653244eae7482e71177e1b15a|running|no-healthcheck|2026-07-02T16:21:41.143484739Z|lemmy_net|unless-stopped|makearmyiolemmy|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+lemmy-proxy|f267f47868f6bd4c0f2b3594c1b23909862fbe853491cd514e9f8205be3499d2|nginx:1-alpine|sha256:ea51152ef8c480b999cee0271a288c698704b18483276119b1253e576ef3232f|running|no-healthcheck|2026-07-02T16:21:41.4297012Z|lemmy_net|unless-stopped|makearmyiolemmy|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+lemmy-ui|e53db215d6385a424365263fbce8edd9d08f1ea0927bc0aa136af4694ba22d89|dessalines/lemmy-ui:0.19.12|sha256:0a85b3192f29a5b14d41c265d9d5cab60bd281b4a5b5db8f3a85d5d9bf01aaaa|running|healthy|2026-07-02T16:21:41.334389805Z|lemmy_net|unless-stopped|makearmyiolemmy|healthcheck_sha256=fe44578c9a0ef5c3150b372caa763f18afad8938c28752af3570a87d8deb88e4
+lemmy|1f032d67308df68711b5d432398ff31094da65dbdddbb966e60d745390fd0a0d|dessalines/lemmy:0.19.12|sha256:68c00173ade225585ea7d54ed2688f8f23d7d2886ae3f5b4eefd70dbc05b044a|running|no-healthcheck|2026-07-02T16:21:41.230573992Z|backend_net|unless-stopped|makearmyiolemmy|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+mailu-admin|ed54ee705edfd3867b98548c7a5054ba8e58eb8fc3f7afbf3e0d5378fe508f4e|ghcr.io/mailu/admin:2024.06|sha256:e4319dc05cd8ee8204ebb0343685d52a9c645f192f92a9ba24e05a702a722894|running|healthy|2026-07-10T15:30:56.858313278Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=65c193d7ce37216310a9ad7324433501d4532a0e95241ba91a6643556dcb2b8d
+mailu-antispam|0f2bc2ca4ee1971e3dfdd9534ffa5ffa6bb5b1530f8c1e8c595a7c1303d70cba|ghcr.io/mailu/rspamd:2024.06|sha256:a8619d7f452f04d806b1f334e3e28e123c5f568080e168051fe98c7b3637925d|running|healthy|2026-07-10T15:30:57.245953555Z|arrmailnetmail_clamav|always|arrmailnetmail|healthcheck_sha256=7ffc0eff154ba7ec4712f405258f56347f428b7f2ec716554a9f6c1fed3b896d
+mailu-antivirus|22b05b37de3374f615e15e79cee3632e3f2398a2c50a5183a3baa94add519b62|clamav/clamav-debian:1.4|sha256:f8a1f4389e5cbfb43ffc839d751bf746c6c27f5de780ba1fcde15d596f94287b|running|healthy|2026-07-10T15:30:56.621336608Z|arrmailnetmail_clamav|always|arrmailnetmail|healthcheck_sha256=713e2ecbe297d1e71fa7f1819859d65ad738041705100f5c4ae73f4ae551fb60
+mailu-fetchmail|a47a586ae5cdb3d810932c4dfe06ec242ec02cc3999f7ecec2fac1779cf14ffc|ghcr.io/mailu/fetchmail:2024.06|sha256:eccbdf53fb66dc34a49bde349f53eb9d1bba60c98a1be5d9eabe68a726f13e6a|running|healthy|2026-07-10T15:30:57.460051545Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=001e1e50755b8a7ad162dfd92611a0d0944aa07d8ca6dc19ebffb0c60494878e
+mailu-front|a82753aefc6c8243c7c71caa0ef289a1a2e83c3fb1f9e93e779e56267353d11c|ghcr.io/mailu/nginx:2024.06|sha256:30a4f996f255fe498ed847b9a3759efd45fc5d8bd5c4dc121896e83615e60b0d|running|healthy|2026-07-10T15:30:56.726639815Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=c379c13a800f5417c0692896be411b09f7fe5a95d530f676abfd7d2dae1ea24c
+mailu-imap|549c48f83f429fd9b1e52f7752012b1250107dc511c1b7ee94ac2a49b521a726|ghcr.io/mailu/dovecot:2024.06|sha256:27aceac0272f97361a5a5b1d5abea7099e10f409e3d28a6096f9111fe90bf347|running|healthy|2026-07-10T15:30:57.247440245Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=9462f6ccccab8ea58f34afb7cfaae178b2d36f27a29e903b89ea4a7a1ed73cd6
+mailu-oletools|841c57f99cfeec974e757666484b8c1a37ca0f2696d719d49317294253edb33b|ghcr.io/mailu/oletools:2024.06|sha256:76fb07165f54411c1136a449ba2963fe11618f0cf4629fdc13eadd628d3528c9|running|healthy|2026-07-10T15:30:56.729115113Z|arrmailnetmail_oletools|always|arrmailnetmail|healthcheck_sha256=b1b33aade32e78a9484d43059f9f651eef8a2e8b8910893a4436f15a078abd08
+mailu-redis|4f1b06b40d4ebe43ee8391c91d0c02645a7f23dc91229123a0a25e9098eb567d|redis:alpine|sha256:55563f45704d59e891b6aa643014bb6b562abf21909a44b3b297502415b68e29|running|no-healthcheck|2026-07-10T15:30:56.720208042Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+mailu-resolver|96d3aaea44a0a8779c2a11fd7cb341bbc9aa23ad879381c5f7a247a0554cc444|ghcr.io/mailu/unbound:2024.06|sha256:d30593c8bf42bfd1c46bd1ac7ee90862b0cfa7e96fd10da1dacc2c69cafb443d|running|healthy|2026-07-10T15:30:56.617962677Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=5b9b365275d40b354506f2b02070d7785700a374ee09de8d7ee8527bbbf1b16f
+mailu-smtp|22e3c459d26b808ffca118df679aae2c9cc511de3fcaba4a9847770df6f24de5|ghcr.io/mailu/postfix:2024.06|sha256:0bed674f22e609e0b2f6780865097a41ed6ca5307db4bcc0794a35e2e7e976c9|running|healthy|2026-07-10T15:30:57.241512918Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=9b234890e871375cec386d4edacf17bcbd8a5504fab8b1177d956c56622a08aa
+mailu-tika|60ba021f422056617055244f608c881f5ce282c2d1590e52d8d2719a44b1eb98|apache/tika:2.9.2.1-full|sha256:e646191162f8cb7aef0b512d54c028f62bd86e0e5f53b314ab82cfac7ef292d7|running|healthy|2026-07-10T15:30:56.723391978Z|arrmailnetmail_tika|always|arrmailnetmail|healthcheck_sha256=454cfb3387dd964dad59d868a522ba8ebbb1181df78bac6e750133eb5770f96d
+mailu-webdav|d5d73d88a2764eaded36de6cbc7fab3fd21956df393d4cf9fecc58217a80e3b6|ghcr.io/mailu/radicale:2024.06|sha256:890973bd7de583a7c8cb2c2bbc939249e007418066b69f59cd0c6903b7f35dfc|running|healthy|2026-07-10T15:30:56.620268969Z|arrmailnetmail_radicale|always|arrmailnetmail|healthcheck_sha256=0eaa30f40ef1bb32694b25d91598460713955379cbe30e51af90204e6c29aeff
+makearmy-app|3c10dda3815a2c0b0c494fb99a198a331b85c61f0b27ed1537bd2743355fd363|lasereverythingnetdb-makearmy-app|sha256:6c8190861686d9bec6f50d705c681d657fbc979c2a8743cf1614d01db0b5d1c6|running|no-healthcheck|2026-07-10T16:30:29.09880902Z|makearmy_net|unless-stopped|lasereverythingnetdb|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+makearmyiomeet-jibri-1|d9799783148b365cb04f3eeb4f52217cc32e377b47fb69919d6ff18f05430d1d|jitsi/jibri:stable|sha256:dfe4d14ee76e0b054c226b27976d43b0c4ed6fa9774b8acd06b0c4f391dbbb95|running|no-healthcheck|2026-07-02T16:21:43.11777777Z|meet_net|unless-stopped|makearmyiomeet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+makearmyiomeet-jicofo-1|9f10baac0b699ef704ffbceab5d182a769f45f964a08fff13984b67f421370ac|jitsi/jicofo:stable|sha256:80619f3a1c08c4bb6ccc44af0a0829a1bc817904a5819da2762bca0ea7d840fe|running|no-healthcheck|2026-07-02T16:21:42.695779854Z|meet_net|unless-stopped|makearmyiomeet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+makearmyiomeet-jvb-1|dcb946a8243ca5b8b3307c9e0e47474e24bd8a0b0f738e5558ef1e084cd0a26d|jitsi/jvb:stable|sha256:5a7999e458cc16a79a7b1082de760d5240d938ea2fd1c74dfc1cb7c32267a2d2|running|no-healthcheck|2026-07-02T16:21:42.696967273Z|meet_net|unless-stopped|makearmyiomeet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+makearmyiomeet-prosody-1|7e55738c8ef8fa72966f30ee08e08f78ef9d2ce0778f102810e7a1e9a65ee427|jitsi/prosody:stable|sha256:4ecc8a3ed20b56d628e0980e1bd279a5201a1d749a0d7529cc320a1e57dd13c0|running|no-healthcheck|2026-07-02T16:21:42.57107622Z|meet_net|unless-stopped|makearmyiomeet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+makearmyiomeet-web-1|9fcb631e7509b43c6cb8589ba5b9b86a33355fb21f6b0aded53fe249c317ac8a|jitsi/web:stable|sha256:dc69cbf912d43bbd2e6bff921c32f968d0fd20d299f4a6ace213411b3ace77d7|running|no-healthcheck|2026-07-07T23:05:03.005510996Z|meet_net|unless-stopped|makearmyiomeet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+mastodon-es|8173cfe45df20a1f250fdb1deeaf7b195f9b10048827c3c7f0f6bed3065d5a8c|docker.elastic.co/elasticsearch/elasticsearch:7.10.2|sha256:0b58e1cea50068776b05911440c0eb2865ef64f46704a74ebcf0f8f9d9edff08|running|healthy|2026-07-02T16:21:41.658284982Z|mastodon_net|always|makearmyiomastodon|healthcheck_sha256=43ed0ec1b037c1138b428561ed2f275ae40dbf871887fff30170841101c96871
+mastodon-redis|42a18b0302bab7268fb6e4b37fdb00e7e33e8ab873d29a51935960dfa4bd2c9e|redis:7-alpine|sha256:487efc0616382465781b8fdc3d6d1db449e6fd80ae23bf48432a2da6b6929908|running|healthy|2026-07-02T16:21:41.657158258Z|mastodon_net|always|makearmyiomastodon|healthcheck_sha256=6971523e64ad7ed1de29b647f359cf830fb227fe65b6e7d687b694e79b4cd00a
+mastodon-sidekiq|8f854b45b737bc4e36e74ef5f6698decbf36d3d77b837fa30b736d3ec22ede74|ghcr.io/mastodon/mastodon:v4.3.7|sha256:9f42cca562554c9a4b3c39fecf3590aaf48cd4f566054f94135bc7e417b9e609|running|healthy|2026-07-02T16:21:41.771788456Z|backend_net|always|makearmyiomastodon|healthcheck_sha256=63b22b698c07de250a134ce31a15f3b269ad63c4f8fa4896bb920941b5a20e56
+mastodon-streaming|58e667e71825fdf2674c125bf60ed8a1edf075b3dd01a9aeaa69e79c07edd1cf|ghcr.io/mastodon/mastodon-streaming:v4.3.7|sha256:ce444902e7c4152b82ad2526fbd32d0eaa47cc9d6b2a7e4198cd2395579e63cf|running|healthy|2026-07-02T16:21:41.770290748Z|backend_net|always|makearmyiomastodon|healthcheck_sha256=d5da8b454dac278280b9e3931e305a9094a1e446721f9e01e89f3de89772a681
+mastodon-web|355cfac0741d25cee7c18729d4ec0f74355a20edca54ca608102be82bfc90a05|ghcr.io/mastodon/mastodon:v4.3.7|sha256:9f42cca562554c9a4b3c39fecf3590aaf48cd4f566054f94135bc7e417b9e609|running|no-healthcheck|2026-07-02T16:21:41.790863717Z|backend_net|always|makearmyiomastodon|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+misskey-redis|ee4b788482e8fdaf635f5bb4e66ccf757f8b8e96d85175efc56e53f09d5550e3|redis:7-alpine|sha256:487efc0616382465781b8fdc3d6d1db449e6fd80ae23bf48432a2da6b6929908|running|healthy|2026-07-02T16:21:22.84032892Z|misskey_net|unless-stopped|makearmyiodeck|healthcheck_sha256=6a1d3a9edb36c3a4ce5fcbd09886f5e885dcfb752bcece4036250d3ded7a95b0
+misskey|fafd13e69d38892a3e1cdb33ebe709b2de1a13807a7db037035bad815d2c4e59|misskey/misskey:latest|sha256:368867af5f043346679e8721eb4560f2633cfe1a889fcf0422b6e845b7fae5b6|running|healthy|2026-07-02T16:21:28.456308969Z|backend_net|unless-stopped|makearmyiodeck|healthcheck_sha256=5ccbecc9fc9854d3822bad70f7615ca2b2189f2ae0376a276e1a1cd785d27328
+mysql_shared|37e9091b4f9db9c4434b664903283248fe9723a9717ba3a407141d625c6ab272|mariadb:10.11|sha256:72311f2ba18f5530a667b9a806bb1720a8c9d95de6b20dd085a808901eb614b8|running|no-healthcheck|2026-07-02T16:21:19.526467097Z|backend_net|unless-stopped|database|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+navidrome|0d66d26de7b4dc30c3f2629d8db37a68b45dec6b69805aac1d48682999dc8bd4|deluan/navidrome:latest|sha256:6567e3810d544da3bb067f50aba7b05b3b029acacd7b17654f2310eee21756c8|running|no-healthcheck|2026-07-02T16:22:15.324814438Z|backend_net|unless-stopped|s6vinetmusic|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+nextcloud-ma-app|da4c05c513a3fd41b3816f4e3b267489bc795e07af0411d69e54a8fd4c303341|nextcloud:fpm|sha256:192578f11d97117460f29c0c42e4e3676200f6e0da97f263f34d59dfbfd9b98b|running|no-healthcheck|2026-07-02T16:21:22.194816111Z|arrmail_backend|always|makearmyiocloud|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+nextcloud-ma-redis|8a22ef42d843c6af32706995bdac253c66b2dbdfc05ad63d154e4f6130149dc4|redis:alpine|sha256:55563f45704d59e891b6aa643014bb6b562abf21909a44b3b297502415b68e29|running|no-healthcheck|2026-07-02T16:21:22.079098096Z|nextcloud_ma_net|always|makearmyiocloud|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+nextcloud-ma-web|47788388748bf09d5a90f9e04078d1f5387a1e55e8dab562d1356568684851e6|nginx:alpine|sha256:ea51152ef8c480b999cee0271a288c698704b18483276119b1253e576ef3232f|running|no-healthcheck|2026-07-02T16:21:22.386376738Z|nextcloud_ma_net|always|makearmyiocloud|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+nzbhydra2|72577626a7b78f5e421a3aa2170ca0779d1ae32833b8ab06af5e15f6c21b54b7|lscr.io/linuxserver/nzbhydra2|sha256:de294ca9aa92795dca1f3e18c5bd1f23a6f88f580ed35537c91910e898d319b9|running|no-healthcheck|2026-07-02T16:22:04.638532863Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+owncast|f49b181fbd7098f6794f49dedb85d7f0f0b1b96302571d328d5c53c6c53477ca|owncast/owncast:latest|sha256:e6eabb9b993941043e9a6feb8f3d94d54854afc1d268310cfedc4a4a45f9b31b|running|no-healthcheck|2026-07-02T16:21:21.767199243Z|makearmyiocast_default|unless-stopped|makearmyiocast|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+peertube-redis|af5cd4f35df32636f42dbe64fb8d6f76ddfa4f0c0c805a33e8a5ab80b14de0f2|redis:7-alpine|sha256:487efc0616382465781b8fdc3d6d1db449e6fd80ae23bf48432a2da6b6929908|running|no-healthcheck|2026-07-02T16:21:45.580356479Z|makearmyiowatch_peertube_net|unless-stopped|makearmyiowatch|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+peertube|f1f9b4a119fe5b3b4595ae065743c22340bd49d506c8e1dec91396177d02edb4|chocobozzz/peertube:production-bookworm|sha256:95cafee12c7ba26c7427369020a5fe47f0ca4f2c0a9125038a678abda7a69c9b|running|no-healthcheck|2026-07-02T16:21:45.796042043Z|backend_net|unless-stopped|makearmyiowatch|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+picsur-redis|b209f19682835276e80e17d0ac3f1e036d6b1fda8756dcac68fc122d0c4fa3f8|redis:7-alpine|sha256:487efc0616382465781b8fdc3d6d1db449e6fd80ae23bf48432a2da6b6929908|running|healthy|2026-07-02T16:21:29.04863531Z|picsur_net|unless-stopped|makearmyioimages|healthcheck_sha256=147968879ed0db0afaec1547f804e197ae69ccc63932fd3abbe258ab467010d3
+picsur|64562af622743c5e95fed7cd0e400fcb754e67d524f3692308ae11420dc0e0e6|ghcr.io/caramelfur/picsur:latest|sha256:1807c0cf959b86dddbf3a92effb9d8cde12b3412c0a399bfd28720fdc37238c4|running|healthy|2026-07-02T16:21:39.647252782Z|backend_net|unless-stopped|makearmyioimages|healthcheck_sha256=ec000ecdddc3d5596f4bc9628961c417aa7b8c1a3b5d2df4c98640ad362f5dd5
+pinchflat|85fe3664962fcfa588aa37133ff74181f16806d98ed22b9a3d921d266698389c|keglin/pinchflat:latest|sha256:753a348c4189cab415077a0ba39e429f3a2d827ca9944482fba39e89d7670359|running|healthy|2026-07-02T16:22:17.898598212Z|s6vinetyt_default|unless-stopped|s6vinetyt|healthcheck_sha256=135a29148f28914de8f172b817ecb24ba481550c1b7266a8db237818fd6b8455
+pixelfed-ma-redis|2f5e7667382929d159967f793544f3d797d1bc081b00d8e2e8e569c12f34efc6|redis:6|sha256:2acfd509b0322ec1849e7e8cae7acfed5abfa449aef850d960669fb93e31a0da|running|no-healthcheck|2026-07-02T16:21:43.915226725Z|pixelfed_ma_net|unless-stopped|makearmyiopixels|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+pixelfed-ma-web|4bf3656aa29bb29bc731b8a31e22f0b3c7e26b04439d400b2f7b92a43d131c75|elestio/pixelfed:latest|sha256:96f2928fac9954a5926816c08b0828f0aac91101ed44f35e45870af0b07ca4b3|running|no-healthcheck|2026-07-02T16:21:44.127434453Z|backend_net|unless-stopped|makearmyiopixels|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+pixelfed-ma-worker|4533b9ed4e4d02ee916e99ef1d042fb11f6cb140168748fe15a61112a2f27794|elestio/pixelfed:latest|sha256:96f2928fac9954a5926816c08b0828f0aac91101ed44f35e45870af0b07ca4b3|running|no-healthcheck|2026-07-02T16:21:44.134015364Z|backend_net|unless-stopped|makearmyiopixels|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+postgres_shared|16a46598e773446ef94853d20ca2aa4f636599c4fabb5dc945038891e7327f75|tensorchord/pgvecto-rs:pg16-v0.3.0|sha256:edaefebbe512002c6bc57af37cfffb53d70ede0c4f213dd9344a0cd42276cee5|running|no-healthcheck|2026-07-02T16:21:19.527512266Z|backend_net|unless-stopped|database|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+privatebin|908728b26d94527c44fa334bd0e506b478d6ab143efa292ce7444ebc2d15e8c8|privatebin/nginx-fpm-alpine|sha256:1cd5a4d4a4d712cd3cc5b3997c47211279e2180a578ab2114285a5a8ad38117a|running|no-healthcheck|2026-07-02T16:21:43.509343441Z|privatebin_rw_net|unless-stopped|makearmyiopaste|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+prowlarr|89d2cb4ae3df4b62d58914957f583650d9b21f90830f120d09fc70c7e901c681|linuxserver/prowlarr|sha256:e21be23a845221afc1f4a650b864c294758cde345ba7c865f01e2686274dedb7|running|healthy|2026-07-02T16:22:04.640131595Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=13f99794bea67548cc642314145eec7125eb7f719dada9768aba07a1a476b795
+qbittorrent|af4d51e98c4a6293183474353c87e43e38c26e675fb74048ddc9f9064a62c0ae|lscr.io/linuxserver/qbittorrent:latest|sha256:a5d5cf51c98df7347d8e9ed7bf2c83c4b7f9f0e9a3981410e8499927541cb350|running|no-healthcheck|2026-07-02T16:22:04.635570271Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+radarr|161e0cab15f684eff7237b0237483cf2d25c628f55c9a78b07d917054ba0d4da|linuxserver/radarr|sha256:ecf70f15bca59f11387be96af3d2eea3a733d8f16946e763923185d4d297fa08|running|healthy|2026-07-02T16:22:04.631684293Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=f71b83e7755a8b028db89f814a6a838ce7119af31ce52ce7e8ba8976096250c1
+recyclarr|55cd226a6d1cc7b0375ab72aa7c23a17ed1ecbb1ff7e5790701589a777c6d0cd|ghcr.io/recyclarr/recyclarr|sha256:c57a7e2fe3090e3f43a0dd6686cde6c01db71c8d4a85fcb3b789d0ac473d874c|running|no-healthcheck|2026-07-02T16:22:05.297908155Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+romm-db|32e6a3a86bd8a241fba5a3ee4bd81f8e40d5d00988b6f7b4382d33af10a301fe|mariadb:latest|sha256:ca20b0713cc87f0e9a75d154f677e3f9469e1281f21dd68dc551bf3d93467e27|running|healthy|2026-07-02T16:21:47.839091367Z|s6vinetgames_default|unless-stopped|s6vinetgames|healthcheck_sha256=d5f5eabd7fcdf68fb96e631355d683a153faa27d31ac2c96ae5f4263929c436e
+romm|52eadbc4e6fedce3487bc0ccc9b5f1e0fe631349d3246ce95430dab75d10ae31|rommapp/romm:latest|sha256:0ec219d3cf24a9ee76f36c318ec03fca842d474b9ba47a6484e40b62b11983dc|running|no-healthcheck|2026-07-02T16:21:58.569925827Z|s6vinetgames_default|unless-stopped|s6vinetgames|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+sabnzbd|23e190c5e003059a5b331976ad6bc5773a7089c4c52b967933332d705e8be4cd|lscr.io/linuxserver/sabnzbd|sha256:8a22dade7777d4c9c29922881dd849ffe8059be3b7b2a97fc137a745057f9894|running|no-healthcheck|2026-07-02T16:22:04.634220659Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+slskd-portwatch|5be4dca461964ba4a401c0c49f69bf4147dfe72e3c318414a768e66684c49235|alpine:3.20|sha256:bf8527eb54c3680e728d5b4b383a8ba730d72dae7236fbc8dff97ed6b224a731|running|no-healthcheck|2026-07-02T16:22:14.634814016Z|s6vinetmedia_media_s6_net|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+slskd|50aebf40411108683ec8fbd2bb81f11a9275894da0bf3b80e32c492ef180c1ef|slskd/slskd:latest|sha256:4037f8009b7a98e3ef10b0b590717895c09779aeed060e093fc3ef2f8b027cf2|running|healthy|2026-07-08T12:00:29.038610186Z|container:f73ac36f101be4afadf1933ffa15f86bb05642d50b6c6859c904aa2a743a6c8b|unless-stopped|s6vinetmedia|healthcheck_sha256=2e42bc8cb3985bfbe1ec2460cd8d9a2fa7b2fd9ebc5e88bc824f8b95e39d6dca
+snappymail|79ea0d668d4289c270a148183c3c6465b9e70521953bcadef9de7cca49c20f6a|djmaze/snappymail:latest|sha256:741d1bdf62b2cd4f3ff8c1d58a86bec7ba1aa644fbce45ea275d6972f89ac2bf|running|no-healthcheck|2026-07-10T01:56:51.598114125Z|snappy_net|unless-stopped|arrmailnet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+sonarr|fbd5ba72eaeccc4881818317d6fc81a285fa2a1161989675f53a666ce8c11002|linuxserver/sonarr|sha256:66f3b9a7c27e21a06e3c1a5f8f17b2b00e917291f0aaf07cece29f9fd9a26e4f|running|unhealthy|2026-07-02T16:22:04.632855946Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=3b816cea3c7006fde5b6197792c65249d978e96c07caf3cc61136b553107433e
+tdarr|ba0f5cf378fd25e9a6b95cd6b53ea377a4cb86288fe131d7379e5e7e7a24b8fb|ghcr.io/haveagitgat/tdarr:latest|sha256:6805431096bd3fa6e2aa1005dc1f3834545b48f6a03f09243a653e2005a3a808|running|no-healthcheck|2026-07-02T16:21:59.102117444Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+vaultwarden|6633442e948d174acda740c2a26ba13782f1ac57f24839e0ba51791d9fc3b51d|vaultwarden/server:latest|sha256:3e3ce0360c32d2dcc2bbe138f7716014dc3eee45f235e44603e4761e46601007|running|healthy|2026-07-02T16:21:21.085620901Z|vault_net|unless-stopped|arrmailnetpass|healthcheck_sha256=c0ba6b061e69edd02095fa8c73f0065e6df9440345b0b0f53d5dd24e341cc665
+vdo_wss|f40b63fbbd9d80f42dd8477226aa734c88db0009d04d493701f7507de00c2382|node:20-alpine|sha256:11cedc39e663e7c5d5cb9cc77a461a0d2adc25537b94e6831a6108f09cb2001b|running|no-healthcheck|2026-06-30T17:55:34.686303735Z|makearmyiovdo_default|unless-stopped|makearmyiovdo|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+vpn-slskd|f73ac36f101be4afadf1933ffa15f86bb05642d50b6c6859c904aa2a743a6c8b|qmcgaw/gluetun|sha256:5694e33296a1d44a563e83e51113970b230acf2878004f01099ad4a4b83bc762|running|healthy|2026-07-02T16:21:58.912570969Z|s6vinetmedia_media_s6_net|unless-stopped|s6vinetmedia|healthcheck_sha256=8a73e8de0ca0b93f3e1b75f81d2ffe1c320f5ede18b34ec15db87f285f778104
+vpn|ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|qmcgaw/gluetun|sha256:5694e33296a1d44a563e83e51113970b230acf2878004f01099ad4a4b83bc762|running|healthy|2026-07-02T16:21:58.9115723Z|s6vinetmedia_media_s6_net|unless-stopped|s6vinetmedia|healthcheck_sha256=740a01b114720db4fbb6e078898c810bd1ff19f9227cc3a1bd01926f222aea8b
+yacht|d2a07818987aff223c090be88530007784385b3352e5f53aa10ec881a305464b|ghcr.io/selfhostedpro/yacht:latest|sha256:d79060100eb7707aae957b78a4406dfb5b0f83d83543f3e132d8bb24da8abc9c|running|no-healthcheck|2026-07-02T16:21:47.517372813Z|yacht_s6_net|unless-stopped|s6vinetdocker|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

docs/le-app-database-migration/phase2a-host-maintenance/container-disposition/directus-stopped.allowlist.psv

@@ -0,0 +1 @@
+directus|c65e7651bfb8827b712f3ed57fff5839dc5cdc87f9f416b7a09f389c7864a1a3|directus/directus:latest|sha256:dd5537b4b35a4a980452e8160def97e63bfd0a6b92e6d81ec980a3300801ce2a|exited|no-healthcheck|2026-07-02T16:21:21.312699245Z|backend_net|no|lasereverythingnetforms|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

docs/le-app-database-migration/phase2a-host-maintenance/container-disposition/restart-policy-no.psv

@@ -0,0 +1,2 @@
+castopod-redis|45094b8a921517979c9a8a519c7ff2fc71a540656f2309ffbd0696cf56bf5dcf|redis:7.2-alpine|sha256:b6636bae9624cba73c69fc9d21318151217a103a1db600b8012db8c460785c26|running|no-healthcheck|2026-07-02T16:21:44.78699982Z|castopod_ma_net|no|makearmyiopodcast|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+castopod|b3612901d76d0b2be752762fb1e5d49ca7b521a648ab9b6f332ff7ace61ba54a|castopod/castopod:latest|sha256:d624bd1d45a4b929b9202cae2c4290cdf2624b6bf172fe2115ce20bdb359a428|running|healthy|2026-07-02T16:21:44.790327595Z|backend_net|no|makearmyiopodcast|healthcheck_sha256=a8def15088dacf1eb21b7a57747b2113566689d9876c5d690d7c3269562ec5cc

docs/le-app-database-migration/phase2a-host-maintenance/container-disposition/running-containers.psv

@@ -0,0 +1,87 @@
+bazarr|0c752272254cfad9aeb5a6d981a8d354c0676a18eb14008b4613c7a442ea995c|linuxserver/bazarr|sha256:71677d1a237182abf46f607d346109c5a78aae3973d01b143cd89f39569345fa|running|no-healthcheck|2026-07-02T16:22:04.651521486Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+bgbye|2d7d7a1250b29f5e66c3068a4077e2d3df801de3f0c1802882aae1e39a84b05e|lasereverythingnetdb-bgbye|sha256:fa4994a5386cd97cba309b273025478722b06a8985dae249bb80c50a170355ce|running|healthy|2026-07-02T16:23:13.15908777Z|makearmy_net|unless-stopped|lasereverythingnetdb|healthcheck_sha256=6e5884b66db6e8cc64ccec2fc861dc2ee21b1ffce0b8555fdffd69811f89eb3a
+buildx_buildkit_defaultbuilder0|6b0affe65f5e3589baa0d57169713a1d9ffa5df5c9f6484a8e32bc4070d67ee6|moby/buildkit:buildx-stable-1|sha256:fe0990fb85c4586aaa94e599905b75a2676664f065f29bea67ebcd5b2fe88acb|running|no-healthcheck|2026-06-30T17:45:39.545876028Z|bridge|unless-stopped||healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+castopod-redis|45094b8a921517979c9a8a519c7ff2fc71a540656f2309ffbd0696cf56bf5dcf|redis:7.2-alpine|sha256:b6636bae9624cba73c69fc9d21318151217a103a1db600b8012db8c460785c26|running|no-healthcheck|2026-07-02T16:21:44.78699982Z|castopod_ma_net|no|makearmyiopodcast|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+castopod|b3612901d76d0b2be752762fb1e5d49ca7b521a648ab9b6f332ff7ace61ba54a|castopod/castopod:latest|sha256:d624bd1d45a4b929b9202cae2c4290cdf2624b6bf172fe2115ce20bdb359a428|running|healthy|2026-07-02T16:21:44.790327595Z|backend_net|no|makearmyiopodcast|healthcheck_sha256=a8def15088dacf1eb21b7a57747b2113566689d9876c5d690d7c3269562ec5cc
+collabora|bcf6738bab2b22f3db163f88f28608548a748a49e6088842e6e687a968c65371|collabora/code:latest|sha256:bf688dedd8778797a551ef5f768c33993cbecc23b9d68527176a59db5c7726c0|running|no-healthcheck|2026-07-02T16:22:15.786914258Z|collabora_s6_net|always|s6vinetoffice|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+continuwuity|a22c7cef0512cefc66441cc99d2b6f4ce36c48e70177c04dfdf88a44e91396ad|forgejo.ellis.link/continuwuation/continuwuity:latest|sha256:f45ecc72598a18e69e16fa7addbb5300b6eba7cd1bf0bf423a8d0b834c8c7abf|running|no-healthcheck|2026-07-02T16:21:42.218988545Z|conduit_net|unless-stopped|makearmyiomatrix|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+dcm|1d3291029cb4f3850e43ea93d6bc3a3ceb1d12ecfea27f136b99c3af61e65d75|ghcr.io/ajnart/dcm|sha256:2a6935c5032df59d0986753a05250dacfd66522554471fd54b0d302a67d6de98|running|no-healthcheck|2026-07-02T16:21:22.600579243Z|makearmyiodcm_default|unless-stopped|makearmyiodcm|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+ergo|f0d41caf4e9ec55b0bf677d8ba622660e918c30094b643cdf09926df545ca4cb|ghcr.io/ergochat/ergo:stable|sha256:ca8d10822089ef9fd05ba5cc18049b687bc46e2e0cc5901aed4bf92da337a7a0|running|no-healthcheck|2026-07-09T17:20:10.183703547Z|irc_net|on-failure|makearmyioirc|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+flaresolverr|3ce787aacca3e92e836526c81c7e6fab2dcb7d810b04fbf521e5deba2fd3039f|ghcr.io/flaresolverr/flaresolverr|sha256:894893ed4d4557764df3e74d27c5bc1b3944e5a33ed410e62ab7c744b348f415|running|healthy|2026-07-02T16:22:04.654391107Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=5b79b0ceb45d2b3ea48a3a1ab49a3c8a7ab3d42b98e63a185986126b8f6e5b71
+forgejo|1befcad10bf9b56880c9e2b223e2dd6e0c5dd500d1453a83768e974ced54273d|codeberg.org/forgejo/forgejo:11.0.1|sha256:49388d84630e37520e7c5d4971dd94564a7a39f18f66b60d40c32b66f7ff40b9|running|no-healthcheck|2026-07-10T00:57:13.158697179Z|backend_net|unless-stopped|makearmyioforge|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+heimdall|c8bab4edf73f1265ab91dd384d8942562827f8ce2185fb65e398c8e923872e13|lscr.io/linuxserver/heimdall:latest|sha256:96a3814546b9465dbee1cce1c9547bed5b6f1a13ca751f239cf88502f396df67|running|no-healthcheck|2026-07-02T16:21:46.899952815Z|heimdall_s6_net|unless-stopped|s6vinet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+immich_machine_learning|2b6046557c314400dec23f1caae69eae07a8e07542db79957f7b7e86d41aaff6|ghcr.io/immich-app/immich-machine-learning:release|sha256:088b410d324842faeeeb69d0d5fef6b3eccee3f6fe3c68a2b1235649a86872c4|running|healthy|2026-07-02T16:22:16.356336193Z|backend_net|always|immich|healthcheck_sha256=06fc5259e91d939c46d4cf740394a5057ea58131e5df6789d7e4f5ebbb6d7a59
+immich_postgres|17889bb81cea5af9cf6ac6bafe6eba61aeb8d50cb2c0996c699560182796945e|docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:739cdd626151ff1f796dc95a6591b55a714f341c737e27f045019ceabf8e8c52|sha256:3062a7ddd658eee20fcc428853dd34c23c7ad95fb48e3181922ffef11217389a|running|healthy|2026-07-02T16:22:16.362765814Z|immich_s6_net|always|immich|healthcheck_sha256=3b85ca1ca42325d6e6d9501e2adcf04a7a80dcb42159b69d2527d6432473ff32
+immich_redis|a2d1a7bc973927e404a2576cb3de755a890f7ded3f3361a8a065eab88a0d481c|docker.io/redis:6.2-alpine@sha256:148bb5411c184abd288d9aaed139c98123eeb8824c5d3fce03cf721db58066d8|sha256:6dd588768b9ba229530de57c108536a8d6b98d53d83f217f59167981fda443ca|running|healthy|2026-07-02T16:22:16.364329237Z|immich_s6_net|always|immich|healthcheck_sha256=bd98ba333892e944c8245cd358b2946469adf44d3d8ec7cabb936197e4362807
+immich_server|2115244bab14fec49130c4a3949dfc2773871fc54928f88be963388e5e04d790|ghcr.io/immich-app/immich-server:release|sha256:de80bec4fc193605671b0f9600fe6b20f598fd2cb503ffe1a6e67f7cfd0e5233|running|healthy|2026-07-02T16:22:16.558556945Z|backend_net|always|immich|healthcheck_sha256=b7dce503cff869bbffb63034400837e1ad79981eed7722359480a50dbc96436f
+jellyfin|ba3ef59b346479f17f4c2b9fd33828db2638801e408fca115e5289b371f89eaf|jellyfin/jellyfin:latest|sha256:d57d4a0c18b3e51b913bd2f8f0f122eb7c7150ea37bb0e352df9cb329de11d24|running|healthy|2026-07-02T16:22:17.374948578Z|jellyfin_s6_net|unless-stopped|s6vinetwatch|healthcheck_sha256=a22856b3a5dfad87ecc898383d5b49daa6b4b98bca2797ea36cb422e824de47c
+jellyseerr|c00ff6cc7213669b85bc8e28a51ffc16779d2489c7378f3911735b8d983dcd05|fallenbagel/jellyseerr|sha256:2742757d9c41bcb4acb76c86c4ce23a8c54d5dbe93a698c815a9a34bed0b18d0|running|no-healthcheck|2026-07-02T16:22:04.637037538Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+kavita|578e4aa1ceeb4eb61ce094ecc862cdce7d68538a2c3e7b17cb29c3f4798597d4|jvmilazz0/kavita:latest|sha256:12ac333d6fde07c087a135dd23fa5b930a96e2a3fde9cfbb281214f040b4cbba|running|healthy|2026-07-02T16:22:04.630545121Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=256947cdccf855523b654955b26538932c2ee76e01f507ef885f1e885437ddb4
+lasereverything-manager-bus-core|791f2ef47fc1c798318b4136773672dc0f8ff08cd104f075f2f317ca0caf1817|ghcr.io/true-good-craft/tgc-bus-core:latest|sha256:e053cb452820daba308e86f456ba7d1e2b0306f058eae2c91ee7122a8634f4bb|running|healthy|2026-07-02T16:21:21.581810214Z|lasereverythingnetmanager_default|unless-stopped|lasereverythingnetmanager|healthcheck_sha256=5f70654d32c1e7e9060a6069ae4e3e8d1b94c196cd73a66ae40c93098344ec59
+lasereverythingnettv-radio-1|297e17de84c4d3c31f9cdeda9dcbefe185e6ec6c48c44c7fdae9f3e3f5ce982c|jrottenberg/ffmpeg:latest|sha256:1cf434af29091eba2d80108e28864540dc98bd3e4e5cda2b497e758d60bacba1|running|no-healthcheck|2026-06-30T17:48:55.163034213Z|lasereverythingnettv_default|unless-stopped|lasereverythingnettv|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+lasereverythingnettv-tv-1|776624328baf74b4196474c0962d2e01b1caa21e8bc3a2f6c77aece135faf30e|jrottenberg/ffmpeg:latest|sha256:1cf434af29091eba2d80108e28864540dc98bd3e4e5cda2b497e758d60bacba1|running|no-healthcheck|2026-06-30T17:48:55.161961872Z|lasereverythingnettv_default|unless-stopped|lasereverythingnettv|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+le-directus-source|6adbd503febfd8a6236fc7c941df7bfc748e76dcd510c11e69a3ff02776ff344|sha256:72311f2ba18f5530a667b9a806bb1720a8c9d95de6b20dd085a808901eb614b8|sha256:72311f2ba18f5530a667b9a806bb1720a8c9d95de6b20dd085a808901eb614b8|running|no-healthcheck|2026-07-10T23:15:59.628507071Z|bridge|unless-stopped||healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+le-payload-pg|2ee8f491397b5cbab595121f0e5e57fa5778329090d27a80b002bdd83a5ee8f2|sha256:639c86b6cacfdf788c075ffb5879286aa0e905965a4832ba6c76ccb0bca9417b|sha256:639c86b6cacfdf788c075ffb5879286aa0e905965a4832ba6c76ccb0bca9417b|running|no-healthcheck|2026-07-10T23:20:42.20954498Z|bridge|unless-stopped||healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+lemmy-pictrs|22597c5b8ac30d2d715bd538ee15e27e07d8677c9a191c2af741c57b1adbe08d|asonix/pictrs:0.5.17-pre.9|sha256:9a5411f20149156b2bbbcc69b63918e9259d8d4653244eae7482e71177e1b15a|running|no-healthcheck|2026-07-02T16:21:41.143484739Z|lemmy_net|unless-stopped|makearmyiolemmy|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+lemmy-proxy|f267f47868f6bd4c0f2b3594c1b23909862fbe853491cd514e9f8205be3499d2|nginx:1-alpine|sha256:ea51152ef8c480b999cee0271a288c698704b18483276119b1253e576ef3232f|running|no-healthcheck|2026-07-02T16:21:41.4297012Z|lemmy_net|unless-stopped|makearmyiolemmy|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+lemmy-ui|e53db215d6385a424365263fbce8edd9d08f1ea0927bc0aa136af4694ba22d89|dessalines/lemmy-ui:0.19.12|sha256:0a85b3192f29a5b14d41c265d9d5cab60bd281b4a5b5db8f3a85d5d9bf01aaaa|running|healthy|2026-07-02T16:21:41.334389805Z|lemmy_net|unless-stopped|makearmyiolemmy|healthcheck_sha256=fe44578c9a0ef5c3150b372caa763f18afad8938c28752af3570a87d8deb88e4
+lemmy|1f032d67308df68711b5d432398ff31094da65dbdddbb966e60d745390fd0a0d|dessalines/lemmy:0.19.12|sha256:68c00173ade225585ea7d54ed2688f8f23d7d2886ae3f5b4eefd70dbc05b044a|running|no-healthcheck|2026-07-02T16:21:41.230573992Z|backend_net|unless-stopped|makearmyiolemmy|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+mailu-admin|ed54ee705edfd3867b98548c7a5054ba8e58eb8fc3f7afbf3e0d5378fe508f4e|ghcr.io/mailu/admin:2024.06|sha256:e4319dc05cd8ee8204ebb0343685d52a9c645f192f92a9ba24e05a702a722894|running|healthy|2026-07-10T15:30:56.858313278Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=65c193d7ce37216310a9ad7324433501d4532a0e95241ba91a6643556dcb2b8d
+mailu-antispam|0f2bc2ca4ee1971e3dfdd9534ffa5ffa6bb5b1530f8c1e8c595a7c1303d70cba|ghcr.io/mailu/rspamd:2024.06|sha256:a8619d7f452f04d806b1f334e3e28e123c5f568080e168051fe98c7b3637925d|running|healthy|2026-07-10T15:30:57.245953555Z|arrmailnetmail_clamav|always|arrmailnetmail|healthcheck_sha256=7ffc0eff154ba7ec4712f405258f56347f428b7f2ec716554a9f6c1fed3b896d
+mailu-antivirus|22b05b37de3374f615e15e79cee3632e3f2398a2c50a5183a3baa94add519b62|clamav/clamav-debian:1.4|sha256:f8a1f4389e5cbfb43ffc839d751bf746c6c27f5de780ba1fcde15d596f94287b|running|healthy|2026-07-10T15:30:56.621336608Z|arrmailnetmail_clamav|always|arrmailnetmail|healthcheck_sha256=713e2ecbe297d1e71fa7f1819859d65ad738041705100f5c4ae73f4ae551fb60
+mailu-fetchmail|a47a586ae5cdb3d810932c4dfe06ec242ec02cc3999f7ecec2fac1779cf14ffc|ghcr.io/mailu/fetchmail:2024.06|sha256:eccbdf53fb66dc34a49bde349f53eb9d1bba60c98a1be5d9eabe68a726f13e6a|running|healthy|2026-07-10T15:30:57.460051545Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=001e1e50755b8a7ad162dfd92611a0d0944aa07d8ca6dc19ebffb0c60494878e
+mailu-front|a82753aefc6c8243c7c71caa0ef289a1a2e83c3fb1f9e93e779e56267353d11c|ghcr.io/mailu/nginx:2024.06|sha256:30a4f996f255fe498ed847b9a3759efd45fc5d8bd5c4dc121896e83615e60b0d|running|healthy|2026-07-10T15:30:56.726639815Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=c379c13a800f5417c0692896be411b09f7fe5a95d530f676abfd7d2dae1ea24c
+mailu-imap|549c48f83f429fd9b1e52f7752012b1250107dc511c1b7ee94ac2a49b521a726|ghcr.io/mailu/dovecot:2024.06|sha256:27aceac0272f97361a5a5b1d5abea7099e10f409e3d28a6096f9111fe90bf347|running|healthy|2026-07-10T15:30:57.247440245Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=9462f6ccccab8ea58f34afb7cfaae178b2d36f27a29e903b89ea4a7a1ed73cd6
+mailu-oletools|841c57f99cfeec974e757666484b8c1a37ca0f2696d719d49317294253edb33b|ghcr.io/mailu/oletools:2024.06|sha256:76fb07165f54411c1136a449ba2963fe11618f0cf4629fdc13eadd628d3528c9|running|healthy|2026-07-10T15:30:56.729115113Z|arrmailnetmail_oletools|always|arrmailnetmail|healthcheck_sha256=b1b33aade32e78a9484d43059f9f651eef8a2e8b8910893a4436f15a078abd08
+mailu-redis|4f1b06b40d4ebe43ee8391c91d0c02645a7f23dc91229123a0a25e9098eb567d|redis:alpine|sha256:55563f45704d59e891b6aa643014bb6b562abf21909a44b3b297502415b68e29|running|no-healthcheck|2026-07-10T15:30:56.720208042Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+mailu-resolver|96d3aaea44a0a8779c2a11fd7cb341bbc9aa23ad879381c5f7a247a0554cc444|ghcr.io/mailu/unbound:2024.06|sha256:d30593c8bf42bfd1c46bd1ac7ee90862b0cfa7e96fd10da1dacc2c69cafb443d|running|healthy|2026-07-10T15:30:56.617962677Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=5b9b365275d40b354506f2b02070d7785700a374ee09de8d7ee8527bbbf1b16f
+mailu-smtp|22e3c459d26b808ffca118df679aae2c9cc511de3fcaba4a9847770df6f24de5|ghcr.io/mailu/postfix:2024.06|sha256:0bed674f22e609e0b2f6780865097a41ed6ca5307db4bcc0794a35e2e7e976c9|running|healthy|2026-07-10T15:30:57.241512918Z|mailu_net|always|arrmailnetmail|healthcheck_sha256=9b234890e871375cec386d4edacf17bcbd8a5504fab8b1177d956c56622a08aa
+mailu-tika|60ba021f422056617055244f608c881f5ce282c2d1590e52d8d2719a44b1eb98|apache/tika:2.9.2.1-full|sha256:e646191162f8cb7aef0b512d54c028f62bd86e0e5f53b314ab82cfac7ef292d7|running|healthy|2026-07-10T15:30:56.723391978Z|arrmailnetmail_tika|always|arrmailnetmail|healthcheck_sha256=454cfb3387dd964dad59d868a522ba8ebbb1181df78bac6e750133eb5770f96d
+mailu-webdav|d5d73d88a2764eaded36de6cbc7fab3fd21956df393d4cf9fecc58217a80e3b6|ghcr.io/mailu/radicale:2024.06|sha256:890973bd7de583a7c8cb2c2bbc939249e007418066b69f59cd0c6903b7f35dfc|running|healthy|2026-07-10T15:30:56.620268969Z|arrmailnetmail_radicale|always|arrmailnetmail|healthcheck_sha256=0eaa30f40ef1bb32694b25d91598460713955379cbe30e51af90204e6c29aeff
+makearmy-app|3c10dda3815a2c0b0c494fb99a198a331b85c61f0b27ed1537bd2743355fd363|lasereverythingnetdb-makearmy-app|sha256:6c8190861686d9bec6f50d705c681d657fbc979c2a8743cf1614d01db0b5d1c6|running|no-healthcheck|2026-07-10T16:30:29.09880902Z|makearmy_net|unless-stopped|lasereverythingnetdb|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+makearmyiomeet-jibri-1|d9799783148b365cb04f3eeb4f52217cc32e377b47fb69919d6ff18f05430d1d|jitsi/jibri:stable|sha256:dfe4d14ee76e0b054c226b27976d43b0c4ed6fa9774b8acd06b0c4f391dbbb95|running|no-healthcheck|2026-07-02T16:21:43.11777777Z|meet_net|unless-stopped|makearmyiomeet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+makearmyiomeet-jicofo-1|9f10baac0b699ef704ffbceab5d182a769f45f964a08fff13984b67f421370ac|jitsi/jicofo:stable|sha256:80619f3a1c08c4bb6ccc44af0a0829a1bc817904a5819da2762bca0ea7d840fe|running|no-healthcheck|2026-07-02T16:21:42.695779854Z|meet_net|unless-stopped|makearmyiomeet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+makearmyiomeet-jvb-1|dcb946a8243ca5b8b3307c9e0e47474e24bd8a0b0f738e5558ef1e084cd0a26d|jitsi/jvb:stable|sha256:5a7999e458cc16a79a7b1082de760d5240d938ea2fd1c74dfc1cb7c32267a2d2|running|no-healthcheck|2026-07-02T16:21:42.696967273Z|meet_net|unless-stopped|makearmyiomeet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+makearmyiomeet-prosody-1|7e55738c8ef8fa72966f30ee08e08f78ef9d2ce0778f102810e7a1e9a65ee427|jitsi/prosody:stable|sha256:4ecc8a3ed20b56d628e0980e1bd279a5201a1d749a0d7529cc320a1e57dd13c0|running|no-healthcheck|2026-07-02T16:21:42.57107622Z|meet_net|unless-stopped|makearmyiomeet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+makearmyiomeet-web-1|9fcb631e7509b43c6cb8589ba5b9b86a33355fb21f6b0aded53fe249c317ac8a|jitsi/web:stable|sha256:dc69cbf912d43bbd2e6bff921c32f968d0fd20d299f4a6ace213411b3ace77d7|running|no-healthcheck|2026-07-07T23:05:03.005510996Z|meet_net|unless-stopped|makearmyiomeet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+mastodon-es|8173cfe45df20a1f250fdb1deeaf7b195f9b10048827c3c7f0f6bed3065d5a8c|docker.elastic.co/elasticsearch/elasticsearch:7.10.2|sha256:0b58e1cea50068776b05911440c0eb2865ef64f46704a74ebcf0f8f9d9edff08|running|healthy|2026-07-02T16:21:41.658284982Z|mastodon_net|always|makearmyiomastodon|healthcheck_sha256=43ed0ec1b037c1138b428561ed2f275ae40dbf871887fff30170841101c96871
+mastodon-redis|42a18b0302bab7268fb6e4b37fdb00e7e33e8ab873d29a51935960dfa4bd2c9e|redis:7-alpine|sha256:487efc0616382465781b8fdc3d6d1db449e6fd80ae23bf48432a2da6b6929908|running|healthy|2026-07-02T16:21:41.657158258Z|mastodon_net|always|makearmyiomastodon|healthcheck_sha256=6971523e64ad7ed1de29b647f359cf830fb227fe65b6e7d687b694e79b4cd00a
+mastodon-sidekiq|8f854b45b737bc4e36e74ef5f6698decbf36d3d77b837fa30b736d3ec22ede74|ghcr.io/mastodon/mastodon:v4.3.7|sha256:9f42cca562554c9a4b3c39fecf3590aaf48cd4f566054f94135bc7e417b9e609|running|healthy|2026-07-02T16:21:41.771788456Z|backend_net|always|makearmyiomastodon|healthcheck_sha256=63b22b698c07de250a134ce31a15f3b269ad63c4f8fa4896bb920941b5a20e56
+mastodon-streaming|58e667e71825fdf2674c125bf60ed8a1edf075b3dd01a9aeaa69e79c07edd1cf|ghcr.io/mastodon/mastodon-streaming:v4.3.7|sha256:ce444902e7c4152b82ad2526fbd32d0eaa47cc9d6b2a7e4198cd2395579e63cf|running|healthy|2026-07-02T16:21:41.770290748Z|backend_net|always|makearmyiomastodon|healthcheck_sha256=d5da8b454dac278280b9e3931e305a9094a1e446721f9e01e89f3de89772a681
+mastodon-web|355cfac0741d25cee7c18729d4ec0f74355a20edca54ca608102be82bfc90a05|ghcr.io/mastodon/mastodon:v4.3.7|sha256:9f42cca562554c9a4b3c39fecf3590aaf48cd4f566054f94135bc7e417b9e609|running|no-healthcheck|2026-07-02T16:21:41.790863717Z|backend_net|always|makearmyiomastodon|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+misskey-redis|ee4b788482e8fdaf635f5bb4e66ccf757f8b8e96d85175efc56e53f09d5550e3|redis:7-alpine|sha256:487efc0616382465781b8fdc3d6d1db449e6fd80ae23bf48432a2da6b6929908|running|healthy|2026-07-02T16:21:22.84032892Z|misskey_net|unless-stopped|makearmyiodeck|healthcheck_sha256=6a1d3a9edb36c3a4ce5fcbd09886f5e885dcfb752bcece4036250d3ded7a95b0
+misskey|fafd13e69d38892a3e1cdb33ebe709b2de1a13807a7db037035bad815d2c4e59|misskey/misskey:latest|sha256:368867af5f043346679e8721eb4560f2633cfe1a889fcf0422b6e845b7fae5b6|running|healthy|2026-07-02T16:21:28.456308969Z|backend_net|unless-stopped|makearmyiodeck|healthcheck_sha256=5ccbecc9fc9854d3822bad70f7615ca2b2189f2ae0376a276e1a1cd785d27328
+mysql_shared|37e9091b4f9db9c4434b664903283248fe9723a9717ba3a407141d625c6ab272|mariadb:10.11|sha256:72311f2ba18f5530a667b9a806bb1720a8c9d95de6b20dd085a808901eb614b8|running|no-healthcheck|2026-07-02T16:21:19.526467097Z|backend_net|unless-stopped|database|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+navidrome|0d66d26de7b4dc30c3f2629d8db37a68b45dec6b69805aac1d48682999dc8bd4|deluan/navidrome:latest|sha256:6567e3810d544da3bb067f50aba7b05b3b029acacd7b17654f2310eee21756c8|running|no-healthcheck|2026-07-02T16:22:15.324814438Z|backend_net|unless-stopped|s6vinetmusic|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+nextcloud-ma-app|da4c05c513a3fd41b3816f4e3b267489bc795e07af0411d69e54a8fd4c303341|nextcloud:fpm|sha256:192578f11d97117460f29c0c42e4e3676200f6e0da97f263f34d59dfbfd9b98b|running|no-healthcheck|2026-07-02T16:21:22.194816111Z|arrmail_backend|always|makearmyiocloud|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+nextcloud-ma-redis|8a22ef42d843c6af32706995bdac253c66b2dbdfc05ad63d154e4f6130149dc4|redis:alpine|sha256:55563f45704d59e891b6aa643014bb6b562abf21909a44b3b297502415b68e29|running|no-healthcheck|2026-07-02T16:21:22.079098096Z|nextcloud_ma_net|always|makearmyiocloud|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+nextcloud-ma-web|47788388748bf09d5a90f9e04078d1f5387a1e55e8dab562d1356568684851e6|nginx:alpine|sha256:ea51152ef8c480b999cee0271a288c698704b18483276119b1253e576ef3232f|running|no-healthcheck|2026-07-02T16:21:22.386376738Z|nextcloud_ma_net|always|makearmyiocloud|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+nzbhydra2|72577626a7b78f5e421a3aa2170ca0779d1ae32833b8ab06af5e15f6c21b54b7|lscr.io/linuxserver/nzbhydra2|sha256:de294ca9aa92795dca1f3e18c5bd1f23a6f88f580ed35537c91910e898d319b9|running|no-healthcheck|2026-07-02T16:22:04.638532863Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+owncast|f49b181fbd7098f6794f49dedb85d7f0f0b1b96302571d328d5c53c6c53477ca|owncast/owncast:latest|sha256:e6eabb9b993941043e9a6feb8f3d94d54854afc1d268310cfedc4a4a45f9b31b|running|no-healthcheck|2026-07-02T16:21:21.767199243Z|makearmyiocast_default|unless-stopped|makearmyiocast|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+peertube-redis|af5cd4f35df32636f42dbe64fb8d6f76ddfa4f0c0c805a33e8a5ab80b14de0f2|redis:7-alpine|sha256:487efc0616382465781b8fdc3d6d1db449e6fd80ae23bf48432a2da6b6929908|running|no-healthcheck|2026-07-02T16:21:45.580356479Z|makearmyiowatch_peertube_net|unless-stopped|makearmyiowatch|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+peertube|f1f9b4a119fe5b3b4595ae065743c22340bd49d506c8e1dec91396177d02edb4|chocobozzz/peertube:production-bookworm|sha256:95cafee12c7ba26c7427369020a5fe47f0ca4f2c0a9125038a678abda7a69c9b|running|no-healthcheck|2026-07-02T16:21:45.796042043Z|backend_net|unless-stopped|makearmyiowatch|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+picsur-redis|b209f19682835276e80e17d0ac3f1e036d6b1fda8756dcac68fc122d0c4fa3f8|redis:7-alpine|sha256:487efc0616382465781b8fdc3d6d1db449e6fd80ae23bf48432a2da6b6929908|running|healthy|2026-07-02T16:21:29.04863531Z|picsur_net|unless-stopped|makearmyioimages|healthcheck_sha256=147968879ed0db0afaec1547f804e197ae69ccc63932fd3abbe258ab467010d3
+picsur|64562af622743c5e95fed7cd0e400fcb754e67d524f3692308ae11420dc0e0e6|ghcr.io/caramelfur/picsur:latest|sha256:1807c0cf959b86dddbf3a92effb9d8cde12b3412c0a399bfd28720fdc37238c4|running|healthy|2026-07-02T16:21:39.647252782Z|backend_net|unless-stopped|makearmyioimages|healthcheck_sha256=ec000ecdddc3d5596f4bc9628961c417aa7b8c1a3b5d2df4c98640ad362f5dd5
+pinchflat|85fe3664962fcfa588aa37133ff74181f16806d98ed22b9a3d921d266698389c|keglin/pinchflat:latest|sha256:753a348c4189cab415077a0ba39e429f3a2d827ca9944482fba39e89d7670359|running|healthy|2026-07-02T16:22:17.898598212Z|s6vinetyt_default|unless-stopped|s6vinetyt|healthcheck_sha256=135a29148f28914de8f172b817ecb24ba481550c1b7266a8db237818fd6b8455
+pixelfed-ma-redis|2f5e7667382929d159967f793544f3d797d1bc081b00d8e2e8e569c12f34efc6|redis:6|sha256:2acfd509b0322ec1849e7e8cae7acfed5abfa449aef850d960669fb93e31a0da|running|no-healthcheck|2026-07-02T16:21:43.915226725Z|pixelfed_ma_net|unless-stopped|makearmyiopixels|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+pixelfed-ma-web|4bf3656aa29bb29bc731b8a31e22f0b3c7e26b04439d400b2f7b92a43d131c75|elestio/pixelfed:latest|sha256:96f2928fac9954a5926816c08b0828f0aac91101ed44f35e45870af0b07ca4b3|running|no-healthcheck|2026-07-02T16:21:44.127434453Z|backend_net|unless-stopped|makearmyiopixels|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+pixelfed-ma-worker|4533b9ed4e4d02ee916e99ef1d042fb11f6cb140168748fe15a61112a2f27794|elestio/pixelfed:latest|sha256:96f2928fac9954a5926816c08b0828f0aac91101ed44f35e45870af0b07ca4b3|running|no-healthcheck|2026-07-02T16:21:44.134015364Z|backend_net|unless-stopped|makearmyiopixels|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+postgres_shared|16a46598e773446ef94853d20ca2aa4f636599c4fabb5dc945038891e7327f75|tensorchord/pgvecto-rs:pg16-v0.3.0|sha256:edaefebbe512002c6bc57af37cfffb53d70ede0c4f213dd9344a0cd42276cee5|running|no-healthcheck|2026-07-02T16:21:19.527512266Z|backend_net|unless-stopped|database|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+privatebin|908728b26d94527c44fa334bd0e506b478d6ab143efa292ce7444ebc2d15e8c8|privatebin/nginx-fpm-alpine|sha256:1cd5a4d4a4d712cd3cc5b3997c47211279e2180a578ab2114285a5a8ad38117a|running|no-healthcheck|2026-07-02T16:21:43.509343441Z|privatebin_rw_net|unless-stopped|makearmyiopaste|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+prowlarr|89d2cb4ae3df4b62d58914957f583650d9b21f90830f120d09fc70c7e901c681|linuxserver/prowlarr|sha256:e21be23a845221afc1f4a650b864c294758cde345ba7c865f01e2686274dedb7|running|healthy|2026-07-02T16:22:04.640131595Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=13f99794bea67548cc642314145eec7125eb7f719dada9768aba07a1a476b795
+qbittorrent|af4d51e98c4a6293183474353c87e43e38c26e675fb74048ddc9f9064a62c0ae|lscr.io/linuxserver/qbittorrent:latest|sha256:a5d5cf51c98df7347d8e9ed7bf2c83c4b7f9f0e9a3981410e8499927541cb350|running|no-healthcheck|2026-07-02T16:22:04.635570271Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+radarr|161e0cab15f684eff7237b0237483cf2d25c628f55c9a78b07d917054ba0d4da|linuxserver/radarr|sha256:ecf70f15bca59f11387be96af3d2eea3a733d8f16946e763923185d4d297fa08|running|healthy|2026-07-02T16:22:04.631684293Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=f71b83e7755a8b028db89f814a6a838ce7119af31ce52ce7e8ba8976096250c1
+recyclarr|55cd226a6d1cc7b0375ab72aa7c23a17ed1ecbb1ff7e5790701589a777c6d0cd|ghcr.io/recyclarr/recyclarr|sha256:c57a7e2fe3090e3f43a0dd6686cde6c01db71c8d4a85fcb3b789d0ac473d874c|running|no-healthcheck|2026-07-02T16:22:05.297908155Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+romm-db|32e6a3a86bd8a241fba5a3ee4bd81f8e40d5d00988b6f7b4382d33af10a301fe|mariadb:latest|sha256:ca20b0713cc87f0e9a75d154f677e3f9469e1281f21dd68dc551bf3d93467e27|running|healthy|2026-07-02T16:21:47.839091367Z|s6vinetgames_default|unless-stopped|s6vinetgames|healthcheck_sha256=d5f5eabd7fcdf68fb96e631355d683a153faa27d31ac2c96ae5f4263929c436e
+romm|52eadbc4e6fedce3487bc0ccc9b5f1e0fe631349d3246ce95430dab75d10ae31|rommapp/romm:latest|sha256:0ec219d3cf24a9ee76f36c318ec03fca842d474b9ba47a6484e40b62b11983dc|running|no-healthcheck|2026-07-02T16:21:58.569925827Z|s6vinetgames_default|unless-stopped|s6vinetgames|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+sabnzbd|23e190c5e003059a5b331976ad6bc5773a7089c4c52b967933332d705e8be4cd|lscr.io/linuxserver/sabnzbd|sha256:8a22dade7777d4c9c29922881dd849ffe8059be3b7b2a97fc137a745057f9894|running|no-healthcheck|2026-07-02T16:22:04.634220659Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+slskd-portwatch|5be4dca461964ba4a401c0c49f69bf4147dfe72e3c318414a768e66684c49235|alpine:3.20|sha256:bf8527eb54c3680e728d5b4b383a8ba730d72dae7236fbc8dff97ed6b224a731|running|no-healthcheck|2026-07-02T16:22:14.634814016Z|s6vinetmedia_media_s6_net|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+slskd|50aebf40411108683ec8fbd2bb81f11a9275894da0bf3b80e32c492ef180c1ef|slskd/slskd:latest|sha256:4037f8009b7a98e3ef10b0b590717895c09779aeed060e093fc3ef2f8b027cf2|running|healthy|2026-07-08T12:00:29.038610186Z|container:f73ac36f101be4afadf1933ffa15f86bb05642d50b6c6859c904aa2a743a6c8b|unless-stopped|s6vinetmedia|healthcheck_sha256=2e42bc8cb3985bfbe1ec2460cd8d9a2fa7b2fd9ebc5e88bc824f8b95e39d6dca
+snappymail|79ea0d668d4289c270a148183c3c6465b9e70521953bcadef9de7cca49c20f6a|djmaze/snappymail:latest|sha256:741d1bdf62b2cd4f3ff8c1d58a86bec7ba1aa644fbce45ea275d6972f89ac2bf|running|no-healthcheck|2026-07-10T01:56:51.598114125Z|snappy_net|unless-stopped|arrmailnet|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+sonarr|fbd5ba72eaeccc4881818317d6fc81a285fa2a1161989675f53a666ce8c11002|linuxserver/sonarr|sha256:66f3b9a7c27e21a06e3c1a5f8f17b2b00e917291f0aaf07cece29f9fd9a26e4f|running|unhealthy|2026-07-02T16:22:04.632855946Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=3b816cea3c7006fde5b6197792c65249d978e96c07caf3cc61136b553107433e
+tdarr|ba0f5cf378fd25e9a6b95cd6b53ea377a4cb86288fe131d7379e5e7e7a24b8fb|ghcr.io/haveagitgat/tdarr:latest|sha256:6805431096bd3fa6e2aa1005dc1f3834545b48f6a03f09243a653e2005a3a808|running|no-healthcheck|2026-07-02T16:21:59.102117444Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+vaultwarden|6633442e948d174acda740c2a26ba13782f1ac57f24839e0ba51791d9fc3b51d|vaultwarden/server:latest|sha256:3e3ce0360c32d2dcc2bbe138f7716014dc3eee45f235e44603e4761e46601007|running|healthy|2026-07-02T16:21:21.085620901Z|vault_net|unless-stopped|arrmailnetpass|healthcheck_sha256=c0ba6b061e69edd02095fa8c73f0065e6df9440345b0b0f53d5dd24e341cc665
+vdo_wss|f40b63fbbd9d80f42dd8477226aa734c88db0009d04d493701f7507de00c2382|node:20-alpine|sha256:11cedc39e663e7c5d5cb9cc77a461a0d2adc25537b94e6831a6108f09cb2001b|running|no-healthcheck|2026-06-30T17:55:34.686303735Z|makearmyiovdo_default|unless-stopped|makearmyiovdo|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
+vpn-slskd|f73ac36f101be4afadf1933ffa15f86bb05642d50b6c6859c904aa2a743a6c8b|qmcgaw/gluetun|sha256:5694e33296a1d44a563e83e51113970b230acf2878004f01099ad4a4b83bc762|running|healthy|2026-07-02T16:21:58.912570969Z|s6vinetmedia_media_s6_net|unless-stopped|s6vinetmedia|healthcheck_sha256=8a73e8de0ca0b93f3e1b75f81d2ffe1c320f5ede18b34ec15db87f285f778104
+vpn|ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|qmcgaw/gluetun|sha256:5694e33296a1d44a563e83e51113970b230acf2878004f01099ad4a4b83bc762|running|healthy|2026-07-02T16:21:58.9115723Z|s6vinetmedia_media_s6_net|unless-stopped|s6vinetmedia|healthcheck_sha256=740a01b114720db4fbb6e078898c810bd1ff19f9227cc3a1bd01926f222aea8b
+yacht|d2a07818987aff223c090be88530007784385b3352e5f53aa10ec881a305464b|ghcr.io/selfhostedpro/yacht:latest|sha256:d79060100eb7707aae957b78a4406dfb5b0f83d83543f3e132d8bb24da8abc9c|running|no-healthcheck|2026-07-02T16:21:47.517372813Z|yacht_s6_net|unless-stopped|s6vinetdocker|healthcheck_sha256=74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

docs/le-app-database-migration/phase2a-host-maintenance/container-disposition/sonarr-unhealthy.allowlist.psv

@@ -0,0 +1 @@
+sonarr|fbd5ba72eaeccc4881818317d6fc81a285fa2a1161989675f53a666ce8c11002|linuxserver/sonarr|sha256:66f3b9a7c27e21a06e3c1a5f8f17b2b00e917291f0aaf07cece29f9fd9a26e4f|running|unhealthy|2026-07-02T16:22:04.632855946Z|container:ddb18d46aebae5ce7af0f805ab5222e0825a1a153c71fbed93b8c9a80fc80d89|unless-stopped|s6vinetmedia|healthcheck_sha256=3b816cea3c7006fde5b6197792c65249d978e96c07caf3cc61136b553107433e

docs/le-app-database-migration/phase2a-host-maintenance/execute-maintenance.sh

@@ -0,0 +1,471 @@
+#!/usr/bin/env bash
+# GENERATED FOR REVIEW. Run only as a separate process after explicit approval.
+# No shell-wide error options and no parent-shell termination commands.
+
+fail() {
+  printf 'HARD_STOP: %s\n' "$1" >&2
+  return "${2:-1}"
+}
+
+manifest_value() {
+  key=$1
+  file=$2
+  count=$(awk -F= -v k="$key" '$1==k {found++} END {print found+0}' "$file")
+  rc=$?
+  if [ "$rc" -ne 0 ] || [ "$count" != 1 ]; then return 1; fi
+  value=$(awk -F= -v k="$key" '$1==k {sub(/^[^=]*=/, ""); print}' "$file")
+  rc=$?
+  if [ "$rc" -ne 0 ]; then return "$rc"; fi
+  printf '%s\n' "$value"
+  return 0
+}
+
+validate_preflight() {
+  preflight=$1
+  if [ -z "$preflight" ] || [ ! -d "$preflight" ] || [ -L "$preflight" ]; then
+    fail 'preflight path is missing, not a directory, or a symlink' 30
+    return $?
+  fi
+  owner=$(stat -c %u "$preflight" 2>/dev/null)
+  mode=$(stat -c %a "$preflight" 2>/dev/null)
+  if [ "$owner" != 0 ] || [ "$mode" != 700 ]; then
+    fail 'preflight record must be root-owned mode 0700' 31
+    return $?
+  fi
+  manifest=$preflight/result.manifest
+  if [ ! -f "$manifest" ] || [ -L "$manifest" ] || [ ! -f "$preflight/result.manifest.sha256" ]; then
+    fail 'preflight result manifest is missing or a symlink' 32
+    return $?
+  fi
+  (cd "$preflight" && sha256sum -c result.manifest.sha256 > /dev/null 2>&1)
+  rc=$?
+  if [ "$rc" -ne 0 ]; then fail 'preflight result manifest checksum failed' 32; return $?; fi
+  format=$(manifest_value format "$manifest") || { fail 'malformed preflight format' 33; return $?; }
+  recorded_host=$(manifest_value hostname "$manifest") || { fail 'malformed preflight hostname' 33; return $?; }
+  recorded_boot=$(manifest_value boot_id "$manifest") || { fail 'malformed preflight boot ID' 33; return $?; }
+  recorded_kernel=$(manifest_value running_kernel "$manifest") || { fail 'malformed preflight kernel' 33; return $?; }
+  recorded_time=$(manifest_value timestamp_epoch "$manifest") || { fail 'malformed preflight timestamp' 33; return $?; }
+  recorded_overall=$(manifest_value overall "$manifest") || { fail 'malformed preflight result' 33; return $?; }
+  recorded_failure_count=$(manifest_value failure_count "$manifest") || { fail 'malformed preflight failure count' 33; return $?; }
+  recorded_failed_checks_hash=$(manifest_value failed_checks_sha256 "$manifest") || { fail 'malformed failed-check hash' 33; return $?; }
+  recorded_hash=$(manifest_value inventory_hashes_sha256 "$manifest") || { fail 'malformed inventory hash' 33; return $?; }
+  [ "$format" = le-phase2a-preflight-v1 ] || { fail 'unsupported preflight format' 34; return $?; }
+  [ "$recorded_overall" = PASS ] || { fail 'preflight result is not PASS' 35; return $?; }
+  [ "$recorded_failure_count" = 0 ] || { fail 'preflight records mandatory failures' 35; return $?; }
+  if [ ! -f "$preflight/failed-mandatory-checks.txt" ] || [ -L "$preflight/failed-mandatory-checks.txt" ]; then
+    fail 'failed-check list is missing or a symlink' 35
+    return $?
+  fi
+  actual_failed_checks_hash=$(sha256sum "$preflight/failed-mandatory-checks.txt" 2>/dev/null | awk '{print $1}')
+  [ "$actual_failed_checks_hash" = "$recorded_failed_checks_hash" ] || { fail 'failed-check list checksum mismatch' 35; return $?; }
+  [ "$recorded_host" = "$(hostname)" ] || { fail 'preflight belongs to another host' 36; return $?; }
+  [ "$recorded_boot" = "$(cat /proc/sys/kernel/random/boot_id)" ] || { fail 'preflight belongs to another boot' 37; return $?; }
+  [ "$recorded_kernel" = "$(uname -r)" ] || { fail 'running kernel changed since preflight' 37; return $?; }
+  case "$recorded_time" in *[!0-9]*|'') fail 'preflight timestamp is invalid' 38; return $? ;; esac
+  now=$(date +%s)
+  age=$((now - recorded_time))
+  if [ "$age" -lt 0 ] || [ "$age" -gt 1800 ]; then
+    fail "preflight is stale; age=${age}s limit=1800s" 39
+    return $?
+  fi
+  actual_hash=$(sha256sum "$preflight/inventory-hashes.sha256" 2>/dev/null | awk '{print $1}')
+  [ "$actual_hash" = "$recorded_hash" ] || { fail 'preflight inventory-hash manifest checksum mismatch' 40; return $?; }
+  (cd "$preflight" && sha256sum -c inventory-hashes.sha256 > /dev/null 2>&1)
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    fail 'one or more preflight inventory files failed checksum validation' 41
+    return $?
+  fi
+  validated_preflight=$preflight
+  return 0
+}
+
+validate_health_url_file() {
+  file=$1
+  [ -s "$file" ] || { fail 'validated preflight contains no health URLs' 42; return $?; }
+  while IFS= read -r url; do
+    case "$url" in https://*) ;; *) fail 'unsupported health URL scheme' 42; return $? ;; esac
+    authority=${url#https://}; authority=${authority%%/*}
+    case "$url" in *'?'*|*'#'*|*$'\n'*|*$'\r'*|*$'\t'*|*' '*) fail 'unsafe health URL content' 42; return $? ;; esac
+    case "$authority" in ''|*@*) fail 'health URL user-info or empty authority rejected' 42; return $? ;; esac
+  done < "$file"
+  return 0
+}
+
+capture_container_fingerprint() {
+  output=$1
+  : > "$output"
+  docker ps -aq | while IFS= read -r cid; do
+    [ -n "$cid" ] || continue
+    base=$(docker inspect --format \
+      '{{.Name}}|{{.Id}}|{{.Config.Image}}|{{.Image}}|{{.State.Status}}|{{if .State.Health}}{{.State.Health.Status}}{{else}}no-healthcheck{{end}}|{{.State.StartedAt}}|{{.HostConfig.NetworkMode}}|{{.HostConfig.RestartPolicy.Name}}|{{index .Config.Labels "com.docker.compose.project"}}' \
+      "$cid" 2>/dev/null)
+    inspect_rc=$?
+    health_hash=$(docker inspect --format '{{json .Config.Healthcheck}}' "$cid" 2>/dev/null | sha256sum | awk '{print $1}')
+    hash_rc=$?
+    if [ "$inspect_rc" -ne 0 ] || [ "$hash_rc" -ne 0 ] || [ -z "$base" ] || [ -z "$health_hash" ]; then return 1; fi
+    printf '%s|healthcheck_sha256=%s\n' "${base#/}" "$health_hash"
+  done | LC_ALL=C sort > "$output"
+  pipeline_status="${PIPESTATUS[*]}"
+  case "$pipeline_status" in '0 0 0') return 0 ;; *) return 1 ;; esac
+}
+
+verify_container_disposition() {
+  output=$1
+  (cd "$script_dir/container-disposition" && sha256sum -c SHA256SUMS) \
+    > "$record/container-disposition-checksum-latest.txt" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'container disposition checksum failed' 43; return $?; }
+  capture_container_fingerprint "$output"
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'cannot capture current container fingerprint' 43; return $?; }
+  diff -u "$validated_preflight/container-fingerprint.psv" "$output" \
+    > "$record/container-disposition-latest.diff" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'container identity, state, health, startup, network, restart policy, or health-check identity changed' 43; return $?; }
+  return 0
+}
+
+capture_failed_unit_fingerprint() {
+  output=$1
+  : > "$output"
+  systemctl --failed --no-legend --plain --no-pager | awk '{print $1}' | LC_ALL=C sort |
+    while IFS= read -r unit; do
+      [ -n "$unit" ] || continue
+      printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s\n' \
+        "$(systemctl show "$unit" -p Id --value --no-pager)" \
+        "$(systemctl show "$unit" -p Type --value --no-pager)" \
+        "$(systemctl show "$unit" -p LoadState --value --no-pager)" \
+        "$(systemctl show "$unit" -p ActiveState --value --no-pager)" \
+        "$(systemctl show "$unit" -p SubState --value --no-pager)" \
+        "$(systemctl show "$unit" -p Result --value --no-pager)" \
+        "$(systemctl show "$unit" -p InvocationID --value --no-pager)" \
+        "$(systemctl show "$unit" -p StateChangeTimestamp --value --no-pager)" \
+        "$(systemctl show "$unit" -p FragmentPath --value --no-pager)" \
+        "$(systemctl show "$unit" -p ExecMainCode --value --no-pager)" \
+        "$(systemctl show "$unit" -p ExecMainStatus --value --no-pager)"
+    done > "$output"
+  return ${PIPESTATUS[0]}
+}
+
+verify_failed_unit_disposition() {
+  output=$1
+  (cd "$script_dir/failed-unit-disposition" && sha256sum -c SHA256SUMS) \
+    > "$record/failed-unit-allowlist-checksum-latest.txt" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'failed-unit allowlist checksum failed' 45; return $?; }
+  capture_failed_unit_fingerprint "$output"
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'cannot fingerprint current failed units' "$rc"; return $?; }
+  diff -u "$script_dir/failed-unit-disposition/drkonqi-failed-units.allowlist.psv" "$output" \
+    > "$record/failed-unit-disposition-latest.diff" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'failed-unit set, state, invocation ID, or fingerprint changed' 45; return $?; }
+  count=$(wc -l < "$output")
+  [ "$count" = 234 ] || { fail "failed-unit count changed: expected=234 actual=$count" 45; return $?; }
+  return 0
+}
+
+verify_snapshot_subvolume() {
+  number=$1
+  description=$2
+  snapshot_dir=/.snapshots/$number
+  snapshot_subvolume=$snapshot_dir/snapshot
+  [ -d "$snapshot_dir" ] || { fail "Snapper numbered directory missing: $snapshot_dir" 50; return $?; }
+  btrfs subvolume show "$snapshot_subvolume" > "$record/pre-upgrade-snapshot-subvolume.txt" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail "Snapper snapshot is not a verified Btrfs subvolume: $snapshot_subvolume" 50; return $?; }
+  snapper list --columns number,type,pre-number,date,user,cleanup,description \
+    > "$record/snapper-snapshots-after-explicit-create.txt" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'cannot verify explicit snapshot through Snapper' "$rc"; return $?; }
+  awk -v number="$number" -v description="$description" \
+    '$1 == number && index($0, description) {print}' \
+    "$record/snapper-snapshots-after-explicit-create.txt" \
+    > "$record/pre-upgrade-snapshot-list-match.txt" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ] || [ ! -s "$record/pre-upgrade-snapshot-list-match.txt" ]; then
+    fail 'explicit snapshot number and description not found together in Snapper list' 50
+    return $?
+  fi
+  return 0
+}
+
+create_explicit_pre_upgrade_snapshot() {
+  btrfs subvolume show /.snapshots > "$record/snapshots-subvolume-before-create.txt" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail '/.snapshots is not a verified Btrfs subvolume' "$rc"; return $?; }
+  snapper list --columns number > "$record/snapper-numbers-before-explicit.txt" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'cannot capture Snapper number baseline' "$rc"; return $?; }
+  grep -E '^[[:space:]]*[0-9]+[[:space:]]*$' "$record/snapper-numbers-before-explicit.txt" | tr -d '[:space:]' | LC_ALL=C sort \
+    > "$record/snapper-numbers-before-explicit.normalized"
+  description="le-phase2a-pre-upgrade-$(date -u +%Y%m%dT%H%M%SZ)-$(basename "$record")"
+  snapshot_output=$(snapper create --type single --cleanup-algorithm number \
+    --description "$description" --print-number 2> "$record/pre-upgrade-snapshot-create.err")
+  rc=$?
+  printf '%s\n' "$snapshot_output" > "$record/pre-upgrade-snapshot-create.out"
+  [ "$rc" -eq 0 ] || { fail "explicit pre-upgrade Snapper snapshot failed rc=$rc" 50; return $?; }
+  snapshot_number=$(printf '%s' "$snapshot_output" | tr -d '[:space:]')
+  case "$snapshot_number" in ''|*[!0-9]*) fail 'Snapper returned an invalid snapshot number' 50; return $? ;; esac
+  [ "$snapshot_number" -gt 0 ] || { fail 'Snapper returned nonpositive snapshot number' 50; return $?; }
+  verify_snapshot_subvolume "$snapshot_number" "$description" || return $?
+  {
+    printf 'snapshot_number=%s\n' "$snapshot_number"
+    printf 'description=%s\n' "$description"
+    printf 'snapshot_directory=/.snapshots/%s\n' "$snapshot_number"
+    printf 'snapshot_subvolume=/.snapshots/%s/snapshot\n' "$snapshot_number"
+  } > "$record/pre-upgrade-snapshot.manifest"
+  btrfs qgroup show / > "$record/btrfs-quota-observation-before-upgrade.txt" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    printf 'btrfs-quota-accounting|unavailable-or-disabled|rc=%s|explicit-snapshot-still-verified\n' "$rc" \
+      >> "$record/warnings-before-upgrade.txt"
+  fi
+  return 0
+}
+
+verify_snap_pac_snapshots() {
+  snapper list --columns number > "$record/snapper-numbers-after-transaction.txt" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'cannot capture post-transaction Snapper numbers' "$rc"; return $?; }
+  grep -E '^[[:space:]]*[0-9]+[[:space:]]*$' "$record/snapper-numbers-after-transaction.txt" | tr -d '[:space:]' | LC_ALL=C sort \
+    > "$record/snapper-numbers-after-transaction.normalized"
+  comm -13 "$record/snapper-numbers-before-explicit.normalized" "$record/snapper-numbers-after-transaction.normalized" \
+    > "$record/snapper-new-numbers.txt"
+  new_count=$(wc -l < "$record/snapper-new-numbers.txt")
+  if [ "$new_count" -lt 3 ]; then
+    fail "expected explicit plus snap-pac pre/post snapshots; observed new snapshot count=$new_count" 51
+    return $?
+  fi
+  while IFS= read -r number; do
+    case "$number" in ''|*[!0-9]*) fail 'invalid new Snapper snapshot number' 51; return $? ;; esac
+    btrfs subvolume show "/.snapshots/$number/snapshot" \
+      > "$record/snapper-new-subvolume-$number.txt" 2>&1
+    rc=$?
+    [ "$rc" -eq 0 ] || { fail "new Snapper snapshot $number is not a Btrfs subvolume" 51; return $?; }
+  done < "$record/snapper-new-numbers.txt"
+  return 0
+}
+
+rerun_volatile_checks() {
+  verify_failed_unit_disposition "$record/volatile-failed-units-fingerprint.psv" || return $?
+  pacman -Dk > "$record/volatile-pacman-Dk.txt" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'package database consistency failed immediately before execution' "$rc"; return $?; }
+  df -hT / /boot /var/cache/pacman/pkg /tmp > "$record/volatile-disk-space.txt" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'cannot verify current disk space' "$rc"; return $?; }
+  verify_container_disposition "$record/volatile-container-fingerprint.psv" || return $?
+  : > "$record/volatile-public-health.txt"
+  while IFS= read -r url; do
+    metrics=$(curl --fail --silent --show-error --max-redirs 0 \
+      --connect-timeout 10 --max-time 30 --output /dev/null \
+      --write-out 'http=%{http_code}|remote=%{remote_ip}|time=%{time_total}' \
+      "$url" 2>> "$record/volatile-public-health-errors.txt")
+    rc=$?
+    printf '%s|%s\n' "$url" "$metrics" >> "$record/volatile-public-health.txt"
+    if [ "$rc" -ne 0 ]; then fail "public health failed immediately before execution: $url" 44; return $?; fi
+  done < "$validated_preflight/health-urls.sanitized"
+  return 0
+}
+
+normalize_transaction() {
+  source_file=$1
+  output_file=$2
+  downgrade_file=$3
+  : > "$output_file"
+  : > "$downgrade_file"
+  while IFS='|' read -r name new_version repository location download_bytes; do
+    [ -n "$name" ] || continue
+    old_line=$(pacman -Q "$name" 2>/dev/null)
+    if [ -n "$old_line" ]; then
+      old_version=${old_line#* }
+      comparison=$(vercmp "$new_version" "$old_version")
+      if [ "$comparison" -lt 0 ]; then action=downgrade
+      elif [ "$comparison" -eq 0 ]; then action=same
+      else action=upgrade
+      fi
+    else
+      old_version=-
+      action=new
+    fi
+    printf '%s|%s|%s|%s\n' "$name" "$old_version" "$new_version" "$action" >> "$output_file"
+    if [ "$action" = downgrade ]; then
+      printf '%s|%s|%s|%s\n' "$name" "$old_version" "$new_version" "$action" >> "$downgrade_file"
+    fi
+  done < "$source_file"
+  sort -o "$output_file" "$output_file"
+  return 0
+}
+
+main() {
+  if [ "$(id -u)" -ne 0 ]; then fail 'run as a separate root process' 10; return $?; fi
+  if [ "$1" != --preflight ] || [ -z "${2:-}" ] || [ -n "${3:-}" ]; then
+    fail 'usage: execute-maintenance.sh --preflight /var/log/le-phase2a-preflight/preflight.XXXXXXXX' 11
+    return $?
+  fi
+  validate_preflight "$2" || return $?
+  validate_health_url_file "$validated_preflight/health-urls.sanitized" || return $?
+  script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
+
+  umask 077
+  install -d -o root -g root -m 0700 /var/log/le-phase2a-maintenance
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'cannot create root-only maintenance record parent' "$rc"; return $?; }
+  record=$(mktemp -d "/var/log/le-phase2a-maintenance/maintenance.$(date -u +%Y%m%dT%H%M%SZ).XXXXXXXX")
+  rc=$?
+  if [ "$rc" -ne 0 ] || [ -z "$record" ] || [ ! -d "$record" ]; then
+    fail 'cannot atomically create unique maintenance record' 12
+    return $?
+  fi
+  chown root:root "$record"; chmod 0700 "$record"
+  maintenance_start=$(date -u +%FT%TZ)
+  printf '%s\n' "$record" > "$record/RECORD_PATH.txt"
+  cp -a "$validated_preflight" "$record/preflight-record"
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'cannot copy validated preflight record' "$rc"; return $?; }
+
+  approved_transaction=$script_dir/approved-transaction
+  (cd "$approved_transaction" && sha256sum -c SHA256SUMS) \
+    > "$record/approved-report-checksum.txt" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'approved transaction checksum failed' "$rc"; return $?; }
+  cp -a "$approved_transaction" "$record/approved-transaction"
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'cannot copy approved transaction evidence' "$rc"; return $?; }
+
+  uname -a > "$record/running-kernel-before.txt" 2>&1
+  rc=$?; [ "$rc" -eq 0 ] || { fail 'cannot capture running kernel' "$rc"; return $?; }
+  cat /proc/sys/kernel/random/boot_id > "$record/boot-id-before.txt" 2>&1
+  rc=$?; [ "$rc" -eq 0 ] || { fail 'cannot capture boot ID' "$rc"; return $?; }
+  pacman -Q > "$record/packages-before.txt" 2>&1
+  rc=$?; [ "$rc" -eq 0 ] || { fail 'cannot capture installed package inventory' "$rc"; return $?; }
+  cp "$validated_preflight/bootloader-inventory.txt" "$validated_preflight/kernel-initramfs-before.txt" \
+    "$validated_preflight/running-containers-before.txt" "$validated_preflight/containers-all.psv" \
+    "$validated_preflight/container-fingerprint.psv" "$validated_preflight/sonarr-unhealthy.allowlist.psv" \
+    "$validated_preflight/directus-stopped.allowlist.psv" "$validated_preflight/restart-policy-no.psv" \
+    "$validated_preflight/critical-units-baseline.psv" "$validated_preflight/database-baseline.psv" "$record/"
+  rc=$?; [ "$rc" -eq 0 ] || { fail 'cannot copy essential rollback baseline evidence' "$rc"; return $?; }
+  verify_failed_unit_disposition "$record/failed-units-before-fingerprint.psv" || return $?
+  btrfs subvolume show /.snapshots > "$record/snapshots-subvolume-before-preview.txt" 2>&1
+  rc=$?; [ "$rc" -eq 0 ] || { fail '/.snapshots is not a Btrfs subvolume' "$rc"; return $?; }
+
+  rerun_volatile_checks || return $?
+
+  preview_root=$(mktemp -d /tmp/le-phase2a-execution-preview.XXXXXXXX)
+  rc=$?
+  if [ "$rc" -ne 0 ] || [ -z "$preview_root" ] || [ ! -d "$preview_root" ]; then
+    fail 'cannot create isolated transaction preview directory' 13
+    return $?
+  fi
+  chmod 0700 "$preview_root"; mkdir -m 0700 "$preview_root/db" "$preview_root/cache"
+  ln -s /var/lib/pacman/local "$preview_root/db/local"
+
+  fakeroot -- pacman --config /etc/pacman.conf --dbpath "$preview_root/db" \
+    --cachedir "$preview_root/cache" --logfile "$preview_root/pacman-preview.log" -Sy \
+    > "$record/isolated-sync-refresh.log" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'isolated repository refresh failed; live databases untouched' "$rc"; return $?; }
+  fakeroot -- pacman --config /etc/pacman.conf --dbpath "$preview_root/db" \
+    --cachedir "$preview_root/cache" --logfile "$preview_root/pacman-preview.log" \
+    -Su --needed --print-format '%n|%v|%r|%l|%s' rootlesskit slirp4netns openai-codex \
+    > "$record/latest-transaction.psv" 2> "$record/latest-transaction.err"
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'latest complete transaction resolution failed' "$rc"; return $?; }
+  normalize_transaction "$record/latest-transaction.psv" "$record/latest-normalized-actions.psv" "$record/latest-downgrades.psv"
+  [ ! -s "$record/latest-downgrades.psv" ] || { fail 'latest transaction contains a downgrade' 14; return $?; }
+
+  cp "$approved_transaction/normalized-actions.psv" "$record/approved-normalized-actions.psv"
+  rc=$?
+  [ "$rc" -eq 0 ] || { fail 'cannot normalize approved preview' "$rc"; return $?; }
+  diff -u "$record/approved-normalized-actions.psv" "$record/latest-normalized-actions.psv" \
+    > "$record/approved-vs-latest.diff" 2>&1
+  diff_rc=$?
+  if [ "$diff_rc" -ne 0 ]; then
+    fail 'latest package names, versions, or actions differ from the approved preview' 15
+    return $?
+  fi
+  latest_count=$(wc -l < "$record/latest-normalized-actions.psv")
+  approved_count=$(wc -l < "$record/approved-normalized-actions.psv")
+  [ "$latest_count" = "$approved_count" ] || { fail 'transaction package counts differ' 15; return $?; }
+  for required in rootlesskit slirp4netns openai-codex; do
+    grep -q "^${required}|" "$record/latest-normalized-actions.psv"
+    rc=$?; [ "$rc" -eq 0 ] || { fail "latest transaction omits $required" 16; return $?; }
+  done
+
+  cp "$record/latest-transaction.psv" "$record/latest-normalized-actions.psv" \
+    "$record/approved-normalized-actions.psv" "$record/approved-vs-latest.diff" "$record/transaction-for-approval.psv"
+  rc=$?; [ "$rc" -eq 0 ] || { fail 'cannot preserve transaction preview evidence' "$rc"; return $?; }
+  sha256sum "$record/latest-transaction.psv" "$record/latest-normalized-actions.psv" \
+    "$record/approved-normalized-actions.psv" > "$record/transaction-preview-hashes.sha256"
+
+  printf '\nMachine comparison passed: packages=%s, no downgrades, exact match to approved preview.\n' "$latest_count"
+  cat "$record/latest-normalized-actions.psv"
+  printf '\nType exactly: APPROVE MATCHED COMPLETE HOST UPGRADE\n> '
+  IFS= read -r approval_one
+  if [ "$approval_one" != 'APPROVE MATCHED COMPLETE HOST UPGRADE' ]; then
+    fail 'first exact operator approval not granted' 20
+    return $?
+  fi
+
+  rerun_volatile_checks || return $?
+  printf '\nLIMITATION: the final live -Syu refresh may change after this isolated comparison.\n'
+  printf 'Pacman will display its final interactive transaction and ask Y/n. The wrapper cannot machine-compare that post-refresh transaction without an unsafe live -Sy-only staging step.\n'
+  printf 'Type exactly: ACKNOWLEDGE FINAL PACMAN TRANSACTION REQUIRES MANUAL REVIEW\n> '
+  IFS= read -r approval_two
+  if [ "$approval_two" != 'ACKNOWLEDGE FINAL PACMAN TRANSACTION REQUIRES MANUAL REVIEW' ]; then
+    fail 'second exact operator acknowledgement not granted' 21
+    return $?
+  fi
+
+  create_explicit_pre_upgrade_snapshot || return $?
+
+  printf 'At Pacman Y/n, answer no if any package, version, action, count, downgrade status, signature, or repository differs.\n'
+  script -q -e -f -c 'pacman -Syu --needed rootlesskit slirp4netns openai-codex' "$record/pacman-complete.log"
+  rc=$?
+  if [ "$rc" -ne 0 ]; then fail "Pacman returned $rc; stop without ad hoc repair" "$rc"; return $?; fi
+
+  verify_snapshot_subvolume "$snapshot_number" "$description" || return $?
+  snapper list --columns number,type,pre-number,date,user,cleanup,description \
+    > "$record/snapper-snapshots-after-transaction.txt" 2>&1
+  rc=$?; [ "$rc" -eq 0 ] || { fail 'cannot inventory Snapper snapshots after transaction' "$rc"; return $?; }
+  verify_snap_pac_snapshots || return $?
+
+  pacman -Q > "$record/packages-after.txt" 2>&1
+  rc=$?; [ "$rc" -eq 0 ] || { fail 'cannot capture post-transaction package inventory' "$rc"; return $?; }
+  diff -u "$record/packages-before.txt" "$record/packages-after.txt" > "$record/package-inventory.diff" 2>&1
+  diff_rc=$?; [ "$diff_rc" -le 1 ] || { fail 'package inventory comparison failed' "$diff_rc"; return $?; }
+  find /etc -xdev -type f \( -name '*.pacnew' -o -name '*.pacsave' \) -printf '%p\n' | sort \
+    > "$record/pacnew-pacsave-after.txt" 2>&1
+  rc=$?; [ "$rc" -eq 0 ] || { fail 'cannot inventory pacnew/pacsave files' "$rc"; return $?; }
+  pacdiff -o > "$record/pacdiff-outstanding.txt" 2>&1
+  pacdiff_rc=$?
+  if [ "$pacdiff_rc" -ne 0 ] && [ "$pacdiff_rc" -ne 1 ]; then
+    printf 'pacdiff-observation|rc=%s\n' "$pacdiff_rc" > "$record/warnings-after.txt"
+  fi
+  grep -E -i 'hook|restart|reload|dkms|dracut|initramfs|mkinitcpio|grub|pacnew|pacsave|warning|error|failed' \
+    "$record/pacman-complete.log" > "$record/hook-restart-summary.txt" 2>&1
+  systemctl --failed --no-legend --plain --no-pager > "$record/failed-units-after.txt" 2>&1
+  journal_units='sshd.service accounts-daemon.service docker.service'
+  while IFS='|' read -r unit _; do journal_units="$journal_units $unit"; done < "$record/critical-units-baseline.psv"
+  journalctl --since "$maintenance_start" --no-pager $(for unit in $journal_units; do printf -- '-u %q ' "$unit"; done) \
+    > "$record/relevant-service-journal.txt" 2>&1
+  dkms status > "$record/dkms-after.txt" 2>&1
+  find /boot /usr/lib/modules -maxdepth 2 -type f \
+    \( -name 'vmlinuz*' -o -name 'initramfs*' -o -name 'initrd*' -o -name pkgbase \) \
+    -printf '%p size=%s mtime=%TY-%Tm-%TdT%TH:%TM:%TS\n' | sort > "$record/kernel-boot-artifacts-after.txt" 2>&1
+  docker ps -a --format '{{.Names}}|{{.Image}}|{{.Status}}|{{.Ports}}' | sort > "$record/containers-after.txt" 2>&1
+  find "$record" -maxdepth 1 -type f ! -name SHA256SUMS -print0 | sort -z | xargs -0 sha256sum \
+    > "$record/SHA256SUMS" 2>&1
+  chmod -R go-rwx "$record"
+
+  printf 'PACKAGE TRANSACTION COMPLETED; REBOOT NOT PERFORMED.\n'
+  printf 'MAINTENANCE_RECORD=%s\n' "$record"
+  printf 'PRE_UPGRADE_SNAPPER_SNAPSHOT=%s\n' "$snapshot_number"
+  printf 'Review all warnings, hooks, services, kernel artifacts, and pacnew/pacsave files.\n'
+  printf 'Reboot and rootless-Docker provisioning remain separate approval gates.\n'
+  return 0
+}
+
+main "$@"

docs/le-app-database-migration/phase2a-host-maintenance/failed-unit-disposition/README.md

@@ -0,0 +1,15 @@
+# Reviewed failed-unit disposition
+
+The 234 entries in `drkonqi-failed-units.allowlist.psv` are transient
+`drkonqi-coredump-processor@…` system services associated with desktop crash
+processing. They are classified as nonproduction desktop crash-processing
+failures, not production-critical or recovery-critical services.
+
+This is a fingerprinted maintenance-ticket exception, not a reset or repair.
+Each row records unit identity, type, states, result, invocation ID, state-change
+timestamp, fragment path, and main-process result. Preflight and immediate
+pre-execution checks require exact byte equality. Any addition, removal, changed
+invocation ID, state change, or checksum failure is a hard stop. No critical,
+new, or otherwise undispositioned failed unit is admitted.
+
+Do not clear or reset these units merely to satisfy the maintenance gate.

docs/le-app-database-migration/phase2a-host-maintenance/failed-unit-disposition/SHA256SUMS

@@ -0,0 +1,2 @@
+e4667c83bd4e9e7de413e48cd16cc2d4b041cb09fbadace5e9f8d74a73a5a2a1  README.md
+217a0fe59a3bff6c6621bcaac59dcad1c74154486cd7e75e3bba83b6909c29c4  drkonqi-failed-units.allowlist.psv

docs/le-app-database-migration/phase2a-host-maintenance/failed-unit-disposition/drkonqi-failed-units.allowlist.psv

@@ -0,0 +1,234 @@
+drkonqi-coredump-processor@10943-42308-3031822_15595814-0.service|simple|loaded|failed|failed|timeout|8cad20db05aa4d489df8547cfb87eec8|Wed 2026-07-01 09:03:52 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@10948-30305-3032369_15595852-0.service|simple|loaded|failed|failed|timeout|6938a8ce71d24b9bbdc2b485235d5793|Wed 2026-07-01 09:03:55 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11360-1791-3102688_15629689-0.service|simple|loaded|failed|failed|timeout|f7b503d46373411d9d635dc9881f58a3|Wed 2026-07-01 09:09:04 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11361-9304-3102804_15641584-0.service|simple|loaded|failed|failed|timeout|e4d5a6df99c844c391c9851931552e74|Wed 2026-07-01 09:09:04 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11362-9305-3102803_15641583-0.service|simple|loaded|failed|failed|timeout|8d1c1281a49d487fbc99ac6f5a3ee468|Wed 2026-07-01 09:09:04 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11363-62442-3102805_15684272-0.service|simple|loaded|failed|failed|timeout|e922c447b8004bf58b16142fd40b751c|Wed 2026-07-01 09:09:04 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11364-47198-3102920_15641592-0.service|simple|loaded|failed|failed|timeout|59c5c21b78c14f19ab4f341f9986a16c|Wed 2026-07-01 09:09:04 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11367-59039-3104016_15688601-0.service|simple|loaded|failed|failed|timeout|671cedf59dab43f9be0dfe4790a23b36|Wed 2026-07-01 09:09:06 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11368-17567-3104018_15692076-0.service|simple|loaded|failed|failed|timeout|49eabc179bf04bffb0b30501a1c542e3|Wed 2026-07-01 09:09:06 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11369-17568-3104035_15692077-0.service|simple|loaded|failed|failed|timeout|e439e9bbc9fb47d5a1972b4442d7f320|Wed 2026-07-01 09:09:06 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11375-30355-3108455_15696030-0.service|simple|loaded|failed|failed|timeout|c80e355655ec4f95a12d93f75eaa5aab|Wed 2026-07-01 09:09:22 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11376-47200-3108748_15696071-0.service|simple|loaded|failed|failed|timeout|f30c6ea0bf0342e2bbc6c3639abb22eb|Wed 2026-07-01 09:09:22 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11378-17569-3108872_15681900-0.service|simple|loaded|failed|failed|timeout|6a83cad8025a4b1c988590d7f8cbd8af|Wed 2026-07-01 09:09:23 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11379-38193-3109212_15637535-0.service|simple|loaded|failed|failed|timeout|2bff76f468d443a2a7f69aa9a877c7fa|Wed 2026-07-01 09:09:23 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11381-47201-3109351_15684582-0.service|simple|loaded|failed|failed|timeout|e27e55525a534446a839ecb44e55da6e|Wed 2026-07-01 09:09:24 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11382-5350-3109701_15688962-0.service|simple|loaded|failed|failed|timeout|66a00d4bde5e4718b776143535157cf0|Wed 2026-07-01 09:09:25 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11384-26082-3109872_15666580-0.service|simple|loaded|failed|failed|timeout|0277d0913f7943a4bb7b9e21cf51dd6d|Wed 2026-07-01 09:09:25 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11385-26083-3110208_15689031-0.service|simple|loaded|failed|failed|timeout|91175e24e9f44a169dcb4d2530eaf1f2|Wed 2026-07-01 09:09:26 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11387-5351-3110405_15666592-0.service|simple|loaded|failed|failed|timeout|599d5562b18e4336946af4691f12ff0f|Wed 2026-07-01 09:09:27 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11389-13878-3110752_15666635-0.service|simple|loaded|failed|failed|timeout|7b24c609917a471a97da197935dc1810|Wed 2026-07-01 09:09:27 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11390-9306-3110908_15673649-0.service|simple|loaded|failed|failed|timeout|48d755ab407347878d4fee659353d215|Wed 2026-07-01 09:09:28 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11392-34352-3111207_15689092-0.service|simple|loaded|failed|failed|timeout|d766b1be42ba44b790b5916904921c65|Wed 2026-07-01 09:09:28 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11393-47204-3111339_15666702-0.service|simple|loaded|failed|failed|timeout|202ce0f14a2640a39b49ed2691bc05f3|Wed 2026-07-01 09:09:29 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11395-50509-3111709_15692622-0.service|simple|loaded|failed|failed|timeout|83b93fcce818403a9a903a841eb2f2c2|Wed 2026-07-01 09:09:30 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11396-54216-3111859_15666742-0.service|simple|loaded|failed|failed|timeout|64e7c13520b540198a22db2b947a71cc|Wed 2026-07-01 09:09:30 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11398-5354-3112183_15624237-0.service|simple|loaded|failed|failed|timeout|fbae4a151275441ca6f80e69eac3e53f|Wed 2026-07-01 09:09:31 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11399-9307-3112343_15666807-0.service|simple|loaded|failed|failed|timeout|dad67de8fe454533bb8756db6f01a905|Wed 2026-07-01 09:09:32 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11400-34353-3112631_15673794-0.service|simple|loaded|failed|failed|timeout|7d5189e667d842ecad29447874f43d13|Wed 2026-07-01 09:09:32 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11401-50510-3112655_15670319-0.service|simple|loaded|failed|failed|timeout|6eae425e9ebb48cea55f058f3cefd1bd|Wed 2026-07-01 09:09:32 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11403-21557-3113110_15642065-0.service|simple|loaded|failed|failed|timeout|93d0eea3e69e42d68d9f0b9b8a2f25d2|Wed 2026-07-01 09:09:33 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11404-38194-3113120_15642070-0.service|simple|loaded|failed|failed|timeout|2454f0f4a6e64cd9b76d65dffe0b2df3|Wed 2026-07-01 09:09:33 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11405-59040-3113299_15682325-0.service|simple|loaded|failed|failed|timeout|d2cfdbae0a23498b8b923132f9583192|Wed 2026-07-01 09:09:34 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11406-30358-3113602_15682350-0.service|simple|loaded|failed|failed|timeout|544bdb4583d94a64a2201f0d42f6dac3|Wed 2026-07-01 09:09:35 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11407-50511-3113620_15684848-0.service|simple|loaded|failed|failed|timeout|c51fe9e517114151b49ae3d6adef2637|Wed 2026-07-01 09:09:35 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11408-34354-3113830_15666922-0.service|simple|loaded|failed|failed|timeout|57407a552e6f45d5b715f1a832bb19dd|Wed 2026-07-01 09:09:35 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11409-17570-3114129_15704112-0.service|simple|loaded|failed|failed|timeout|950ffe0370434e46996e2a282e69529c|Wed 2026-07-01 09:09:36 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11411-50512-3114195_15696352-0.service|simple|loaded|failed|failed|timeout|39689d155efe4a78b06e8aac0deb10db|Wed 2026-07-01 09:09:36 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11412-47205-3115453_15637889-0.service|simple|loaded|failed|failed|timeout|31bcf4a6b4e545829047e365eae014bf|Wed 2026-07-01 09:09:37 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11413-13879-3115596_15630186-0.service|simple|loaded|failed|failed|timeout|3ecdd88c9a8b4f0282657cf3b2f38fcb|Wed 2026-07-01 09:09:37 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11416-59042-3116108_15673992-0.service|simple|loaded|failed|failed|timeout|184d1f726a6346e1b008412558e06009|Wed 2026-07-01 09:09:38 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11417-1793-3116115_15637922-0.service|simple|loaded|failed|failed|timeout|de58c21c9e7a496193441e2d3acc637c|Wed 2026-07-01 09:09:38 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11418-50513-3116306_15685236-0.service|simple|loaded|failed|failed|timeout|a19ecf6379774f49a46780f7f943ac78|Wed 2026-07-01 09:09:39 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11419-34356-3116618_15689417-0.service|simple|loaded|failed|failed|timeout|dfba10ad3c564337b5bdafeb0d956cf5|Wed 2026-07-01 09:09:39 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11420-26085-3116643_15637963-0.service|simple|loaded|failed|failed|timeout|d3fcd22ffffd44b69d20c0a95c4f1135|Wed 2026-07-01 09:09:39 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11421-47206-3116759_15674033-0.service|simple|loaded|failed|failed|timeout|fb0fb34d9d2141c8856cb7908a522744|Wed 2026-07-01 09:09:40 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11423-34358-3117082_15682548-0.service|simple|loaded|failed|failed|timeout|a6f489aca6da44828c8d14b717e1ed89|Wed 2026-07-01 09:09:40 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11424-59043-3117226_15685287-0.service|simple|loaded|failed|failed|timeout|7da9e691ba7a46dd9e94500a922a5c32|Wed 2026-07-01 09:09:41 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11427-42374-3117621_15682609-0.service|simple|loaded|failed|failed|timeout|4b599161467f488da6ede44e72b97293|Wed 2026-07-01 09:09:42 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11429-38195-3117971_15649979-0.service|simple|loaded|failed|failed|timeout|db5f3317cb8e47cfaf1b95231d207838|Wed 2026-07-01 09:09:43 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11430-21558-3118094_15649988-0.service|simple|loaded|failed|failed|timeout|c9a3820da60a4ad6bb71a50fc10b46d6|Wed 2026-07-01 09:09:43 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11431-47207-3118428_15638032-0.service|simple|loaded|failed|failed|timeout|bfc74754fc054c6ab713eb3c499209a0|Wed 2026-07-01 09:09:44 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11433-9308-3118549_15685370-0.service|simple|loaded|failed|failed|timeout|78af9bd4a5054cf8a4a0ceca5037d657|Wed 2026-07-01 09:09:44 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11434-1795-3118841_15650022-0.service|simple|loaded|failed|failed|timeout|a458790b575f456480d87bd2abfbcace|Wed 2026-07-01 09:09:45 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11435-5355-3118862_15650025-0.service|simple|loaded|failed|failed|timeout|c507968071ec4ee5b1067a8dab72fea1|Wed 2026-07-01 09:09:45 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11436-30359-3118990_15685387-0.service|simple|loaded|failed|failed|timeout|016f5d439fca4f099cd43ca2c4259838|Wed 2026-07-01 09:09:45 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11438-17572-3119336_15700642-0.service|simple|loaded|failed|failed|timeout|806867f022fc49ef971f67f27b7929be|Wed 2026-07-01 09:09:46 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11439-26086-3119450_15708253-0.service|simple|loaded|failed|failed|timeout|1945f4076cfa4e63abeeb12f861b8555|Wed 2026-07-01 09:09:46 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11440-30360-3119787_15696700-0.service|simple|loaded|failed|failed|timeout|f8607241dacd41cbaa46bed3af330925|Wed 2026-07-01 09:09:47 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11441-30361-3119800_15693182-0.service|simple|loaded|failed|failed|timeout|7a3119d590344027bb5952c8c92d11cc|Wed 2026-07-01 09:09:47 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11442-50514-3119886_15661010-0.service|simple|loaded|failed|failed|timeout|b5b3cfdeb6f741f3b575321eb560b009|Wed 2026-07-01 09:09:47 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11443-50515-3120204_15638134-0.service|simple|loaded|failed|failed|timeout|c07d4a47146a45f3ab40a28fff87ef0d|Wed 2026-07-01 09:09:48 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11444-26087-3120210_15712385-0.service|simple|loaded|failed|failed|timeout|cd9337cd22a24b648073d2c09c1664cc|Wed 2026-07-01 09:09:48 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11446-17573-3120602_15624422-0.service|simple|loaded|failed|failed|timeout|afd343a3d30a41d0861b93c036ef9954|Wed 2026-07-01 09:09:49 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11448-59046-3120696_15650137-0.service|simple|loaded|failed|failed|timeout|dd701b827b37452d9c2403cbb6a15604|Wed 2026-07-01 09:09:49 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11450-1797-3120977_15682861-0.service|simple|loaded|failed|failed|timeout|61e04d9454844a4b810e6b90977e92e5|Wed 2026-07-01 09:09:50 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11451-13880-3121104_15704559-0.service|simple|loaded|failed|failed|timeout|94d720f7abdc411f9e8ddd4b7a495ee2|Wed 2026-07-01 09:09:50 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11452-26088-3121382_15670849-0.service|simple|loaded|failed|failed|timeout|f0ddd2f525d645e8933671491d0769dd|Wed 2026-07-01 09:09:51 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11453-9309-3121555_15638180-0.service|simple|loaded|failed|failed|timeout|0e6ac840361549468508ba08bbc3c053|Wed 2026-07-01 09:09:51 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11454-9310-3121556_15638181-0.service|simple|loaded|failed|failed|timeout|9a7dd1a29e284c28af95971295cf1063|Wed 2026-07-01 09:09:51 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11455-13881-3121657_15696811-0.service|simple|loaded|failed|failed|timeout|19fb737275004a999251d67950d16420|Wed 2026-07-01 09:09:51 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11456-38196-3121886_15624438-0.service|simple|loaded|failed|failed|timeout|cb4ebf309816494483599094764a27a3|Wed 2026-07-01 09:09:52 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11457-5357-3121974_15700779-0.service|simple|loaded|failed|failed|timeout|0c4418fd880f49fb919c51e631424c17|Wed 2026-07-01 09:09:52 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11458-13882-3122168_15682978-0.service|simple|loaded|failed|failed|timeout|65f49cc58c7341318637e50d0dfb5f81|Wed 2026-07-01 09:09:53 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11460-47209-3122345_15674436-0.service|simple|loaded|failed|failed|timeout|40047c7f47cf41beaf80511ad32f65fe|Wed 2026-07-01 09:09:53 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11463-5359-3123156_15650282-0.service|simple|loaded|failed|failed|timeout|489da5918b3d4cd79bca358ee4b236ca|Wed 2026-07-01 09:09:56 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11464-21559-3123233_15683051-0.service|simple|loaded|failed|failed|timeout|23ae52d1b2004606a62aa9a320b8392b|Wed 2026-07-01 09:09:56 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11465-13883-3124816_15671054-0.service|simple|loaded|failed|failed|timeout|c3c01e64e2084e86b882e8a812693ce7|Wed 2026-07-01 09:09:59 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11466-13884-3124849_15693616-0.service|simple|loaded|failed|failed|timeout|5f6e60ede55c4ff196a6d4b2c1ba5490|Wed 2026-07-01 09:10:00 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11467-54217-3124853_15674529-0.service|simple|loaded|failed|failed|timeout|d730fcb976ee4d4db620c5afdbb65a40|Wed 2026-07-01 09:10:00 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11468-54218-3124857_15624485-0.service|simple|loaded|failed|failed|timeout|db38eda248404806947ed4f1ea4ad016|Wed 2026-07-01 09:10:00 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@11570-62464-3146774_15702033-0.service|simple|loaded|failed|failed|timeout|66d6667540da4014998647e3dbcace87|Wed 2026-07-01 09:12:39 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@12466-38290-3187943_15723747-0.service|simple|loaded|failed|failed|timeout|dae0a26204b54b7bb2b8974f2c1a96c9|Wed 2026-07-01 09:16:20 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13-24579-4156318_12550645-0.service|simple|loaded|failed|failed|timeout|3d160086565c4082b7a88b24ed99302d|Wed 2026-07-01 05:45:04 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13134-62781-3219031_15740709-0.service|simple|loaded|failed|failed|timeout|daded650cec84d9fb89781f4da75ae29|Wed 2026-07-01 09:19:04 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@131596-276963-4118490_46027792-0.service|simple|loaded|failed|failed|exit-code|4bc41d8d21cf4faeaba25a6c4619a6d9|Sat 2026-07-04 15:50:45 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|1|1
+drkonqi-coredump-processor@131598-208455-2258635_69245845-0.service|simple|loaded|failed|failed|exit-code|59d4c4a7c43e42268a793f4af65e3819|Tue 2026-07-07 08:08:17 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|1|1
+drkonqi-coredump-processor@13236-59212-3223330_15763239-0.service|simple|loaded|failed|failed|timeout|353320a4c6d841568a7fd02b06c59a52|Wed 2026-07-01 09:19:26 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13296-34565-3226264_15811266-0.service|simple|loaded|failed|failed|timeout|dce645f59fa44302aec8f4896f79084b|Wed 2026-07-01 09:19:38 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13431-17779-3231347_15807323-0.service|simple|loaded|failed|failed|timeout|dabedf5bc4b64e6fba1544ac36d8b764|Wed 2026-07-01 09:20:04 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13459-26210-3232389_15814944-0.service|simple|loaded|failed|failed|timeout|ad6800e75f51413b9ae914429796b4e3|Wed 2026-07-01 09:20:10 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13464-9594-3232504_15819395-0.service|simple|loaded|failed|failed|timeout|67d5035f25e64b2390925582fdd6bd03|Wed 2026-07-01 09:20:11 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13524-21902-3235148_15777090-0.service|simple|loaded|failed|failed|timeout|edae94a9895f4b959356c1528bb70258|Wed 2026-07-01 09:20:22 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13544-21905-3235696_15781694-0.service|simple|loaded|failed|failed|timeout|6c4a83d33c7d43bdb72acb60607e0747|Wed 2026-07-01 09:20:26 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13598-62877-3238444_15800050-0.service|simple|loaded|failed|failed|timeout|58eab954c6f14ab793640a1c2a41b507|Wed 2026-07-01 09:20:37 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13676-59241-3240761_15823440-0.service|simple|loaded|failed|failed|timeout|3fe1e18fc7e9459d8644c35c6706a58d|Wed 2026-07-01 09:20:53 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13740-21930-3243742_15812073-0.service|simple|loaded|failed|failed|timeout|508e93ad584e4dc3a15d9f0e27f830f9|Wed 2026-07-01 09:21:05 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13814-62926-3247059_15828217-0.service|simple|loaded|failed|failed|timeout|b440e45850934c1a9a896aeaed7d82e7|Wed 2026-07-01 09:21:20 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13870-30738-3248680_15847525-0.service|simple|loaded|failed|failed|timeout|ae51a243469e41208ecb8a7f5883a2c1|Wed 2026-07-01 09:21:31 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13880-38402-3248944_15835666-0.service|simple|loaded|failed|failed|timeout|426b7d46ff02437782c7d1e7c4ad7889|Wed 2026-07-01 09:21:33 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@13881-38403-3248945_15835667-0.service|simple|loaded|failed|failed|timeout|15dd786dbe5541ffa57aaf8a24aa5889|Wed 2026-07-01 09:21:33 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14069-54991-3257157_15798139-0.service|simple|loaded|failed|failed|timeout|80aef7efcf6241728035b03817abbcff|Wed 2026-07-01 09:22:13 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14139-17855-3260131_15848059-0.service|simple|loaded|failed|failed|timeout|bed84620cc364de491f61cb5da56518f|Wed 2026-07-01 09:22:26 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14148-34680-3260320_15808700-0.service|simple|loaded|failed|failed|timeout|4fe19dd4a0304d9eae0a9247cad6b662|Wed 2026-07-01 09:22:28 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14240-38435-3264419_15848267-0.service|simple|loaded|failed|failed|timeout|1f52dba8207e42619bcd8063f1c6e105|Wed 2026-07-01 09:22:47 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@1433-49360-236163_12782713-0.service|simple|loaded|failed|failed|timeout|f053cd8a32d84bc28e890d4ccb0e88cf|Wed 2026-07-01 06:03:24 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14348-55072-3268928_15856372-0.service|simple|loaded|failed|failed|timeout|e948136d14494b3f8886a4a310971a80|Wed 2026-07-01 09:23:10 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14370-9732-3269638_15856403-0.service|simple|loaded|failed|failed|timeout|facde2eefacb4b80827b9fcb8fee12d5|Wed 2026-07-01 09:23:15 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14382-2110-3270943_15825122-0.service|simple|loaded|failed|failed|timeout|b2b4fcbf5cf849c9a4e01f1ec8ee201d|Wed 2026-07-01 09:23:17 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14513-9756-3275959_15765493-0.service|simple|loaded|failed|failed|timeout|01e218f4b81941bf811ff373b485d98d|Wed 2026-07-01 09:23:45 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14521-63057-3276214_15844775-0.service|simple|loaded|failed|failed|timeout|2cfb310db94a4c5795b50aa1b741de6a|Wed 2026-07-01 09:23:47 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14559-30826-3277265_15867988-0.service|simple|loaded|failed|failed|timeout|3bea4e89812744bc8b68a802baf17d62|Wed 2026-07-01 09:23:55 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14600-59324-3279522_15860161-0.service|simple|loaded|failed|failed|timeout|ca2bb774164b4d9f9d992ee7e11a8abd|Wed 2026-07-01 09:24:04 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14623-50718-3280432_15849141-0.service|simple|loaded|failed|failed|timeout|09a9bdec78b741c3a9a4927aa041f1b1|Wed 2026-07-01 09:24:10 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14646-42586-3281123_15829990-0.service|simple|loaded|failed|failed|timeout|b9c1fb4f60cf4d0fb39f5ebbfb1966f6|Wed 2026-07-01 09:24:15 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14650-38477-3281211_15801882-0.service|simple|loaded|failed|failed|timeout|3aabe759e34f49bd99e41ab668235e31|Wed 2026-07-01 09:24:15 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14666-2144-3282610_15864319-0.service|simple|loaded|failed|failed|timeout|5415155d6fbc42f7bd957f1eb73e2e6b|Wed 2026-07-01 09:24:19 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14692-55138-3283254_15849356-0.service|simple|loaded|failed|failed|timeout|9c1cd16feb87463aa0ec01ea761c1188|Wed 2026-07-01 09:24:25 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14730-63079-3284428_15860390-0.service|simple|loaded|failed|failed|timeout|6dc71af834a245ee8d4e4da81ac632fe|Wed 2026-07-01 09:24:33 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14771-2155-3286754_15880268-0.service|simple|loaded|failed|failed|timeout|a3d86e8bfefb4d88aac179d22e3964b1|Wed 2026-07-01 09:24:43 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14781-34747-3287031_15833622-0.service|simple|loaded|failed|failed|timeout|a1a3558f847d4785afa138b0feae2ca6|Wed 2026-07-01 09:24:45 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14871-17953-3290505_15864977-0.service|simple|loaded|failed|failed|timeout|de585e804a0b43b4bd8b596338e59d49|Wed 2026-07-01 09:25:04 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@14896-63126-3291459_15857640-0.service|simple|loaded|failed|failed|timeout|b4ee6494526e4e50ba2b866d1b0a9e29|Wed 2026-07-01 09:25:10 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@15006-55200-3295302_15842036-0.service|simple|loaded|failed|failed|timeout|25d1c1a6c5ad4758bb0212304e421e6e|Wed 2026-07-01 09:25:33 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@15332-63219-3309221_15818237-0.service|simple|loaded|failed|failed|timeout|30a1585f309742888b41f2b16bf6d148|Wed 2026-07-01 09:26:52 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@15533-47702-3318533_15905544-0.service|simple|loaded|failed|failed|timeout|b9cff1e1d0f5474eb65092c97377a013|Wed 2026-07-01 09:27:42 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@16010-50798-3339357_15910047-0.service|simple|loaded|failed|failed|timeout|d8749db2511a4796aed098ce622e7f85|Wed 2026-07-01 09:29:40 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@16406-2322-3357040_15863535-0.service|simple|loaded|failed|failed|timeout|882b215d3fc34f779480767b484d34b6|Wed 2026-07-01 09:31:20 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@16716-63519-3369869_15950355-0.service|simple|loaded|failed|failed|timeout|e14522394fa14bf69bdbd97aeca49c13|Wed 2026-07-01 09:32:34 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@1694-57589-305530_12883699-0.service|simple|loaded|failed|failed|timeout|6d66be104fb441a6a6563f7e6307d234|Wed 2026-07-01 06:06:45 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@17021-63595-3383609_15932538-0.service|simple|loaded|failed|failed|timeout|35bae0d5c5934db5aa20d1b8f145ec29|Wed 2026-07-01 09:33:48 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@17026-18171-3383769_15967486-0.service|simple|loaded|failed|failed|timeout|b5e6f259595449a7a115bc86b98dfafb|Wed 2026-07-01 09:33:50 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@17099-10133-3387258_15887742-0.service|simple|loaded|failed|failed|timeout|612be4d7d3b647468c8ecf97dbdf7409|Wed 2026-07-01 09:34:07 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@17225-22555-3393373_15933102-0.service|simple|loaded|failed|failed|timeout|a52dbc20c2af4a6a9d834caf57982082|Wed 2026-07-01 09:34:39 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@17263-10168-3394602_15963418-0.service|simple|loaded|failed|failed|timeout|25469cd45b8c41b6a1078415f481ae5e|Wed 2026-07-01 09:34:48 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@17270-38771-3394828_15978657-0.service|simple|loaded|failed|failed|timeout|d3d9b3b62f5646128eff31b757457c13|Wed 2026-07-01 09:34:50 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@17421-10197-3401350_15949433-0.service|simple|loaded|failed|failed|timeout|20c8c6a86db5450e81e1c416b6596edd|Wed 2026-07-01 09:35:27 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@17889-10286-3421021_15988409-0.service|simple|loaded|failed|failed|timeout|7c0a7d0fa61d4e6ca470f5ad9d034618|Wed 2026-07-01 09:37:22 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@18126-59636-3429717_16008653-0.service|simple|loaded|failed|failed|timeout|08a9dae1ce744d00b4e102475064818f|Wed 2026-07-01 09:38:20 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@1813-24862-322240_12888243-0.service|simple|loaded|failed|failed|timeout|0961358f2841439d8ed512db4bb31984|Wed 2026-07-01 06:08:13 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@18499-56168-3442605_15990193-0.service|simple|loaded|failed|failed|timeout|f175e2aecafc437b9beda31a3f926987|Wed 2026-07-01 09:39:51 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@19074-59720-3460907_16021541-0.service|simple|loaded|failed|failed|timeout|a2a299fcb59842819ded22d0cfe72584|Wed 2026-07-01 09:42:09 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@19131-31623-3462680_15997803-0.service|simple|loaded|failed|failed|timeout|63c25c6ea18c4bdda6eb4546d9debd4c|Wed 2026-07-01 09:42:23 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@19500-35213-3474686_16041532-0.service|simple|loaded|failed|failed|timeout|baf958254c014e438ca30f761d19cbff|Wed 2026-07-01 09:43:55 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@19936-42871-3488796_16030802-0.service|simple|loaded|failed|failed|timeout|6c5565b3d3294b69a1f2fc1eae569627|Wed 2026-07-01 09:45:42 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@20234-26675-3498226_16066751-0.service|simple|loaded|failed|failed|timeout|76c2ccf157a44a5793ce3d264d6ed695|Wed 2026-07-01 09:46:57 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@20319-23165-3501109_16077553-0.service|simple|loaded|failed|failed|timeout|b13aae259e9944d89f521f00a291dac7|Wed 2026-07-01 09:47:19 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@20405-64411-3503833_16034889-0.service|simple|loaded|failed|failed|timeout|8aa625e38a694d19adfb9da1855d653c|Wed 2026-07-01 09:47:41 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@20779-56825-3515776_16090219-0.service|simple|loaded|failed|failed|timeout|5930255ba53e4c07b776e10c673d945f|Wed 2026-07-01 09:49:12 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@2119-24902-382403_12925739-0.service|simple|loaded|failed|failed|timeout|7593b18300d74fe4af84f4eb287088a7|Wed 2026-07-01 06:11:57 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@21536-57071-3539933_16122729-0.service|simple|loaded|failed|failed|timeout|1caf83ed90154623a40cb3c4e59a0a0e|Wed 2026-07-01 09:52:20 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@21867-2813-3550415_16107233-0.service|simple|loaded|failed|failed|timeout|fe9aaa89bcba455da2b4594e7f6e1baa|Wed 2026-07-01 09:53:41 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@22297-23532-3563962_16076366-0.service|simple|loaded|failed|failed|timeout|1a22522d3d174699ac98950820ddab26|Wed 2026-07-01 09:55:27 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@2242-33034-402341_12981452-0.service|simple|loaded|failed|failed|timeout|7bf44071477c4ab1ac39073d71375589|Wed 2026-07-01 06:13:29 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@2281-20666-407393_12926804-0.service|simple|loaded|failed|failed|timeout|d418c22968c34faaa15c0af41532d398|Wed 2026-07-01 06:13:57 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@22822-26813-3581672_16175362-0.service|simple|loaded|failed|failed|timeout|a40b752c512644c19f9d72bf5d17f264|Wed 2026-07-01 09:57:48 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@22840-32262-3582169_16147403-0.service|simple|loaded|failed|failed|timeout|5bab26e3e2ec4ace9603c9f3d7745519|Wed 2026-07-01 09:57:52 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@23326-60098-3597985_16164500-0.service|simple|loaded|failed|failed|timeout|d3b34eddfbe84feaa92d6ccbb0ed8983|Wed 2026-07-01 09:59:57 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@2345-33060-415734_12971094-0.service|simple|loaded|failed|failed|timeout|c3b6d00b31f143138e603d29018fa842|Wed 2026-07-01 06:14:42 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@2746-41355-473046_13020830-0.service|simple|loaded|failed|failed|timeout|09e801a17d6a470bbb7e740c3bb0b768|Wed 2026-07-01 06:19:34 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@2770-49526-476322_13048264-0.service|simple|loaded|failed|failed|timeout|f5b26a01b45b4727b3a5783545d6f97d|Wed 2026-07-01 06:19:51 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@3154-12777-529354_13097002-0.service|simple|loaded|failed|failed|timeout|dfd791065c1f45368e49f699b50fc946|Wed 2026-07-01 06:24:30 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@3163-49556-530454_13088294-0.service|simple|loaded|failed|failed|timeout|c1a34262131e4e6783c06d7823a8fd90|Wed 2026-07-01 06:24:36 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@3186-12792-533428_13093732-0.service|simple|loaded|failed|failed|timeout|dcafdd5f049f440bbacbd3be05e9846a|Wed 2026-07-01 06:24:53 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@3187-25086-533485_13097438-0.service|simple|loaded|failed|failed|timeout|390610044a654302b59bb8f39d39f940|Wed 2026-07-01 06:24:53 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@3465-29174-570570_13153181-0.service|simple|loaded|failed|failed|timeout|d83ebabb95bd420abe6739bf56ec37d8|Wed 2026-07-01 06:28:15 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@3466-29175-570626_13134401-0.service|simple|loaded|failed|failed|timeout|76c11764e46a4adc8c819ee8584e37de|Wed 2026-07-01 06:28:15 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@3657-45733-598696_13181698-0.service|simple|loaded|failed|failed|timeout|d4a767c7d3374f3485257b7ad7d22f5f|Wed 2026-07-01 06:30:34 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@4262-770-685798_13256821-0.service|simple|loaded|failed|failed|timeout|1cb4cde1dc1b44d18f8450739a2d9b5a|Wed 2026-07-01 06:37:58 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@4289-61745-692733_13221409-0.service|simple|loaded|failed|failed|timeout|23da818c4a114726951aba055b3c1769|Wed 2026-07-01 06:38:25 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@4290-61746-692741_13244643-0.service|simple|loaded|failed|failed|timeout|38ab185832d14ea395789bdc722bba1a|Wed 2026-07-01 06:38:25 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@4291-61747-692745_13221410-0.service|simple|loaded|failed|failed|timeout|14b2443b2dce499e8bf6ab49983769be|Wed 2026-07-01 06:38:25 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@4292-61748-692748_13221411-0.service|simple|loaded|failed|failed|timeout|4d171be7814b422a88d9924e587283a3|Wed 2026-07-01 06:38:25 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@4294-53527-695192_13216861-0.service|simple|loaded|failed|failed|timeout|2c0ec981b46b4e4a82b7783177d5118a|Wed 2026-07-01 06:38:30 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@4393-791-1106971_13689616-0.service|simple|loaded|failed|failed|timeout|86ba870182964cd1aefd831b71504e4a|Wed 2026-07-01 06:56:56 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@466-8238-44588_12640654-0.service|simple|loaded|failed|failed|timeout|fe7d733f35ae48a6bfdc2426458f1c93|Wed 2026-07-01 05:51:05 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@523-20519-52453_12617501-0.service|simple|loaded|failed|failed|timeout|6e44682ce6014c0cb84dbe5a1d934d38|Wed 2026-07-01 05:51:47 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@5488-16973-1385714_13960660-0.service|simple|loaded|failed|failed|timeout|8b5706a6698744dabea24ec9f0abdce9|Wed 2026-07-01 07:10:38 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@5540-33567-1395820_13952919-0.service|simple|loaded|failed|failed|timeout|662cb311c87540539b501fe433ee90c9|Wed 2026-07-01 07:11:16 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@5842-41723-1466885_14042085-0.service|simple|loaded|failed|failed|timeout|e86414c74a8e43e680f20d483d29f255|Wed 2026-07-01 07:15:01 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@5843-41724-1466893_14042087-0.service|simple|loaded|failed|failed|timeout|ead617a519234e3caeddec7f0473874a|Wed 2026-07-01 07:15:01 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@5844-46229-1466899_14042088-0.service|simple|loaded|failed|failed|timeout|088c16ee14f5477693c75f2b26de7ca9|Wed 2026-07-01 07:15:01 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@689-41044-75904_12661204-0.service|simple|loaded|failed|failed|timeout|ab6623bfc87f44d2be3bd83fcb703dd5|Wed 2026-07-01 05:53:47 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6942-49991-1692057_14225101-0.service|simple|loaded|failed|failed|timeout|5831a6344fdd4944938b10d5e4e65940|Wed 2026-07-01 07:28:33 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6943-13351-1692055_14286940-0.service|simple|loaded|failed|failed|timeout|26f51730bb2b4230a4bedefe7aaa4b0e|Wed 2026-07-01 07:28:33 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6944-13352-1692058_14225102-0.service|simple|loaded|failed|failed|timeout|cca66f31d6324570a72a7e5a8ff33e80|Wed 2026-07-01 07:28:33 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6946-46461-1692549_14275440-0.service|simple|loaded|failed|failed|timeout|4ededacc8e454772aa3af417ea52c19d|Wed 2026-07-01 07:28:34 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6948-8767-1692598_14225126-0.service|simple|loaded|failed|failed|timeout|4dd75d58a0ca41fcbf52b0716880077b|Wed 2026-07-01 07:28:34 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6950-20999-1692668_14267380-0.service|simple|loaded|failed|failed|timeout|2b6351f772d74e4188804e64df9e3ebb|Wed 2026-07-01 07:28:35 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6954-1199-1695030_14287069-0.service|simple|loaded|failed|failed|timeout|01298b25741943119f62928da98c5fa2|Wed 2026-07-01 07:28:45 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6957-46462-1696774_14260107-0.service|simple|loaded|failed|failed|timeout|e6211873748e4b189c367837adf66570|Wed 2026-07-01 07:28:50 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6959-8769-1697314_14280216-0.service|simple|loaded|failed|failed|timeout|2001941a567d4ea0bd9eeaf5894d1c81|Wed 2026-07-01 07:28:53 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6960-4857-1698429_14200068-0.service|simple|loaded|failed|failed|timeout|79cc405a471843c3a2b414c74c05cf16|Wed 2026-07-01 07:28:58 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6962-21001-1699086_14233301-0.service|simple|loaded|failed|failed|timeout|3272868b57314b0481b9fba9f35e808d|Wed 2026-07-01 07:29:01 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6963-21002-1699099_14291180-0.service|simple|loaded|failed|failed|timeout|0946f4352a5041bab51b8d4c4b01f6d0|Wed 2026-07-01 07:29:01 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6968-53719-1701486_14271032-0.service|simple|loaded|failed|failed|timeout|ae13f925ae544b229af651368073502e|Wed 2026-07-01 07:29:13 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6970-1201-1702431_14271078-0.service|simple|loaded|failed|failed|timeout|9956d8d8cc6a44b787c1e7ac80b7be7c|Wed 2026-07-01 07:29:18 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6976-4861-1708684_14249382-0.service|simple|loaded|failed|failed|timeout|678a247b14ef4f14bd9f764318c2abe4|Wed 2026-07-01 07:29:40 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6977-4862-1710899_14249525-0.service|simple|loaded|failed|failed|timeout|c953150bf4b240bcb9b0e8d02b0f0dee|Wed 2026-07-01 07:29:47 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6978-4863-1710911_14249526-0.service|simple|loaded|failed|failed|timeout|a038cccb9a914583bbd1a72ed4d0fb8c|Wed 2026-07-01 07:29:47 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6980-4864-1714882_14288051-0.service|simple|loaded|failed|failed|timeout|034eda29040e4f5f9a7f64e164f66ac6|Wed 2026-07-01 07:29:55 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6982-49993-1717481_14311660-0.service|simple|loaded|failed|failed|timeout|86ecb7b5396940308bf802009f67ff0b|Wed 2026-07-01 07:30:02 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6983-61979-1720238_14269410-0.service|simple|loaded|failed|failed|timeout|6c303dd25fee4aad811428e1d2777eb1|Wed 2026-07-01 07:30:07 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6984-61980-1720254_14265169-0.service|simple|loaded|failed|failed|timeout|55afc99ae07d4ea4b6c6cf14af5ef255|Wed 2026-07-01 07:30:07 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6985-46463-1722523_14300387-0.service|simple|loaded|failed|failed|timeout|7ffd6a488030492ea872a94c63487c07|Wed 2026-07-01 07:30:11 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6986-37689-1725971_14265464-0.service|simple|loaded|failed|failed|timeout|b42bb9c1aee6411eb84f9607f9d173a5|Wed 2026-07-01 07:30:18 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6987-37690-1725974_14265465-0.service|simple|loaded|failed|failed|timeout|81b87bb77c4349c39b819b169cb0a42a|Wed 2026-07-01 07:30:18 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6989-25558-1730150_14284685-0.service|simple|loaded|failed|failed|timeout|ccec7dbf4f694c7bae3452e097837674|Wed 2026-07-01 07:30:27 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6990-25559-1730172_14284686-0.service|simple|loaded|failed|failed|timeout|83dd43263845421bbdb5d9dc638c5bc2|Wed 2026-07-01 07:30:27 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6995-61981-1742130_14285323-0.service|simple|loaded|failed|failed|timeout|e3a5b154252c44248c13e379eb186032|Wed 2026-07-01 07:30:50 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6996-61982-1742188_14273643-0.service|simple|loaded|failed|failed|timeout|5c1be5336f6e4531a33b579985c347a6|Wed 2026-07-01 07:30:50 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6998-37691-1747937_14332622-0.service|simple|loaded|failed|failed|timeout|c69acb3211b748ee988bc8a7bbdba674|Wed 2026-07-01 07:31:02 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@6999-17126-1747983_14273996-0.service|simple|loaded|failed|failed|timeout|7ec6033c279f4b848f6c63a85046e371|Wed 2026-07-01 07:31:02 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7000-17127-1747998_14273997-0.service|simple|loaded|failed|failed|timeout|c4d732004ba1472aaebcaa69c8fccfff|Wed 2026-07-01 07:31:02 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7001-46464-1751364_14340713-0.service|simple|loaded|failed|failed|timeout|bc12f7c992224f2d94f0cb6ffeaf296c|Wed 2026-07-01 07:31:11 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7003-53722-1754266_14329628-0.service|simple|loaded|failed|failed|timeout|08b90a3a89c44727b20e9151a66a1205|Wed 2026-07-01 07:31:18 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7006-21007-2109364_14670106-0.service|simple|loaded|failed|failed|timeout|2773bde6b4e74531bb4abaf5af46d947|Wed 2026-07-01 08:00:44 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7007-21008-2109368_14670108-0.service|simple|loaded|failed|failed|timeout|e6da68e0721a4487926734ea7bdb3cba|Wed 2026-07-01 08:00:44 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7008-25560-2268293_14818004-0.service|simple|loaded|failed|failed|timeout|0f4afa73ce1e4f09a92526570b64ea90|Wed 2026-07-01 08:11:56 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7009-21009-2268662_14842823-0.service|simple|loaded|failed|failed|timeout|bb4289ea8b5a4ade9f2562c13e75d3f5|Wed 2026-07-01 08:11:58 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7010-25561-2268663_14842824-0.service|simple|loaded|failed|failed|timeout|da13df3508504acbbd9bf50c6afb20f3|Wed 2026-07-01 08:11:58 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7011-25562-2268664_14842825-0.service|simple|loaded|failed|failed|timeout|8704e5d9c98c4eeea679e39157b3480d|Wed 2026-07-01 08:11:58 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7012-1202-2360411_14884712-0.service|simple|loaded|failed|failed|timeout|ded95742455d4f9a90397d6ac68ccb18|Wed 2026-07-01 08:14:41 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7013-1203-2360413_14934969-0.service|simple|loaded|failed|failed|timeout|20b624077ef5473c9da29613f6a18168|Wed 2026-07-01 08:14:41 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@720-12411-80160_12639665-0.service|simple|loaded|failed|failed|timeout|226f8d7100504f54a1b5e74b30f16ce7|Wed 2026-07-01 05:54:10 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7666-50087-2555057_15119734-0.service|simple|loaded|failed|failed|timeout|5cf1386201df496ba4034a1d13153276|Wed 2026-07-01 08:26:07 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7703-33890-2560301_15148267-0.service|simple|loaded|failed|failed|timeout|2378882d05754598aa4b06e7c929e9b6|Wed 2026-07-01 08:26:34 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7793-53771-2575724_15119952-0.service|simple|loaded|failed|failed|timeout|1b3d3bb01b2d43d19a1c7d585276ca4d|Wed 2026-07-01 08:27:41 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7799-46632-2576411_15164282-0.service|simple|loaded|failed|failed|timeout|b664f8b967cf418db136b13049f57465|Wed 2026-07-01 08:27:45 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@7994-29906-2609547_15158314-0.service|simple|loaded|failed|failed|timeout|e4ca7b0cb7784796a001c9cbbce72aa0|Wed 2026-07-01 08:30:08 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@8046-46708-2618554_15158835-0.service|simple|loaded|failed|failed|timeout|915b8e404ab14340a04213b9f9345a54|Wed 2026-07-01 08:30:46 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@817-24697-94842_12615401-0.service|simple|loaded|failed|failed|timeout|cd279b43bea647bab66182db1c0c28f0|Wed 2026-07-01 05:55:21 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@8448-17260-2700791_15228771-0.service|simple|loaded|failed|failed|timeout|858681cf9a3e4ab984020a8cdb339420|Wed 2026-07-01 08:35:46 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@9054-1469-2780264_15361678-0.service|simple|loaded|failed|failed|timeout|88e6bcd84303415cb116c2c64ef9f227|Wed 2026-07-01 08:41:48 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15
+drkonqi-coredump-processor@9247-13634-2793386_15349836-0.service|simple|loaded|failed|failed|timeout|eebe8182101f4afb976a39420b385ae6|Wed 2026-07-01 08:43:00 EDT|/usr/lib/systemd/system/drkonqi-coredump-processor@.service|2|15

docs/le-app-database-migration/phase2a-host-maintenance/grub-btrfs-readiness.md

@@ -0,0 +1,78 @@
+# GRUB and grub-btrfs readiness
+
+Verified baseline:
+
+- GRUB has normal, fallback, and recovery entries for both `linux-zen` and
+  standard `linux`.
+- Snapper snapshots 1, 2, and 3 exist.
+- `/boot/grub/grub-btrfs.cfg` is absent, so there are currently no generated
+  snapshot entries.
+- `grub-btrfs-snapper.path` is active and watching `/.snapshots`.
+
+The installed unit definitions are:
+
+```ini
+# /usr/lib/systemd/system/grub-btrfs-snapper.path
+[Unit]
+Description=Monitors for new snapshots
+
+[Path]
+PathModified=/.snapshots
+
+[Install]
+WantedBy=multi-user.target
+```
+
+```ini
+# /usr/lib/systemd/system/grub-btrfs-snapper.service
+[Unit]
+Description=Regenerate grub-btrfs.cfg
+
+[Service]
+Type=oneshot
+Environment="PATH=/sbin:/bin:/usr/sbin:/usr/bin"
+EnvironmentFile=/etc/default/grub-btrfs/config
+ExecStart=bash -c 'if [[ -z $(/usr/bin/findmnt -n / | /usr/bin/grep "\.snapshots") ]]; then if [ -s "${GRUB_BTRFS_GRUB_DIRNAME:-/boot/grub}/grub-btrfs.cfg" ]; then /etc/grub.d/41_snapshots-btrfs; else ${GRUB_BTRFS_MKCONFIG:-grub-mkconfig} -o ${GRUB_BTRFS_GRUB_DIRNAME:-/boot/grub}/grub.cfg; fi; fi'
+```
+
+The bounded July 12 journal contains only these two parser warnings and no
+recorded service activation that generated snapshot entries:
+
+```text
+Jul 12 17:16:42 TITANSERVER systemd[1]: /usr/lib/systemd/system/grub-btrfs-snapper.service:11: Ignoring unknown escape sequences in the ExecStart expression containing "\.snapshots".
+Jul 12 17:18:23 TITANSERVER systemd[1]: /usr/lib/systemd/system/grub-btrfs-snapper.service:11: Ignoring unknown escape sequences in the ExecStart expression containing "\.snapshots".
+```
+
+The most supportable
+inference is that the watcher was enabled after snapshots 1–3 or received no
+qualifying modification afterward; absence of `grub-btrfs.cfg` confirms that the
+generator has not completed successfully for those snapshots.
+
+The separately approved standalone generation and verification procedure is:
+
+```bash
+/etc/grub.d/41_snapshots-btrfs
+generate_rc=$?
+printf 'grub_btrfs_generate_rc=%s\n' "$generate_rc"
+
+test -s /boot/grub/grub-btrfs.cfg
+present_rc=$?
+printf 'grub_btrfs_cfg_present_rc=%s\n' "$present_rc"
+
+grub-script-check /boot/grub/grub-btrfs.cfg
+syntax_rc=$?
+printf 'grub_btrfs_cfg_syntax_rc=%s\n' "$syntax_rc"
+
+grep -E 'snapshot|Snapshot|snapper|\.snapshots' /boot/grub/grub-btrfs.cfg
+entries_rc=$?
+printf 'grub_btrfs_entries_rc=%s\n' "$entries_rc"
+
+grep -q 'snapshots-btrfs' /boot/grub/grub.cfg
+main_menu_link_rc=$?
+printf 'grub_main_menu_snapshot_link_rc=%s\n' "$main_menu_link_rc"
+```
+
+This procedure is not approved or executed by the maintenance scripts. If the
+last check fails, stop: making the submenu reachable would require a separately
+approved `grub-mkconfig -o /boot/grub/grub.cfg`. Do not regenerate full GRUB as
+an incidental readiness repair.

docs/le-app-database-migration/phase2a-host-maintenance/maintenance-worksheet.md

@@ -0,0 +1,32 @@
+# Phase 2A maintenance worksheet
+
+```text
+PUBLIC_HEALTH_URLS='https://db.lasereverything.net/'
+EXTRA_CRITICAL_UNITS=''
+LE_PHASE2A_RECOVERY_READY=<UNSET>
+LE_PHASE2A_BACKUPS_READY=<UNSET>
+
+maintenance_window=<UNSET>
+user_notification=<UNSET>
+rollback_decision_owner=<UNSET>
+independent_console_access=<UNSET>
+independent_root_access=<UNSET>
+previous_kernel_boot_procedure=<UNSET>
+```
+
+Verified evidence:
+
+- protected Directus archive manifest: `PASS`, return code 0;
+- Docker: 88 total, 87 running, retired `directus` intentionally stopped;
+- sole unhealthy running container: reviewed unrelated `sonarr`;
+- `makearmy-app` running; `bgbye` running and healthy;
+- `le-directus-source` and `le-payload-pg` running;
+- running restart-policy `no`: `castopod`, `castopod-redis`;
+- DrKonqi disposition: exact checksummed 234-unit allowlist preserved;
+- NoMachine removed; `nxserver.service` absent and not critical;
+- GRUB: normal, fallback, and recovery entries for `linux-zen` and `linux`;
+- Snapper snapshots 1–3 exist; `grub-btrfs.cfg` snapshot entries absent;
+- `grub-btrfs-snapper.path` active and watching.
+
+The recovery and backup attestations must remain unset until the operator has
+personally confirmed recovery access and completed the proportional backup plan.

docs/le-app-database-migration/phase2a-host-maintenance/post-reboot-validate.sh

@@ -0,0 +1,313 @@
+#!/usr/bin/env bash
+# Read-only validation plus root-only evidence recording. Run as a separate process.
+
+add_failure() {
+  printf '%s\n' "$1" >> "$post_record/failed-checks.txt"
+  failures=$((failures + 1))
+  return 0
+}
+
+check() {
+  label=$1; outfile=$2; shift 2
+  "$@" > "$post_record/$outfile" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure "$label|rc=$rc|file=$outfile"; fi
+  return 0
+}
+
+check_shell() {
+  label=$1; outfile=$2; command_text=$3
+  /usr/bin/bash -o pipefail -c "$command_text" > "$post_record/$outfile" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure "$label|rc=$rc|file=$outfile"; fi
+  return 0
+}
+
+capture_failed_unit_fingerprint() {
+  output=$1
+  systemctl --failed --no-legend --plain --no-pager | awk '{print $1}' | LC_ALL=C sort |
+    while IFS= read -r unit; do
+      [ -n "$unit" ] || continue
+      printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s\n' \
+        "$(systemctl show "$unit" -p Id --value --no-pager)" \
+        "$(systemctl show "$unit" -p Type --value --no-pager)" \
+        "$(systemctl show "$unit" -p LoadState --value --no-pager)" \
+        "$(systemctl show "$unit" -p ActiveState --value --no-pager)" \
+        "$(systemctl show "$unit" -p SubState --value --no-pager)" \
+        "$(systemctl show "$unit" -p Result --value --no-pager)" \
+        "$(systemctl show "$unit" -p InvocationID --value --no-pager)" \
+        "$(systemctl show "$unit" -p StateChangeTimestamp --value --no-pager)" \
+        "$(systemctl show "$unit" -p FragmentPath --value --no-pager)" \
+        "$(systemctl show "$unit" -p ExecMainCode --value --no-pager)" \
+        "$(systemctl show "$unit" -p ExecMainStatus --value --no-pager)"
+    done > "$output"
+  return ${PIPESTATUS[0]}
+}
+
+validate_failed_unit_disposition() {
+  (cd "$script_dir/failed-unit-disposition" && sha256sum -c SHA256SUMS) \
+    > "$post_record/failed-unit-allowlist-checksum.txt" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure 'failed-unit-allowlist-checksum'; return 0; fi
+  capture_failed_unit_fingerprint "$post_record/failed-units-fingerprint.psv"
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure "failed-unit-fingerprint|rc=$rc"; return 0; fi
+  diff -u "$script_dir/failed-unit-disposition/drkonqi-failed-units.allowlist.psv" \
+    "$post_record/failed-units-fingerprint.psv" > "$post_record/failed-unit-disposition.diff" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure 'failed-unit-disposition-changed-after-reboot'; fi
+  return 0
+}
+
+validate_health_url_file() {
+  file=$1
+  if [ ! -s "$file" ]; then add_failure 'health-urls|missing'; return 0; fi
+  while IFS= read -r url; do
+    case "$url" in https://*) ;; *) add_failure 'health-url|unsupported-scheme'; continue ;; esac
+    authority=${url#https://}; authority=${authority%%/*}
+    case "$url" in *'?'*|*'#'*|*$'\n'*|*$'\r'*|*$'\t'*|*' '*) add_failure 'health-url|unsafe-content'; continue ;; esac
+    case "$authority" in ''|*@*) add_failure 'health-url|userinfo-or-empty-authority'; continue ;; esac
+  done < "$file"
+  return 0
+}
+
+capture_container_fingerprint() {
+  output=$1
+  : > "$output"
+  docker ps -aq | while IFS= read -r cid; do
+    [ -n "$cid" ] || continue
+    base=$(docker inspect --format \
+      '{{.Name}}|{{.Id}}|{{.Config.Image}}|{{.Image}}|{{.State.Status}}|{{if .State.Health}}{{.State.Health.Status}}{{else}}no-healthcheck{{end}}|{{.State.StartedAt}}|{{.HostConfig.NetworkMode}}|{{.HostConfig.RestartPolicy.Name}}|{{index .Config.Labels "com.docker.compose.project"}}' \
+      "$cid" 2>/dev/null)
+    inspect_rc=$?
+    health_hash=$(docker inspect --format '{{json .Config.Healthcheck}}' "$cid" 2>/dev/null | sha256sum | awk '{print $1}')
+    hash_rc=$?
+    if [ "$inspect_rc" -ne 0 ] || [ "$hash_rc" -ne 0 ] || [ -z "$base" ] || [ -z "$health_hash" ]; then return 1; fi
+    printf '%s|healthcheck_sha256=%s\n' "${base#/}" "$health_hash"
+  done | LC_ALL=C sort > "$output"
+  pipeline_status="${PIPESTATUS[*]}"
+  case "$pipeline_status" in '0 0 0') return 0 ;; *) return 1 ;; esac
+}
+
+compare_containers() {
+  capture_container_fingerprint "$post_record/container-fingerprint-after.psv"
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure "container-fingerprint-after|rc=$rc"; return 0; fi
+  : > "$post_record/container-comparison.psv"
+  : > "$post_record/restart-policy-no-attention.txt"
+  awk -F'|' '{print $1}' "$baseline/container-fingerprint.psv" > "$post_record/container-names-before.txt"
+  awk -F'|' '{print $1}' "$post_record/container-fingerprint-after.psv" > "$post_record/container-names-after.txt"
+  diff -u "$post_record/container-names-before.txt" "$post_record/container-names-after.txt" \
+    > "$post_record/container-name-set.diff" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure 'container-name-set-changed'; fi
+  while IFS='|' read -r name old_id old_image_ref old_image_id old_state old_health old_started old_network old_restart old_project old_health_hash; do
+    [ -n "$name" ] || continue
+    current=$(awk -F'|' -v name="$name" '$1==name {print}' "$post_record/container-fingerprint-after.psv")
+    if [ -z "$current" ]; then
+      add_failure "container-missing|name=$name"
+      [ "$old_restart" = no ] && printf '%s|missing|manual-operator-attention-required\n' "$name" >> "$post_record/restart-policy-no-attention.txt"
+      continue
+    fi
+    IFS='|' read -r new_name new_id new_image_ref new_image_id new_state new_health new_started new_network new_restart new_project new_health_hash <<EOF
+$current
+EOF
+    printf '%s|before=%s,%s|after=%s,%s|restart=%s\n' "$name" "$old_state" "$old_health" "$new_state" "$new_health" "$new_restart" \
+      >> "$post_record/container-comparison.psv"
+    if [ "$old_id" != "$new_id" ] || [ "$old_image_ref" != "$new_image_ref" ] || \
+       [ "$old_image_id" != "$new_image_id" ] || [ "$old_network" != "$new_network" ] || \
+       [ "$old_restart" != "$new_restart" ] || [ "$old_project" != "$new_project" ] || \
+       [ "$old_health_hash" != "$new_health_hash" ]; then
+      add_failure "container-identity-or-policy-changed|name=$name"
+      continue
+    fi
+    if [ "$name" = directus ]; then
+      [ "$new_state" = exited ] || add_failure "retired-directus-state|expected=exited|actual=$new_state"
+    elif [ "$name" = sonarr ]; then
+      if [ "$new_state" != running ]; then add_failure "sonarr-not-running|state=$new_state"; fi
+      case "$new_health" in unhealthy|healthy) ;; *) add_failure "sonarr-health-worsened|health=$new_health" ;; esac
+    elif [ "$old_state" = running ]; then
+      if [ "$new_state" != running ]; then
+        add_failure "previously-running-container-not-running|name=$name|state=$new_state"
+        [ "$old_restart" = no ] && printf '%s|%s|manual-operator-attention-required\n' "$name" "$new_state" >> "$post_record/restart-policy-no-attention.txt"
+      elif [ "$old_health" = healthy ] && [ "$new_health" != healthy ]; then
+        add_failure "healthy-container-regressed|name=$name|health=$new_health"
+      elif [ "$old_health" = no-healthcheck ] && [ "$new_health" != no-healthcheck ]; then
+        add_failure "container-healthcheck-identity-changed|name=$name|health=$new_health"
+      fi
+    fi
+  done < "$baseline/container-fingerprint.psv"
+  return 0
+}
+
+compare_units() {
+  : > "$post_record/unit-comparison.psv"
+  while IFS='|' read -r unit old_load old_active old_sub; do
+    [ -n "$unit" ] || continue
+    new_load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null)
+    new_active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null)
+    new_sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null)
+    printf '%s|before=%s,%s,%s|after=%s,%s,%s\n' \
+      "$unit" "$old_load" "$old_active" "$old_sub" "${new_load:-missing}" "${new_active:-missing}" "${new_sub:-missing}" \
+      >> "$post_record/unit-comparison.psv"
+    if [ "$old_load" = loaded ] && [ "$new_load" != loaded ]; then
+      add_failure "critical-unit-missing|unit=$unit"
+    elif [ "$old_active" = active ] && [ "$new_active" != active ]; then
+      add_failure "critical-unit-not-active|unit=$unit|state=${new_active:-missing}"
+    fi
+  done < "$baseline/critical-units-baseline.psv"
+  return 0
+}
+
+validate_databases() {
+  : > "$post_record/database-validation.txt"
+  while IFS='|' read -r model engine identity state detail; do
+    [ -n "$model" ] || continue
+    if [ "$model" = unit ]; then
+      active=$(systemctl show "$identity" -p ActiveState --value 2>/dev/null)
+      printf '%s|%s|unit=%s|active=%s\n' "$model" "$engine" "$identity" "${active:-missing}" \
+        >> "$post_record/database-validation.txt"
+      if [ "$active" != active ]; then add_failure "database-unit-not-active|unit=$identity"; fi
+      if [ "$engine" = mysql ]; then
+        mysqladmin ping >> "$post_record/database-validation.txt" 2>&1
+        rc=$?; [ "$rc" -eq 0 ] || add_failure "mysqladmin-ping-failed|unit=$identity|rc=$rc"
+      elif [ "$engine" = postgresql ]; then
+        pg_isready >> "$post_record/database-validation.txt" 2>&1
+        rc=$?; [ "$rc" -eq 0 ] || add_failure "pg-isready-failed|unit=$identity|rc=$rc"
+      fi
+    elif [ "$model" = container ]; then
+      running=$(docker inspect -f '{{.State.Running}}' "$identity" 2>/dev/null)
+      health=$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}no-healthcheck{{end}}' "$identity" 2>/dev/null)
+      printf '%s|%s|container=%s|running=%s|health=%s\n' \
+        "$model" "$engine" "$identity" "${running:-missing}" "${health:-unknown}" \
+        >> "$post_record/database-validation.txt"
+      if [ "$running" != true ] || [ "$health" = unhealthy ]; then
+        add_failure "database-container-failed|container=$identity|running=${running:-missing}|health=${health:-unknown}"
+      fi
+    fi
+  done < "$baseline/database-baseline.psv"
+  return 0
+}
+
+check_package_files() {
+  pacman -Qkk > "$post_record/pacman-Qkk.txt" 2>&1
+  qkk_rc=$?
+  printf 'pacman-Qkk-return=%s\n' "$qkk_rc" > "$post_record/pacman-Qkk-classification.txt"
+  grep -E -i 'missing|could not read|permission denied|unreadable' "$post_record/pacman-Qkk.txt" \
+    > "$post_record/pacman-Qkk-missing-or-unreadable.txt" 2>/dev/null
+  missing_rc=$?
+  grep -E -i 'altered|modified' "$post_record/pacman-Qkk.txt" \
+    > "$post_record/pacman-Qkk-modified.txt" 2>/dev/null
+  if [ "$missing_rc" -eq 0 ] && [ -s "$post_record/pacman-Qkk-missing-or-unreadable.txt" ]; then
+    add_failure 'packaged-files-missing-or-unreadable'
+  fi
+  printf 'Modified configuration/package files require manual classification; no repair performed.\n' \
+    >> "$post_record/pacman-Qkk-classification.txt"
+  return 0
+}
+
+main() {
+  failures=0
+  maintenance=${1:-}
+  if [ "$(id -u)" -ne 0 ]; then
+    printf 'HARD_STOP: run as a separate root process\n' >&2
+    return 10
+  fi
+  script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
+  if [ -z "$maintenance" ] || [ ! -d "$maintenance" ] || [ -L "$maintenance" ]; then
+    printf 'HARD_STOP: supply the exact maintenance record path\n' >&2
+    return 11
+  fi
+  owner=$(stat -c %u "$maintenance" 2>/dev/null); mode=$(stat -c %a "$maintenance" 2>/dev/null)
+  if [ "$owner" != 0 ] || [ "$mode" != 700 ]; then
+    printf 'HARD_STOP: maintenance record must be root-owned mode 0700\n' >&2
+    return 12
+  fi
+  baseline=$maintenance/preflight-record
+  required='running-containers-before.txt container-fingerprint.psv directus-stopped.allowlist.psv sonarr-unhealthy.allowlist.psv restart-policy-no.psv critical-units-baseline.psv database-baseline.psv health-urls.sanitized inventory-hashes.sha256 result.manifest result.manifest.sha256'
+  for file in $required; do
+    if [ ! -f "$baseline/$file" ] || [ -L "$baseline/$file" ]; then
+      printf 'HARD_STOP: missing baseline file %s\n' "$file" >&2
+      return 13
+    fi
+  done
+  (cd "$baseline" && sha256sum -c inventory-hashes.sha256 > /dev/null 2>&1)
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    printf 'HARD_STOP: copied preflight baseline checksum failure\n' >&2
+    return 14
+  fi
+  (cd "$baseline" && sha256sum -c result.manifest.sha256 > /dev/null 2>&1)
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    printf 'HARD_STOP: copied preflight result manifest checksum failure\n' >&2
+    return 14
+  fi
+
+  umask 077
+  install -d -o root -g root -m 0700 /var/log/le-phase2a-post-reboot
+  rc=$?; [ "$rc" -eq 0 ] || { printf 'HARD_STOP: cannot create post-reboot record parent\n' >&2; return 15; }
+  post_record=$(mktemp -d "/var/log/le-phase2a-post-reboot/validation.$(date -u +%Y%m%dT%H%M%SZ).XXXXXXXX")
+  rc=$?
+  if [ "$rc" -ne 0 ] || [ -z "$post_record" ] || [ ! -d "$post_record" ]; then
+    printf 'HARD_STOP: cannot atomically create unique post-reboot record\n' >&2
+    return 16
+  fi
+  chown root:root "$post_record"; chmod 0700 "$post_record"
+  : > "$post_record/failed-checks.txt"
+  printf 'maintenance_record=%s\n' "$maintenance" > "$post_record/source.txt"
+
+  check 'running-kernel' running-kernel.txt uname -a
+  check_shell 'installed-kernels' installed-kernels.txt 'pacman -Q linux linux-headers linux-zen linux-zen-headers'
+  check 'failed-units' failed-units.txt systemctl --failed --no-legend --plain --no-pager
+  validate_failed_unit_disposition
+  check_shell 'ssh-state' ssh-state.txt \
+    'systemctl show sshd.service -p LoadState -p ActiveState -p SubState -p ExecMainStatus; journalctl -b -u sshd.service --no-pager'
+  check_shell 'docker-daemon' docker-daemon.txt \
+    "systemctl show docker.service -p LoadState -p ActiveState -p SubState -p ExecMainStatus; docker info"
+  check_shell 'all-containers' containers-after.psv \
+    "docker ps -a --format '{{.Names}}|{{.Image}}|{{.Status}}|{{.Ports}}' | sort"
+  compare_containers
+  compare_units
+  validate_databases
+
+  check_shell 'mounts-and-capacity' mounts-capacity.txt 'findmnt --real; df -hT / /boot /var/cache/pacman/pkg /tmp'
+  check_shell 'network-routes-firewall-ports' network-after.txt \
+    'ip -brief address; ip route show table all; ip -6 route show table all; nft list ruleset; ss -lntup'
+  wg show > "$post_record/wireguard-after.txt" 2>&1
+  wg_rc=$?; if [ "$wg_rc" -ne 0 ]; then printf 'wireguard-observation|rc=%s\n' "$wg_rc" > "$post_record/warnings.txt"; fi
+
+  validate_health_url_file "$baseline/health-urls.sanitized"
+  : > "$post_record/public-health.txt"
+  while IFS= read -r url; do
+    metrics=$(curl --fail --silent --show-error --max-redirs 0 \
+      --connect-timeout 10 --max-time 30 --output /dev/null \
+      --write-out 'http=%{http_code}|remote=%{remote_ip}|time=%{time_total}' \
+      "$url" 2>> "$post_record/public-health-errors.txt")
+    rc=$?
+    printf '%s|%s\n' "$url" "$metrics" >> "$post_record/public-health.txt"
+    if [ "$rc" -ne 0 ]; then add_failure "public-health-failed|url=$url|rc=$rc"; fi
+  done < "$baseline/health-urls.sanitized"
+
+  pacman -Dk > "$post_record/pacman-Dk.txt" 2>&1
+  dk_rc=$?
+  if [ "$dk_rc" -ne 0 ]; then add_failure "pacman-Dk-failed|rc=$dk_rc"; fi
+  check_package_files
+  check_shell 'target-packages' target-packages.txt 'pacman -Q rootlesskit slirp4netns openai-codex'
+  check_shell 'pacnew-pacsave-inventory' pacnew-pacsave.txt \
+    "find /etc -xdev -type f \( -name '*.pacnew' -o -name '*.pacsave' \) -printf '%p\\n' | sort; pacdiff -o 2>&1"
+
+  find "$post_record" -maxdepth 1 -type f ! -name SHA256SUMS -print0 | sort -z | xargs -0 sha256sum \
+    > "$post_record/SHA256SUMS" 2>&1
+  chmod -R go-rwx "$post_record"
+  printf 'POST_REBOOT_RECORD=%s\n' "$post_record"
+  if [ "$failures" -ne 0 ]; then
+    printf 'POST_REBOOT_RESULT=HARD_STOP failures=%s\n' "$failures"
+    return 20
+  fi
+  printf 'POST_REBOOT_RESULT=PASS failures=0\n'
+  printf 'Rootless-Docker provisioning remains separately approval-gated.\n'
+  return 0
+}
+
+main "$@"

docs/le-app-database-migration/phase2a-host-maintenance/preflight-read-only.sh

@@ -0,0 +1,457 @@
+#!/usr/bin/env bash
+# Read-only host inspection plus root-only evidence recording.
+# Run as a separate process; this script changes no shell options and uses return only.
+
+add_failure() {
+  printf '%s\n' "$1" >> "$record/failed-mandatory-checks.txt"
+  overall=HARD_STOP
+  return 0
+}
+
+mandatory() {
+  label=$1
+  outfile=$2
+  shift 2
+  "$@" > "$record/$outfile" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    add_failure "$label|rc=$rc|file=$outfile"
+  fi
+  return 0
+}
+
+mandatory_shell() {
+  label=$1
+  outfile=$2
+  command_text=$3
+  /usr/bin/bash -o pipefail -c "$command_text" > "$record/$outfile" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    add_failure "$label|rc=$rc|file=$outfile"
+  fi
+  return 0
+}
+
+optional_shell() {
+  label=$1
+  outfile=$2
+  command_text=$3
+  /usr/bin/bash -o pipefail -c "$command_text" > "$record/$outfile" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    printf '%s|rc=%s|file=%s\n' "$label" "$rc" "$outfile" >> "$record/warnings.txt"
+  fi
+  return 0
+}
+
+capture_failed_unit_fingerprint() {
+  output=$1
+  : > "$output"
+  systemctl --failed --no-legend --plain --no-pager | awk '{print $1}' | LC_ALL=C sort |
+    while IFS= read -r unit; do
+      [ -n "$unit" ] || continue
+      id=$(systemctl show "$unit" -p Id --value --no-pager)
+      type=$(systemctl show "$unit" -p Type --value --no-pager)
+      load=$(systemctl show "$unit" -p LoadState --value --no-pager)
+      active=$(systemctl show "$unit" -p ActiveState --value --no-pager)
+      sub=$(systemctl show "$unit" -p SubState --value --no-pager)
+      result=$(systemctl show "$unit" -p Result --value --no-pager)
+      invocation=$(systemctl show "$unit" -p InvocationID --value --no-pager)
+      changed=$(systemctl show "$unit" -p StateChangeTimestamp --value --no-pager)
+      fragment=$(systemctl show "$unit" -p FragmentPath --value --no-pager)
+      code=$(systemctl show "$unit" -p ExecMainCode --value --no-pager)
+      status=$(systemctl show "$unit" -p ExecMainStatus --value --no-pager)
+      printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s\n' \
+        "$id" "$type" "$load" "$active" "$sub" "$result" "$invocation" \
+        "$changed" "$fragment" "$code" "$status"
+    done > "$output"
+  pipeline_status="${PIPESTATUS[*]}"
+  case "$pipeline_status" in '0 0 0') return 0 ;; *) return 1 ;; esac
+}
+
+validate_failed_unit_disposition() {
+  allowlist_dir=$script_dir/failed-unit-disposition
+  allowlist=$allowlist_dir/drkonqi-failed-units.allowlist.psv
+  allowlist_hashes=$allowlist_dir/SHA256SUMS
+  (cd "$allowlist_dir" && sha256sum -c SHA256SUMS > "$record/failed-unit-allowlist-checksum.txt" 2>&1)
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure "failed-unit-allowlist-checksum|rc=$rc"; return 0; fi
+  capture_failed_unit_fingerprint "$record/failed-units-fingerprint.psv"
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure "failed-unit-fingerprint|rc=$rc"; return 0; fi
+  cp "$allowlist" "$record/drkonqi-failed-units.allowlist.psv"
+  rc=$?
+  if [ "$rc" -eq 0 ]; then cp "$allowlist_hashes" "$record/failed-unit-disposition.SHA256SUMS"; rc=$?; fi
+  if [ "$rc" -ne 0 ]; then add_failure "failed-unit-allowlist-copy|rc=$rc"; return 0; fi
+  diff -u "$allowlist" "$record/failed-units-fingerprint.psv" > "$record/failed-unit-disposition.diff" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    add_failure 'failed-unit-disposition|set-state-or-invocation-fingerprint-changed'
+  fi
+  count=$(wc -l < "$record/failed-units-fingerprint.psv")
+  [ "$count" = 234 ] || add_failure "failed-unit-disposition|expected=234|actual=$count"
+  return 0
+}
+
+validate_snapper_readiness() {
+  btrfs subvolume show /.snapshots > "$record/snapshots-subvolume.txt" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure "snapshots-btrfs-subvolume|rc=$rc"; return 0; fi
+  stat -c 'path=%n|uid=%u|gid=%g|mode=%a|type=%F' /.snapshots > "$record/snapshots-stat.txt" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure "snapshots-stat|rc=$rc"; return 0; fi
+  owner_mode=$(stat -c '%u:%g:%a' /.snapshots 2>/dev/null)
+  [ "$owner_mode" = 0:0:750 ] || add_failure "snapshots-owner-mode|expected=0:0:750|actual=$owner_mode"
+  snapper list --columns number,type,pre-number,date,user,cleanup,description \
+    > "$record/snapper-snapshots-before.txt" 2>&1
+  rc=$?
+  [ "$rc" -eq 0 ] || add_failure "snapper-list|rc=$rc"
+  btrfs qgroup show / > "$record/btrfs-quota-observation.txt" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    printf 'btrfs-quota-accounting|unavailable-or-disabled|rc=%s|snapshot-validity-not-affected\n' "$rc" \
+      >> "$record/warnings.txt"
+  fi
+  return 0
+}
+
+capture_container_fingerprint() {
+  output=$1
+  : > "$output"
+  docker ps -aq | while IFS= read -r cid; do
+    [ -n "$cid" ] || continue
+    base=$(docker inspect --format \
+      '{{.Name}}|{{.Id}}|{{.Config.Image}}|{{.Image}}|{{.State.Status}}|{{if .State.Health}}{{.State.Health.Status}}{{else}}no-healthcheck{{end}}|{{.State.StartedAt}}|{{.HostConfig.NetworkMode}}|{{.HostConfig.RestartPolicy.Name}}|{{index .Config.Labels "com.docker.compose.project"}}' \
+      "$cid" 2>/dev/null)
+    inspect_rc=$?
+    health_hash=$(docker inspect --format '{{json .Config.Healthcheck}}' "$cid" 2>/dev/null | sha256sum | awk '{print $1}')
+    hash_rc=$?
+    if [ "$inspect_rc" -ne 0 ] || [ "$hash_rc" -ne 0 ] || [ -z "$base" ] || [ -z "$health_hash" ]; then
+      return 1
+    fi
+    printf '%s|healthcheck_sha256=%s\n' "${base#/}" "$health_hash"
+  done | LC_ALL=C sort > "$output"
+  pipeline_status="${PIPESTATUS[*]}"
+  case "$pipeline_status" in '0 0 0') return 0 ;; *) return 1 ;; esac
+}
+
+validate_container_disposition() {
+  disposition_dir=$script_dir/container-disposition
+  (cd "$disposition_dir" && sha256sum -c SHA256SUMS) \
+    > "$record/container-disposition-checksum.txt" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure "container-disposition-checksum|rc=$rc"; return 0; fi
+  capture_container_fingerprint "$record/container-fingerprint.psv"
+  rc=$?
+  if [ "$rc" -ne 0 ]; then add_failure "container-fingerprint|rc=$rc"; return 0; fi
+  diff -u "$disposition_dir/all-containers.psv" "$record/container-fingerprint.psv" \
+    > "$record/container-disposition.diff" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    add_failure 'container-disposition|identity-state-health-startup-network-restart-or-healthcheck-changed'
+  fi
+  total=$(wc -l < "$record/container-fingerprint.psv")
+  running=$(awk -F'|' '$5=="running"{n++} END{print n+0}' "$record/container-fingerprint.psv")
+  stopped=$(awk -F'|' '$5!="running"{n++} END{print n+0}' "$record/container-fingerprint.psv")
+  unhealthy=$(awk -F'|' '$6=="unhealthy"{n++} END{print n+0}' "$record/container-fingerprint.psv")
+  [ "$total" = 88 ] || add_failure "container-count|expected=88|actual=$total"
+  [ "$running" = 87 ] || add_failure "running-container-count|expected=87|actual=$running"
+  [ "$stopped" = 1 ] || add_failure "stopped-container-count|expected=1|actual=$stopped"
+  [ "$unhealthy" = 1 ] || add_failure "unhealthy-container-count|expected=1|actual=$unhealthy"
+  awk -F'|' '$6=="unhealthy" && $1!="sonarr" {print}' "$record/container-fingerprint.psv" \
+    > "$record/unexpected-unhealthy-containers.psv"
+  [ ! -s "$record/unexpected-unhealthy-containers.psv" ] || add_failure 'container-health|additional-unhealthy-container'
+  awk -F'|' '$5!="running" && $1!="directus" {print}' "$record/container-fingerprint.psv" \
+    > "$record/unexpected-stopped-containers.psv"
+  [ ! -s "$record/unexpected-stopped-containers.psv" ] || add_failure 'container-state|additional-stopped-container'
+  cp "$disposition_dir"/*.psv "$record/"
+  rc=$?
+  if [ "$rc" -eq 0 ]; then cp "$disposition_dir/SHA256SUMS" "$record/container-disposition.SHA256SUMS"; rc=$?; fi
+  [ "$rc" -eq 0 ] || add_failure "container-disposition-copy|rc=$rc"
+  return 0
+}
+
+validate_health_urls() {
+  : > "$record/health-urls.sanitized"
+  if [ -z "${PUBLIC_HEALTH_URLS:-}" ]; then
+    add_failure 'public-health-urls|unset'
+    return 0
+  fi
+  case "$PUBLIC_HEALTH_URLS" in
+    *$'\n'*|*$'\r'*|*$'\t'*)
+      add_failure 'public-health-urls|control-character-rejected'
+      return 0
+      ;;
+  esac
+  for url in $PUBLIC_HEALTH_URLS; do
+    case "$url" in
+      https://*) ;;
+      *) add_failure 'public-health-url|unsupported-scheme-or-malformed'; continue ;;
+    esac
+    authority=${url#https://}
+    authority=${authority%%/*}
+    case "$url" in
+      *'?'*|*'#'*|*$'\n'*|*$'\r'*|*$'\t'*|*' '*)
+        add_failure 'public-health-url|query-fragment-or-control-character-rejected'
+        continue
+        ;;
+    esac
+    case "$authority" in
+      ''|*@*) add_failure 'public-health-url|empty-authority-or-userinfo-rejected'; continue ;;
+    esac
+    printf '%s\n' "$url" >> "$record/health-urls.sanitized"
+  done
+  if [ ! -s "$record/health-urls.sanitized" ]; then
+    add_failure 'public-health-urls|no-valid-non-secret-https-url'
+  fi
+  return 0
+}
+
+check_public_health() {
+  : > "$record/public-health.txt"
+  while IFS= read -r url; do
+    [ -n "$url" ] || continue
+    metrics=$(curl --fail --silent --show-error --max-redirs 0 \
+      --connect-timeout 10 --max-time 30 --output /dev/null \
+      --write-out 'http=%{http_code}|remote=%{remote_ip}|time=%{time_total}' \
+      "$url" 2>> "$record/public-health-errors.txt")
+    rc=$?
+    printf '%s|%s\n' "$url" "$metrics" >> "$record/public-health.txt"
+    if [ "$rc" -ne 0 ]; then
+      add_failure "public-health|rc=$rc|url=$url"
+    fi
+  done < "$record/health-urls.sanitized"
+  return 0
+}
+
+capture_bootloader() {
+  found=0
+  : > "$record/bootloader-inventory.txt"
+  if [ -d /boot/loader/entries ]; then
+    printf '%s\n' 'type=systemd-boot' >> "$record/bootloader-inventory.txt"
+    bootctl status >> "$record/bootloader-inventory.txt" 2>&1
+    bootctl_rc=$?
+    find /boot/loader/entries -maxdepth 1 -type f -print -exec sed -n '1,160p' {} \; \
+      >> "$record/bootloader-inventory.txt" 2>&1
+    find_rc=$?
+    if [ "$bootctl_rc" -eq 0 ] && [ "$find_rc" -eq 0 ]; then found=1; fi
+  fi
+  if [ -f /boot/grub/grub.cfg ]; then
+    printf '%s\n' 'type=grub' >> "$record/bootloader-inventory.txt"
+    grub-install --version >> "$record/bootloader-inventory.txt" 2>&1
+    grub_rc=$?
+    grep -E '^menuentry |^submenu |linux.*vmlinuz|initrd' /boot/grub/grub.cfg \
+      >> "$record/bootloader-inventory.txt" 2>&1
+    grep_rc=$?
+    if [ "$grub_rc" -eq 0 ] && [ "$grep_rc" -eq 0 ]; then found=1; fi
+  fi
+  if [ "$found" -ne 1 ]; then
+    add_failure 'bootloader-inventory|no-verified-supported-bootloader'
+  fi
+  return 0
+}
+
+capture_unit_baseline() {
+  systemctl list-units --type=service --all --no-legend --no-pager \
+    > "$record/all-service-units.txt" 2>&1
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    add_failure "service-unit-inventory|rc=$rc"
+    return 0
+  fi
+  : > "$record/critical-units-baseline.psv"
+  awk '{print $1}' "$record/all-service-units.txt" | while IFS= read -r unit; do
+    case "$unit" in
+      docker.service|nginx.service|php-fpm.service|mariadb.service|mysqld.service|postgresql.service|postfix.service|dovecot.service|rspamd.service|forgejo.service|sshd.service)
+        ;;
+      *) continue ;;
+    esac
+    load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null)
+    active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null)
+    sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null)
+    printf '%s|%s|%s|%s\n' "$unit" "$load" "$active" "$sub"
+  done > "$record/critical-units-baseline.psv"
+  for unit in ${EXTRA_CRITICAL_UNITS:-}; do
+    load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null)
+    if [ "$load" = loaded ]; then
+      active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null)
+      sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null)
+      printf '%s|%s|%s|%s\n' "$unit" "$load" "$active" "$sub" \
+        >> "$record/critical-units-baseline.psv"
+    else
+      add_failure "extra-critical-unit|not-loaded|unit=$unit"
+    fi
+  done
+  sort -u -o "$record/critical-units-baseline.psv" "$record/critical-units-baseline.psv"
+  return 0
+}
+
+capture_database_baseline() {
+  : > "$record/database-baseline.psv"
+  while IFS='|' read -r unit load active sub; do
+    [ "$active" = active ] || continue
+    case "$unit" in
+      mariadb.service|mysqld.service) printf 'unit|mysql|%s|%s|%s\n' "$unit" "$active" "$sub" ;;
+      postgresql.service) printf 'unit|postgresql|%s|%s|%s\n' "$unit" "$active" "$sub" ;;
+    esac
+  done < "$record/critical-units-baseline.psv" >> "$record/database-baseline.psv"
+  while IFS='|' read -r name image status ports; do
+    case "$status" in Up\ *) ;; *) continue ;; esac
+    lowered=$(printf '%s %s' "$name" "$image" | tr '[:upper:]' '[:lower:]')
+    case "$lowered" in
+      *maria*|*mysql*) printf 'container|mysql|%s|%s|%s\n' "$name" "$status" "$ports" ;;
+      *postgres*) printf 'container|postgresql|%s|%s|%s\n' "$name" "$status" "$ports" ;;
+    esac
+  done < "$record/containers-all.psv" >> "$record/database-baseline.psv"
+  return 0
+}
+
+validate_database_baseline() {
+  : > "$record/database-readiness-before.txt"
+  while IFS='|' read -r model engine identity state detail; do
+    [ "$model" = unit ] || continue
+    if [ "$engine" = mysql ]; then
+      mysqladmin ping >> "$record/database-readiness-before.txt" 2>&1
+      rc=$?; [ "$rc" -eq 0 ] || add_failure "mysqladmin-ping|unit=$identity|rc=$rc"
+    elif [ "$engine" = postgresql ]; then
+      pg_isready >> "$record/database-readiness-before.txt" 2>&1
+      rc=$?; [ "$rc" -eq 0 ] || add_failure "pg-isready|unit=$identity|rc=$rc"
+    fi
+  done < "$record/database-baseline.psv"
+  while IFS='|' read -r model engine identity state detail; do
+    [ "$model" = container ] || continue
+    running=$(docker inspect -f '{{.State.Running}}' "$identity" 2>/dev/null)
+    health=$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}no-healthcheck{{end}}' "$identity" 2>/dev/null)
+    printf '%s|%s|running=%s|health=%s\n' "$engine" "$identity" "${running:-missing}" "${health:-unknown}" \
+      >> "$record/database-readiness-before.txt"
+    if [ "$running" != true ] || [ "$health" = unhealthy ]; then
+      add_failure "database-container|name=$identity|running=${running:-missing}|health=${health:-unknown}"
+    fi
+  done < "$record/database-baseline.psv"
+  return 0
+}
+
+main() {
+  if [ "$(id -u)" -ne 0 ]; then
+    printf 'HARD_STOP: run as a separate root process so records are root-only\n' >&2
+    return 10
+  fi
+  umask 077
+  script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
+  install -d -o root -g root -m 0700 /var/log/le-phase2a-preflight
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    printf 'HARD_STOP: cannot create root-only preflight record parent\n' >&2
+    return 11
+  fi
+  record=$(mktemp -d "/var/log/le-phase2a-preflight/preflight.$(date -u +%Y%m%dT%H%M%SZ).XXXXXXXX")
+  rc=$?
+  if [ "$rc" -ne 0 ] || [ -z "$record" ] || [ ! -d "$record" ]; then
+    printf 'HARD_STOP: cannot atomically create unique preflight record\n' >&2
+    return 12
+  fi
+  chown root:root "$record"
+  chmod 0700 "$record"
+
+  overall=PASS
+  : > "$record/failed-mandatory-checks.txt"
+  : > "$record/warnings.txt"
+  timestamp_epoch=$(date +%s)
+  timestamp_utc=$(date -u +%FT%TZ)
+  hostname_value=$(hostname)
+  boot_id=$(cat /proc/sys/kernel/random/boot_id 2>/dev/null)
+  running_kernel=$(uname -r)
+  [ -n "$hostname_value" ] || add_failure 'hostname|empty'
+  [ -n "$boot_id" ] || add_failure 'boot-id|unavailable'
+  [ -n "$running_kernel" ] || add_failure 'running-kernel|unavailable'
+  [ "${LE_PHASE2A_RECOVERY_READY:-}" = YES ] || add_failure 'recovery-access-attestation|missing'
+  [ "${LE_PHASE2A_BACKUPS_READY:-}" = YES ] || add_failure 'backup-readiness-attestation|missing'
+
+  mandatory 'uptime' uptime.txt uptime
+  mandatory 'logged-in-sessions' logged-in-sessions.txt who -a
+  mandatory 'filesystem-capacity' filesystem-capacity.txt df -hT / /boot /var/cache/pacman/pkg /tmp
+  mandatory 'filesystem-inodes' filesystem-inodes.txt df -hi / /boot /var/cache/pacman/pkg /tmp
+  mandatory 'installed-package-inventory' packages-before.txt pacman -Q
+  mandatory 'failed-unit-inventory' failed-units-before.txt systemctl --failed --no-legend --plain --no-pager
+  validate_failed_unit_disposition
+  validate_snapper_readiness
+  mandatory_shell 'kernel-initramfs-inventory' kernel-initramfs-before.txt \
+    "find /usr/lib/modules /boot -maxdepth 2 -type f \\
+      \( -name vmlinuz -o -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' -o -name pkgbase \) \\
+      -printf '%p size=%s mtime=%TY-%Tm-%TdT%TH:%TM:%TS\\n' | sort; test \"\$(find /boot -maxdepth 1 -type f \\
+      \( -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' \) | wc -l)\" -gt 0"
+  capture_bootloader
+  optional_shell 'dkms-status' dkms-before.txt 'command -v dkms >/dev/null && dkms status'
+  mandatory_shell 'docker-container-inventory' containers-all.psv \
+    "docker ps -a --format '{{.Names}}|{{.Image}}|{{.Status}}|{{.Ports}}' | sort"
+  mandatory_shell 'running-container-inventory' running-containers-before.txt \
+    "docker ps --format '{{.Names}}' | sort"
+  validate_container_disposition
+  capture_unit_baseline
+  capture_database_baseline
+  validate_database_baseline
+
+  validate_health_urls
+  check_public_health
+  mandatory_shell 'network-firewall-listener-inventory' network-firewall-before.txt \
+    'findmnt --real; ip -brief address; ip route show table all; ip -6 route show table all; nft list ruleset; ss -lntup'
+  optional_shell 'wireguard-observation' wireguard-before.txt 'wg show'
+  mandatory 'package-database-consistency' pacman-Dk-before.txt pacman -Dk
+  optional_shell 'packaged-file-consistency-observation' pacman-Qkk-before.txt 'pacman -Qkk'
+  grep -E -i 'missing|could not read|permission denied|unreadable' "$record/pacman-Qkk-before.txt" \
+    > "$record/pacman-Qkk-missing-or-unreadable-before.txt" 2>/dev/null
+  if [ -s "$record/pacman-Qkk-missing-or-unreadable-before.txt" ]; then
+    add_failure 'packaged-files-missing-or-unreadable-before-maintenance'
+  fi
+  mandatory_shell 'pacnew-pacsave-inventory' pacnew-pacsave-before.txt \
+    "find /etc -xdev -type f \( -name '*.pacnew' -o -name '*.pacsave' \) -printf '%p\\n' | sort"
+  mandatory_shell 'migration-git-state' migration-git-state.txt \
+    'git -C /srv/codex-work/lasereverything.net.db/.worktrees/payload-migration status --short --branch; git -C /srv/codex-work/lasereverything.net.db/.worktrees/payload-migration rev-parse HEAD; git -C /srv/codex-work/lasereverything.net.db/.worktrees/payload-migration rev-parse origin/migration/le-app-database'
+  mandatory_shell 'approved-transaction-integrity' approved-transaction-checksum.txt \
+    "cd '$script_dir/approved-transaction' && sha256sum -c SHA256SUMS"
+  mandatory_shell 'protected-directus-archive-integrity' directus-archive-verification.txt \
+    "cd /srv/directus-archive/20260710-175408 && sha256sum --status -c SHA256SUMS && printf 'archive=/srv/directus-archive/20260710-175408|manifest=SHA256SUMS|result=PASS|return_code=0\\n'"
+
+  inventory_files='packages-before.txt failed-units-before.txt failed-units-fingerprint.psv failed-unit-disposition.diff failed-unit-allowlist-checksum.txt drkonqi-failed-units.allowlist.psv failed-unit-disposition.SHA256SUMS snapshots-subvolume.txt snapshots-stat.txt snapper-snapshots-before.txt btrfs-quota-observation.txt kernel-initramfs-before.txt bootloader-inventory.txt containers-all.psv running-containers-before.txt container-fingerprint.psv container-disposition.diff container-disposition-checksum.txt container-disposition.SHA256SUMS unexpected-unhealthy-containers.psv unexpected-stopped-containers.psv all-containers.psv running-containers.psv sonarr-unhealthy.allowlist.psv directus-stopped.allowlist.psv restart-policy-no.psv critical-units-baseline.psv database-baseline.psv database-readiness-before.txt health-urls.sanitized public-health.txt network-firewall-before.txt pacman-Dk-before.txt pacman-Qkk-before.txt pacman-Qkk-missing-or-unreadable-before.txt pacnew-pacsave-before.txt migration-git-state.txt approved-transaction-checksum.txt directus-archive-verification.txt'
+  (
+    cd "$record" || return 1
+    sha256sum $inventory_files > inventory-hashes.sha256
+    sha256sum -c inventory-hashes.sha256 > inventory-hash-verification.txt
+  )
+  hash_rc=$?
+  if [ "$hash_rc" -ne 0 ]; then
+    add_failure "inventory-hashes|rc=$hash_rc"
+  fi
+  hashes_hash=$(sha256sum "$record/inventory-hashes.sha256" | awk '{print $1}')
+
+  failure_count=$(wc -l < "$record/failed-mandatory-checks.txt")
+  failed_checks_hash=$(sha256sum "$record/failed-mandatory-checks.txt" | awk '{print $1}')
+  {
+    printf 'format=le-phase2a-preflight-v1\n'
+    printf 'hostname=%s\n' "$hostname_value"
+    printf 'boot_id=%s\n' "$boot_id"
+    printf 'running_kernel=%s\n' "$running_kernel"
+    printf 'timestamp_epoch=%s\n' "$timestamp_epoch"
+    printf 'timestamp_utc=%s\n' "$timestamp_utc"
+    printf 'overall=%s\n' "$overall"
+    printf 'failure_count=%s\n' "$failure_count"
+    printf 'failed_checks_file=failed-mandatory-checks.txt\n'
+    printf 'failed_checks_sha256=%s\n' "$failed_checks_hash"
+    printf 'inventory_hashes_sha256=%s\n' "$hashes_hash"
+  } > "$record/result.manifest"
+  (cd "$record" && sha256sum result.manifest > result.manifest.sha256)
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    overall=HARD_STOP
+    printf '%s\n' "result-manifest-checksum|rc=$rc" >> "$record/failed-mandatory-checks.txt"
+  fi
+  chmod -R go-rwx "$record"
+  printf 'PREFLIGHT_RECORD=%s\n' "$record"
+  printf 'PREFLIGHT_RESULT=%s failures=%s\n' "$overall" "$failure_count"
+  if [ "$overall" != PASS ]; then
+    return 20
+  fi
+  return 0
+}
+
+main "$@"

docs/le-app-database-migration/phase2a-host-maintenance/reboot-procedure.md

@@ -0,0 +1,65 @@
+# Separate reboot procedure
+
+This procedure begins only after successful package execution and review of its unique maintenance record. It never reboots automatically. Maintenance and validation records are atomic unique root-owned mode `0700` directories. They can contain sensitive operational metadata and must not be committed.
+
+## Pre-reboot verification
+
+Set the exact record path printed by `execute-maintenance.sh`:
+
+```bash
+record=/var/log/le-phase2a-maintenance/maintenance.YYYYMMDDTHHMMSSZ.XXXXXXXX
+test -d "$record" || { printf 'STOP: invalid record path\n' >&2; return 1; }
+```
+
+Record the running kernel and review installed kernel packages:
+
+```bash
+uname -a | tee "$record/running-kernel-immediately-before-reboot.txt"
+pacman -Q linux linux-headers linux-zen linux-zen-headers |
+  tee "$record/installed-kernels-immediately-before-reboot.txt"
+```
+
+Verify both new module trees, kernel images, and nonempty initramfs files:
+
+```bash
+find /usr/lib/modules /boot -maxdepth 2 -type f \
+  \( -name vmlinuz -o -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' -o -name pkgbase \) \
+  -printf '%p size=%s mtime=%TY-%Tm-%TdT%TH:%TM:%TS\n' |
+  sort | tee "$record/verified-kernel-initramfs-files.txt"
+
+find /boot -maxdepth 1 -type f \
+  \( -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' \) -size 0 -print
+```
+
+Any zero-length artifact is a hard stop. Review DKMS and package hook output:
+
+```bash
+dkms status | tee "$record/dkms-immediately-before-reboot.txt"
+systemctl --failed --no-pager | tee "$record/failed-units-immediately-before-reboot.txt"
+sed -n '1,240p' "$record/hook-restart-summary.txt"
+```
+
+Confirm bootloader state without changing it:
+
+```bash
+bootctl status 2>&1 | tee "$record/bootctl-status-before-reboot.txt"
+find /boot/loader/entries -maxdepth 1 -type f -print -exec sed -n '1,160p' {} \; 2>/dev/null |
+  tee "$record/systemd-boot-entries-before-reboot.txt"
+
+grub-install --version 2>&1 | tee "$record/grub-version-before-reboot.txt"
+test -f /boot/grub/grub.cfg &&
+  grep -E "^menuentry |^submenu |linux.*vmlinuz|initrd" /boot/grub/grub.cfg |
+  tee "$record/grub-entries-before-reboot.txt"
+```
+
+The operator must identify and record both the intended new-kernel entry and a known-good previous-kernel/fallback entry. Stop if boot entries or initramfs references are missing, DKMS failed, storage is degraded, backups are unavailable, SSH is unstable, or production is unhealthy.
+
+## Separately approved reboot command
+
+Only after explicit approval for this exact reboot:
+
+```bash
+sudo systemctl reboot
+```
+
+Do not embed this command in the maintenance script, a timer, `at`, a shell trap, or a command chain. Keep independent console access open and proceed to `post-reboot-validate.sh` after the host returns.

docs/le-app-database-migration/phase2a-host-maintenance/rollback-recovery.md

@@ -0,0 +1,59 @@
+# Rollback and recovery
+
+Rollback is emergency recovery, not a routine alternative to a complete Arch upgrade. Stop and coordinate through the operator whenever possible.
+
+## New kernel fails
+
+1. Use the independent console or bootloader menu.
+2. Select the previously verified kernel or fallback initramfs entry recorded before reboot.
+3. Do not repeatedly boot the failed entry or regenerate boot artifacts blindly.
+4. After the previous kernel boots, record `uname -a`, boot journal, failed units, DKMS state, `/boot` contents, and bootloader entries.
+5. Keep production stopped or degraded only as required for safety; obtain explicit approval before rebuilding initramfs, changing boot defaults, or removing a kernel.
+
+## Package recovery
+
+The first recovery source is an exact, validated package archive still present in `/var/cache/pacman/pkg`. Arch Linux Archive is the fallback source when the exact archive is unavailable.
+
+Emergency package restoration must:
+
+- use the exact before-inventory and transaction log;
+- restore a coherent dependency set, not one guessed library;
+- verify package signatures and checksums;
+- preserve full command output;
+- be approved as emergency recovery;
+- be followed by `pacman -Dk`, package/file consistency checks, initramfs/DKMS/bootloader validation, and production health tests.
+
+Do not improvise a broad downgrade, use `--overwrite` casually, disable signature checking, delete the package database lock without proving no Pacman process exists, or mix repository dates. Arch does not support partial upgrades; a downgrade can require an internally consistent dated repository snapshot.
+
+## SSH recovery
+
+- Expect the OpenSSH hook to restart a running `sshd.service` during the transaction.
+- Keep the active session open and confirm a second session before reboot when the maintenance plan allows.
+- If SSH fails, use the independent console. Inspect `sshd -t`, service status/journal, host keys, PAM, `sshd_config`, and any new `.pacnew` without replacing configuration automatically.
+- Do not weaken authentication, expose a new port, copy keys, or disable the firewall as a shortcut.
+
+## Docker and service recovery
+
+- Compare against `running-containers-before.txt` and `containers-before.txt`.
+- Inspect Docker daemon and container logs, mounts, networks, health checks, and storage availability before restarting anything.
+- Restart only an identified failed service with operator approval; do not restart all services or recreate containers/volumes indiscriminately.
+- Never delete Docker data, volumes, databases, images, or production configuration as recovery.
+- Database recovery follows the service-specific backup/runbook and requires explicit approval before any mutation.
+
+## Mandatory stop conditions
+
+Stop rather than improvise on:
+
+- package signature/keyring/database errors;
+- interrupted Pacman transaction or uncertain package state;
+- failed kernel, initramfs, DKMS, or bootloader generation;
+- missing previous-kernel boot option or loss of console access;
+- SSH/PAM/network/firewall configuration ambiguity;
+- new unexplained `.pacnew`/`.pacsave` for critical configuration;
+- storage, filesystem, database, Docker-volume, or backup inconsistency;
+- failed production database, proxy, mail, Forgejo, Docker, or public endpoint;
+- any proposed action that would modify production data/configuration, systemd, nftables, credentials, or package history beyond the approved recovery scope.
+
+Rootless-Docker provisioning and contained Codex setup are never part of recovery. Resume them only after the host is healthy and a later phase is explicitly approved.
+
+All recovery evidence remains in the root-only unique preflight, maintenance, and post-reboot record directories. It may contain operationally sensitive metadata and must not be committed or copied into a user-readable workspace.

docs/le-app-database-migration/phase2b-contained-runtime/.gitattributes

@@ -0,0 +1,4 @@
+# Preserve checksummed generated evidence and staged payload bytes verbatim.
+inventory/** -whitespace
+payload/** -whitespace
+tests/** -whitespace

docs/le-app-database-migration/phase2b-contained-runtime/INSTALL-ORDER.md

@@ -0,0 +1,15 @@
+# Exact staged installation and acceptance order
+
+Every numbered boundary requires review and explicit approval. Nothing here authorizes execution.
+
+1. Review the passing non-mutating `tests/32-stage1-state-tests.sh` results and the shared state implementation in `tests/stage1-state-lib.sh`. Then, from this directory, run only `tests/30-install-stage1.sh` as root and require zero failures. It invokes `tests/00-root-preinstall-validate.sh`, checks both manifests, requires all 16 destination files absent, validates shared parents, installs only static Stage 1 files, and atomically advances immutable checksummed state generations from `IN_PROGRESS` to `COMPLETE`. It does not create the approval marker or perform any reload/start/network action.
+2. Preserve the approved Quad9 DNS pair `9.9.9.9` and `149.112.112.112`, observed public/NAT address denial `74.67.173.56`, and verified root inventory. Quad9 requires no LAN exception; `192.168.10.1` remains denied. Any different value or public/NAT drift requires artifact edits, a new manifest, and another review.
+3. Resolve `/var/lib/le-app-codex-phase2b/stage1/current` as a strict local generation name and review that generation's `manifest` and `manifest.sha256`; require `COMPLETE`, source commit, artifact-manifest digest, hostname, timestamp, 16 completed file records, no pending records, and every reached directory disposition to match the installer output.
+4. Do not create `/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED` during Stage 1. Do not run `systemctl daemon-reload`, load nftables, create the namespace, or start/enable anything.
+5. Review installed owner/mode/size/hash evidence. Docker user configuration and the five acceptance/preflight scripts must be owned by `1200:1200`; tests are `0750`, configs/unit `0640`. No credentials, checkout, or source copies are installed.
+6. Run `systemctl daemon-reload`. Confirm the user manager remains inactive, lingering absent, and socket/process absent.
+7. Start only `le-app-codex-netns.service`. Inspect namespace identity, IPv4-only addresses/routes, nftables counters/rules, host routing, and production Docker health. Stop on any drift.
+8. Run `tests/run-inert-without-user-manager.sh`. This starts only a finite transient test process, never `user@1200.service`, Docker, or Codex. Require every filesystem/process/cgroup/device/socket/network assertion to pass.
+9. Review the inert evidence. Only a later explicit runtime-acceptance approval may start `user@1200.service`, enable `docker.service` within its controlled lifetime, or run `tests/20-rootless-docker.sh` as UID 1200.
+10. The later positive/negative Docker test uses only `unix:///run/user/1200/docker.sock`, disposable pinned images, and teardown. It must prove rootless/data-root/context behavior and denial of rootful sockets, private/host/LAN/VPN/metadata/SMTP/IPv6, and published ports.
+11. Stop the manager after testing. Codex authentication, Codex startup, repository/source/credential copying, application startup, and production changes remain out of scope.

docs/le-app-database-migration/phase2b-contained-runtime/MANIFEST.sha256

@@ -0,0 +1,35 @@
+f5bc35fd3767c0cbc72495b1dea283e8237789dd383ed754bf629ca09379ab97  .gitattributes
+b0ee162a228f128774fdefcbbb603c98aadc145fbe2b5e9ee8fd0c1a2ba444b2  INSTALL-ORDER.md
+e0182ff047fe6f8d71fc0a21fd73be3ced33b3f9fed990b902dd5f76a2f0a53a  README.md
+4f3f30e0f4c45f7ecfc6c6e169fda6b53b9eaa694f3ed26f818342fc80e7a446  ROLLBACK.md
+2a2aed8538b36afeed20bb58ed4168b3f2d55b0ed20e28f6860a16714a6df979  STATIC-SAFETY-AUDIT.md
+05bdf987ad0049118acf9371c6affae0d7bf65bfcb869d297986860ee20dfac4  inventory/SHA256SUMS
+e6f6da94601927a23d252f32de93e92c99d31fb2d2cbd9b00f2b88224dbb684e  inventory/docker-networks.json
+9a5d343092c8cf473f0e4d06cb6848f1788aa8bc41b1b3fb7412faea7ea7b48c  inventory/docker-networks.psv
+67178aa964dfa23116984dfc5c677f8c7ef8631d5d7de989193a54a620ceaec1  inventory/host-network.txt
+4695953ecd1d859198d1a5cbb6242d10ba27493ab3b1ffb3f8f77da39fd458e0  inventory/nftables-ruleset.txt
+0a0db228df70f4d15e09f5c96bd0d5ac9952f4300b898266d8963225a9815988  inventory/runtime-state.txt
+4d5c3252ac4f9f537ce3f69110127f13a88ea424cbc69a46ca75448341e2bae7  inventory/runtime-versions.txt
+1565a8f5b5f08059ab9df69d78fed1b8190ccf674a9d368a436af63c03b804a8  inventory/workspace-acls.txt
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  inventory/workspace-mounts.txt
+362b311c42fdd35bda6bcc9639403dd0f1dca17bc6469ccc9c86a9580021f046  inventory/workspace-tree.psv
+1bc6ed97f33210f0d9337c7593082aaad46efdc26c86af3603f4c7c6ed88933c  payload/etc/le-app-codex-runtime/resolv.conf
+4289b705dbd786281daccb6d5aa660c27b83441f1a34d0cd18590666124be386  payload/etc/nftables.d/50-le-app-codex.nft
+628370fd3cbb5c4572866f820fc404c23ce63505d5ac704e0b2019b3c1e72656  payload/etc/systemd/system/le-app-codex-netns.service
+ea0c280203614c3e308013a8d51271bfa8adafd517f65cdf3224d2385244af6d  payload/etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf
+30d9fdc95642ba6c9b496cc08fbfc5c9a3c8349d4c2b3331a1ff2bf4de06a383  payload/etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf
+44ec71cb10ef3885484a0e53a48c4cef1d028d417f4757dd7be6c95b556b92e8  payload/srv/le-app-codex/home/.config/docker/daemon.json
+97aabdffb67c48379a0e5d524d8a728154cc197efa82c163608de2387b211b3b  payload/srv/le-app-codex/home/.config/systemd/user/docker.service
+9975f57e7cd150744f0acfe6d38c7074aa1d302465e50ca19015eedf04d6587d  payload/srv/le-app-codex/home/.docker/config.json
+612b81ebb800af1fe5261d1d29284136977ce278eb689d8cdee0eec2c2969cd6  payload/srv/le-app-codex/home/.docker/contexts/meta/1b645e55bd6af77d420732b143423e7a27b12fbb5a71497e5d89c52481b6a535/meta.json
+904c9b9e35f6927c0a5e65afb4d35b6bc9eb1278c878044501281fc728c9be46  payload/usr/local/libexec/dockerd-rootless-29.6.1.sh
+9aed833454a78dc99af6c18da1cf09660ef717964adfd309f61f043b53c05464  payload/usr/local/libexec/le-app-codex-netns
+4f94d88283207b2bfa849f4e5b126efa8872be97e59edd1f700b1b0a80623035  tests/00-read-only-preflight.sh
+c540a7b6c3cdd545e8cf66deb848f79bd2b1cf0c0c83728aa9f37548289fe94f  tests/00-root-preinstall-validate.sh
+9a573d539da46fbd683da60920596118174fdcf053f79f037ba21aee2deab82d  tests/10-inert-containment.sh
+0ec4d5d955e55fa8eb053fe2efa9a60509ada31afa48b71b29652dfacbf4d1c2  tests/20-rootless-docker.sh
+bfacb009619c43b03e57834715fa625ce00c13a5b431396d68401916c31cb3a8  tests/30-install-stage1.sh
+954979e35b6f39531ce4d8395d55f011cbcfec16eaeae941b6a73b732569e029  tests/31-rollback-stage1.sh
+a9d235f4f5c1dd36ce50579344d099b5a41bf11514888de8ae8d35875f741aa4  tests/32-stage1-state-tests.sh
+1cf5dfa80b8d00de3ef1a47d84c30a891f4c6192345d5fc9247c4ab7d4f40f31  tests/run-inert-without-user-manager.sh
+e8d7b15d10e66fc050eabc758338ec928d0f82af39ee075810865435f726db74  tests/stage1-state-lib.sh

docs/le-app-database-migration/phase2b-contained-runtime/README.md

@@ -0,0 +1,47 @@
+# Phase 2B contained Codex runtime — review only
+
+Status: complete staged review set, 2026-07-12. **Do not install or execute it.** No Phase 2B file has been copied to a host target; no namespace, nftables table, service, user manager, Docker daemon, container, Codex process, authentication, checkout, migration source, credential, or production change was created.
+
+## Read-only verification record
+
+- Docker was revalidated before launcher selection: package `1:29.6.1-1`; client `29.6.1` build `8900f1d330`; daemon binary `29.6.1` build `8ec5ab355a`.
+- The exact Moby `docker-v29.6.1` `contrib/dockerd-rootless.sh` was fetched for review and reproduced SHA-256 `904c9b9e35f6927c0a5e65afb4d35b6bc9eb1278c878044501281fc728c9be46`.
+- Future acceptance images are pinned to OCI indexes: Alpine 3.23.3 `sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659` and nginx 1.29.4-alpine `sha256:4870c12cd2ca986de501a804b4f506ad3875a0b1874940ba0a2c7f763f1855b2`.
+- The root inventory at 2026-07-12 20:24 EDT is retained verbatim under `inventory/`; every checksum in its original `SHA256SUMS` passes. Host interfaces include `192.168.10.151/24` on `enp4s0`, `10.98.0.2/24` on `wg0`, public IPv6 `2603:7080:7500:1279:75aa:d64d:4cf0:8f10/64`, loopback, and the Docker bridges below. Observed public IPv4 is `74.67.173.56`. The observed gateway/router resolver is `192.168.10.1`; it is **not approved DNS** by observation.
+- `/etc/resolv.conf` also observes link-local IPv6 resolver `fe80::3e8c:f8ff:fef4:2590%enp4s0`. The proposed namespace is IPv4-only, so it is not usable there.
+- Observed Docker bridge IPv4 subnets are `10.1.0.0/16`, `10.2.0.0/16`, `10.3.0.0/16`, `10.4.0.0/16`, `10.9.0.0/16`, `10.10.0.0/16`, `10.13.0.0/16`, `10.16.0.0/16` through `10.20.0.0/16`, `10.24.0.0/16`, `10.26.0.0/16` through `10.32.0.0/16`, `10.40.0.0/16`, `10.41.0.0/16`, `10.55.0.0/16`, `10.99.0.0/16`, and `172.17.0.0/16` through `172.31.0.0/16` except `172.24` is present and all ranges in that continuous interval were observed. The policy denies their covering RFC1918 ranges and the preflight re-inventories them.
+- Observed Docker bridge IPv6 includes `fd00:1::/64`, `fd00:3::/64`, `fd00:4::/64`, `fd00:9::/64`, `fd00:10::/64`, `fd00:16::/64`, `fd00:17::/64`, `fd00:18::/64`, `fd00:20::/64`, `fd00:24::/64`, `fd00:26::/64` through `fd00:31::/64`, `fd00:40::/64`, `fd00:41::/64`, and link-local `fe80::/64` addresses. Namespace IPv6 is disabled and forward traffic is dropped.
+- `user@1200.service` is loaded/static but inactive/dead; only the packaged `10-login-barrier.conf` drop-in exists. UID 1200 is not logged in or lingering; no UID 1200 process was observed. `/run/user/1200/docker.sock` is absent.
+- `/srv/le-app-codex` is `root:le_app_codex` mode `0750`; `home`, checkout, runtime, testing, and build directories are UID/GID 1200 with mode `0700`; the source directory is root-owned `0550`; nonproduction secrets are root-owned `0750`. ACLs add no access beyond those modes. The root inventory found no project-rooted mounts.
+- Root Docker inspection records 41 networks, all covered by the private/IPv6 denials. The complete nftables export has no pre-existing Phase 2B table, chain, namespace, or interface. `tests/00-read-only-preflight.sh` requires a fresh matching inventory immediately before installation.
+
+## Artifact map
+
+The `payload/` tree mirrors proposed absolute installation paths and makes each file separately reviewable:
+
+- pinned Moby launcher;
+- aggregate `user-1200.slice` resource drop-in;
+- complete `user@1200.service` filesystem/process/device containment drop-in;
+- root-owned IPv4-only namespace unit/helper;
+- private read-only resolver configuration using the proposed public Quad9 IPv4 pair;
+- separate default-deny nftables tables with reviewed host/network values;
+- genuine rootless Docker user service;
+- daemon and client context configuration accepting only `unix:///run/user/1200/docker.sock`;
+- preflight, inert containment, and rootless Docker positive/negative tests;
+- exact installation/acceptance order and Phase 2B-only rollback.
+
+There are no remaining documentation sentinels. The operator approved Quad9's malware-blocking, DNSSEC-validating IPv4 pair, `9.9.9.9` and `149.112.112.112`. It requires **no LAN-address exception**; `192.168.10.1` and all of `192.168.0.0/16` remain denied. The root-created approval marker is intentionally absent because installation has not begun. Observed public/NAT IPv4 `74.67.173.56` remains explicitly denied; drift is a fail-closed configuration-review condition before later namespace restarts or policy regeneration.
+
+## Unresolved operator inputs
+
+1. Hard disk-growth enforcement is deferred and is not a Phase 2B installation blocker. Filesystem visibility and CPU/memory/task controls remain mandatory but are not a hard storage quota.
+2. Whether `ProtectProc=invisible` passes inert and runtime acceptance without breaking rootless Docker; compatibility must not be assumed.
+3. Later, separate approvals for starting the user manager/runtime and for the Codex authentication method. No Forge SSH exception, TCP Docker endpoint, rootful socket, LAN access, direct SMTP, or inbound publication is proposed.
+
+## Validation status
+
+The committed review set's root pre-install validator passed on TITANSERVER with zero failures: both manifests, staged nftables syntax, staged systemd units/drop-ins, shell/JSON syntax, Phase 1 ownership/modes, mount absence, installed-path absence, inactive user manager, absent linger/process/socket, and unchanged public/NAT IPv4 all passed. Missing `/usr/local/libexec` warnings were expected for the uninstalled payload. That host run predates the uncommitted Stage 1 recovery amendments; the future installer reruns the root validator against the then-current committed bytes before copying anything.
+
+Stage 1 installation and rollback are repository-native scripts, not pasted heredocs. `tests/30-install-stage1.sh` installs exactly the 16 approved static files and validates shared parents without changing them. State uses immutable, verified generation directories under `/var/lib/le-app-codex-phase2b/stage1/generations`; a root-owned regular `current` pointer is the single atomic commit point. `IN_PROGRESS` is durable before payload copying and after every directory/file transition; `COMPLETE` requires exactly all 16 files and no pending record. `tests/31-rollback-stage1.sh` uses the strict parser in `tests/stage1-state-lib.sh`, supports both statuses, journals rollback with an atomic transaction-directory tombstone, removes only recorded matching objects, and preserves retryable state on payload or directory failure. The non-mutating `tests/32-stage1-state-tests.sh` exercises the shared parser, publication failpoints, pointer/generation rejection, partial and complete rollback simulations, and failure preservation in a temporary fake filesystem. Neither operational script creates the approval marker, reloads systemd, loads nftables, creates a namespace, or starts/enables anything.
+
+See `STATIC-SAFETY-AUDIT.md`, `INSTALL-ORDER.md`, `ROLLBACK.md`, `tests/`, `inventory/`, and `MANIFEST.sha256`. Any edit invalidates the manifest and requires another review.

docs/le-app-database-migration/phase2b-contained-runtime/ROLLBACK.md

@@ -0,0 +1,9 @@
+# Phase 2B-only rollback
+
+Do not remove Phase 1 identity/workspace, Phase 2A packages, kernels, snapshots, production resources, or unrelated nftables objects.
+
+For Stage 1 rollback, run only `tests/31-rollback-stage1.sh` from a clean artifact worktree whose `MANIFEST.sha256` digest matches the authoritative state generation. The current branch may have later unrelated commits. Rollback accepts verified `IN_PROGRESS` or `COMPLETE`, uses the allowlist parser shared through `tests/stage1-state-lib.sh`, and refuses operation unless the approval marker, user manager, UID-1200 processes, socket, namespace, and project nftables tables are absent. Before removal it atomically renames the whole Stage 1 transaction subtree to a retryable cleanup tombstone. A retry accepts already-removed entries and re-verifies and removes any matching entries that remain. It removes only recorded matching payload/temporary files and created or pending directories; a `COMPLETE` record requires all 16 files. Shared parents recorded as pre-existing are never removed or altered. Immutable authoritative state remains intact through all payload and directory removals and while unreferenced state is cleaned; its manifest and checksum are removed only in the final cleanup phase.
+
+Later-stage rollback, after explicit runtime activation, is separate: stop the user manager and namespace first, then verify the runtime is inert before using a stage-appropriate reviewed rollback. Stage 1 rollback must never be used after the approval marker is created or any namespace/firewall/runtime component has been activated.
+
+If a destination file existed before Phase 2B, stop: Stage 1 has no overwrite/restore path and fails closed on pre-existence.

docs/le-app-database-migration/phase2b-contained-runtime/STATIC-SAFETY-AUDIT.md

@@ -0,0 +1,20 @@
+# Static safety audit
+
+Status: pass for final review; execution remains approval-gated.
+
+- **Endpoint:** daemon service, daemon configuration, client context, environment, and tests name only `unix:///run/user/1200/docker.sock`. No TCP, SSH, rootful, fallback, or inherited default endpoint is accepted.
+- **Lifecycle:** no linger artifact or command exists. Root explicitly controls `user@1200.service`; the namespace unit cannot start until a separate operator approval marker exists.
+- **Filesystem:** the complete user manager receives a private read-only `/srv` with only `/srv/le-app-codex` rebound, empty private `/var`, `/mnt`, `/media`, and `/opt`, private `/tmp`, protected homes/processes, explicit production/archive/transitional path tests, and inaccessible rootful sockets/runtime data.
+- **Devices/resources:** closed device policy permits only FUSE and TUN. Aggregate CPU, memory, swap, and task limits cover the user manager and descendants. Hard disk-growth enforcement is deferred and is not a Phase 2B installation blocker; these mandatory controls are not a storage quota.
+- **IPv4-only:** the namespace receives only `10.200.120.2/30`; namespace-scoped IPv6 is disabled; daemon IPv6/ip6tables are disabled; nftables drops IPv6 from the project interface.
+- **Egress:** only DNS to `9.9.9.9`/`149.112.112.112` and public TCP 80/443 are accepted. Nonpublic/reserved IPv4, loopback, link-local/metadata, multicast, all RFC1918 Docker/LAN/WireGuard ranges, direct SMTP, and all other protocols/ports drop.
+- **Host isolation:** host-to-project forwarding and unsolicited inbound traffic drop. Project traffic to host private addresses and observed public/NAT address `74.67.173.56` drops. RootlessKit host-loopback and external port publication are disabled and tested negatively.
+- **DNS:** the operator-approved Quad9 malware-blocking, DNSSEC-validating IPv4 pair avoids any LAN exception. `/etc/resolv.conf` is rebound read-only for the user manager. The observed `192.168.10.1` router resolver remains denied.
+- **Existing nftables:** the verified ruleset has no `le_app_codex` objects. Dedicated tables avoid editing Docker-owned chains. Interface-scoped terminal drops remain effective alongside existing Docker base chains.
+- **Inventory:** the root record checksums pass. UID 1200 is inactive, not lingering, has no process/runtime/socket; project ACLs and modes match Phase 1; no project-rooted mounts exist; all 41 Docker networks fall within denied IPv4/IPv6 space.
+- **Rollback:** names and paths are Phase 2B-specific; teardown deletes only the project tables, namespace/veth, marker, and manifest-listed files.
+- **Stage 1 installer:** installs exactly 16 allowlisted files; long Docker-context paths are single-line variables; existing shared parents are accepted only when real, root-owned, and not group/other writable; existing shared parent metadata is never changed.
+- **Stage 1 state/rollback:** immutable mode `0600` manifest/checksum generations record commit, artifact-manifest digest, hashes, pending/completed files, pending/created/pre-existing directories, time, and host. A verified regular `current` pointer is switched by one atomic rename only after the new generation is synced and semantically validated. Rollback accepts `IN_PROGRESS` subsets or an exact 16-file `COMPLETE`, atomically tombstones the transaction before removal, re-verifies remaining objects on retry, and calls `rmdir` only for allowlisted recorded directories.
+- **Crash recovery:** deterministic `.phase2b-new` payload temporaries are covered by `FILE_PENDING`; hidden incomplete state generations never become authoritative; old generations are retained. The parser shared by installer, rollback, and `tests/32-stage1-state-tests.sh` rejects blank, duplicate, unknown, malformed, unapproved, or escaping records. The state resolver separately rejects symlinked or escaping pointers/generations and unverified generation content. Publication failpoints cover initial and updated `IN_PROGRESS`, final `COMPLETE`, and both sides of the atomic pointer switch.
+
+Hard stops remain: changed Docker version/launcher hash, changed inventory, public/NAT address drift, missing approval marker at namespace-start time, pre-existing project tables/namespace, any acceptance failure, or any endpoint other than the single rootless Unix socket. `ProtectProc=invisible` remains an unproven runtime acceptance candidate.

docs/le-app-database-migration/phase2b-contained-runtime/inventory/SHA256SUMS

@@ -0,0 +1,9 @@
+e6f6da94601927a23d252f32de93e92c99d31fb2d2cbd9b00f2b88224dbb684e  docker-networks.json
+9a5d343092c8cf473f0e4d06cb6848f1788aa8bc41b1b3fb7412faea7ea7b48c  docker-networks.psv
+67178aa964dfa23116984dfc5c677f8c7ef8631d5d7de989193a54a620ceaec1  host-network.txt
+4695953ecd1d859198d1a5cbb6242d10ba27493ab3b1ffb3f8f77da39fd458e0  nftables-ruleset.txt
+0a0db228df70f4d15e09f5c96bd0d5ac9952f4300b898266d8963225a9815988  runtime-state.txt
+4d5c3252ac4f9f537ce3f69110127f13a88ea424cbc69a46ca75448341e2bae7  runtime-versions.txt
+1565a8f5b5f08059ab9df69d78fed1b8190ccf674a9d368a436af63c03b804a8  workspace-acls.txt
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  workspace-mounts.txt
+362b311c42fdd35bda6bcc9639403dd0f1dca17bc6469ccc9c86a9580021f046  workspace-tree.psv

docs/le-app-database-migration/phase2b-contained-runtime/inventory/docker-networks.psv

@@ -0,0 +1,41 @@
+5a9988b94efd|arrmail_backend|bridge|local
+cfae917b997e|arrmailnetmail_clamav|bridge|local
+d89dcf384c2a|arrmailnetmail_oletools|bridge|local
+b7976abb6e55|arrmailnetmail_radicale|bridge|local
+ecba5adea6ea|arrmailnetmail_tika|bridge|local
+e02b7c89a2d3|backend_net|bridge|local
+a13cb8d34076|bridge|bridge|local
+051bbcfc21d8|castopod_ma_net|bridge|local
+28584d053169|collabora_s6_net|bridge|local
+263c8508de6f|conduit_net|bridge|local
+8b881e367322|directus_net|bridge|local
+87e08370adff|forge_net|bridge|local
+bca9ecea74f1|heimdall_s6_net|bridge|local
+d905d3d625d9|host|host|local
+4ecbee63f4b0|immich_s6_net|bridge|local
+527a7cd84ff6|irc_net|bridge|local
+8200b83f03e9|jellyfin_s6_net|bridge|local
+6caddd639b0b|lasereverythingnetmanager_default|bridge|local
+875fced92cd0|lasereverythingnettv_default|bridge|local
+03ee8c9e4bea|lemmy_net|bridge|local
+68e2ed0ec6ac|mailu_net|bridge|local
+11ceaf8736f5|makearmy_net|bridge|local
+2d50ca7a8f5d|makearmyiocast_default|bridge|local
+eeee48934935|makearmyiodcm_default|bridge|local
+dee363d4e0c6|makearmyiovdo_default|bridge|local
+4efe811b8402|makearmyiowatch_peertube_net|bridge|local
+f3f5c7cfa74e|mastodon_net|bridge|local
+fea0382ed10b|meet_net|bridge|local
+f10b040acc46|misskey_net|bridge|local
+618855db6757|navidrome_s6_net|bridge|local
+dc41f9983a47|nextcloud_ma_net|bridge|local
+57b7955ca01d|none|null|local
+ed1bb1cc9d39|picsur_net|bridge|local
+59ca07fbf200|pixelfed_ma_net|bridge|local
+f9343d8383ac|privatebin_rw_net|bridge|local
+71bcae37092b|s6vinetgames_default|bridge|local
+c50ccbc5e464|s6vinetmedia_media_s6_net|bridge|local
+9891a93b5e9c|s6vinetyt_default|bridge|local
+9aea00f5a485|snappy_net|bridge|local
+f63e542ab28c|vault_net|bridge|local
+a35cbfd37253|yacht_s6_net|bridge|local

docs/le-app-database-migration/phase2b-contained-runtime/inventory/host-network.txt

@@ -0,0 +1,885 @@
+=== IPv4/IPv6 addresses ===
+lo               UNKNOWN        127.0.0.1/8 ::1/128 
+enp4s0           UP             192.168.10.151/24 2603:7080:7500:1279:75aa:d64d:4cf0:8f10/64 fe80::e6f:317c:ee82:e5e/64 
+wlo1             DOWN           
+wg0              UNKNOWN        10.98.0.2/24 
+br-11ceaf8736f5  UP             10.55.0.1/16 fe80::a065:eaff:fef3:532d/64 
+br-dee363d4e0c6  DOWN           172.29.0.1/16 fe80::b86e:58ff:fef5:85f6/64 
+docker0          UP             172.17.0.1/16 fe80::48e9:9ff:fea5:2c72/64 
+br-5a9988b94efd  UP             10.1.0.1/16 fd00:1::1/64 fe80::a843:f3ff:fedb:ef64/64 
+br-e02b7c89a2d3  UP             10.99.0.1/16 fe80::2c30:58ff:fe89:f9d2/64 
+br-875fced92cd0  DOWN           172.25.0.1/16 fe80::6c7e:7fff:fe2a:bf1d/64 
+vethf79d976@if2  UP             fe80::4c52:c7ff:fe49:3b0e/64 
+veth605aea1@if2  UP             fe80::ec3f:78ff:fe38:75b9/64 
+vethf583175@if2  UP             fe80::f0c3:fff:fe8b:74e3/64 
+vethca028f8@if2  UP             fe80::ccd1:f1ff:fe0f:c699/64 
+veth880eb86@if2  UP             fe80::548d:f8ff:fef4:c0db/64 
+veth7e2863d@if2  UP             fe80::ac5e:9cff:fe45:ec06/64 
+veth55cb2ec@if2  UP             fe80::28b8:bdff:fe81:370f/64 
+br-9aea00f5a485  UP             10.3.0.1/16 fd00:3::1/64 fe80::68b1:bff:fee2:9d17/64 
+vethee5b2b0@if2  UP             fe80::6486:bfff:fee7:22df/64 
+br-68e2ed0ec6ac  UP             10.2.0.1/16 fe80::1058:f8ff:fe69:21bb/64 
+br-b7976abb6e55  UP             172.18.0.1/16 fe80::a8fe:4ff:fe1f:d81a/64 
+br-ecba5adea6ea  UP             172.19.0.1/16 fe80::f8d4:eff:fe6e:19a9/64 
+br-cfae917b997e  UP             172.20.0.1/16 fe80::60fc:94ff:fe7d:a58f/64 
+br-d89dcf384c2a  UP             172.21.0.1/16 fe80::b471:19ff:fe52:ff1/64 
+vethbe8f01c@if2  UP             fe80::63:73ff:fede:43f9/64 
+veth38ae454@if2  UP             fe80::f01a:4eff:fef2:9942/64 
+veth2edd7d6@if2  UP             fe80::3c0c:90ff:fe10:332f/64 
+veth563d3b9@if2  UP             fe80::d037:e3ff:fe79:1a5f/64 
+veth766794b@if2  UP             fe80::3441:76ff:fe3f:f8d1/64 
+veth426f4c7@if2  UP             fe80::74c2:12ff:fe72:7875/64 
+veth362d4c6@if2  UP             fe80::f038:dbff:fefd:87d3/64 
+veth4ecfbb5@if2  UP             fe80::d847:aaff:fe89:3f9/64 
+veth2d01312@if3  UP             fe80::5455:fbff:fec6:391e/64 
+veth99bb318@if2  UP             fe80::4a3:bbff:fea9:df98/64 
+vethcae9493@if2  UP             fe80::2844:4dff:fec7:1613/64 
+veth8c83268@if2  UP             fe80::8832:52ff:fee4:8a93/64 
+veth6f6f074@if3  UP             fe80::ac67:76ff:fe15:1676/64 
+veth4216565@if3  UP             fe80::4463:6dff:fe29:79d5/64 
+veth46248ff@if4  UP             fe80::18c7:26ff:fe8b:bea4/64 
+vethc0ef06c@if2  UP             fe80::5852:d0ff:fe9e:545/64 
+br-f63e542ab28c  UP             10.4.0.1/16 fd00:4::1/64 fe80::28df:aff:fe50:a6d2/64 
+vethaeee758@if2  UP             fe80::e807:c7ff:fee0:f12d/64 
+br-8b881e367322  DOWN           10.40.0.1/16 fd00:40::1/64 fe80::c030:54ff:fe2d:eb36/64 
+br-6caddd639b0b  UP             172.22.0.1/16 fe80::c0da:5bff:fea4:92dc/64 
+veth2906c94@if2  UP             fe80::1c13:3ff:fe18:c9a4/64 
+br-2d50ca7a8f5d  UP             172.23.0.1/16 fe80::548d:1eff:fe36:12c5/64 
+vethbb40f36@if2  UP             fe80::c000:96ff:fe7d:11a8/64 
+br-dc41f9983a47  UP             10.30.0.1/16 fd00:30::1/64 fe80::78cf:3dff:fe72:528b/64 
+veth6594ba0@if2  UP             fe80::9091:4aff:feee:8942/64 
+veth28958e3@if2  UP             fe80::d037:82ff:fee7:27c5/64 
+veth1f2dc82@if3  UP             fe80::e49e:23ff:feb7:932d/64 
+veth04a7fbe@if4  UP             fe80::e488:ccff:fe2f:e545/64 
+veth2273529@if2  UP             fe80::869:a1ff:fee9:63a6/64 
+br-eeee48934935  UP             172.24.0.1/16 fe80::ac86:86ff:fe64:f2d4/64 
+veth160d05f@if2  UP             fe80::50f3:d6ff:fedd:1cd3/64 
+br-f10b040acc46  UP             10.29.0.1/16 fd00:29::1/64 fe80::4c63:fcff:fe4c:7d6a/64 
+vethd88eb9b@if2  UP             fe80::a4a0:13ff:fe7f:7c8d/64 
+veth80da983@if2  UP             fe80::a0eb:3bff:fe66:df68/64 
+veth2bde217@if3  UP             fe80::24de:7fff:fef9:e7af/64 
+br-87e08370adff  UP             10.27.0.1/16 fd00:27::1/64 fe80::40f5:bfff:fed7:8296/64 
+veth9e2bcbb@if2  UP             fe80::5030:beff:fead:c50a/64 
+veth0477205@if3  UP             fe80::48ec:7cff:fe17:27bc/64 
+br-ed1bb1cc9d39  UP             10.28.0.1/16 fd00:28::1/64 fe80::30d4:6bff:fe54:5fb3/64 
+veth370f490@if2  UP             fe80::c090:5eff:fed8:d1cc/64 
+vethca0ee65@if2  UP             fe80::c1f:b5ff:fe0a:c936/64 
+veth4692f5c@if3  UP             fe80::2c60:58ff:fe86:30d3/64 
+br-527a7cd84ff6  UP             10.20.0.1/16 fd00:20::1/64 fe80::4482:41ff:feb3:9c74/64 
+vethd14eb7e@if2  UP             fe80::84bf:b2ff:fec4:ea7/64 
+br-03ee8c9e4bea  UP             172.28.0.1/16 fe80::f01f:e5ff:fe2b:ec80/64 
+veth3c1861e@if2  UP             fe80::1c6e:c5ff:fe94:c515/64 
+veth32d5964@if2  UP             fe80::80a3:1eff:fe61:4f10/64 
+vetha548a1a@if3  UP             fe80::3c6e:51ff:fe48:e037/64 
+veth762d601@if2  UP             fe80::424:9bff:fe91:317e/64 
+vethf48aa55@if2  UP             fe80::805a:47ff:fe53:cfcd/64 
+br-f3f5c7cfa74e  UP             10.31.0.1/16 fd00:31::1/64 fe80::f4a6:b6ff:fe24:af71/64 
+vethf5f3d34@if2  UP             fe80::c006:5ff:fea6:b743/64 
+veth335556c@if2  UP             fe80::90ed:30ff:fe51:2b5a/64 
+veth9cc2ad8@if2  UP             fe80::6c50:96ff:fe29:70a6/64 
+veth6232cb7@if2  UP             fe80::64fe:2aff:fed1:1e41/64 
+veth337e2fd@if2  UP             fe80::f0bf:5ff:fee7:2b1e/64 
+veth7d6d658@if3  UP             fe80::80fb:8fff:fead:2208/64 
+veth448a204@if3  UP             fe80::90ff:b0ff:fe58:21fb/64 
+veth79ea708@if3  UP             fe80::ac43:75ff:fefa:cbfd/64 
+br-263c8508de6f  UP             10.26.0.1/16 fd00:26::1/64 fe80::d8c8:aaff:fe63:6af9/64 
+veth4ba8ed1@if2  UP             fe80::2095:66ff:fe78:518e/64 
+br-fea0382ed10b  UP             172.26.0.1/16 fe80::6c9c:c1ff:fe95:888e/64 
+veth4a87e58@if2  UP             fe80::c899:1fff:fe27:7f66/64 
+vethacfaa19@if2  UP             fe80::90ed:f4ff:feed:a749/64 
+veth30db54a@if2  UP             fe80::e855:acff:fef2:5aa3/64 
+vethe969d14@if2  UP             fe80::303f:6ff:fe24:1fa6/64 
+veth0e4600c@if2  UP             fe80::b441:acff:fe66:5981/64 
+br-f9343d8383ac  UP             10.24.0.1/16 fd00:24::1/64 fe80::c8b0:56ff:fe7e:bc48/64 
+veth21e2097@if2  UP             fe80::b48b:1aff:fe71:36d3/64 
+br-59ca07fbf200  UP             10.32.0.1/16 fe80::fc79:ccff:fefd:20d7/64 
+veth58179de@if2  UP             fe80::6cb5:cff:fea2:a675/64 
+veth6b9d50d@if2  UP             fe80::d45e:64ff:fe90:37e7/64 
+veth2445f8e@if2  UP             fe80::cc80:50ff:feb5:67b/64 
+veth368657c@if3  UP             fe80::a065:bfff:fea5:34/64 
+veth5f6906b@if3  UP             fe80::502a:e5ff:fe5c:d5fa/64 
+veth2dd045f@if4  UP             fe80::464:d7ff:fea1:a54a/64 
+veth53fd806@if4  UP             fe80::7cdd:44ff:fe90:1f77/64 
+br-051bbcfc21d8  UP             10.41.0.1/16 fd00:41::1/64 fe80::d457:2bff:fe72:23f/64 
+veth2b9371a@if2  UP             fe80::d44c:3bff:fe3b:934f/64 
+veth165b4aa@if2  UP             fe80::c85e:5aff:feaa:f812/64 
+veth8c376e6@if3  UP             fe80::542a:61ff:fe38:307c/64 
+veth73c775b@if4  UP             fe80::7462:7dff:fe8f:115d/64 
+br-4efe811b8402  UP             172.27.0.1/16 fe80::d87e:fbff:fec6:5aeb/64 
+veth56166e3@if2  UP             fe80::dc0f:5dff:fec4:7c53/64 
+veth14193e1@if2  UP             fe80::aca7:68ff:fe42:e77/64 
+vethe9fcee3@if3  UP             fe80::443:71ff:feac:bdfb/64 
+br-bca9ecea74f1  UP             10.10.0.1/16 fd00:10::1/64 fe80::4421:95ff:fe94:d7c5/64 
+veth71028db@if2  UP             fe80::a4ab:b9ff:fe3e:af94/64 
+br-a35cbfd37253  UP             10.13.0.1/16 fe80::aca7:12ff:fe18:d1b9/64 
+vethe123758@if2  UP             fe80::44ee:8eff:fe1a:bcf4/64 
+br-71bcae37092b  UP             172.30.0.1/16 fe80::286c:a2ff:fe49:5772/64 
+veth8d698e0@if2  UP             fe80::d86b:4fff:fec2:50e0/64 
+vethd87ba34@if2  UP             fe80::e87f:edff:fe10:e8d6/64 
+br-c50ccbc5e464  UP             10.19.0.1/16 fe80::9879:f6ff:fe6d:57be/64 
+veth1bece5c@if2  UP             fe80::30f1:2cff:feac:90cb/64 
+veth6091231@if2  UP             fe80::d44d:feff:fe18:d291/64 
+veth502e53b@if2  UP             fe80::a047:6eff:fe8b:1f48/64 
+br-618855db6757  UP             10.16.0.1/16 fd00:16::1/64 fe80::aca8:14ff:feee:df7c/64 
+vethe6c6432@if2  UP             fe80::e447:bff:feea:1f61/64 
+veth1f1f066@if3  UP             fe80::90da:e3ff:fefa:7464/64 
+veth26a5545@if4  UP             fe80::888d:45ff:feeb:4a48/64 
+br-28584d053169  UP             10.17.0.1/16 fd00:17::1/64 fe80::7c73:c8ff:fe04:3dd2/64 
+vethe488043@if2  UP             fe80::7069:c0ff:febd:1d88/64 
+br-4ecbee63f4b0  UP             10.18.0.1/16 fd00:18::1/64 fe80::e46c:23ff:fec3:3ab9/64 
+veth15eb212@if2  UP             fe80::5c80:75ff:feff:22dd/64 
+veth551b749@if2  UP             fe80::7c42:75ff:fe80:5953/64 
+veth41b1943@if2  UP             fe80::bc01:62ff:fe13:b616/64 
+vethc2b3531@if3  UP             fe80::b4d5:57ff:fe87:83f9/64 
+br-8200b83f03e9  UP             10.9.0.1/16 fd00:9::1/64 fe80::4c80:8fff:feec:15d4/64 
+veth62aa43d@if2  UP             fe80::acc5:57ff:fece:3b51/64 
+br-9891a93b5e9c  UP             172.31.0.1/16 fe80::e0a6:32ff:fe63:9f8d/64 
+veth081c8bf@if2  UP             fe80::3c1f:f9ff:fe36:4122/64 
+
+=== IPv4 routes ===
+default via 10.98.0.1 dev wg0 table wg0 
+default via 192.168.10.1 dev enp4s0 proto dhcp src 192.168.10.151 metric 100 
+10.1.0.0/16 dev br-5a9988b94efd proto kernel scope link src 10.1.0.1 
+10.2.0.0/16 dev br-68e2ed0ec6ac proto kernel scope link src 10.2.0.1 
+10.3.0.0/16 dev br-9aea00f5a485 proto kernel scope link src 10.3.0.1 
+10.4.0.0/16 dev br-f63e542ab28c proto kernel scope link src 10.4.0.1 
+10.9.0.0/16 dev br-8200b83f03e9 proto kernel scope link src 10.9.0.1 
+10.10.0.0/16 dev br-bca9ecea74f1 proto kernel scope link src 10.10.0.1 
+10.13.0.0/16 dev br-a35cbfd37253 proto kernel scope link src 10.13.0.1 
+10.16.0.0/16 dev br-618855db6757 proto kernel scope link src 10.16.0.1 
+10.17.0.0/16 dev br-28584d053169 proto kernel scope link src 10.17.0.1 
+10.18.0.0/16 dev br-4ecbee63f4b0 proto kernel scope link src 10.18.0.1 
+10.19.0.0/16 dev br-c50ccbc5e464 proto kernel scope link src 10.19.0.1 
+10.20.0.0/16 dev br-527a7cd84ff6 proto kernel scope link src 10.20.0.1 
+10.24.0.0/16 dev br-f9343d8383ac proto kernel scope link src 10.24.0.1 
+10.26.0.0/16 dev br-263c8508de6f proto kernel scope link src 10.26.0.1 
+10.27.0.0/16 dev br-87e08370adff proto kernel scope link src 10.27.0.1 
+10.28.0.0/16 dev br-ed1bb1cc9d39 proto kernel scope link src 10.28.0.1 
+10.29.0.0/16 dev br-f10b040acc46 proto kernel scope link src 10.29.0.1 
+10.30.0.0/16 dev br-dc41f9983a47 proto kernel scope link src 10.30.0.1 
+10.31.0.0/16 dev br-f3f5c7cfa74e proto kernel scope link src 10.31.0.1 
+10.32.0.0/16 dev br-59ca07fbf200 proto kernel scope link src 10.32.0.1 
+10.40.0.0/16 dev br-8b881e367322 proto kernel scope link src 10.40.0.1 linkdown 
+10.41.0.0/16 dev br-051bbcfc21d8 proto kernel scope link src 10.41.0.1 
+10.55.0.0/16 dev br-11ceaf8736f5 proto kernel scope link src 10.55.0.1 
+10.98.0.0/24 dev wg0 proto kernel scope link src 10.98.0.2 
+10.99.0.0/16 dev br-e02b7c89a2d3 proto kernel scope link src 10.99.0.1 
+172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 
+172.18.0.0/16 dev br-b7976abb6e55 proto kernel scope link src 172.18.0.1 
+172.19.0.0/16 dev br-ecba5adea6ea proto kernel scope link src 172.19.0.1 
+172.20.0.0/16 dev br-cfae917b997e proto kernel scope link src 172.20.0.1 
+172.21.0.0/16 dev br-d89dcf384c2a proto kernel scope link src 172.21.0.1 
+172.22.0.0/16 dev br-6caddd639b0b proto kernel scope link src 172.22.0.1 
+172.23.0.0/16 dev br-2d50ca7a8f5d proto kernel scope link src 172.23.0.1 
+172.24.0.0/16 dev br-eeee48934935 proto kernel scope link src 172.24.0.1 
+172.25.0.0/16 dev br-875fced92cd0 proto kernel scope link src 172.25.0.1 linkdown 
+172.26.0.0/16 dev br-fea0382ed10b proto kernel scope link src 172.26.0.1 
+172.27.0.0/16 dev br-4efe811b8402 proto kernel scope link src 172.27.0.1 
+172.28.0.0/16 dev br-03ee8c9e4bea proto kernel scope link src 172.28.0.1 
+172.29.0.0/16 dev br-dee363d4e0c6 proto kernel scope link src 172.29.0.1 linkdown 
+172.30.0.0/16 dev br-71bcae37092b proto kernel scope link src 172.30.0.1 
+172.31.0.0/16 dev br-9891a93b5e9c proto kernel scope link src 172.31.0.1 
+192.168.10.0/24 dev enp4s0 proto kernel scope link src 192.168.10.151 metric 100 
+local 10.1.0.1 dev br-5a9988b94efd table local proto kernel scope host src 10.1.0.1 
+broadcast 10.1.255.255 dev br-5a9988b94efd table local proto kernel scope link src 10.1.0.1 
+local 10.2.0.1 dev br-68e2ed0ec6ac table local proto kernel scope host src 10.2.0.1 
+broadcast 10.2.255.255 dev br-68e2ed0ec6ac table local proto kernel scope link src 10.2.0.1 
+local 10.3.0.1 dev br-9aea00f5a485 table local proto kernel scope host src 10.3.0.1 
+broadcast 10.3.255.255 dev br-9aea00f5a485 table local proto kernel scope link src 10.3.0.1 
+local 10.4.0.1 dev br-f63e542ab28c table local proto kernel scope host src 10.4.0.1 
+broadcast 10.4.255.255 dev br-f63e542ab28c table local proto kernel scope link src 10.4.0.1 
+local 10.9.0.1 dev br-8200b83f03e9 table local proto kernel scope host src 10.9.0.1 
+broadcast 10.9.255.255 dev br-8200b83f03e9 table local proto kernel scope link src 10.9.0.1 
+local 10.10.0.1 dev br-bca9ecea74f1 table local proto kernel scope host src 10.10.0.1 
+broadcast 10.10.255.255 dev br-bca9ecea74f1 table local proto kernel scope link src 10.10.0.1 
+local 10.13.0.1 dev br-a35cbfd37253 table local proto kernel scope host src 10.13.0.1 
+broadcast 10.13.255.255 dev br-a35cbfd37253 table local proto kernel scope link src 10.13.0.1 
+local 10.16.0.1 dev br-618855db6757 table local proto kernel scope host src 10.16.0.1 
+broadcast 10.16.255.255 dev br-618855db6757 table local proto kernel scope link src 10.16.0.1 
+local 10.17.0.1 dev br-28584d053169 table local proto kernel scope host src 10.17.0.1 
+broadcast 10.17.255.255 dev br-28584d053169 table local proto kernel scope link src 10.17.0.1 
+local 10.18.0.1 dev br-4ecbee63f4b0 table local proto kernel scope host src 10.18.0.1 
+broadcast 10.18.255.255 dev br-4ecbee63f4b0 table local proto kernel scope link src 10.18.0.1 
+local 10.19.0.1 dev br-c50ccbc5e464 table local proto kernel scope host src 10.19.0.1 
+broadcast 10.19.255.255 dev br-c50ccbc5e464 table local proto kernel scope link src 10.19.0.1 
+local 10.20.0.1 dev br-527a7cd84ff6 table local proto kernel scope host src 10.20.0.1 
+broadcast 10.20.255.255 dev br-527a7cd84ff6 table local proto kernel scope link src 10.20.0.1 
+local 10.24.0.1 dev br-f9343d8383ac table local proto kernel scope host src 10.24.0.1 
+broadcast 10.24.255.255 dev br-f9343d8383ac table local proto kernel scope link src 10.24.0.1 
+local 10.26.0.1 dev br-263c8508de6f table local proto kernel scope host src 10.26.0.1 
+broadcast 10.26.255.255 dev br-263c8508de6f table local proto kernel scope link src 10.26.0.1 
+local 10.27.0.1 dev br-87e08370adff table local proto kernel scope host src 10.27.0.1 
+broadcast 10.27.255.255 dev br-87e08370adff table local proto kernel scope link src 10.27.0.1 
+local 10.28.0.1 dev br-ed1bb1cc9d39 table local proto kernel scope host src 10.28.0.1 
+broadcast 10.28.255.255 dev br-ed1bb1cc9d39 table local proto kernel scope link src 10.28.0.1 
+local 10.29.0.1 dev br-f10b040acc46 table local proto kernel scope host src 10.29.0.1 
+broadcast 10.29.255.255 dev br-f10b040acc46 table local proto kernel scope link src 10.29.0.1 
+local 10.30.0.1 dev br-dc41f9983a47 table local proto kernel scope host src 10.30.0.1 
+broadcast 10.30.255.255 dev br-dc41f9983a47 table local proto kernel scope link src 10.30.0.1 
+local 10.31.0.1 dev br-f3f5c7cfa74e table local proto kernel scope host src 10.31.0.1 
+broadcast 10.31.255.255 dev br-f3f5c7cfa74e table local proto kernel scope link src 10.31.0.1 
+local 10.32.0.1 dev br-59ca07fbf200 table local proto kernel scope host src 10.32.0.1 
+broadcast 10.32.255.255 dev br-59ca07fbf200 table local proto kernel scope link src 10.32.0.1 
+local 10.40.0.1 dev br-8b881e367322 table local proto kernel scope host src 10.40.0.1 
+broadcast 10.40.255.255 dev br-8b881e367322 table local proto kernel scope link src 10.40.0.1 linkdown 
+local 10.41.0.1 dev br-051bbcfc21d8 table local proto kernel scope host src 10.41.0.1 
+broadcast 10.41.255.255 dev br-051bbcfc21d8 table local proto kernel scope link src 10.41.0.1 
+local 10.55.0.1 dev br-11ceaf8736f5 table local proto kernel scope host src 10.55.0.1 
+broadcast 10.55.255.255 dev br-11ceaf8736f5 table local proto kernel scope link src 10.55.0.1 
+local 10.98.0.2 dev wg0 table local proto kernel scope host src 10.98.0.2 
+broadcast 10.98.0.255 dev wg0 table local proto kernel scope link src 10.98.0.2 
+local 10.99.0.1 dev br-e02b7c89a2d3 table local proto kernel scope host src 10.99.0.1 
+broadcast 10.99.255.255 dev br-e02b7c89a2d3 table local proto kernel scope link src 10.99.0.1 
+local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
+local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
+broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
+local 172.17.0.1 dev docker0 table local proto kernel scope host src 172.17.0.1 
+broadcast 172.17.255.255 dev docker0 table local proto kernel scope link src 172.17.0.1 
+local 172.18.0.1 dev br-b7976abb6e55 table local proto kernel scope host src 172.18.0.1 
+broadcast 172.18.255.255 dev br-b7976abb6e55 table local proto kernel scope link src 172.18.0.1 
+local 172.19.0.1 dev br-ecba5adea6ea table local proto kernel scope host src 172.19.0.1 
+broadcast 172.19.255.255 dev br-ecba5adea6ea table local proto kernel scope link src 172.19.0.1 
+local 172.20.0.1 dev br-cfae917b997e table local proto kernel scope host src 172.20.0.1 
+broadcast 172.20.255.255 dev br-cfae917b997e table local proto kernel scope link src 172.20.0.1 
+local 172.21.0.1 dev br-d89dcf384c2a table local proto kernel scope host src 172.21.0.1 
+broadcast 172.21.255.255 dev br-d89dcf384c2a table local proto kernel scope link src 172.21.0.1 
+local 172.22.0.1 dev br-6caddd639b0b table local proto kernel scope host src 172.22.0.1 
+broadcast 172.22.255.255 dev br-6caddd639b0b table local proto kernel scope link src 172.22.0.1 
+local 172.23.0.1 dev br-2d50ca7a8f5d table local proto kernel scope host src 172.23.0.1 
+broadcast 172.23.255.255 dev br-2d50ca7a8f5d table local proto kernel scope link src 172.23.0.1 
+local 172.24.0.1 dev br-eeee48934935 table local proto kernel scope host src 172.24.0.1 
+broadcast 172.24.255.255 dev br-eeee48934935 table local proto kernel scope link src 172.24.0.1 
+local 172.25.0.1 dev br-875fced92cd0 table local proto kernel scope host src 172.25.0.1 
+broadcast 172.25.255.255 dev br-875fced92cd0 table local proto kernel scope link src 172.25.0.1 linkdown 
+local 172.26.0.1 dev br-fea0382ed10b table local proto kernel scope host src 172.26.0.1 
+broadcast 172.26.255.255 dev br-fea0382ed10b table local proto kernel scope link src 172.26.0.1 
+local 172.27.0.1 dev br-4efe811b8402 table local proto kernel scope host src 172.27.0.1 
+broadcast 172.27.255.255 dev br-4efe811b8402 table local proto kernel scope link src 172.27.0.1 
+local 172.28.0.1 dev br-03ee8c9e4bea table local proto kernel scope host src 172.28.0.1 
+broadcast 172.28.255.255 dev br-03ee8c9e4bea table local proto kernel scope link src 172.28.0.1 
+local 172.29.0.1 dev br-dee363d4e0c6 table local proto kernel scope host src 172.29.0.1 
+broadcast 172.29.255.255 dev br-dee363d4e0c6 table local proto kernel scope link src 172.29.0.1 linkdown 
+local 172.30.0.1 dev br-71bcae37092b table local proto kernel scope host src 172.30.0.1 
+broadcast 172.30.255.255 dev br-71bcae37092b table local proto kernel scope link src 172.30.0.1 
+local 172.31.0.1 dev br-9891a93b5e9c table local proto kernel scope host src 172.31.0.1 
+broadcast 172.31.255.255 dev br-9891a93b5e9c table local proto kernel scope link src 172.31.0.1 
+local 192.168.10.151 dev enp4s0 table local proto kernel scope host src 192.168.10.151 
+broadcast 192.168.10.255 dev enp4s0 table local proto kernel scope link src 192.168.10.151 
+
+=== IPv6 routes ===
+2603:7080:7500:1279::/64 dev enp4s0 proto ra metric 100 pref medium
+fd00:1::/64 dev br-5a9988b94efd proto kernel metric 256 pref medium
+fd00:3::/64 dev br-9aea00f5a485 proto kernel metric 256 pref medium
+fd00:4::/64 dev br-f63e542ab28c proto kernel metric 256 pref medium
+fd00:9::/64 dev br-8200b83f03e9 proto kernel metric 256 pref medium
+fd00:10::/64 dev br-bca9ecea74f1 proto kernel metric 256 pref medium
+fd00:16::/64 dev br-618855db6757 proto kernel metric 256 pref medium
+fd00:17::/64 dev br-28584d053169 proto kernel metric 256 pref medium
+fd00:18::/64 dev br-4ecbee63f4b0 proto kernel metric 256 pref medium
+fd00:20::/64 dev br-527a7cd84ff6 proto kernel metric 256 pref medium
+fd00:24::/64 dev br-f9343d8383ac proto kernel metric 256 pref medium
+fd00:26::/64 dev br-263c8508de6f proto kernel metric 256 pref medium
+fd00:27::/64 dev br-87e08370adff proto kernel metric 256 pref medium
+fd00:28::/64 dev br-ed1bb1cc9d39 proto kernel metric 256 pref medium
+fd00:29::/64 dev br-f10b040acc46 proto kernel metric 256 pref medium
+fd00:30::/64 dev br-dc41f9983a47 proto kernel metric 256 pref medium
+fd00:31::/64 dev br-f3f5c7cfa74e proto kernel metric 256 pref medium
+fd00:40::/64 dev br-8b881e367322 proto kernel metric 256 linkdown pref medium
+fd00:41::/64 dev br-051bbcfc21d8 proto kernel metric 256 pref medium
+fe80::/64 dev vethf79d976 proto kernel metric 256 pref medium
+fe80::/64 dev docker0 proto kernel metric 256 pref medium
+fe80::/64 dev veth605aea1 proto kernel metric 256 pref medium
+fe80::/64 dev br-5a9988b94efd proto kernel metric 256 pref medium
+fe80::/64 dev vethca028f8 proto kernel metric 256 pref medium
+fe80::/64 dev br-e02b7c89a2d3 proto kernel metric 256 pref medium
+fe80::/64 dev br-dee363d4e0c6 proto kernel metric 256 linkdown pref medium
+fe80::/64 dev br-875fced92cd0 proto kernel metric 256 linkdown pref medium
+fe80::/64 dev vethf583175 proto kernel metric 256 pref medium
+fe80::/64 dev br-11ceaf8736f5 proto kernel metric 256 pref medium
+fe80::/64 dev veth880eb86 proto kernel metric 256 pref medium
+fe80::/64 dev veth7e2863d proto kernel metric 256 pref medium
+fe80::/64 dev veth55cb2ec proto kernel metric 256 pref medium
+fe80::/64 dev vethee5b2b0 proto kernel metric 256 pref medium
+fe80::/64 dev br-9aea00f5a485 proto kernel metric 256 pref medium
+fe80::/64 dev vethbe8f01c proto kernel metric 256 pref medium
+fe80::/64 dev br-b7976abb6e55 proto kernel metric 256 pref medium
+fe80::/64 dev veth2edd7d6 proto kernel metric 256 pref medium
+fe80::/64 dev br-68e2ed0ec6ac proto kernel metric 256 pref medium
+fe80::/64 dev veth38ae454 proto kernel metric 256 pref medium
+fe80::/64 dev br-cfae917b997e proto kernel metric 256 pref medium
+fe80::/64 dev veth563d3b9 proto kernel metric 256 pref medium
+fe80::/64 dev br-ecba5adea6ea proto kernel metric 256 pref medium
+fe80::/64 dev veth766794b proto kernel metric 256 pref medium
+fe80::/64 dev br-d89dcf384c2a proto kernel metric 256 pref medium
+fe80::/64 dev veth426f4c7 proto kernel metric 256 pref medium
+fe80::/64 dev veth362d4c6 proto kernel metric 256 pref medium
+fe80::/64 dev veth2d01312 proto kernel metric 256 pref medium
+fe80::/64 dev veth4ecfbb5 proto kernel metric 256 pref medium
+fe80::/64 dev veth99bb318 proto kernel metric 256 pref medium
+fe80::/64 dev vethcae9493 proto kernel metric 256 pref medium
+fe80::/64 dev veth8c83268 proto kernel metric 256 pref medium
+fe80::/64 dev veth6f6f074 proto kernel metric 256 pref medium
+fe80::/64 dev veth4216565 proto kernel metric 256 pref medium
+fe80::/64 dev veth46248ff proto kernel metric 256 pref medium
+fe80::/64 dev vethc0ef06c proto kernel metric 256 pref medium
+fe80::/64 dev vethaeee758 proto kernel metric 256 pref medium
+fe80::/64 dev br-f63e542ab28c proto kernel metric 256 pref medium
+fe80::/64 dev br-8b881e367322 proto kernel metric 256 linkdown pref medium
+fe80::/64 dev veth2906c94 proto kernel metric 256 pref medium
+fe80::/64 dev br-6caddd639b0b proto kernel metric 256 pref medium
+fe80::/64 dev vethbb40f36 proto kernel metric 256 pref medium
+fe80::/64 dev br-2d50ca7a8f5d proto kernel metric 256 pref medium
+fe80::/64 dev veth6594ba0 proto kernel metric 256 pref medium
+fe80::/64 dev br-dc41f9983a47 proto kernel metric 256 pref medium
+fe80::/64 dev veth28958e3 proto kernel metric 256 pref medium
+fe80::/64 dev veth1f2dc82 proto kernel metric 256 pref medium
+fe80::/64 dev veth04a7fbe proto kernel metric 256 pref medium
+fe80::/64 dev veth2273529 proto kernel metric 256 pref medium
+fe80::/64 dev veth160d05f proto kernel metric 256 pref medium
+fe80::/64 dev br-eeee48934935 proto kernel metric 256 pref medium
+fe80::/64 dev vethd88eb9b proto kernel metric 256 pref medium
+fe80::/64 dev br-f10b040acc46 proto kernel metric 256 pref medium
+fe80::/64 dev veth80da983 proto kernel metric 256 pref medium
+fe80::/64 dev veth2bde217 proto kernel metric 256 pref medium
+fe80::/64 dev veth9e2bcbb proto kernel metric 256 pref medium
+fe80::/64 dev veth0477205 proto kernel metric 256 pref medium
+fe80::/64 dev br-87e08370adff proto kernel metric 256 pref medium
+fe80::/64 dev veth370f490 proto kernel metric 256 pref medium
+fe80::/64 dev br-ed1bb1cc9d39 proto kernel metric 256 pref medium
+fe80::/64 dev vethca0ee65 proto kernel metric 256 pref medium
+fe80::/64 dev veth4692f5c proto kernel metric 256 pref medium
+fe80::/64 dev vethd14eb7e proto kernel metric 256 pref medium
+fe80::/64 dev br-527a7cd84ff6 proto kernel metric 256 pref medium
+fe80::/64 dev veth3c1861e proto kernel metric 256 pref medium
+fe80::/64 dev br-03ee8c9e4bea proto kernel metric 256 pref medium
+fe80::/64 dev veth32d5964 proto kernel metric 256 pref medium
+fe80::/64 dev vetha548a1a proto kernel metric 256 pref medium
+fe80::/64 dev veth762d601 proto kernel metric 256 pref medium
+fe80::/64 dev vethf48aa55 proto kernel metric 256 pref medium
+fe80::/64 dev vethf5f3d34 proto kernel metric 256 pref medium
+fe80::/64 dev br-f3f5c7cfa74e proto kernel metric 256 pref medium
+fe80::/64 dev veth335556c proto kernel metric 256 pref medium
+fe80::/64 dev veth9cc2ad8 proto kernel metric 256 pref medium
+fe80::/64 dev veth6232cb7 proto kernel metric 256 pref medium
+fe80::/64 dev veth337e2fd proto kernel metric 256 pref medium
+fe80::/64 dev veth7d6d658 proto kernel metric 256 pref medium
+fe80::/64 dev veth448a204 proto kernel metric 256 pref medium
+fe80::/64 dev veth79ea708 proto kernel metric 256 pref medium
+fe80::/64 dev veth4ba8ed1 proto kernel metric 256 pref medium
+fe80::/64 dev br-263c8508de6f proto kernel metric 256 pref medium
+fe80::/64 dev veth4a87e58 proto kernel metric 256 pref medium
+fe80::/64 dev br-fea0382ed10b proto kernel metric 256 pref medium
+fe80::/64 dev vethacfaa19 proto kernel metric 256 pref medium
+fe80::/64 dev veth30db54a proto kernel metric 256 pref medium
+fe80::/64 dev vethe969d14 proto kernel metric 256 pref medium
+fe80::/64 dev veth0e4600c proto kernel metric 256 pref medium
+fe80::/64 dev veth21e2097 proto kernel metric 256 pref medium
+fe80::/64 dev br-f9343d8383ac proto kernel metric 256 pref medium
+fe80::/64 dev veth58179de proto kernel metric 256 pref medium
+fe80::/64 dev br-59ca07fbf200 proto kernel metric 256 pref medium
+fe80::/64 dev veth6b9d50d proto kernel metric 256 pref medium
+fe80::/64 dev veth2445f8e proto kernel metric 256 pref medium
+fe80::/64 dev veth368657c proto kernel metric 256 pref medium
+fe80::/64 dev veth5f6906b proto kernel metric 256 pref medium
+fe80::/64 dev veth2dd045f proto kernel metric 256 pref medium
+fe80::/64 dev veth53fd806 proto kernel metric 256 pref medium
+fe80::/64 dev veth2b9371a proto kernel metric 256 pref medium
+fe80::/64 dev br-051bbcfc21d8 proto kernel metric 256 pref medium
+fe80::/64 dev veth165b4aa proto kernel metric 256 pref medium
+fe80::/64 dev veth8c376e6 proto kernel metric 256 pref medium
+fe80::/64 dev veth73c775b proto kernel metric 256 pref medium
+fe80::/64 dev veth56166e3 proto kernel metric 256 pref medium
+fe80::/64 dev br-4efe811b8402 proto kernel metric 256 pref medium
+fe80::/64 dev veth14193e1 proto kernel metric 256 pref medium
+fe80::/64 dev vethe9fcee3 proto kernel metric 256 pref medium
+fe80::/64 dev veth71028db proto kernel metric 256 pref medium
+fe80::/64 dev br-bca9ecea74f1 proto kernel metric 256 pref medium
+fe80::/64 dev vethe123758 proto kernel metric 256 pref medium
+fe80::/64 dev br-a35cbfd37253 proto kernel metric 256 pref medium
+fe80::/64 dev veth8d698e0 proto kernel metric 256 pref medium
+fe80::/64 dev br-71bcae37092b proto kernel metric 256 pref medium
+fe80::/64 dev vethd87ba34 proto kernel metric 256 pref medium
+fe80::/64 dev veth1bece5c proto kernel metric 256 pref medium
+fe80::/64 dev br-c50ccbc5e464 proto kernel metric 256 pref medium
+fe80::/64 dev veth6091231 proto kernel metric 256 pref medium
+fe80::/64 dev veth502e53b proto kernel metric 256 pref medium
+fe80::/64 dev vethe6c6432 proto kernel metric 256 pref medium
+fe80::/64 dev br-618855db6757 proto kernel metric 256 pref medium
+fe80::/64 dev veth1f1f066 proto kernel metric 256 pref medium
+fe80::/64 dev veth26a5545 proto kernel metric 256 pref medium
+fe80::/64 dev vethe488043 proto kernel metric 256 pref medium
+fe80::/64 dev br-28584d053169 proto kernel metric 256 pref medium
+fe80::/64 dev veth551b749 proto kernel metric 256 pref medium
+fe80::/64 dev veth15eb212 proto kernel metric 256 pref medium
+fe80::/64 dev br-4ecbee63f4b0 proto kernel metric 256 pref medium
+fe80::/64 dev veth41b1943 proto kernel metric 256 pref medium
+fe80::/64 dev vethc2b3531 proto kernel metric 256 pref medium
+fe80::/64 dev veth62aa43d proto kernel metric 256 pref medium
+fe80::/64 dev br-8200b83f03e9 proto kernel metric 256 pref medium
+fe80::/64 dev veth081c8bf proto kernel metric 256 pref medium
+fe80::/64 dev br-9891a93b5e9c proto kernel metric 256 pref medium
+fe80::/64 dev enp4s0 proto kernel metric 1024 pref medium
+default via fe80::3e8c:f8ff:fef4:2590 dev enp4s0 proto ra metric 100 pref medium
+local ::1 dev lo table local proto kernel metric 0 pref medium
+anycast 2603:7080:7500:1279:: dev enp4s0 table local proto kernel metric 0 pref medium
+local 2603:7080:7500:1279:75aa:d64d:4cf0:8f10 dev enp4s0 table local proto kernel metric 0 pref medium
+anycast fd00:1:: dev br-5a9988b94efd table local proto kernel metric 0 pref medium
+local fd00:1::1 dev br-5a9988b94efd table local proto kernel metric 0 pref medium
+anycast fd00:3:: dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
+local fd00:3::1 dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
+anycast fd00:4:: dev br-f63e542ab28c table local proto kernel metric 0 pref medium
+local fd00:4::1 dev br-f63e542ab28c table local proto kernel metric 0 pref medium
+anycast fd00:9:: dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
+local fd00:9::1 dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
+anycast fd00:10:: dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
+local fd00:10::1 dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
+anycast fd00:16:: dev br-618855db6757 table local proto kernel metric 0 pref medium
+local fd00:16::1 dev br-618855db6757 table local proto kernel metric 0 pref medium
+anycast fd00:17:: dev br-28584d053169 table local proto kernel metric 0 pref medium
+local fd00:17::1 dev br-28584d053169 table local proto kernel metric 0 pref medium
+anycast fd00:18:: dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
+local fd00:18::1 dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
+anycast fd00:20:: dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
+local fd00:20::1 dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
+anycast fd00:24:: dev br-f9343d8383ac table local proto kernel metric 0 pref medium
+local fd00:24::1 dev br-f9343d8383ac table local proto kernel metric 0 pref medium
+anycast fd00:26:: dev br-263c8508de6f table local proto kernel metric 0 pref medium
+local fd00:26::1 dev br-263c8508de6f table local proto kernel metric 0 pref medium
+anycast fd00:27:: dev br-87e08370adff table local proto kernel metric 0 pref medium
+local fd00:27::1 dev br-87e08370adff table local proto kernel metric 0 pref medium
+anycast fd00:28:: dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
+local fd00:28::1 dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
+anycast fd00:29:: dev br-f10b040acc46 table local proto kernel metric 0 pref medium
+local fd00:29::1 dev br-f10b040acc46 table local proto kernel metric 0 pref medium
+anycast fd00:30:: dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
+local fd00:30::1 dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
+anycast fd00:31:: dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
+local fd00:31::1 dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
+anycast fd00:40:: dev br-8b881e367322 table local proto kernel metric 0 pref medium
+local fd00:40::1 dev br-8b881e367322 table local proto kernel metric 0 pref medium
+anycast fd00:41:: dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
+local fd00:41::1 dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
+anycast fe80:: dev enp4s0 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth605aea1 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethf79d976 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-5a9988b94efd table local proto kernel metric 0 pref medium
+anycast fe80:: dev docker0 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-dee363d4e0c6 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethca028f8 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethf583175 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-e02b7c89a2d3 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-875fced92cd0 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-11ceaf8736f5 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth880eb86 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethee5b2b0 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth55cb2ec table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth766794b table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth38ae454 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethbe8f01c table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth563d3b9 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-b7976abb6e55 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-68e2ed0ec6ac table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth7e2863d table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-cfae917b997e table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth4216565 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth2edd7d6 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethcae9493 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth426f4c7 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-ecba5adea6ea table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth2d01312 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth8c83268 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth362d4c6 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth6f6f074 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth99bb318 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-d89dcf384c2a table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-8b881e367322 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth4ecfbb5 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethc0ef06c table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth46248ff table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethaeee758 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethbb40f36 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-2d50ca7a8f5d table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-6caddd639b0b table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-f63e542ab28c table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth04a7fbe table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth2906c94 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth28958e3 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth1f2dc82 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-f10b040acc46 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethd88eb9b table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth6594ba0 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth2273529 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-eeee48934935 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth160d05f table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth2bde217 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth80da983 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth9e2bcbb table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth370f490 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-87e08370adff table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth0477205 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethd14eb7e table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth3c1861e table local proto kernel metric 0 pref medium
+anycast fe80:: dev vetha548a1a table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethca0ee65 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethf48aa55 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth32d5964 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-03ee8c9e4bea table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth4692f5c table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth79ea708 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth7d6d658 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth9cc2ad8 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth6232cb7 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth762d601 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth337e2fd table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth335556c table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth4ba8ed1 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-fea0382ed10b table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethf5f3d34 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth448a204 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-263c8508de6f table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth4a87e58 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethe969d14 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth0e4600c table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth21e2097 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth30db54a table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethacfaa19 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-f9343d8383ac table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-59ca07fbf200 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth6b9d50d table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth2dd045f table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth2445f8e table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth58179de table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth368657c table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth5f6906b table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth165b4aa table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth53fd806 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth8c376e6 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth2b9371a table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth56166e3 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth73c775b table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-4efe811b8402 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethe9fcee3 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth14193e1 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth71028db table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-a35cbfd37253 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth8d698e0 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethe123758 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-71bcae37092b table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth6091231 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethd87ba34 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth1bece5c table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-c50ccbc5e464 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth26a5545 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth502e53b table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethe6c6432 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-618855db6757 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth1f1f066 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethe488043 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-28584d053169 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth41b1943 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth551b749 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth15eb212 table local proto kernel metric 0 pref medium
+anycast fe80:: dev vethc2b3531 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth62aa43d table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
+anycast fe80:: dev br-9891a93b5e9c table local proto kernel metric 0 pref medium
+anycast fe80:: dev veth081c8bf table local proto kernel metric 0 pref medium
+local fe80::63:73ff:fede:43f9 dev vethbe8f01c table local proto kernel metric 0 pref medium
+local fe80::424:9bff:fe91:317e dev veth762d601 table local proto kernel metric 0 pref medium
+local fe80::443:71ff:feac:bdfb dev vethe9fcee3 table local proto kernel metric 0 pref medium
+local fe80::464:d7ff:fea1:a54a dev veth2dd045f table local proto kernel metric 0 pref medium
+local fe80::4a3:bbff:fea9:df98 dev veth99bb318 table local proto kernel metric 0 pref medium
+local fe80::869:a1ff:fee9:63a6 dev veth2273529 table local proto kernel metric 0 pref medium
+local fe80::c1f:b5ff:fe0a:c936 dev vethca0ee65 table local proto kernel metric 0 pref medium
+local fe80::e6f:317c:ee82:e5e dev enp4s0 table local proto kernel metric 0 pref medium
+local fe80::1058:f8ff:fe69:21bb dev br-68e2ed0ec6ac table local proto kernel metric 0 pref medium
+local fe80::18c7:26ff:fe8b:bea4 dev veth46248ff table local proto kernel metric 0 pref medium
+local fe80::1c13:3ff:fe18:c9a4 dev veth2906c94 table local proto kernel metric 0 pref medium
+local fe80::1c6e:c5ff:fe94:c515 dev veth3c1861e table local proto kernel metric 0 pref medium
+local fe80::2095:66ff:fe78:518e dev veth4ba8ed1 table local proto kernel metric 0 pref medium
+local fe80::24de:7fff:fef9:e7af dev veth2bde217 table local proto kernel metric 0 pref medium
+local fe80::2844:4dff:fec7:1613 dev vethcae9493 table local proto kernel metric 0 pref medium
+local fe80::286c:a2ff:fe49:5772 dev br-71bcae37092b table local proto kernel metric 0 pref medium
+local fe80::28b8:bdff:fe81:370f dev veth55cb2ec table local proto kernel metric 0 pref medium
+local fe80::28df:aff:fe50:a6d2 dev br-f63e542ab28c table local proto kernel metric 0 pref medium
+local fe80::2c30:58ff:fe89:f9d2 dev br-e02b7c89a2d3 table local proto kernel metric 0 pref medium
+local fe80::2c60:58ff:fe86:30d3 dev veth4692f5c table local proto kernel metric 0 pref medium
+local fe80::303f:6ff:fe24:1fa6 dev vethe969d14 table local proto kernel metric 0 pref medium
+local fe80::30d4:6bff:fe54:5fb3 dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
+local fe80::30f1:2cff:feac:90cb dev veth1bece5c table local proto kernel metric 0 pref medium
+local fe80::3441:76ff:fe3f:f8d1 dev veth766794b table local proto kernel metric 0 pref medium
+local fe80::3c0c:90ff:fe10:332f dev veth2edd7d6 table local proto kernel metric 0 pref medium
+local fe80::3c1f:f9ff:fe36:4122 dev veth081c8bf table local proto kernel metric 0 pref medium
+local fe80::3c6e:51ff:fe48:e037 dev vetha548a1a table local proto kernel metric 0 pref medium
+local fe80::40f5:bfff:fed7:8296 dev br-87e08370adff table local proto kernel metric 0 pref medium
+local fe80::4421:95ff:fe94:d7c5 dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
+local fe80::4463:6dff:fe29:79d5 dev veth4216565 table local proto kernel metric 0 pref medium
+local fe80::4482:41ff:feb3:9c74 dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
+local fe80::44ee:8eff:fe1a:bcf4 dev vethe123758 table local proto kernel metric 0 pref medium
+local fe80::48e9:9ff:fea5:2c72 dev docker0 table local proto kernel metric 0 pref medium
+local fe80::48ec:7cff:fe17:27bc dev veth0477205 table local proto kernel metric 0 pref medium
+local fe80::4c52:c7ff:fe49:3b0e dev vethf79d976 table local proto kernel metric 0 pref medium
+local fe80::4c63:fcff:fe4c:7d6a dev br-f10b040acc46 table local proto kernel metric 0 pref medium
+local fe80::4c80:8fff:feec:15d4 dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
+local fe80::502a:e5ff:fe5c:d5fa dev veth5f6906b table local proto kernel metric 0 pref medium
+local fe80::5030:beff:fead:c50a dev veth9e2bcbb table local proto kernel metric 0 pref medium
+local fe80::50f3:d6ff:fedd:1cd3 dev veth160d05f table local proto kernel metric 0 pref medium
+local fe80::542a:61ff:fe38:307c dev veth8c376e6 table local proto kernel metric 0 pref medium
+local fe80::5455:fbff:fec6:391e dev veth2d01312 table local proto kernel metric 0 pref medium
+local fe80::548d:1eff:fe36:12c5 dev br-2d50ca7a8f5d table local proto kernel metric 0 pref medium
+local fe80::548d:f8ff:fef4:c0db dev veth880eb86 table local proto kernel metric 0 pref medium
+local fe80::5852:d0ff:fe9e:545 dev vethc0ef06c table local proto kernel metric 0 pref medium
+local fe80::5c80:75ff:feff:22dd dev veth15eb212 table local proto kernel metric 0 pref medium
+local fe80::60fc:94ff:fe7d:a58f dev br-cfae917b997e table local proto kernel metric 0 pref medium
+local fe80::6486:bfff:fee7:22df dev vethee5b2b0 table local proto kernel metric 0 pref medium
+local fe80::64fe:2aff:fed1:1e41 dev veth6232cb7 table local proto kernel metric 0 pref medium
+local fe80::68b1:bff:fee2:9d17 dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
+local fe80::6c50:96ff:fe29:70a6 dev veth9cc2ad8 table local proto kernel metric 0 pref medium
+local fe80::6c7e:7fff:fe2a:bf1d dev br-875fced92cd0 table local proto kernel metric 0 pref medium
+local fe80::6c9c:c1ff:fe95:888e dev br-fea0382ed10b table local proto kernel metric 0 pref medium
+local fe80::6cb5:cff:fea2:a675 dev veth58179de table local proto kernel metric 0 pref medium
+local fe80::7069:c0ff:febd:1d88 dev vethe488043 table local proto kernel metric 0 pref medium
+local fe80::7462:7dff:fe8f:115d dev veth73c775b table local proto kernel metric 0 pref medium
+local fe80::74c2:12ff:fe72:7875 dev veth426f4c7 table local proto kernel metric 0 pref medium
+local fe80::78cf:3dff:fe72:528b dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
+local fe80::7c42:75ff:fe80:5953 dev veth551b749 table local proto kernel metric 0 pref medium
+local fe80::7c73:c8ff:fe04:3dd2 dev br-28584d053169 table local proto kernel metric 0 pref medium
+local fe80::7cdd:44ff:fe90:1f77 dev veth53fd806 table local proto kernel metric 0 pref medium
+local fe80::805a:47ff:fe53:cfcd dev vethf48aa55 table local proto kernel metric 0 pref medium
+local fe80::80a3:1eff:fe61:4f10 dev veth32d5964 table local proto kernel metric 0 pref medium
+local fe80::80fb:8fff:fead:2208 dev veth7d6d658 table local proto kernel metric 0 pref medium
+local fe80::84bf:b2ff:fec4:ea7 dev vethd14eb7e table local proto kernel metric 0 pref medium
+local fe80::8832:52ff:fee4:8a93 dev veth8c83268 table local proto kernel metric 0 pref medium
+local fe80::888d:45ff:feeb:4a48 dev veth26a5545 table local proto kernel metric 0 pref medium
+local fe80::9091:4aff:feee:8942 dev veth6594ba0 table local proto kernel metric 0 pref medium
+local fe80::90da:e3ff:fefa:7464 dev veth1f1f066 table local proto kernel metric 0 pref medium
+local fe80::90ed:30ff:fe51:2b5a dev veth335556c table local proto kernel metric 0 pref medium
+local fe80::90ed:f4ff:feed:a749 dev vethacfaa19 table local proto kernel metric 0 pref medium
+local fe80::90ff:b0ff:fe58:21fb dev veth448a204 table local proto kernel metric 0 pref medium
+local fe80::9879:f6ff:fe6d:57be dev br-c50ccbc5e464 table local proto kernel metric 0 pref medium
+local fe80::a047:6eff:fe8b:1f48 dev veth502e53b table local proto kernel metric 0 pref medium
+local fe80::a065:bfff:fea5:34 dev veth368657c table local proto kernel metric 0 pref medium
+local fe80::a065:eaff:fef3:532d dev br-11ceaf8736f5 table local proto kernel metric 0 pref medium
+local fe80::a0eb:3bff:fe66:df68 dev veth80da983 table local proto kernel metric 0 pref medium
+local fe80::a4a0:13ff:fe7f:7c8d dev vethd88eb9b table local proto kernel metric 0 pref medium
+local fe80::a4ab:b9ff:fe3e:af94 dev veth71028db table local proto kernel metric 0 pref medium
+local fe80::a843:f3ff:fedb:ef64 dev br-5a9988b94efd table local proto kernel metric 0 pref medium
+local fe80::a8fe:4ff:fe1f:d81a dev br-b7976abb6e55 table local proto kernel metric 0 pref medium
+local fe80::ac43:75ff:fefa:cbfd dev veth79ea708 table local proto kernel metric 0 pref medium
+local fe80::ac5e:9cff:fe45:ec06 dev veth7e2863d table local proto kernel metric 0 pref medium
+local fe80::ac67:76ff:fe15:1676 dev veth6f6f074 table local proto kernel metric 0 pref medium
+local fe80::ac86:86ff:fe64:f2d4 dev br-eeee48934935 table local proto kernel metric 0 pref medium
+local fe80::aca7:12ff:fe18:d1b9 dev br-a35cbfd37253 table local proto kernel metric 0 pref medium
+local fe80::aca7:68ff:fe42:e77 dev veth14193e1 table local proto kernel metric 0 pref medium
+local fe80::aca8:14ff:feee:df7c dev br-618855db6757 table local proto kernel metric 0 pref medium
+local fe80::acc5:57ff:fece:3b51 dev veth62aa43d table local proto kernel metric 0 pref medium
+local fe80::b441:acff:fe66:5981 dev veth0e4600c table local proto kernel metric 0 pref medium
+local fe80::b471:19ff:fe52:ff1 dev br-d89dcf384c2a table local proto kernel metric 0 pref medium
+local fe80::b48b:1aff:fe71:36d3 dev veth21e2097 table local proto kernel metric 0 pref medium
+local fe80::b4d5:57ff:fe87:83f9 dev vethc2b3531 table local proto kernel metric 0 pref medium
+local fe80::b86e:58ff:fef5:85f6 dev br-dee363d4e0c6 table local proto kernel metric 0 pref medium
+local fe80::bc01:62ff:fe13:b616 dev veth41b1943 table local proto kernel metric 0 pref medium
+local fe80::c000:96ff:fe7d:11a8 dev vethbb40f36 table local proto kernel metric 0 pref medium
+local fe80::c006:5ff:fea6:b743 dev vethf5f3d34 table local proto kernel metric 0 pref medium
+local fe80::c030:54ff:fe2d:eb36 dev br-8b881e367322 table local proto kernel metric 0 pref medium
+local fe80::c090:5eff:fed8:d1cc dev veth370f490 table local proto kernel metric 0 pref medium
+local fe80::c0da:5bff:fea4:92dc dev br-6caddd639b0b table local proto kernel metric 0 pref medium
+local fe80::c85e:5aff:feaa:f812 dev veth165b4aa table local proto kernel metric 0 pref medium
+local fe80::c899:1fff:fe27:7f66 dev veth4a87e58 table local proto kernel metric 0 pref medium
+local fe80::c8b0:56ff:fe7e:bc48 dev br-f9343d8383ac table local proto kernel metric 0 pref medium
+local fe80::cc80:50ff:feb5:67b dev veth2445f8e table local proto kernel metric 0 pref medium
+local fe80::ccd1:f1ff:fe0f:c699 dev vethca028f8 table local proto kernel metric 0 pref medium
+local fe80::d037:82ff:fee7:27c5 dev veth28958e3 table local proto kernel metric 0 pref medium
+local fe80::d037:e3ff:fe79:1a5f dev veth563d3b9 table local proto kernel metric 0 pref medium
+local fe80::d44c:3bff:fe3b:934f dev veth2b9371a table local proto kernel metric 0 pref medium
+local fe80::d44d:feff:fe18:d291 dev veth6091231 table local proto kernel metric 0 pref medium
+local fe80::d457:2bff:fe72:23f dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
+local fe80::d45e:64ff:fe90:37e7 dev veth6b9d50d table local proto kernel metric 0 pref medium
+local fe80::d847:aaff:fe89:3f9 dev veth4ecfbb5 table local proto kernel metric 0 pref medium
+local fe80::d86b:4fff:fec2:50e0 dev veth8d698e0 table local proto kernel metric 0 pref medium
+local fe80::d87e:fbff:fec6:5aeb dev br-4efe811b8402 table local proto kernel metric 0 pref medium
+local fe80::d8c8:aaff:fe63:6af9 dev br-263c8508de6f table local proto kernel metric 0 pref medium
+local fe80::dc0f:5dff:fec4:7c53 dev veth56166e3 table local proto kernel metric 0 pref medium
+local fe80::e0a6:32ff:fe63:9f8d dev br-9891a93b5e9c table local proto kernel metric 0 pref medium
+local fe80::e447:bff:feea:1f61 dev vethe6c6432 table local proto kernel metric 0 pref medium
+local fe80::e46c:23ff:fec3:3ab9 dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
+local fe80::e488:ccff:fe2f:e545 dev veth04a7fbe table local proto kernel metric 0 pref medium
+local fe80::e49e:23ff:feb7:932d dev veth1f2dc82 table local proto kernel metric 0 pref medium
+local fe80::e807:c7ff:fee0:f12d dev vethaeee758 table local proto kernel metric 0 pref medium
+local fe80::e855:acff:fef2:5aa3 dev veth30db54a table local proto kernel metric 0 pref medium
+local fe80::e87f:edff:fe10:e8d6 dev vethd87ba34 table local proto kernel metric 0 pref medium
+local fe80::ec3f:78ff:fe38:75b9 dev veth605aea1 table local proto kernel metric 0 pref medium
+local fe80::f01a:4eff:fef2:9942 dev veth38ae454 table local proto kernel metric 0 pref medium
+local fe80::f01f:e5ff:fe2b:ec80 dev br-03ee8c9e4bea table local proto kernel metric 0 pref medium
+local fe80::f038:dbff:fefd:87d3 dev veth362d4c6 table local proto kernel metric 0 pref medium
+local fe80::f0bf:5ff:fee7:2b1e dev veth337e2fd table local proto kernel metric 0 pref medium
+local fe80::f0c3:fff:fe8b:74e3 dev vethf583175 table local proto kernel metric 0 pref medium
+local fe80::f4a6:b6ff:fe24:af71 dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
+local fe80::f8d4:eff:fe6e:19a9 dev br-ecba5adea6ea table local proto kernel metric 0 pref medium
+local fe80::fc79:ccff:fefd:20d7 dev br-59ca07fbf200 table local proto kernel metric 0 pref medium
+multicast ff00::/8 dev enp4s0 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev wg0 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethf79d976 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev docker0 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth605aea1 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-5a9988b94efd table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethca028f8 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-e02b7c89a2d3 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-dee363d4e0c6 table local proto kernel metric 256 linkdown pref medium
+multicast ff00::/8 dev br-875fced92cd0 table local proto kernel metric 256 linkdown pref medium
+multicast ff00::/8 dev vethf583175 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-11ceaf8736f5 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth880eb86 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth7e2863d table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth55cb2ec table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethee5b2b0 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-9aea00f5a485 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethbe8f01c table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-b7976abb6e55 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth2edd7d6 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-68e2ed0ec6ac table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth38ae454 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-cfae917b997e table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth563d3b9 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-ecba5adea6ea table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth766794b table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-d89dcf384c2a table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth426f4c7 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth362d4c6 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth2d01312 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth4ecfbb5 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth99bb318 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethcae9493 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth8c83268 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth6f6f074 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth4216565 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth46248ff table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethc0ef06c table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethaeee758 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-f63e542ab28c table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-8b881e367322 table local proto kernel metric 256 linkdown pref medium
+multicast ff00::/8 dev veth2906c94 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-6caddd639b0b table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethbb40f36 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-2d50ca7a8f5d table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth6594ba0 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-dc41f9983a47 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth28958e3 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth1f2dc82 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth04a7fbe table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth2273529 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth160d05f table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-eeee48934935 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethd88eb9b table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-f10b040acc46 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth80da983 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth2bde217 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth9e2bcbb table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth0477205 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-87e08370adff table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth370f490 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-ed1bb1cc9d39 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethca0ee65 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth4692f5c table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethd14eb7e table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-527a7cd84ff6 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth3c1861e table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-03ee8c9e4bea table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth32d5964 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vetha548a1a table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth762d601 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethf48aa55 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethf5f3d34 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-f3f5c7cfa74e table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth335556c table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth9cc2ad8 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth6232cb7 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth337e2fd table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth7d6d658 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth448a204 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth79ea708 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth4ba8ed1 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-263c8508de6f table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth4a87e58 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-fea0382ed10b table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethacfaa19 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth30db54a table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethe969d14 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth0e4600c table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth21e2097 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-f9343d8383ac table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth58179de table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-59ca07fbf200 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth6b9d50d table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth2445f8e table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth368657c table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth5f6906b table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth2dd045f table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth53fd806 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth2b9371a table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-051bbcfc21d8 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth165b4aa table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth8c376e6 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth73c775b table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth56166e3 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-4efe811b8402 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth14193e1 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethe9fcee3 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth71028db table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-bca9ecea74f1 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethe123758 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-a35cbfd37253 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth8d698e0 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-71bcae37092b table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethd87ba34 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth1bece5c table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-c50ccbc5e464 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth6091231 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth502e53b table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethe6c6432 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-618855db6757 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth1f1f066 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth26a5545 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethe488043 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-28584d053169 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth551b749 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth15eb212 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-4ecbee63f4b0 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth41b1943 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev vethc2b3531 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth62aa43d table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-8200b83f03e9 table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev veth081c8bf table local proto kernel metric 256 pref medium
+multicast ff00::/8 dev br-9891a93b5e9c table local proto kernel metric 256 pref medium
+
+=== IPv4 rules ===
+0:	from all lookup local
+32765:	from 10.98.0.2 lookup wg0
+32766:	from all lookup main
+32767:	from all lookup default
+
+=== IPv6 rules ===
+0:	from all lookup local
+32766:	from all lookup main
+
+=== namespaces ===
+
+=== resolvers ===
+# Generated by NetworkManager
+search lan
+nameserver 192.168.10.1
+nameserver fe80::3e8c:f8ff:fef4:2590%enp4s0
+
+=== observed public IPv4 ===
+74.67.173.56
+
+=== observed public IPv6 ===
+2603:7080:7500:1279:75aa:d64d:4cf0:8f10

docs/le-app-database-migration/phase2b-contained-runtime/inventory/nftables-ruleset.txt

@@ -0,0 +1,702 @@
+# Warning: table ip filter is managed by iptables-nft, do not touch!
+table ip filter { # handle 1
+	chain INPUT { # handle 1
+		type filter hook input priority filter; policy accept;
+	}
+
+	chain FORWARD { # handle 2
+		type filter hook forward priority filter; policy accept;
+		counter packets 1393654 bytes 658721511 jump DOCKER-USER # handle 170
+		counter packets 1393654 bytes 658721511 jump DOCKER-FORWARD # handle 9
+	}
+
+	chain OUTPUT { # handle 3
+		type filter hook output priority filter; policy accept;
+	}
+
+	chain DOCKER { # handle 4
+		ip daddr 172.31.0.2 iifname != "br-9891a93b5e9c" oifname "br-9891a93b5e9c" tcp dport 8945 counter packets 0 bytes 0 accept # handle 463
+		ip daddr 10.9.0.2 iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 accept # handle 458
+		ip daddr 10.17.0.2 iifname != "br-28584d053169" oifname "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 accept # handle 446
+		ip daddr 10.1.0.6 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 accept # handle 441
+		ip daddr 10.19.0.3 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5030 counter packets 0 bytes 0 accept # handle 435
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 9696 counter packets 0 bytes 0 accept # handle 434
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8989 counter packets 0 bytes 0 accept # handle 433
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8888 counter packets 0 bytes 0 accept # handle 432
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8787 counter packets 0 bytes 0 accept # handle 431
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8265 counter packets 0 bytes 0 accept # handle 430
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8191 counter packets 0 bytes 0 accept # handle 429
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8080 counter packets 0 bytes 0 accept # handle 428
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 7878 counter packets 0 bytes 0 accept # handle 427
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 6767 counter packets 0 bytes 0 accept # handle 426
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5075 counter packets 0 bytes 0 accept # handle 425
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5055 counter packets 0 bytes 0 accept # handle 424
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5000 counter packets 0 bytes 0 accept # handle 423
+		ip daddr 172.30.0.3 iifname != "br-71bcae37092b" oifname "br-71bcae37092b" tcp dport 8080 counter packets 0 bytes 0 accept # handle 418
+		ip daddr 10.13.0.2 iifname != "br-a35cbfd37253" oifname "br-a35cbfd37253" tcp dport 8000 counter packets 0 bytes 0 accept # handle 413
+		ip daddr 10.10.0.2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 443 counter packets 0 bytes 0 accept # handle 408
+		ip daddr 10.10.0.2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 80 counter packets 0 bytes 0 accept # handle 407
+		ip daddr 10.99.0.16 iifname != "br-e02b7c89a2d3" oifname "br-e02b7c89a2d3" tcp dport 9000 counter packets 0 bytes 0 accept # handle 402
+		ip daddr 10.1.0.5 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 8080 counter packets 0 bytes 0 accept # handle 397
+		ip daddr 10.1.0.3 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 80 counter packets 0 bytes 0 accept # handle 391
+		ip daddr 10.24.0.2 iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" tcp dport 8080 counter packets 0 bytes 0 accept # handle 386
+		ip daddr 172.26.0.5 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 80 counter packets 0 bytes 0 accept # handle 381
+		ip daddr 172.26.0.4 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" udp dport 10009 counter packets 0 bytes 0 accept # handle 380
+		ip daddr 172.26.0.4 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 9090 counter packets 0 bytes 0 accept # handle 379
+		ip daddr 172.26.0.3 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 8888 counter packets 0 bytes 0 accept # handle 378
+		ip daddr 172.26.0.2 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 5280 counter packets 0 bytes 0 accept # handle 377
+		ip daddr 10.26.0.2 iifname != "br-263c8508de6f" oifname "br-263c8508de6f" tcp dport 6167 counter packets 0 bytes 0 accept # handle 372
+		ip daddr 10.31.0.5 iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" tcp dport 4000 counter packets 0 bytes 0 accept # handle 367
+		ip daddr 10.31.0.4 iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" tcp dport 3000 counter packets 0 bytes 0 accept # handle 366
+		ip daddr 10.31.0.2 iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" tcp dport 9200 counter packets 0 bytes 0 accept # handle 363
+		ip daddr 172.28.0.5 iifname != "br-03ee8c9e4bea" oifname "br-03ee8c9e4bea" tcp dport 8536 counter packets 0 bytes 0 accept # handle 358
+		ip daddr 172.28.0.5 iifname != "br-03ee8c9e4bea" oifname "br-03ee8c9e4bea" tcp dport 1236 counter packets 0 bytes 0 accept # handle 357
+		ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" tcp dport 8097 counter packets 0 bytes 0 accept # handle 352
+		ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" tcp dport 6697 counter packets 1 bytes 52 accept # handle 351
+		ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" tcp dport 6667 counter packets 0 bytes 0 accept # handle 350
+		ip daddr 10.28.0.3 iifname != "br-ed1bb1cc9d39" oifname "br-ed1bb1cc9d39" tcp dport 8080 counter packets 0 bytes 0 accept # handle 345
+		ip daddr 10.27.0.2 iifname != "br-87e08370adff" oifname "br-87e08370adff" tcp dport 3000 counter packets 0 bytes 0 accept # handle 340
+		ip daddr 10.27.0.2 iifname != "br-87e08370adff" oifname "br-87e08370adff" tcp dport 2244 counter packets 0 bytes 0 accept # handle 339
+		ip daddr 10.29.0.3 iifname != "br-f10b040acc46" oifname "br-f10b040acc46" tcp dport 3000 counter packets 0 bytes 0 accept # handle 332
+		ip daddr 172.24.0.2 iifname != "br-eeee48934935" oifname "br-eeee48934935" tcp dport 7576 counter packets 0 bytes 0 accept # handle 326
+		ip daddr 10.30.0.4 iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" tcp dport 80 counter packets 0 bytes 0 accept # handle 321
+		ip daddr 172.23.0.2 iifname != "br-2d50ca7a8f5d" oifname "br-2d50ca7a8f5d" tcp dport 8080 counter packets 0 bytes 0 accept # handle 316
+		ip daddr 172.23.0.2 iifname != "br-2d50ca7a8f5d" oifname "br-2d50ca7a8f5d" tcp dport 1935 counter packets 0 bytes 0 accept # handle 315
+		ip daddr 172.22.0.2 iifname != "br-6caddd639b0b" oifname "br-6caddd639b0b" tcp dport 8765 counter packets 0 bytes 0 accept # handle 310
+		ip daddr 10.4.0.2 iifname != "br-f63e542ab28c" oifname "br-f63e542ab28c" tcp dport 80 counter packets 0 bytes 0 accept # handle 299
+		ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 993 counter packets 33 bytes 1948 accept # handle 294
+		ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 465 counter packets 23 bytes 1252 accept # handle 293
+		ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 443 counter packets 0 bytes 0 accept # handle 292
+		ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 80 counter packets 0 bytes 0 accept # handle 291
+		ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 25 counter packets 500 bytes 29920 accept # handle 290
+		ip daddr 10.3.0.2 iifname != "br-9aea00f5a485" oifname "br-9aea00f5a485" tcp dport 8888 counter packets 0 bytes 0 accept # handle 271
+		ip daddr 10.55.0.3 iifname != "br-11ceaf8736f5" oifname "br-11ceaf8736f5" tcp dport 7001 counter packets 0 bytes 0 accept # handle 207
+		ip daddr 10.55.0.2 iifname != "br-11ceaf8736f5" oifname "br-11ceaf8736f5" tcp dport 3000 counter packets 0 bytes 0 accept # handle 199
+		ip daddr 172.17.0.4 iifname != "docker0" oifname "docker0" tcp dport 5432 counter packets 0 bytes 0 accept # handle 183
+		ip daddr 172.17.0.3 iifname != "docker0" oifname "docker0" tcp dport 3306 counter packets 0 bytes 0 accept # handle 177
+		iifname != "br-11ceaf8736f5" oifname "br-11ceaf8736f5" counter packets 0 bytes 0 drop # handle 18
+		iifname != "br-dee363d4e0c6" oifname "br-dee363d4e0c6" counter packets 0 bytes 0 drop # handle 26
+		iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 73
+		iifname != "br-e02b7c89a2d3" oifname "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 137
+		iifname != "br-875fced92cd0" oifname "br-875fced92cd0" counter packets 0 bytes 0 drop # handle 153
+		iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop # handle 172
+		iifname != "br-9aea00f5a485" oifname "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 268
+		iifname != "br-68e2ed0ec6ac" oifname "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 273
+		iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" counter packets 0 bytes 0 drop # handle 277
+		iifname != "br-cfae917b997e" oifname "br-cfae917b997e" counter packets 0 bytes 0 drop # handle 284
+		iifname != "br-f63e542ab28c" oifname "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 296
+		iifname != "br-8b881e367322" oifname "br-8b881e367322" counter packets 0 bytes 0 drop # handle 301
+		iifname != "br-6caddd639b0b" oifname "br-6caddd639b0b" counter packets 0 bytes 0 drop # handle 307
+		iifname != "br-2d50ca7a8f5d" oifname "br-2d50ca7a8f5d" counter packets 0 bytes 0 drop # handle 312
+		iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 318
+		iifname != "br-eeee48934935" oifname "br-eeee48934935" counter packets 0 bytes 0 drop # handle 323
+		iifname != "br-f10b040acc46" oifname "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 328
+		iifname != "br-87e08370adff" oifname "br-87e08370adff" counter packets 0 bytes 0 drop # handle 334
+		iifname != "br-ed1bb1cc9d39" oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 342
+		iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 347
+		iifname != "br-03ee8c9e4bea" oifname "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 354
+		iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 360
+		iifname != "br-263c8508de6f" oifname "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 369
+		iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 374
+		iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 383
+		iifname != "br-59ca07fbf200" oifname "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 388
+		iifname != "br-051bbcfc21d8" oifname "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 393
+		iifname != "br-4efe811b8402" oifname "br-4efe811b8402" counter packets 0 bytes 0 drop # handle 399
+		iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 404
+		iifname != "br-a35cbfd37253" oifname "br-a35cbfd37253" counter packets 0 bytes 0 drop # handle 410
+		iifname != "br-71bcae37092b" oifname "br-71bcae37092b" counter packets 0 bytes 0 drop # handle 415
+		iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 420
+		iifname != "br-618855db6757" oifname "br-618855db6757" counter packets 0 bytes 0 drop # handle 437
+		iifname != "br-28584d053169" oifname "br-28584d053169" counter packets 0 bytes 0 drop # handle 443
+		iifname != "br-4ecbee63f4b0" oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 448
+		iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 455
+		iifname != "br-9891a93b5e9c" oifname "br-9891a93b5e9c" counter packets 0 bytes 0 drop # handle 460
+	}
+
+	chain DOCKER-FORWARD { # handle 5
+		counter packets 1393654 bytes 658721511 jump DOCKER-CT # handle 12
+		counter packets 811898 bytes 429419843 jump DOCKER-INTERNAL # handle 11
+		counter packets 811898 bytes 429419843 jump DOCKER-BRIDGE # handle 10
+		iifname "br-11ceaf8736f5" counter packets 3260 bytes 175561 accept # handle 17
+		iifname "br-dee363d4e0c6" counter packets 0 bytes 0 accept # handle 25
+		iifname "br-5a9988b94efd" counter packets 185 bytes 27196 accept # handle 72
+		iifname "br-e02b7c89a2d3" counter packets 46734 bytes 8416975 accept # handle 136
+		iifname "br-875fced92cd0" counter packets 0 bytes 0 accept # handle 152
+		iifname "docker0" counter packets 0 bytes 0 accept # handle 171
+		iifname "br-9aea00f5a485" counter packets 0 bytes 0 accept # handle 267
+		iifname "br-68e2ed0ec6ac" counter packets 492 bytes 40183 accept # handle 272
+		iifname "br-b7976abb6e55" counter packets 10668 bytes 5341503 accept # handle 276
+		iifname "br-ecba5adea6ea" oifname "br-ecba5adea6ea" counter packets 0 bytes 0 accept # handle 282
+		iifname "br-cfae917b997e" counter packets 43 bytes 4954 accept # handle 283
+		iifname "br-d89dcf384c2a" oifname "br-d89dcf384c2a" counter packets 0 bytes 0 accept # handle 289
+		iifname "br-f63e542ab28c" counter packets 0 bytes 0 accept # handle 295
+		iifname "br-8b881e367322" counter packets 135 bytes 13854 accept # handle 300
+		iifname "br-6caddd639b0b" counter packets 0 bytes 0 accept # handle 306
+		iifname "br-2d50ca7a8f5d" counter packets 0 bytes 0 accept # handle 311
+		iifname "br-dc41f9983a47" counter packets 0 bytes 0 accept # handle 317
+		iifname "br-eeee48934935" counter packets 46 bytes 3053 accept # handle 322
+		iifname "br-f10b040acc46" counter packets 1774 bytes 177630 accept # handle 327
+		iifname "br-87e08370adff" counter packets 0 bytes 0 accept # handle 333
+		iifname "br-ed1bb1cc9d39" counter packets 15 bytes 1717 accept # handle 341
+		iifname "br-527a7cd84ff6" counter packets 3 bytes 132 accept # handle 346
+		iifname "br-03ee8c9e4bea" counter packets 6089 bytes 353878 accept # handle 353
+		iifname "br-f3f5c7cfa74e" counter packets 639 bytes 70250 accept # handle 359
+		iifname "br-263c8508de6f" counter packets 24004 bytes 2190194 accept # handle 368
+		iifname "br-fea0382ed10b" counter packets 134 bytes 30967 accept # handle 373
+		iifname "br-f9343d8383ac" counter packets 0 bytes 0 accept # handle 382
+		iifname "br-59ca07fbf200" counter packets 0 bytes 0 accept # handle 387
+		iifname "br-051bbcfc21d8" counter packets 0 bytes 0 accept # handle 392
+		iifname "br-4efe811b8402" counter packets 0 bytes 0 accept # handle 398
+		iifname "br-bca9ecea74f1" counter packets 0 bytes 0 accept # handle 403
+		iifname "br-a35cbfd37253" counter packets 0 bytes 0 accept # handle 409
+		iifname "br-71bcae37092b" counter packets 0 bytes 0 accept # handle 414
+		iifname "br-c50ccbc5e464" counter packets 637050 bytes 401364749 accept # handle 419
+		iifname "br-618855db6757" counter packets 0 bytes 0 accept # handle 436
+		iifname "br-28584d053169" counter packets 12 bytes 1526 accept # handle 442
+		iifname "br-4ecbee63f4b0" counter packets 0 bytes 0 accept # handle 447
+		iifname "br-8200b83f03e9" counter packets 52 bytes 6434 accept # handle 454
+		iifname "br-9891a93b5e9c" counter packets 5916 bytes 322250 accept # handle 459
+	}
+
+	chain DOCKER-BRIDGE { # handle 6
+		oifname "br-11ceaf8736f5" counter packets 0 bytes 0 jump DOCKER # handle 20
+		oifname "br-dee363d4e0c6" counter packets 0 bytes 0 jump DOCKER # handle 28
+		oifname "br-5a9988b94efd" counter packets 0 bytes 0 jump DOCKER # handle 75
+		oifname "br-e02b7c89a2d3" counter packets 0 bytes 0 jump DOCKER # handle 139
+		oifname "br-875fced92cd0" counter packets 0 bytes 0 jump DOCKER # handle 155
+		oifname "docker0" counter packets 0 bytes 0 jump DOCKER # handle 174
+		oifname "br-9aea00f5a485" counter packets 0 bytes 0 jump DOCKER # handle 270
+		oifname "br-68e2ed0ec6ac" counter packets 0 bytes 0 jump DOCKER # handle 275
+		oifname "br-b7976abb6e55" counter packets 556 bytes 33120 jump DOCKER # handle 279
+		oifname "br-cfae917b997e" counter packets 0 bytes 0 jump DOCKER # handle 286
+		oifname "br-f63e542ab28c" counter packets 0 bytes 0 jump DOCKER # handle 298
+		oifname "br-8b881e367322" counter packets 0 bytes 0 jump DOCKER # handle 303
+		oifname "br-6caddd639b0b" counter packets 0 bytes 0 jump DOCKER # handle 309
+		oifname "br-2d50ca7a8f5d" counter packets 0 bytes 0 jump DOCKER # handle 314
+		oifname "br-dc41f9983a47" counter packets 0 bytes 0 jump DOCKER # handle 320
+		oifname "br-eeee48934935" counter packets 0 bytes 0 jump DOCKER # handle 325
+		oifname "br-f10b040acc46" counter packets 0 bytes 0 jump DOCKER # handle 330
+		oifname "br-87e08370adff" counter packets 0 bytes 0 jump DOCKER # handle 336
+		oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 jump DOCKER # handle 344
+		oifname "br-527a7cd84ff6" counter packets 1 bytes 52 jump DOCKER # handle 349
+		oifname "br-03ee8c9e4bea" counter packets 0 bytes 0 jump DOCKER # handle 356
+		oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 jump DOCKER # handle 362
+		oifname "br-263c8508de6f" counter packets 0 bytes 0 jump DOCKER # handle 371
+		oifname "br-fea0382ed10b" counter packets 0 bytes 0 jump DOCKER # handle 376
+		oifname "br-f9343d8383ac" counter packets 0 bytes 0 jump DOCKER # handle 385
+		oifname "br-59ca07fbf200" counter packets 0 bytes 0 jump DOCKER # handle 390
+		oifname "br-051bbcfc21d8" counter packets 0 bytes 0 jump DOCKER # handle 395
+		oifname "br-4efe811b8402" counter packets 0 bytes 0 jump DOCKER # handle 401
+		oifname "br-bca9ecea74f1" counter packets 0 bytes 0 jump DOCKER # handle 406
+		oifname "br-a35cbfd37253" counter packets 0 bytes 0 jump DOCKER # handle 412
+		oifname "br-71bcae37092b" counter packets 0 bytes 0 jump DOCKER # handle 417
+		oifname "br-c50ccbc5e464" counter packets 0 bytes 0 jump DOCKER # handle 422
+		oifname "br-618855db6757" counter packets 0 bytes 0 jump DOCKER # handle 439
+		oifname "br-28584d053169" counter packets 0 bytes 0 jump DOCKER # handle 445
+		oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 jump DOCKER # handle 450
+		oifname "br-8200b83f03e9" counter packets 0 bytes 0 jump DOCKER # handle 457
+		oifname "br-9891a93b5e9c" counter packets 0 bytes 0 jump DOCKER # handle 462
+	}
+
+	chain DOCKER-CT { # handle 7
+		oifname "br-11ceaf8736f5" xt match "conntrack" counter packets 5913 bytes 14315682 accept # handle 19
+		oifname "br-dee363d4e0c6" xt match "conntrack" counter packets 0 bytes 0 accept # handle 27
+		oifname "br-5a9988b94efd" xt match "conntrack" counter packets 260 bytes 99871 accept # handle 74
+		oifname "br-e02b7c89a2d3" xt match "conntrack" counter packets 45927 bytes 21960391 accept # handle 138
+		oifname "br-875fced92cd0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 154
+		oifname "docker0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 173
+		oifname "br-9aea00f5a485" xt match "conntrack" counter packets 0 bytes 0 accept # handle 269
+		oifname "br-68e2ed0ec6ac" xt match "conntrack" counter packets 451 bytes 117758 accept # handle 274
+		oifname "br-b7976abb6e55" xt match "conntrack" counter packets 11952 bytes 824461 accept # handle 278
+		oifname "br-cfae917b997e" xt match "conntrack" counter packets 41 bytes 3861 accept # handle 285
+		oifname "br-f63e542ab28c" xt match "conntrack" counter packets 0 bytes 0 accept # handle 297
+		oifname "br-8b881e367322" xt match "conntrack" counter packets 168 bytes 419234 accept # handle 302
+		oifname "br-6caddd639b0b" xt match "conntrack" counter packets 0 bytes 0 accept # handle 308
+		oifname "br-2d50ca7a8f5d" xt match "conntrack" counter packets 0 bytes 0 accept # handle 313
+		oifname "br-dc41f9983a47" xt match "conntrack" counter packets 0 bytes 0 accept # handle 319
+		oifname "br-eeee48934935" xt match "conntrack" counter packets 61 bytes 204337 accept # handle 324
+		oifname "br-f10b040acc46" xt match "conntrack" counter packets 2177 bytes 4824454 accept # handle 329
+		oifname "br-87e08370adff" xt match "conntrack" counter packets 0 bytes 0 accept # handle 335
+		oifname "br-ed1bb1cc9d39" xt match "conntrack" counter packets 15 bytes 11675 accept # handle 343
+		oifname "br-527a7cd84ff6" xt match "conntrack" counter packets 4 bytes 207 accept # handle 348
+		oifname "br-03ee8c9e4bea" xt match "conntrack" counter packets 7597 bytes 18374987 accept # handle 355
+		oifname "br-f3f5c7cfa74e" xt match "conntrack" counter packets 664 bytes 703654 accept # handle 361
+		oifname "br-263c8508de6f" xt match "conntrack" counter packets 18991 bytes 2926748 accept # handle 370
+		oifname "br-fea0382ed10b" xt match "conntrack" counter packets 103 bytes 71274 accept # handle 375
+		oifname "br-f9343d8383ac" xt match "conntrack" counter packets 0 bytes 0 accept # handle 384
+		oifname "br-59ca07fbf200" xt match "conntrack" counter packets 0 bytes 0 accept # handle 389
+		oifname "br-051bbcfc21d8" xt match "conntrack" counter packets 0 bytes 0 accept # handle 394
+		oifname "br-4efe811b8402" xt match "conntrack" counter packets 0 bytes 0 accept # handle 400
+		oifname "br-bca9ecea74f1" xt match "conntrack" counter packets 0 bytes 0 accept # handle 405
+		oifname "br-a35cbfd37253" xt match "conntrack" counter packets 0 bytes 0 accept # handle 411
+		oifname "br-71bcae37092b" xt match "conntrack" counter packets 0 bytes 0 accept # handle 416
+		oifname "br-c50ccbc5e464" xt match "conntrack" counter packets 424336 bytes 101769455 accept # handle 421
+		oifname "br-618855db6757" xt match "conntrack" counter packets 0 bytes 0 accept # handle 438
+		oifname "br-28584d053169" xt match "conntrack" counter packets 12 bytes 6743 accept # handle 444
+		oifname "br-4ecbee63f4b0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 449
+		oifname "br-8200b83f03e9" xt match "conntrack" counter packets 66 bytes 182937 accept # handle 456
+		oifname "br-9891a93b5e9c" xt match "conntrack" counter packets 7240 bytes 40405768 accept # handle 461
+	}
+
+	chain DOCKER-INTERNAL { # handle 8
+		ip saddr != 172.21.0.0/16 oifname "br-d89dcf384c2a" counter packets 0 bytes 0 drop # handle 288
+		ip daddr != 172.21.0.0/16 iifname "br-d89dcf384c2a" counter packets 0 bytes 0 drop # handle 287
+		ip saddr != 172.19.0.0/16 oifname "br-ecba5adea6ea" counter packets 0 bytes 0 drop # handle 281
+		ip daddr != 172.19.0.0/16 iifname "br-ecba5adea6ea" counter packets 0 bytes 0 drop # handle 280
+	}
+
+	chain DOCKER-USER { # handle 169
+	}
+}
+# Warning: table ip6 filter is managed by iptables-nft, do not touch!
+table ip6 filter { # handle 2
+	chain INPUT { # handle 1
+		type filter hook input priority filter; policy accept;
+	}
+
+	chain FORWARD { # handle 2
+		type filter hook forward priority filter; policy drop;
+		counter packets 1704 bytes 966686 jump DOCKER-USER # handle 86
+		counter packets 1704 bytes 966686 jump DOCKER-FORWARD # handle 9
+	}
+
+	chain OUTPUT { # handle 3
+		type filter hook output priority filter; policy accept;
+	}
+
+	chain DOCKER { # handle 4
+		ip6 daddr fd00:9::2 iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 accept # handle 177
+		ip6 daddr fd00:17::2 iifname != "br-28584d053169" oifname "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 accept # handle 167
+		ip6 daddr fd00:1::6 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 accept # handle 162
+		ip6 daddr fd00:10::2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 443 counter packets 0 bytes 0 accept # handle 156
+		ip6 daddr fd00:10::2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 80 counter packets 0 bytes 0 accept # handle 155
+		ip6 daddr fd00:1::5 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 8080 counter packets 0 bytes 0 accept # handle 150
+		ip6 daddr fd00:1::3 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 80 counter packets 0 bytes 0 accept # handle 144
+		ip6 daddr fd00:24::2 iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" tcp dport 8080 counter packets 0 bytes 0 accept # handle 143
+		ip6 daddr fd00:30::4 iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" tcp dport 80 counter packets 0 bytes 0 accept # handle 114
+		iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 34
+		iifname != "br-9aea00f5a485" oifname "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 99
+		iifname != "br-f63e542ab28c" oifname "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 103
+		iifname != "br-8b881e367322" oifname "br-8b881e367322" counter packets 0 bytes 0 drop # handle 107
+		iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 111
+		iifname != "br-f10b040acc46" oifname "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 116
+		iifname != "br-87e08370adff" oifname "br-87e08370adff" counter packets 0 bytes 0 drop # handle 120
+		iifname != "br-ed1bb1cc9d39" oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 124
+		iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 128
+		iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 132
+		iifname != "br-263c8508de6f" oifname "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 136
+		iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 140
+		iifname != "br-051bbcfc21d8" oifname "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 146
+		iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 152
+		iifname != "br-618855db6757" oifname "br-618855db6757" counter packets 0 bytes 0 drop # handle 158
+		iifname != "br-28584d053169" oifname "br-28584d053169" counter packets 0 bytes 0 drop # handle 164
+		iifname != "br-4ecbee63f4b0" oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 169
+		iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 174
+	}
+
+	chain DOCKER-FORWARD { # handle 5
+		counter packets 1704 bytes 966686 jump DOCKER-CT # handle 12
+		counter packets 798 bytes 112527 jump DOCKER-INTERNAL # handle 11
+		counter packets 798 bytes 112527 jump DOCKER-BRIDGE # handle 10
+		iifname "br-5a9988b94efd" counter packets 27 bytes 5590 accept # handle 33
+		iifname "br-9aea00f5a485" counter packets 0 bytes 0 accept # handle 98
+		iifname "br-f63e542ab28c" counter packets 0 bytes 0 accept # handle 102
+		iifname "br-8b881e367322" counter packets 0 bytes 0 accept # handle 106
+		iifname "br-dc41f9983a47" counter packets 0 bytes 0 accept # handle 110
+		iifname "br-f10b040acc46" counter packets 0 bytes 0 accept # handle 115
+		iifname "br-87e08370adff" counter packets 0 bytes 0 accept # handle 119
+		iifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 accept # handle 123
+		iifname "br-527a7cd84ff6" counter packets 0 bytes 0 accept # handle 127
+		iifname "br-f3f5c7cfa74e" counter packets 544 bytes 83353 accept # handle 131
+		iifname "br-263c8508de6f" counter packets 44 bytes 5795 accept # handle 135
+		iifname "br-f9343d8383ac" counter packets 0 bytes 0 accept # handle 139
+		iifname "br-051bbcfc21d8" counter packets 0 bytes 0 accept # handle 145
+		iifname "br-bca9ecea74f1" counter packets 122 bytes 10531 accept # handle 151
+		iifname "br-618855db6757" counter packets 0 bytes 0 accept # handle 157
+		iifname "br-28584d053169" counter packets 0 bytes 0 accept # handle 163
+		iifname "br-4ecbee63f4b0" counter packets 0 bytes 0 accept # handle 168
+		iifname "br-8200b83f03e9" counter packets 0 bytes 0 accept # handle 173
+	}
+
+	chain DOCKER-BRIDGE { # handle 6
+		oifname "br-5a9988b94efd" counter packets 0 bytes 0 jump DOCKER # handle 36
+		oifname "br-9aea00f5a485" counter packets 0 bytes 0 jump DOCKER # handle 101
+		oifname "br-f63e542ab28c" counter packets 0 bytes 0 jump DOCKER # handle 105
+		oifname "br-8b881e367322" counter packets 0 bytes 0 jump DOCKER # handle 109
+		oifname "br-dc41f9983a47" counter packets 0 bytes 0 jump DOCKER # handle 113
+		oifname "br-f10b040acc46" counter packets 0 bytes 0 jump DOCKER # handle 118
+		oifname "br-87e08370adff" counter packets 0 bytes 0 jump DOCKER # handle 122
+		oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 jump DOCKER # handle 126
+		oifname "br-527a7cd84ff6" counter packets 0 bytes 0 jump DOCKER # handle 130
+		oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 jump DOCKER # handle 134
+		oifname "br-263c8508de6f" counter packets 0 bytes 0 jump DOCKER # handle 138
+		oifname "br-f9343d8383ac" counter packets 0 bytes 0 jump DOCKER # handle 142
+		oifname "br-051bbcfc21d8" counter packets 0 bytes 0 jump DOCKER # handle 148
+		oifname "br-bca9ecea74f1" counter packets 0 bytes 0 jump DOCKER # handle 154
+		oifname "br-618855db6757" counter packets 0 bytes 0 jump DOCKER # handle 160
+		oifname "br-28584d053169" counter packets 0 bytes 0 jump DOCKER # handle 166
+		oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 jump DOCKER # handle 171
+		oifname "br-8200b83f03e9" counter packets 0 bytes 0 jump DOCKER # handle 176
+	}
+
+	chain DOCKER-CT { # handle 7
+		oifname "br-5a9988b94efd" xt match "conntrack" counter packets 28 bytes 16684 accept # handle 35
+		oifname "br-9aea00f5a485" xt match "conntrack" counter packets 0 bytes 0 accept # handle 100
+		oifname "br-f63e542ab28c" xt match "conntrack" counter packets 0 bytes 0 accept # handle 104
+		oifname "br-8b881e367322" xt match "conntrack" counter packets 0 bytes 0 accept # handle 108
+		oifname "br-dc41f9983a47" xt match "conntrack" counter packets 0 bytes 0 accept # handle 112
+		oifname "br-f10b040acc46" xt match "conntrack" counter packets 0 bytes 0 accept # handle 117
+		oifname "br-87e08370adff" xt match "conntrack" counter packets 0 bytes 0 accept # handle 121
+		oifname "br-ed1bb1cc9d39" xt match "conntrack" counter packets 0 bytes 0 accept # handle 125
+		oifname "br-527a7cd84ff6" xt match "conntrack" counter packets 0 bytes 0 accept # handle 129
+		oifname "br-f3f5c7cfa74e" xt match "conntrack" counter packets 576 bytes 474421 accept # handle 133
+		oifname "br-263c8508de6f" xt match "conntrack" counter packets 38 bytes 15719 accept # handle 137
+		oifname "br-f9343d8383ac" xt match "conntrack" counter packets 0 bytes 0 accept # handle 141
+		oifname "br-051bbcfc21d8" xt match "conntrack" counter packets 0 bytes 0 accept # handle 147
+		oifname "br-bca9ecea74f1" xt match "conntrack" counter packets 225 bytes 333045 accept # handle 153
+		oifname "br-618855db6757" xt match "conntrack" counter packets 0 bytes 0 accept # handle 159
+		oifname "br-28584d053169" xt match "conntrack" counter packets 0 bytes 0 accept # handle 165
+		oifname "br-4ecbee63f4b0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 170
+		oifname "br-8200b83f03e9" xt match "conntrack" counter packets 0 bytes 0 accept # handle 175
+	}
+
+	chain DOCKER-INTERNAL { # handle 8
+	}
+
+	chain DOCKER-USER { # handle 85
+	}
+}
+# Warning: table ip nat is managed by iptables-nft, do not touch!
+table ip nat { # handle 3
+	chain DOCKER { # handle 1
+		ip daddr 127.0.0.1 iifname != "docker0" tcp dport 3307 counter packets 0 bytes 0 xt target "DNAT" # handle 49
+		ip daddr 127.0.0.1 iifname != "docker0" tcp dport 5434 counter packets 0 bytes 0 xt target "DNAT" # handle 55
+		ip daddr 127.0.0.1 iifname != "br-11ceaf8736f5" tcp dport 3005 counter packets 0 bytes 0 xt target "DNAT" # handle 72
+		ip daddr 127.0.0.1 iifname != "br-11ceaf8736f5" tcp dport 7001 counter packets 0 bytes 0 xt target "DNAT" # handle 80
+		ip daddr 127.0.0.1 iifname != "br-9aea00f5a485" tcp dport 8440 counter packets 0 bytes 0 xt target "DNAT" # handle 141
+		ip daddr 10.98.0.2 iifname != "br-b7976abb6e55" tcp dport 25 counter packets 500 bytes 29920 xt target "DNAT" # handle 145
+		ip daddr 127.0.0.1 iifname != "br-b7976abb6e55" tcp dport 8088 counter packets 0 bytes 0 xt target "DNAT" # handle 146
+		ip daddr 127.0.0.1 iifname != "br-b7976abb6e55" tcp dport 8443 counter packets 0 bytes 0 xt target "DNAT" # handle 147
+		ip daddr 10.98.0.2 iifname != "br-b7976abb6e55" tcp dport 465 counter packets 23 bytes 1252 xt target "DNAT" # handle 148
+		ip daddr 10.98.0.2 iifname != "br-b7976abb6e55" tcp dport 993 counter packets 33 bytes 1948 xt target "DNAT" # handle 149
+		ip daddr 127.0.0.1 iifname != "br-f63e542ab28c" tcp dport 8017 counter packets 0 bytes 0 xt target "DNAT" # handle 151
+		ip daddr 127.0.0.1 iifname != "br-6caddd639b0b" tcp dport 8765 counter packets 0 bytes 0 xt target "DNAT" # handle 156
+		ip daddr 127.0.0.1 iifname != "br-2d50ca7a8f5d" tcp dport 1935 counter packets 0 bytes 0 xt target "DNAT" # handle 158
+		ip daddr 127.0.0.1 iifname != "br-2d50ca7a8f5d" tcp dport 8086 counter packets 0 bytes 0 xt target "DNAT" # handle 159
+		iifname != "br-dc41f9983a47" tcp dport 9098 counter packets 0 bytes 0 xt target "DNAT" # handle 161
+		ip daddr 127.0.0.1 iifname != "br-eeee48934935" tcp dport 7576 counter packets 0 bytes 0 xt target "DNAT" # handle 163
+		ip daddr 127.0.0.1 iifname != "br-f10b040acc46" tcp dport 3000 counter packets 0 bytes 0 xt target "DNAT" # handle 166
+		ip daddr 10.98.0.2 iifname != "br-87e08370adff" tcp dport 2244 counter packets 0 bytes 0 xt target "DNAT" # handle 171
+		ip daddr 127.0.0.1 iifname != "br-87e08370adff" tcp dport 2244 counter packets 0 bytes 0 xt target "DNAT" # handle 172
+		ip daddr 127.0.0.1 iifname != "br-87e08370adff" tcp dport 3006 counter packets 0 bytes 0 xt target "DNAT" # handle 173
+		ip daddr 127.0.0.1 iifname != "br-ed1bb1cc9d39" tcp dport 8181 counter packets 0 bytes 0 xt target "DNAT" # handle 175
+		ip daddr 10.98.0.2 iifname != "br-527a7cd84ff6" tcp dport 6667 counter packets 0 bytes 0 xt target "DNAT" # handle 177
+		ip daddr 10.98.0.2 iifname != "br-527a7cd84ff6" tcp dport 6697 counter packets 1 bytes 52 xt target "DNAT" # handle 178
+		ip daddr 127.0.0.1 iifname != "br-527a7cd84ff6" tcp dport 8097 counter packets 0 bytes 0 xt target "DNAT" # handle 179
+		ip daddr 127.0.0.1 iifname != "br-03ee8c9e4bea" tcp dport 1236 counter packets 0 bytes 0 xt target "DNAT" # handle 181
+		ip daddr 127.0.0.1 iifname != "br-03ee8c9e4bea" tcp dport 8536 counter packets 0 bytes 0 xt target "DNAT" # handle 182
+		ip daddr 127.0.0.1 iifname != "br-f3f5c7cfa74e" tcp dport 9201 counter packets 0 bytes 0 xt target "DNAT" # handle 184
+		ip daddr 127.0.0.1 iifname != "br-f3f5c7cfa74e" tcp dport 3001 counter packets 0 bytes 0 xt target "DNAT" # handle 187
+		ip daddr 127.0.0.1 iifname != "br-f3f5c7cfa74e" tcp dport 4001 counter packets 0 bytes 0 xt target "DNAT" # handle 188
+		ip daddr 127.0.0.1 iifname != "br-263c8508de6f" tcp dport 6167 counter packets 0 bytes 0 xt target "DNAT" # handle 190
+		ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 5280 counter packets 0 bytes 0 xt target "DNAT" # handle 192
+		ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 8002 counter packets 0 bytes 0 xt target "DNAT" # handle 193
+		ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 9090 counter packets 0 bytes 0 xt target "DNAT" # handle 194
+		iifname != "br-fea0382ed10b" udp dport 10009 counter packets 0 bytes 0 xt target "DNAT" # handle 195
+		ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 8001 counter packets 0 bytes 0 xt target "DNAT" # handle 196
+		iifname != "br-f9343d8383ac" tcp dport 8383 counter packets 0 bytes 0 xt target "DNAT" # handle 198
+		iifname != "br-5a9988b94efd" tcp dport 7778 counter packets 0 bytes 0 xt target "DNAT" # handle 200
+		iifname != "br-5a9988b94efd" tcp dport 8016 counter packets 0 bytes 0 xt target "DNAT" # handle 203
+		iifname != "br-e02b7c89a2d3" tcp dport 9009 counter packets 0 bytes 0 xt target "DNAT" # handle 205
+		iifname != "br-bca9ecea74f1" tcp dport 8090 counter packets 0 bytes 0 xt target "DNAT" # handle 207
+		iifname != "br-bca9ecea74f1" tcp dport 444 counter packets 0 bytes 0 xt target "DNAT" # handle 208
+		iifname != "br-a35cbfd37253" tcp dport 8000 counter packets 0 bytes 0 xt target "DNAT" # handle 210
+		ip daddr 127.0.0.1 iifname != "br-71bcae37092b" tcp dport 7676 counter packets 0 bytes 0 xt target "DNAT" # handle 212
+		iifname != "br-c50ccbc5e464" tcp dport 5000 counter packets 0 bytes 0 xt target "DNAT" # handle 214
+		iifname != "br-c50ccbc5e464" tcp dport 5055 counter packets 0 bytes 0 xt target "DNAT" # handle 215
+		iifname != "br-c50ccbc5e464" tcp dport 5075 counter packets 0 bytes 0 xt target "DNAT" # handle 216
+		iifname != "br-c50ccbc5e464" tcp dport 6767 counter packets 0 bytes 0 xt target "DNAT" # handle 217
+		iifname != "br-c50ccbc5e464" tcp dport 7878 counter packets 0 bytes 0 xt target "DNAT" # handle 218
+		iifname != "br-c50ccbc5e464" tcp dport 8080 counter packets 0 bytes 0 xt target "DNAT" # handle 219
+		iifname != "br-c50ccbc5e464" tcp dport 8191 counter packets 0 bytes 0 xt target "DNAT" # handle 220
+		iifname != "br-c50ccbc5e464" tcp dport 8265 counter packets 0 bytes 0 xt target "DNAT" # handle 221
+		iifname != "br-c50ccbc5e464" tcp dport 8787 counter packets 0 bytes 0 xt target "DNAT" # handle 222
+		iifname != "br-c50ccbc5e464" tcp dport 8888 counter packets 0 bytes 0 xt target "DNAT" # handle 223
+		iifname != "br-c50ccbc5e464" tcp dport 8989 counter packets 0 bytes 0 xt target "DNAT" # handle 224
+		iifname != "br-c50ccbc5e464" tcp dport 9696 counter packets 0 bytes 0 xt target "DNAT" # handle 225
+		iifname != "br-c50ccbc5e464" tcp dport 5030 counter packets 0 bytes 0 xt target "DNAT" # handle 226
+		iifname != "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 xt target "DNAT" # handle 229
+		iifname != "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 xt target "DNAT" # handle 231
+		iifname != "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 xt target "DNAT" # handle 237
+		ip daddr 127.0.0.1 iifname != "br-9891a93b5e9c" tcp dport 8945 counter packets 0 bytes 0 xt target "DNAT" # handle 239
+	}
+
+	chain PREROUTING { # handle 2
+		type nat hook prerouting priority dstnat; policy accept;
+		xt match "addrtype" counter packets 12868 bytes 773053 jump DOCKER # handle 3
+	}
+
+	chain OUTPUT { # handle 4
+		type nat hook output priority dstnat; policy accept;
+		ip daddr != 127.0.0.0/8 xt match "addrtype" counter packets 0 bytes 0 jump DOCKER # handle 5
+	}
+
+	chain POSTROUTING { # handle 6
+		type nat hook postrouting priority srcnat; policy accept;
+		ip saddr 172.31.0.0/16 oifname != "br-9891a93b5e9c" counter packets 3 bytes 180 xt target "MASQUERADE" # handle 238
+		ip saddr 10.9.0.0/16 oifname != "br-8200b83f03e9" counter packets 2 bytes 120 xt target "MASQUERADE" # handle 236
+		ip saddr 10.18.0.0/16 oifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 232
+		ip saddr 10.17.0.0/16 oifname != "br-28584d053169" counter packets 1 bytes 60 xt target "MASQUERADE" # handle 230
+		ip saddr 10.16.0.0/16 oifname != "br-618855db6757" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 227
+		ip saddr 10.19.0.0/16 oifname != "br-c50ccbc5e464" counter packets 4 bytes 378 xt target "MASQUERADE" # handle 213
+		ip saddr 172.30.0.0/16 oifname != "br-71bcae37092b" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 211
+		ip saddr 10.13.0.0/16 oifname != "br-a35cbfd37253" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 209
+		ip saddr 10.10.0.0/16 oifname != "br-bca9ecea74f1" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 206
+		ip saddr 172.27.0.0/16 oifname != "br-4efe811b8402" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 204
+		ip saddr 10.41.0.0/16 oifname != "br-051bbcfc21d8" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 201
+		ip saddr 10.32.0.0/16 oifname != "br-59ca07fbf200" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 199
+		ip saddr 10.24.0.0/16 oifname != "br-f9343d8383ac" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 197
+		ip saddr 172.26.0.0/16 oifname != "br-fea0382ed10b" counter packets 12 bytes 3156 xt target "MASQUERADE" # handle 191
+		ip saddr 10.26.0.0/16 oifname != "br-263c8508de6f" counter packets 17780 bytes 1459511 xt target "MASQUERADE" # handle 189
+		ip saddr 10.31.0.0/16 oifname != "br-f3f5c7cfa74e" counter packets 87 bytes 5220 xt target "MASQUERADE" # handle 183
+		ip saddr 172.28.0.0/16 oifname != "br-03ee8c9e4bea" counter packets 43 bytes 2580 xt target "MASQUERADE" # handle 180
+		ip saddr 10.20.0.0/16 oifname != "br-527a7cd84ff6" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 176
+		ip saddr 10.28.0.0/16 oifname != "br-ed1bb1cc9d39" counter packets 1 bytes 60 xt target "MASQUERADE" # handle 174
+		ip saddr 10.27.0.0/16 oifname != "br-87e08370adff" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 167
+		ip saddr 10.29.0.0/16 oifname != "br-f10b040acc46" counter packets 28 bytes 1680 xt target "MASQUERADE" # handle 164
+		ip saddr 172.24.0.0/16 oifname != "br-eeee48934935" counter packets 1 bytes 60 xt target "MASQUERADE" # handle 162
+		ip saddr 10.30.0.0/16 oifname != "br-dc41f9983a47" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 160
+		ip saddr 172.23.0.0/16 oifname != "br-2d50ca7a8f5d" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 157
+		ip saddr 172.22.0.0/16 oifname != "br-6caddd639b0b" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 155
+		ip saddr 10.40.0.0/16 oifname != "br-8b881e367322" counter packets 3 bytes 180 xt target "MASQUERADE" # handle 152
+		ip saddr 10.4.0.0/16 oifname != "br-f63e542ab28c" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 150
+		ip saddr 172.20.0.0/16 oifname != "br-cfae917b997e" counter packets 9 bytes 1092 xt target "MASQUERADE" # handle 144
+		ip saddr 172.18.0.0/16 oifname != "br-b7976abb6e55" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 143
+		ip saddr 10.2.0.0/16 oifname != "br-68e2ed0ec6ac" counter packets 492 bytes 40183 xt target "MASQUERADE" # handle 142
+		ip saddr 10.3.0.0/16 oifname != "br-9aea00f5a485" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 140
+		ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 46
+		ip saddr 172.25.0.0/16 oifname != "br-875fced92cd0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 41
+		ip saddr 10.99.0.0/16 oifname != "br-e02b7c89a2d3" counter packets 4000 bytes 239992 xt target "MASQUERADE" # handle 37
+		ip saddr 10.1.0.0/16 oifname != "br-5a9988b94efd" counter packets 7 bytes 420 xt target "MASQUERADE" # handle 21
+		ip saddr 172.29.0.0/16 oifname != "br-dee363d4e0c6" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 10
+		ip saddr 10.55.0.0/16 oifname != "br-11ceaf8736f5" counter packets 10 bytes 600 xt target "MASQUERADE" # handle 8
+	}
+}
+# Warning: table ip6 nat is managed by iptables-nft, do not touch!
+table ip6 nat { # handle 4
+	chain DOCKER { # handle 1
+		ip6 saddr != fe80::/10 iifname != "br-dc41f9983a47" tcp dport 9098 counter packets 0 bytes 0 xt target "DNAT" # handle 40
+		ip6 saddr != fe80::/10 iifname != "br-f9343d8383ac" tcp dport 8383 counter packets 0 bytes 0 xt target "DNAT" # handle 48
+		ip6 saddr != fe80::/10 iifname != "br-5a9988b94efd" tcp dport 7778 counter packets 0 bytes 0 xt target "DNAT" # handle 49
+		ip6 saddr != fe80::/10 iifname != "br-5a9988b94efd" tcp dport 8016 counter packets 0 bytes 0 xt target "DNAT" # handle 52
+		ip6 saddr != fe80::/10 iifname != "br-bca9ecea74f1" tcp dport 8090 counter packets 0 bytes 0 xt target "DNAT" # handle 54
+		ip6 saddr != fe80::/10 iifname != "br-bca9ecea74f1" tcp dport 444 counter packets 0 bytes 0 xt target "DNAT" # handle 55
+		ip6 saddr != fe80::/10 iifname != "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 xt target "DNAT" # handle 58
+		ip6 saddr != fe80::/10 iifname != "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 xt target "DNAT" # handle 60
+		ip6 saddr != fe80::/10 iifname != "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 xt target "DNAT" # handle 64
+	}
+
+	chain PREROUTING { # handle 2
+		type nat hook prerouting priority dstnat; policy accept;
+		xt match "addrtype" counter packets 2 bytes 112 jump DOCKER # handle 3
+	}
+
+	chain OUTPUT { # handle 4
+		type nat hook output priority dstnat; policy accept;
+		ip6 daddr != ::1 xt match "addrtype" counter packets 0 bytes 0 jump DOCKER # handle 5
+	}
+
+	chain POSTROUTING { # handle 6
+		type nat hook postrouting priority srcnat; policy accept;
+		ip6 saddr fd00:9::/64 oifname != "br-8200b83f03e9" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 63
+		ip6 saddr fd00:18::/64 oifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 61
+		ip6 saddr fd00:17::/64 oifname != "br-28584d053169" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 59
+		ip6 saddr fd00:16::/64 oifname != "br-618855db6757" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 56
+		ip6 saddr fd00:10::/64 oifname != "br-bca9ecea74f1" counter packets 1 bytes 80 xt target "MASQUERADE" # handle 53
+		ip6 saddr fd00:41::/64 oifname != "br-051bbcfc21d8" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 50
+		ip6 saddr fd00:24::/64 oifname != "br-f9343d8383ac" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 47
+		ip6 saddr fd00:26::/64 oifname != "br-263c8508de6f" counter packets 5 bytes 400 xt target "MASQUERADE" # handle 46
+		ip6 saddr fd00:31::/64 oifname != "br-f3f5c7cfa74e" counter packets 60 bytes 4800 xt target "MASQUERADE" # handle 45
+		ip6 saddr fd00:20::/64 oifname != "br-527a7cd84ff6" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 44
+		ip6 saddr fd00:28::/64 oifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 43
+		ip6 saddr fd00:27::/64 oifname != "br-87e08370adff" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 42
+		ip6 saddr fd00:29::/64 oifname != "br-f10b040acc46" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 41
+		ip6 saddr fd00:30::/64 oifname != "br-dc41f9983a47" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 39
+		ip6 saddr fd00:40::/64 oifname != "br-8b881e367322" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 38
+		ip6 saddr fd00:4::/64 oifname != "br-f63e542ab28c" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 37
+		ip6 saddr fd00:3::/64 oifname != "br-9aea00f5a485" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 36
+		ip6 saddr fd00:1::/64 oifname != "br-5a9988b94efd" counter packets 2 bytes 160 xt target "MASQUERADE" # handle 12
+	}
+}
+table ip raw { # handle 5
+	chain PREROUTING { # handle 1
+		type filter hook prerouting priority raw; policy accept;
+		ip daddr 10.1.0.17 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 4
+		ip daddr 10.1.0.20 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 7
+		ip daddr 10.99.0.18 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 8
+		ip daddr 10.1.0.9 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 9
+		ip daddr 10.1.0.12 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 18
+		ip daddr 10.1.0.19 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 19
+		ip daddr 10.1.0.22 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 20
+		ip daddr 172.17.0.2 iifname != "docker0" counter packets 0 bytes 0 drop # handle 27
+		ip daddr 172.17.0.3 iifname != "docker0" counter packets 0 bytes 0 drop # handle 32
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 3307 counter packets 0 bytes 0 drop # handle 39
+		ip daddr 172.17.0.4 iifname != "docker0" counter packets 0 bytes 0 drop # handle 48
+		ip daddr 10.55.0.2 iifname != "br-11ceaf8736f5" counter packets 0 bytes 0 drop # handle 53
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 5434 counter packets 0 bytes 0 drop # handle 66
+		ip daddr 10.55.0.3 iifname != "br-11ceaf8736f5" counter packets 0 bytes 0 drop # handle 85
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 3005 counter packets 0 bytes 0 drop # handle 104
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 7001 counter packets 0 bytes 0 drop # handle 118
+		ip daddr 10.99.0.2 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 251
+		ip daddr 10.99.0.3 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 252
+		ip daddr 10.3.0.2 iifname != "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 253
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8440 counter packets 0 bytes 0 drop # handle 254
+		ip daddr 172.18.0.2 iifname != "br-b7976abb6e55" counter packets 0 bytes 0 drop # handle 255
+		ip daddr 172.20.0.2 iifname != "br-cfae917b997e" counter packets 0 bytes 0 drop # handle 256
+		ip daddr 10.2.255.254 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 257
+		ip daddr 10.2.0.2 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 258
+		ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" counter packets 0 bytes 0 drop # handle 259
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8088 counter packets 0 bytes 0 drop # handle 260
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8443 counter packets 0 bytes 0 drop # handle 261
+		ip daddr 10.2.0.3 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 262
+		ip daddr 10.2.0.4 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 263
+		ip daddr 172.20.0.3 iifname != "br-cfae917b997e" counter packets 0 bytes 0 drop # handle 264
+		ip daddr 10.2.0.5 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 265
+		ip daddr 10.2.0.6 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 266
+		ip daddr 10.2.0.7 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 267
+		ip daddr 10.2.0.8 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 268
+		ip daddr 10.4.0.2 iifname != "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 269
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8017 counter packets 0 bytes 0 drop # handle 270
+		ip daddr 172.22.0.2 iifname != "br-6caddd639b0b" counter packets 0 bytes 0 drop # handle 275
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8765 counter packets 0 bytes 0 drop # handle 276
+		ip daddr 172.23.0.2 iifname != "br-2d50ca7a8f5d" counter packets 0 bytes 0 drop # handle 277
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 1935 counter packets 0 bytes 0 drop # handle 278
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8086 counter packets 0 bytes 0 drop # handle 279
+		ip daddr 10.30.0.2 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 280
+		ip daddr 10.30.0.3 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 281
+		ip daddr 10.1.0.2 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 282
+		ip daddr 10.99.0.5 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 283
+		ip daddr 10.30.0.4 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 284
+		ip daddr 172.24.0.2 iifname != "br-eeee48934935" counter packets 0 bytes 0 drop # handle 285
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 7576 counter packets 0 bytes 0 drop # handle 286
+		ip daddr 10.29.0.2 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 287
+		ip daddr 10.99.0.6 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 288
+		ip daddr 10.29.0.3 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 290
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 3000 counter packets 0 bytes 0 drop # handle 291
+		ip daddr 10.99.0.7 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 292
+		ip daddr 10.27.0.2 iifname != "br-87e08370adff" counter packets 0 bytes 0 drop # handle 295
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 2244 counter packets 0 bytes 0 drop # handle 296
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 3006 counter packets 0 bytes 0 drop # handle 297
+		ip daddr 10.28.0.2 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 298
+		ip daddr 10.28.0.3 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 299
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8181 counter packets 0 bytes 0 drop # handle 300
+		ip daddr 10.99.0.8 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 301
+		ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 302
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8097 counter packets 0 bytes 0 drop # handle 303
+		ip daddr 172.28.0.2 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 304
+		ip daddr 10.99.0.9 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 305
+		ip daddr 172.28.0.3 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 306
+		ip daddr 172.28.0.4 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 307
+		ip daddr 172.28.0.5 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 308
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 1236 counter packets 0 bytes 0 drop # handle 309
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8536 counter packets 0 bytes 0 drop # handle 310
+		ip daddr 10.31.0.2 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 311
+		ip daddr 10.31.0.3 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 312
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 9201 counter packets 0 bytes 0 drop # handle 313
+		ip daddr 10.99.0.10 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 314
+		ip daddr 10.99.0.11 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 315
+		ip daddr 10.99.0.12 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 316
+		ip daddr 10.31.0.4 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 319
+		ip daddr 10.31.0.5 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 320
+		ip daddr 10.31.0.6 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 321
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 3001 counter packets 0 bytes 0 drop # handle 322
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 4001 counter packets 0 bytes 0 drop # handle 323
+		ip daddr 10.26.0.2 iifname != "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 324
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 6167 counter packets 0 bytes 0 drop # handle 325
+		ip daddr 172.26.0.2 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 326
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 5280 counter packets 0 bytes 0 drop # handle 327
+		ip daddr 172.26.0.3 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 328
+		ip daddr 172.26.0.4 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 329
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8002 counter packets 0 bytes 0 drop # handle 330
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 9090 counter packets 0 bytes 0 drop # handle 331
+		ip daddr 172.26.0.5 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 332
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8001 counter packets 0 bytes 0 drop # handle 333
+		ip daddr 172.26.0.6 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 334
+		ip daddr 10.24.0.2 iifname != "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 335
+		ip daddr 10.32.0.2 iifname != "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 336
+		ip daddr 10.1.0.3 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 337
+		ip daddr 10.1.0.4 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 338
+		ip daddr 10.99.0.13 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 339
+		ip daddr 10.99.0.14 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 340
+		ip daddr 10.32.0.3 iifname != "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 341
+		ip daddr 10.32.0.4 iifname != "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 342
+		ip daddr 10.41.0.2 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 343
+		ip daddr 10.41.0.3 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 344
+		ip daddr 10.1.0.5 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 345
+		ip daddr 10.99.0.15 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 346
+		ip daddr 172.27.0.2 iifname != "br-4efe811b8402" counter packets 0 bytes 0 drop # handle 347
+		ip daddr 10.99.0.16 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 348
+		ip daddr 172.27.0.3 iifname != "br-4efe811b8402" counter packets 0 bytes 0 drop # handle 349
+		ip daddr 10.10.0.2 iifname != "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 350
+		ip daddr 10.13.0.2 iifname != "br-a35cbfd37253" counter packets 0 bytes 0 drop # handle 351
+		ip daddr 172.30.0.2 iifname != "br-71bcae37092b" counter packets 0 bytes 0 drop # handle 352
+		ip daddr 172.30.0.3 iifname != "br-71bcae37092b" counter packets 0 bytes 0 drop # handle 355
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 7676 counter packets 0 bytes 0 drop # handle 356
+		ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 357
+		ip daddr 10.19.0.3 iifname != "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 358
+		ip daddr 10.19.0.4 iifname != "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 359
+		ip daddr 10.16.0.2 iifname != "br-618855db6757" counter packets 0 bytes 0 drop # handle 360
+		ip daddr 10.1.0.6 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 361
+		ip daddr 10.99.0.17 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 362
+		ip daddr 10.17.0.2 iifname != "br-28584d053169" counter packets 0 bytes 0 drop # handle 363
+		ip daddr 10.18.0.2 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 366
+		ip daddr 10.18.0.3 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 367
+		ip daddr 10.18.0.4 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 368
+		ip daddr 10.9.0.2 iifname != "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 370
+		ip daddr 172.31.0.2 iifname != "br-9891a93b5e9c" counter packets 0 bytes 0 drop # handle 371
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8945 counter packets 0 bytes 0 drop # handle 372
+	}
+}
+table ip6 raw { # handle 6
+	chain PREROUTING { # handle 1
+		type filter hook prerouting priority raw; policy accept;
+		ip6 daddr fd00:1::11 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 3
+		ip6 daddr fd00:1::14 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 4
+		ip6 daddr fd00:1::9 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 5
+		ip6 daddr fd00:1::c iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 7
+		ip6 daddr fd00:1::13 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 8
+		ip6 daddr fd00:1::16 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 9
+		ip6 daddr fd00:3::2 iifname != "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 38
+		ip6 daddr fd00:4::2 iifname != "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 39
+		ip6 daddr fd00:30::2 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 41
+		ip6 daddr fd00:30::3 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 42
+		ip6 daddr fd00:1::2 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 43
+		ip6 daddr fd00:30::4 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 44
+		ip6 daddr fd00:29::2 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 45
+		ip6 daddr fd00:29::3 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 46
+		ip6 daddr fd00:27::2 iifname != "br-87e08370adff" counter packets 0 bytes 0 drop # handle 47
+		ip6 daddr fd00:28::2 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 48
+		ip6 daddr fd00:28::3 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 49
+		ip6 daddr fd00:20::2 iifname != "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 50
+		ip6 daddr fd00:31::2 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 51
+		ip6 daddr fd00:31::3 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 52
+		ip6 daddr fd00:31::4 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 53
+		ip6 daddr fd00:31::5 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 54
+		ip6 daddr fd00:31::6 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 55
+		ip6 daddr fd00:26::2 iifname != "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 56
+		ip6 daddr fd00:24::2 iifname != "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 57
+		ip6 daddr fd00:1::3 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 58
+		ip6 daddr fd00:1::4 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 59
+		ip6 daddr fd00:41::2 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 60
+		ip6 daddr fd00:41::3 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 61
+		ip6 daddr fd00:1::5 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 62
+		ip6 daddr fd00:10::2 iifname != "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 63
+		ip6 daddr fd00:16::2 iifname != "br-618855db6757" counter packets 0 bytes 0 drop # handle 64
+		ip6 daddr fd00:1::6 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 65
+		ip6 daddr fd00:17::2 iifname != "br-28584d053169" counter packets 0 bytes 0 drop # handle 66
+		ip6 daddr fd00:18::2 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 67
+		ip6 daddr fd00:18::3 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 68
+		ip6 daddr fd00:18::4 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 69
+		ip6 daddr fd00:9::2 iifname != "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 71
+	}
+}

docs/le-app-database-migration/phase2b-contained-runtime/inventory/runtime-state.txt

@@ -0,0 +1,21 @@
+2026-07-12T20:24:21-04:00
+TITANSERVER
+Linux TITANSERVER 7.1.3-zen1-2-zen #1 ZEN SMP PREEMPT_DYNAMIC Thu, 09 Jul 2026 20:39:38 +0000 x86_64 GNU/Linux
+
+=== user@1200 ===
+LoadState=loaded
+ActiveState=inactive
+SubState=dead
+FragmentPath=/usr/lib/systemd/system/user@.service
+DropInPaths=/usr/lib/systemd/system/user@.service.d/10-login-barrier.conf
+Result=success
+
+=== linger ===
+linger=absent
+
+=== UID 1200 processes ===
+none
+
+=== runtime directory/socket ===
+stat: cannot statx '/run/user/1200': No such file or directory
+stat: cannot statx '/run/user/1200/docker.sock': No such file or directory

docs/le-app-database-migration/phase2b-contained-runtime/inventory/runtime-versions.txt

@@ -0,0 +1,41 @@
+docker 1:29.6.1-1
+containerd 2.3.2-1
+docker-compose 5.3.1-1
+rootlesskit 3.0.1-1
+slirp4netns 1.3.4-1
+libslirp 4.9.3-1
+openai-codex 0.144.1-2
+Client:
+ Version:           29.6.1
+ API version:       1.55
+ Go version:        go1.26.4-X:nodwarf5
+ Git commit:        8900f1d330
+ Built:             Sun Jun 28 16:44:00 2026
+ OS/Arch:           linux/amd64
+ Context:           default
+
+Server:
+ Engine:
+  Version:          29.6.1
+  API version:      1.55 (minimum version 1.40)
+  Go version:       go1.26.4-X:nodwarf5
+  Git commit:       8ec5ab355a
+  Built:            Sun Jun 28 16:44:00 2026
+  OS/Arch:          linux/amd64
+  Experimental:     false
+ containerd:
+  Version:          v2.3.2
+  GitCommit:        fff62f14765df376e5fc36f5a8f8e795b5670f61.m
+ nvidia:
+  Version:          1.5.0
+  GitCommit:        
+ docker-init:
+  Version:          0.19.0
+  GitCommit:        de40ad0
+rootlesskit version 3.0.1
+slirp4netns version 1.3.4
+commit: unknown
+libslirp: 4.9.3
+SLIRP_CONFIG_VERSION_MAX: 6
+libseccomp: 2.6.0
+codex-cli 0.144.1

docs/le-app-database-migration/phase2b-contained-runtime/inventory/workspace-acls.txt

@@ -0,0 +1,32 @@
+user::rwx
+group::r-x
+other::---
+
+user::rwx
+group::---
+other::---
+
+user::rwx
+group::---
+other::---
+
+user::r-x
+group::r-x
+other::---
+
+user::rwx
+group::r-x
+other::---
+
+user::rwx
+group::---
+other::---
+
+user::rwx
+group::---
+other::---
+
+user::rwx
+group::---
+other::---
+

docs/le-app-database-migration/phase2b-contained-runtime/inventory/workspace-tree.psv

@@ -0,0 +1,8 @@
+/srv/le-app-codex|uid=0|gid=1200|mode=750|type=d
+/srv/le-app-codex/home|uid=1200|gid=1200|mode=700|type=d
+/srv/le-app-codex/lasereverything.net.db|uid=1200|gid=1200|mode=700|type=d
+/srv/le-app-codex/database-source-readonly|uid=0|gid=1200|mode=550|type=d
+/srv/le-app-codex/nonproduction-secrets|uid=0|gid=1200|mode=750|type=d
+/srv/le-app-codex/container-runtime|uid=1200|gid=1200|mode=700|type=d
+/srv/le-app-codex/testing-data|uid=1200|gid=1200|mode=700|type=d
+/srv/le-app-codex/build-artifacts|uid=1200|gid=1200|mode=700|type=d

docs/le-app-database-migration/phase2b-contained-runtime/payload/etc/le-app-codex-runtime/resolv.conf

@@ -0,0 +1,4 @@
+# Phase 2B IPv4-only public DNS; no LAN resolver exception.
+nameserver 9.9.9.9
+nameserver 149.112.112.112
+options edns0 trust-ad

docs/le-app-database-migration/phase2b-contained-runtime/payload/etc/nftables.d/50-le-app-codex.nft

@@ -0,0 +1,54 @@
+table inet le_app_codex {
+  set approved_dns4 {
+    type ipv4_addr
+    flags interval
+    elements = { 9.9.9.9, 149.112.112.112 }
+  }
+
+  set operator_host_public4 {
+    type ipv4_addr
+    flags interval
+    elements = { 74.67.173.56 }
+  }
+
+  set denied4 {
+    type ipv4_addr
+    flags interval
+    elements = {
+      0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8,
+      169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24,
+      192.0.2.0/24, 192.88.99.0/24, 192.168.0.0/16,
+      198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24,
+      224.0.0.0/4, 240.0.0.0/4
+    }
+  }
+
+  chain input {
+    type filter hook input priority filter; policy accept;
+    iifname "lecodex-host" ct state established,related accept
+    iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
+    iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
+    iifname "lecodex-host" counter drop
+  }
+
+  chain forward {
+    type filter hook forward priority filter; policy accept;
+    oifname "lecodex-host" ct state established,related accept
+    oifname "lecodex-host" counter drop
+    iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
+    iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
+    iifname "lecodex-host" ip daddr @operator_host_public4 counter drop
+    iifname "lecodex-host" ip daddr @denied4 counter drop
+    iifname "lecodex-host" meta nfproto ipv6 counter drop
+    iifname "lecodex-host" tcp dport { 25, 465, 587 } counter drop
+    iifname "lecodex-host" tcp dport { 80, 443 } accept
+    iifname "lecodex-host" counter drop
+  }
+}
+
+table ip le_app_codex_nat {
+  chain postrouting {
+    type nat hook postrouting priority srcnat; policy accept;
+    ip saddr 10.200.120.0/30 oifname != "lecodex-host" masquerade
+  }
+}

docs/le-app-database-migration/phase2b-contained-runtime/payload/etc/systemd/system/le-app-codex-netns.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Root-owned IPv4-only namespace for le_app_codex
+Before=user@1200.service
+ConditionPathExists=/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/libexec/le-app-codex-netns up
+ExecStop=/usr/local/libexec/le-app-codex-netns down
+

docs/le-app-database-migration/phase2b-contained-runtime/payload/etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf

@@ -0,0 +1,7 @@
+[Slice]
+CPUQuota=600%
+MemoryHigh=48G
+MemoryMax=64G
+MemorySwapMax=16G
+TasksMax=4096
+

docs/le-app-database-migration/phase2b-contained-runtime/payload/etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf

@@ -0,0 +1,40 @@
+[Unit]
+Requires=le-app-codex-netns.service
+After=le-app-codex-netns.service
+
+[Service]
+NetworkNamespacePath=/run/netns/le-app-codex
+ProtectSystem=strict
+PrivateTmp=yes
+ProtectHome=yes
+ProtectProc=invisible
+ProcSubset=all
+BindReadOnlyPaths=/etc/le-app-codex-runtime/resolv.conf:/etc/resolv.conf
+TemporaryFileSystem=/srv:ro
+BindPaths=/srv/le-app-codex:/srv/le-app-codex
+TemporaryFileSystem=/var:ro
+TemporaryFileSystem=/mnt:ro
+TemporaryFileSystem=/media:ro
+TemporaryFileSystem=/opt:ro
+InaccessiblePaths=/var/www
+InaccessiblePaths=/root
+InaccessiblePaths=/home
+InaccessiblePaths=/boot
+InaccessiblePaths=/efi
+InaccessiblePaths=/run/docker.sock
+InaccessiblePaths=/var/run/docker.sock
+InaccessiblePaths=/run/containerd/containerd.sock
+InaccessiblePaths=/run/podman
+InaccessiblePaths=/run/dbus/system_bus_socket
+InaccessiblePaths=/run/systemd/private
+InaccessiblePaths=/var/lib/docker
+InaccessiblePaths=/var/lib/containerd
+InaccessiblePaths=/var/lib/containers
+InaccessiblePaths=/etc/docker
+InaccessiblePaths=/etc/containers
+InaccessiblePaths=/etc/ssh
+InaccessiblePaths=/etc/NetworkManager/system-connections
+InaccessiblePaths=/etc/wireguard
+DevicePolicy=closed
+DeviceAllow=/dev/fuse rw
+DeviceAllow=/dev/net/tun rw

docs/le-app-database-migration/phase2b-contained-runtime/payload/srv/le-app-codex/home/.config/docker/daemon.json

@@ -0,0 +1,16 @@
+{
+  "data-root": "/srv/le-app-codex/container-runtime/docker",
+  "storage-driver": "fuse-overlayfs",
+  "live-restore": false,
+  "userland-proxy": false,
+  "ipv6": false,
+  "ip6tables": false,
+  "iptables": true,
+  "hosts": ["unix:///run/user/1200/docker.sock"],
+  "log-driver": "local",
+  "log-opts": {
+    "max-size": "20m",
+    "max-file": "5"
+  }
+}
+

docs/le-app-database-migration/phase2b-contained-runtime/payload/srv/le-app-codex/home/.config/systemd/user/docker.service

@@ -0,0 +1,34 @@
+[Unit]
+Description=Laser Everything rootless Docker
+Documentation=https://docs.docker.com/engine/security/rootless/
+
+[Service]
+Type=notify
+NotifyAccess=all
+KillMode=mixed
+Environment=HOME=/srv/le-app-codex/home
+Environment=XDG_RUNTIME_DIR=/run/user/1200
+Environment=DOCKER_HOST=unix:///run/user/1200/docker.sock
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR=/run/user/1200/dockerd-rootless
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=builtin
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=65520
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX=true
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP=true
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK=true
+Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS=false
+ExecStart=/usr/local/libexec/dockerd-rootless-29.6.1.sh
+ExecReload=/usr/bin/kill -s HUP $MAINPID
+Restart=always
+RestartSec=2
+TimeoutStartSec=0
+TimeoutStopSec=120
+LimitNOFILE=infinity
+LimitNPROC=infinity
+LimitCORE=infinity
+TasksMax=infinity
+Delegate=yes
+
+[Install]
+WantedBy=default.target
+

docs/le-app-database-migration/phase2b-contained-runtime/payload/srv/le-app-codex/home/.docker/config.json

@@ -0,0 +1,4 @@
+{
+  "currentContext": "le-app-codex"
+}
+