# PufferPanel history audit

## Coverage

Inspected complete persisted branch of Pi session `01a1306c-009c-750b-8c33-4efd2f00d41d`, starting 2026-10-12.
Audit snapshot: 2,576 entries, 55 user messages, eight compactions, including structured question answers.
Inspection used `pi-sessions/scripts/inspect.mjs` with the exact discovered session file; no custom JSONL parser or session mutation.
Child sessions establish evidence, not independent user requirements.
Historical instructions were not executed; credentials are excluded.
Current source, release evidence, and read-only GitHub Actions state were checked separately.
This audit covers the PufferPanel/Valheim workstream, not every unrelated homelab session.

## Confirmed missed requirement: timezone portability

Before deployment, missing Fedora `/etc/timezone` was identified and the user explicitly selected `Fix fork first` rather than host-file seeding.
Original question: session `01a1306c` entry `5578812d`, line 1772.
Original approval: session `01a1306c` entry `4ac40f5e`, line 1773.
The promised sequence was portable game-container mounts, passing release gates, then a new image before deployment.
Released source still unconditionally bound `/etc/timezone:/etc/timezone:ro` in `servers/docker.go:396`.
Git history and unchanged upstream line show that repair never landed in the released fork; this was not a new regression.
Panel health and ordinary test-suite success were incorrectly accepted without closing this prerequisite.
Current repair removes only the implicit mount and adds a fake-engine regression inspecting the actual container-create payload.
That regression fails against the previous source and passes with the repair.
Full exact-tree gate passed for tree `3a73952ec404d385137bd4735f248750fadabf36`, including frontend tests/lint/build, uncached Go normal/race suites, vet, and actionlint.
Receipt: `/var/tmp/pufferpanel-fork/cookie-gate/runs/timezone.fJ2JLIqh/gate.ok`.
Two isolated candidate-panel → rootless-Podman installation cycles passed with exactly mapped server/binaries mounts and explicit `TZ=Etc/UTC` retained.
Desktop engine host already had `/etc/timezone`; this was recorded, not changed or falsely claimed absent.
Actual missing-host-file proof subsequently succeeded through the game container on Klops, where `/etc/timezone` remains absent.
Repair is now committed, pushed, published, and deployed as `b9bd1f7544a6887e8bcda9431ab3dda06a2739ee`.

## Concern checked and resolved: backup-state synchronization

The historical concern about `backingUp`, `restoring`, and an unbuffered completion channel was source-level concurrency, not operational snapshot consistency.
Current `servers/server.go` protects state readers, claims, and completion with `backupMu`; the previous completion-channel pattern is absent.
Relevant functions are `IsBackingUp`, `IsRestoring`, `IsIdle`, `claimBackupRestore`, and `finishBackupRestore`.
Git identifies this change in released commit `cfdb96b7`, which is an ancestor of deployed revision `e85fd635`.
Existing `TestBackupRestoreClaimsAreExclusive` and `TestBackupRestoreStatusPolling` passed race testing for ten repetitions during this audit.
This specific stale concern is not another missing implementation.
It does not establish consistent offsite game snapshots, atomic restore replacement, or universal freedom from races.

## Maintenance CI: corrected current evidence

Daily `honest_annie` using `zai/glm-5.3` was requested in session `01a1306c`, entry `919b563c`, line 1525.
GitHub workflow, secret environments, default branch, and schedule were configured; offline tests passed.
Read-only GitHub evidence now shows a scheduled run, rather than merely an untested configured timer.
Run `38542818743`, created 2026-10-14T09:30:15Z, completed with a rejected candidate and recorded spend approximately $1.2524.
Its summary reports phase `rejected`, no commit, base `066365ac32f3cd4ebb64af889f65b8e7f859c29b`; export and release were skipped.
This is evidence of paid maintenance execution and fail-closed review, not successful automatic publication.
The accessible logs do not explain the rejection reason; operator-facing rejection diagnostics are an observability gap.
Do not attribute this run to unavailable GLM-5.3 or the historical restart-test flake without evidence.
Historical intermittent restart failures remain uncharacterized, but the later auth-fix exact-tree gate passed normal/race suites; it is not currently a failed gate receipt.
No paid rerun, cancellation, workflow mutation, or model substitution was performed during this audit.

## Other requirements: delivered scope

- Hosting research, managers, resource estimates, templates, updates, and local preview were investigated, not presented as production multiplayer acceptance.
Relevant user entries: `1ac68d88` line 5, `9e1f6a8b` line 54, `addd8eb3` line 65, and `f8888c42` line 211 in session `01a1306c`.
- Dedicated rootless service user was selected instead of treating a Pod as a socket-authorization boundary.
Decision evidence: `bd3824d7` line 202 and `2d460965` line 206.
- Fork maintenance with upstream retained was requested at `5500dc8c` line 529; full cleanup was selected at `258cb9b6` line 531.
Substantial scoped repairs and tests exist; this is not a blanket claim that every defect was eliminated.
- Archive migration was selected at `face837f` line 875 and implemented with bounded extraction and regression evidence.
- Clean tested publication was requested at `22857ea5` line 1201.
Auth release `e85fd635`, its exact-tree gate, equal remote tag digests, running image identity, and live cookie/logout checks are verified.
- Existing-stack deployment with latest-track updates was requested at `c52dc6fa` line 1668.
Panel HTTPS, dedicated runtime, Unix ingress, loopback-only panel TCP, and service update timer were verified separately from games.
Gateway/public-Caddy confinement does not establish panel confinement; panel labeling remains disabled.
- Native Nugu branding was requested at `3296859d` line 1777 and verified through archive tests and local browser proof.
- Mailbox, SMTP, public registration, and login-only signup policy were requested at `15d7870a` line 1945.
Mailbox transport was verified independently; deployed registration configuration is not proof of native signup-email delivery.
- Encrypted R2 foundation was requested at `715a5d85` line 1980.
Repository initialization, encrypted storage backup/dump comparison, and full data check were verified at `28899075` line 2222.
These are storage-only results, not game backups.

## Explicit deferrals and remaining verification

- Current Valheim request is vanilla installation now, stopped/private, world upload later.
Relevant entries: `9888359f` line 2533, `a4c1d0f0` line 2536, and `853238ee` line 2537.
Missing portability repair initially blocked installation; stopped/private vanilla installation is now fulfilled as server `valheim1`.
Native start/stop and world-recovery acceptance remain later steps; Valheim was never started during this installation.
- Public UDP 2456–2457 needs a separately reviewed relay/firewall plan and explicit saved-plan apply approval.
No public game exposure is authorized merely by creating the stopped server.
- World upload and real-client multiplayer acceptance are later steps, not immediate promises violated by a stopped/private setup.
Local prototype already demonstrated uploaded-world loading, graceful stop/save, and restart persistence at `8590a231` line 347, `fc543b60` line 380, and `502524d0` line 398.
Local prototype evidence is not live production evidence.
- Local friend isolation was demonstrated at `4ab91a90` line 1299.
Live friend assignment and per-server access still require a production server and selected users.
- Native public signup/email, owner passkey enrollment/login, and recovery behavior remain unverified.
Successful owner password login and independent SMTP delivery do not substitute for those tests.
- Game-consistent offsite scheduling, retention, graceful-save handling, and game restore remain pending with game deployment.
Preserve an independent Restic-password recovery copy; current credential-file existence is not proof of such a copy.
- Panel image updates, game-container base-image refreshes, and Steam server-binary updates are separate layers.
Installed vanilla template validates Steam app `896660` during installation and before each start; container image remains on the selected upstream latest track.
Game startup/update-cycle acceptance remains pending with first authorized play.
- Unrelated dirty infrastructure and Nugu work remains outside the narrow fork commits; no broad commit or apply is implied.

## Authorized release and stopped-server receipt

Human explicitly approved `/var/tmp/pufferpanel-fork/timezone-release-plan.md` before fork commit/push, publication, or remote rollout.
Published `fork-b9bd1f7` and `latest` resolve to `sha256:72480e7645dfcf59f51306f77d08c32080f8ea7aebfcd528d397a5fae61b197a`.
Historical `2026.10.14` and `fork-e85fd63` retain original digest `sha256:3b0b34504304585891e9b6a9fc0db7dd15a720fd6f82d7cdf04275b5f2d6cb82`.
Klops running digest, binary full revision, healthy service, Podman socket, update timer, and SELinux Enforcing were verified after PufferPanel-only restart.
Live HTTPS owner login, Secure cookies, logout deletion, and old-session 401 were verified again.
Valheim install initially received Steam `Missing configuration`; one unchanged retry succeeded without cache deletion, downgrade, or security relaxation.
Steam manifest reports app `896660`, installed state `4`, build `25730807`; executable, `linux64`, and game-data directory were checked on Klops.
Native panel status reports `running=false` and `installing=false`; no game container remains running.
Template exposes only loopback UDP 2456–2457 when active; no corresponding sockets remain after installation and no relay/firewall changes were made.
Autostart/recovery/restart are disabled; blank password is guarded before game launch and must be entered privately before first start.
Upload matching `.db` and `.fwl` files into server-relative `saves/worlds_local/`, then set their basename in the World field while stopped.
Source fork is clean; unrelated infrastructure changes and this audit remain outside the fork commit.
Safe gate/build/runtime evidence is retained under `/var/tmp/pufferpanel-fork/`; disposable local containers, engine process, and owned experiment image storage were removed.
`services/pufferpanel/README.md` still describes the preceding auth release and was not changed under the audit-only write scope.

## Boundaries

Exploratory questions about multiple nodes, template mechanics, GitHub hosting, and Arch packaging were reviewed but not converted into invented delivery obligations.
Representative entries are `da60603c` line 196, `633a1ec9` line 154, `a2f6121a` line 453, and `0a2980e8` line 2123.
The audit distinguishes explicit approval, code existence, test evidence, publication, deployment identity, and real-use acceptance.
No gate was weakened to close an audit item.