Open conflicts
Technical tradeoffs and deliberate boundary decisions preserved across the zone. Each item records the observed evidence, evaluated alternatives, and default operational policy.
Documented Conflicts and Defaults
| Conflict | Evidence | Options | Default kept |
|---|---|---|---|
| Stray OpenMontage node dev servers | Ports 51827, 51828, 51830 bound to 127.0.0.1 by node processes (~30h old, not systemd units) | Kill active processes vs Register in AGENTS.md vs Leave running unregistered | Left running unregistered on loopback to avoid terminating live developer sessions |
| Moincraft tenant dead upstream and IP SAN | Port 55668 has no listener for /mindserver/ on 178.18.250.170; raw IP missing from moincraft.de certificate SAN | Mutate foreign tenant configuration vs Leave untouched | Preserved untouched as an isolated boundary owned by foreign tenant user mc |
| Buzz documentation vault unpublished | Vault directory /home/loca/dev/wikis/buzz exists without Nginx vhost or automated build pipeline | Stand up Nginx site and build trigger vs Archive directory vs Keep dormant | Kept dormant in repository without public exposure until requested by project owner |
| Gated wiki policy divergence | wiki.midi.loca.zone and wiki.opmo.loca.zone enforce Authelia gates while 41 other wikis remain public | Strip Authelia gates vs Gate all wikis vs Preserve per-service policy | Preserved individual service configurations as intentional protection boundaries |
| Transient TLS probe timeout | Periodic automated TLS probe timeouts recorded on wiki.tndm.loca.zone (not reproduced under direct curl) | Modify Nginx TLS timeout parameters vs Classify as transient probe artifact | Treated as non-blocking probe latency artifact; no configuration changes made |
| WRDP health check unit state | Unit wrdp-health.service failed in baseline snapshot but cleared in post-repair scan | Rebuild test bench health checker vs Retain baseline record | Baseline failure retained as historical finding 20; cleared on live re-scan |
| Portal satellite card positioning | Nested subdomains attach to parent card backs rather than card fronts | Move satellite icons to card front vs Keep on card back | Kept on card back to protect the single-link clickable target of card fronts |
| Certificate SAN expansion gaps remain | Certbot dry-run failed with secondary-validation DNS A/CAA network errors on api/app/site/s3/code.site/dev/editor/photopea; all 4 SAN gaps remain (dev.os, code.site.os, editor.site.os, photopea.site.os) | Retry renewal loops vs Retain existing certificate | Retained valid os.loca.zone certificate (covers os, api.os, app.os, s3.os, site.os; valid 74 days, expires 2026-11-24) per contingency |
| s3.lobe storage boundary and LobeHub auth | s3.lobe.loca.zone is hidden from discovery (HIDDEN = {"auth", "s3.lobe"} in generator); LobeHub (lobe.loca.zone) is a visible card with native Better-Auth OIDC against Authelia | Expose s3.lobe on portal vs Keep unlisted | Kept s3.lobe unlisted as internal object storage while LobeHub remains a visible, self-authenticated portal card |
Sources
/home/loca/dev/wikis/loca/evidence/pre-integration-snapshot.json:6662-6979/home/loca/dev/wikis/loca/evidence/post-repairs-snapshot.json/home/loca/dev/wikis/loca/evidence/step9-cert.json:1-55/etc/nginx/sites-available/wiki.midi.loca.zone:1-25/etc/nginx/sites-available/wiki.opmo.loca.zone:1-25/home/loca/dev/wikis/buzz/