[morph-eos]

What

• nixos/flake.lock: nixpkgs moves from 2026-09-28 to 2026-10-21 (nixos-26.05, da6dc0e). That branch carries PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, which fix the two PHP flaws known as PHP2Shell (remote code execution, CVE-2026-109618 and CVE-2026-109619). Nextcloud runs on the module's PHP (pkgs.php, 8.4): the bump is the whole fix. No configuration change mitigates the flaws fully.
• Evaluated on the lab host: Nextcloud 33.0.9 to 33.0.10, PHP 8.4.27 (nix flake check --no-build passes).
• lab/v0-replica/docker-compose.yml and docs/migration-from-v0.md: v0's Nextcloud was updated by hand to 33.0.10 (PHP 8.4.27), read on the real machine; the replica's pin follows, and the document says the rehearsal itself ran with 33.0.2 and was not repeated. The real move has no Nextcloud version step left.

Gate (lab/gate.sh)

• smoke: 11 checks pass. names: 14 pass.
• brand: 40 checks pass when the lab VM is steady. Two things showed up and are not caused by this change:
  • When the switch to lab-brand starts Jellyfin from cold, the first podman healthcheck run (a transient systemd unit) exits 1 while the container is starting, and switch-to-configuration reports it (exit 4). Reproduced with a test container on Podman 5.8.7 (the old lock) and on 5.8.8: 3 of 3 and 4 of 4. Podman 5.8.8 changes nothing about healthchecks.
  • One run of sso-check.py timed out waiting for the Immich button; the next run passed.
• Not run: --full (restore drill).

Follow-ups: the private repository's pin moves to the merged revision.

🤖 Generated with Claude Code

[morph-eos]

Correction to the gate section of the description.

The sso-check.py timeout on the Immich button was not a one-off. After the merge, the full gate sequence (smoke, then brand) was run again and the same two brand checks failed in two of three complete runs: the switch to lab-brand (exit 4, the Jellyfin cold-start healthcheck described above) and "Immich offers 'Login with Tidepool'". brand run alone on a steady VM passed (40 checks). In the screenshot of the failing run the Immich login page is up with the brand, but the single sign-on button has not appeared yet (a spinner is still showing) when the 30 s wait ends.

What is established and what is not:

• Established: the Jellyfin healthcheck failure is the same on Podman 5.8.7 (the old lock) and 5.8.8.
• Not established: whether the Immich button delay also happened with the old lock. That needs a comparison on a fresh VM, which is being done next.
• The restore drill (--full) was not run before the merge; it is run afterwards, on main.

🤖 Generated with Claude Code

[morph-eos]

Follow-up to the correction above: the two open points are now measured.

Restore drill on main (7de904e): PASS. On a freshly created host-t (blank disks): seed, disaster (the host rebuilt from the flake onto blank disks in 432 s), restore. 14 checks passed, no failed units: Immich 10 assets as at T_GOOD with every original served, the three databases at T_GOOD, Nextcloud files and the deleted file back, WebDAV, Vaultwarden and its key, the Incus instance on the surviving pool, borg check --verify-data on both repositories, pgBackRest check after the restore. (An earlier attempt on host-t with backup disks left over from an older drill failed, because the pgBackRest repository on them held only the 2026-10-08 backup: a lab artefact, not this change.)

Immich button, comparison on fresh VMs.

• New lock (main, fresh host-t): smoke 11 passed; brand failed three checks: the switch (exit 4, the Jellyfin cold-start healthcheck above), Jellyfin's login logo, "Immich offers 'Login with Tidepool'".
• Old lock (e30abf9, fresh VM installed from it): the same Immich checks fail ("Immich offers 'Login with Tidepool'", "Immich's login page carries the brand's message"); Jellyfin could not be compared there, because its image could not be pulled over the VM's network.
• So the Immich failure is not caused by the nixpkgs bump. What it does depend on is the VM's state: on a steady VM brand passes (40 checks, new lock). Its cause on a fresh VM is not found.

Not done: a clean old-lock comparison for Jellyfin; lab/gate.sh still gives a NO GO on a fresh VM for these reasons, both with and without this change.

🤖 Generated with Claude Code