The payload reference

This page is not written. It is contract/web-api/, the contract lemonfiber generates from the Rust types that actually serialise each reply, read at the revision named at its foot and set out as tables. A field added upstream appears here when the pin moves, and nothing on this page can say a field exists that the artefact does not.

That is also its limit. The artefact knows shapes and the doc comments written on them; it does not know which endpoint answers which kind, or what a client has to do that no schema can express. Those are the envelope and every payload kind, which is where to start. Come here for the exact shape of a field.

How to read it

The first table maps each kind to the type its data is. Every type is then set out once, by name, however many kinds use it, and a type named in a field links to its own entry.

• A required field is always present. One that is not may be absent, and a type that includes null may also be present and empty — the two are different, and a client keeps them apart.
• A type that is one of several things is closed: a client reads the value it names, and a value it does not know is refused plainly rather than guessed at. Where the choices are objects, the field that tells them apart is shown with the value that selects each one.
• Numbers carry the width the Rust type has, such as uint16, and the bounds that follow from it.

Every kind, and the type its data is

Kind	What data holds
admission	Admitted
adoption	AdoptReport
alert	Alert
alerts	AlertReport
archives	Listing
askable	AskableReport
asked	AskedReport
backup	BackupReport
bandwidth	Sharing
beside	BesideReport
bundle	Bundle
capabilities	Capabilities
catalogue	CatalogueReport
certificate	CertificateReport
clients	Guidance
config	ConfigReport
credentials	Inventory
dashboard	Snapshot
device-challenge	DeviceChallenge
device-key	RegisteredDeviceKey
device-keys	DeviceKeyListing
doctor	DoctorReport
error	Problem
forms	FormsReport
front-door	FrontDoorReport
glossary	Vocabulary
grant	GrantReport
handoff	HandoffReport
held	HeldReport
history	HistoryReport
hosting	HostingReport
household	HouseholdReport
import	ImportReport
invitation	Invitation
job	Started
key-claim	KeyClaim
keys	KeyListing
lifecycle	LifecycleReport
log	LogLine
migration	MigrationReport
minted-key	MintedKey
music	MusicReport
news	Newest
news-items	News
outbound	Leaving
pairing	Pairing
part-way	PartWayReport
pausing	PausingReport
playing	PlayingReport
plugins	PluginInstalls
preview	Plan
provenance	ProvenanceReport
pull	string
quality	QualityReport
removal	HouseholdRemoval
repair	RepairReport
replacement	ReplaceReport
reset	ResetReport
restore	Restoration
seed	SeedReport
self-update	UpdateReport
settings	SettingsReport
setup	SetupReport
space	Reckoning
start	string
status	StatusReport
step	Line
stop-seeding	Letting
stored	Stored
stuck	StuckReport
substitution	SubstitutionReport
title	TitleReport
trace	TraceReport
undo	UndoReversal
uninstall	Uninstall
update	StackUpdateReport
upgrade	UpgradeReport
version	VersionReport
walkthrough	WalkthroughReport
watch	SupervisionReport
watched	WatchedReport
wiring	WiringReport
wizard	WizardReport
word	Term

Every type, by name

Action

What an undo does.

Tagged by what it does rather than by the field it sits in, so a reader parsing one branches on a word rather than on which keys are present.

One of these:

• does: "remove"

  Remove the resource that was created.

  • id string

    The identifier to remove.

  • resource string

    The kind of resource.

• does: "restore"

  Restore a value, or remove it where there was none before (None).

  • key string

    The setting to restore.

  • value stringornull optional

    What to restore it to, or None to remove it.

  • wrote string

    What lemonfiber put there, which has to still be there for putting the old value back to be putting anything back.

    Carried so that a reversal can ask whether it is undoing its own work. Without it a reversal knows only what it would like the setting to say, and a setting the operator has since chosen for themselves reads exactly like one nobody has touched.

• does: "delete"

  Remove a path that was created.

  • path string

    The path to remove.

• does: "withdraw"

  Take a region lemonfiber wrote back out of the file it was written into.

  Only where the region is still what was written. One that was edited since, or whose markers were, is somebody else's work now, and is left exactly as it is.

  • key string

    The same file beneath the stack directory, as the record of what lemonfiber materialised names it.

  • owner string

    Whose region it is, as its markers name it.

  • path string

    The file the region is in.

  • written integeruint32, ≥ 0

    The checksum of what was written between the markers, which has to still be what is there for taking it out to be taking out lemonfiber's own work.

• does: "rewind"

  Write a file back to what it held before lemonfiber wrote over it.

  Only where it still holds what was written. One written since is somebody else's work now, and is left exactly as it is.

  • path string

    The file to write back.

  • previous string

    What to write back into it.

  • written integeruint32, ≥ 0

    The checksum of what lemonfiber wrote, which has to still be what is there for writing the old text back to be undoing lemonfiber's own work.

• does: "move-back"

  Move a service's state back to where it was.

  Only where nothing has taken its old place, and only from where it was moved to.

  • from string

    Where it goes back to.

  • to string

    Where it is now.

• does: "keep-copy"

  Keep the copy of a volume where it is: the volume was never changed, so nothing is put back.

  • to string

    Where the copy is.

  • volume string

    The volume it was copied from.

• does: "repin"

  Pin a service back to the version it was standing on.

  The one reversal nothing in this product carries out. Which version runs is decided by the materialised stack and by what Compose was told to start, and a reversal of settings and files reaches neither — so this is worked out, reported, and left for the operator rather than attempted.

  • current string

    The version this run moved it to, which has to still be the one running for putting the old one back to be putting anything back.

  • previous string

    The version to put back.

• does: "reconfigure"

  Put one field of a service's own resource back to what it held.

  The only reversal that needs the service itself: the value lives inside it, and nothing on the host can write it. A reversal that cannot reach the service says so rather than reporting the field restored.

  • field string

    The field to put back.

  • id string

    The identifier to change.

  • resource string

    The kind of resource.

  • value stringornull optional

    What to put back, or None where it held nothing.

• does: "revoke"

  Revoke the key a mint made.

  • name string

    The key's name.

• does: "reinstate"

  Make a revoked key good again.

  Worked out so the record of a revoke has a reversal to name, and never carried out: a key is revoked because something should stop holding it, and reinstating it would hand back what the revoke took away. Whatever still needs a key is minted a new one.

  • name string

    The key's name.

• does: "revoke-device"

  Revoke the device key a registration made.

  • name string

    The device key's name.

• does: "reinstate-device"

  Make a revoked device key good again.

  Worked out so the record of a revoke has a reversal to name, and never carried out, for the reason [Action::Reinstate] never is.

  • name string

    The device key's name.

• does: "resettle"

  Put a setting in the settings store back to what it held.

  • filed stringornull optional

    The environment file's setting it goes back to, where it was moved out of one.

  • name string

    The setting's name.

  • recorded stringornull optional

    What lemonfiber recorded, which has to still be there.

  • value stringornull optional

    What to put back, or None to clear it.

• does: "regrant"

  Give a grant back to a plugin, or end one it was given.

  • give boolean

    Whether to give it, rather than end it.

  • grant PluginGrant

    The grant, by the setting the credential is held under.

  • plugin string

    The plugin the grant is of.

• does: "rehold"

  Put a secret in the secret store back to the value it held.

  • earlier stringornull optional

    The fingerprint of the value to put back, or None to forget it.

  • filed stringornull optional

    The environment file's setting it goes back to, where it was moved out of one.

  • kept stringornull optional

    The fingerprint of what lemonfiber kept, which has to still be there.

  • name string

    The secret's name.

• does: "leave"

  Leave the operator's overlay as it is.

  Worked out so the record of a change to it has a reversal to name, and never carried out: lemonfiber does not write the operator's own file.

  • path string

    The overlay.

Active

One download still coming down when a reduction was asked for.

Field	Type	Required	What it is
name	string	yes	What it is, as the client names it.
progress	integeruint8, ≥ 0, ≤ 255	yes	How far along, from zero to a hundred.
protocol	string	yes	Which client has it.

Address

Where the front door is reached, and what is worth knowing about the address.

Field	Type	Required	What it is
caution	stringornull	no	What is worth knowing about the address itself, where anything is. Absent for one that keeps working on its own.
url	string	yes	The whole address, as it would be typed or followed.

Admitted

A session opened, and the moment it stops being one.

The ending is carried rather than left for a client to work out, because a client that guessed would be a second opinion about who is admitted — and the two would disagree on the day somebody's clock is wrong.

Field	Type	Required	What it is
member	stringornull	no	The household member this session is for, where it is a member's. Absent is the operator, which is the whole of the discriminator. A second field naming which kind of person this is could disagree with this one, and the day they disagreed a client would have to choose which to believe. The id and nothing else. What that member is called, what they may watch and what they have left are read from the household report, which already carries all of it per member — so there is one fact here and no second copy of anything that could go stale against the read.
token	string	yes	The secret this session is carried by, sent in the header the per-run token is.
until	string	yes	When it stops being one, written as every other instant this product writes.

AdoptReport

What adopting a setup already here came to, or would come to.

Field	Type	Required	What it is
back_up	array ofstring	yes	The host paths those services keep their data in, so a backup can be taken of exactly the right thing.
backed_up	stringornull	no	Where the capture of those paths was written, once one has been taken. Absent on a rehearsal, which captures nothing, and absent where the setup mounted nothing worth capturing. Present on an adoption that went through, because an operator told a backup was taken is owed the path to it.
project	stringornull	no	The project lemonfiber would manage, where exactly one could be adopted.
refusal	stringornull	no	Why nothing was done, where nothing was.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
stance	Stance	yes	Where the act stands.
upgrades	array ofCarryingReport	yes	The services whose databases a newer version would upgrade, and whose data therefore has to be backed up before anything opens it.

Affected

One thing that is wrong, as the expanded summary lists it.

Field	Type	Required	What it is
acknowledged	boolean	no	Whether the operator has acknowledged it by declining its fix. It still stands and is still counted.
check	string	yes	The check that raised it.
downstream	array ofstring	yes	What is also wrong because of this, counted with it rather than again.
exit	integerornullint32	no	How the service it is about exited, where it has and the engine said. The technical half of what happened, kept out of the summary so the plain words lead, and here for whoever wants the code.
meaning	string	yes	What it costs the operator. The line expands to items an operator can act on, and an item that states only the event leaves the judgement it was supposed to save them.
onset	string	yes	When the stack first saw it wrong since it last saw it right, in whole seconds since the epoch. The condition's own stamp, kept between runs, so every surface that reports the check names the same moment and a restart does not make an old fault new.
remedies	array ofstring	yes	What to do about it, most likely first.
severity	ProblemSeverity	yes	How bad it is.
summary	string	yes	What is wrong, in one line.

Alert

One interruption: what happened, which way, and how much it matters.

Field	Type	Required	What it is
affected	array ofstring	yes	Every check this alert speaks for, the first being [Self::check]. More than one where the same event was grouped across several services.
check	string	yes	The check this came from, so an alert and its condition cannot drift apart. Where several were grouped, the first of them.
exit	integerornullint32	no	How the service it is about exited, where it has and the engine said; where several were grouped, how the first of them did. The technical half of what happened, kept out of the summary so the plain words lead, and here for whoever wants the code.
id	stringornull	no	What names this alert rather than this event: the same on an onset and on the resolution that ends it, and different the next time the same thing goes wrong — the check and which recurrence of it this is. So a client can close what it opened without comparing sentences. Absent on an alert recorded before alerts carried one.
kind	string	yes	What kind of event it is, shared by every instance of it.
meaning	string	yes	What it costs the operator, which is the half between the event and the fix. "The tunnel dropped" and "restart the gateway" leave whoever reads them to work out for themselves whether anything leaked.
moment	Moment	yes	Which way it went.
remedies	array ofstring	yes	What to do about it, most likely first. An alert that says what happened and not what to do is a notification, which is a different and worse thing.
severity	ProblemSeverity	yes	How much it matters. A resolution takes the severity of what resolved, because "the critical thing is over" is itself worth the attention the critical thing had.
summary	string	yes	What happened, in the words the condition was raised with.

AlertReport

What the operator will be told about, and what changing it came to.

Field	Type	Required	What it is
changed	boolean	yes	Whether this call changed the answer.
exceptions	array ofExceptionReport	yes	Events set apart from the preset, quietest name first.
means	string	yes	What that preset means, in the operator's terms.
preset	string	yes	The preset in force for events with no exception of their own.
rehearsed	boolean	yes	Whether it only reported what it would have written.

Answer

How one download client answered about the limits on it.

One of these:

• answered: "held"

  It answered, in both directions.

  • down BandwidthHeld

    What became of the download limit.

  • period Periodornull optional

    Which side of the household's day it says it is on, where it keeps the hours itself.

  • up BandwidthHeld

    And of the upload one.

• answered: "silent"

  It did not answer, and this is what it said.

  Its own line rather than an absence, because a client nobody could reach is a client whose limits are unknown, and an unknown limit rendered as no limit is the report reading better than the stack is.

  • said string

    What went wrong, in the words of whatever refused.

ApiKind

The API shapes lemonfiber knows how to speak.

Four services share the servarr shape, which is what makes one client enough for them. Bindery is its own kind deliberately: it is not a Servarr application and Prowlarr's app sync does not reach it. Bazarr is its own for the neighbouring reason: it is told about the *arrs rather than being one of them, in a form body a client of the shared shape could not send.

One of these:

• "servarr"

  Sonarr, Radarr, Lidarr and Prowlarr.

• "sabnzbd"

  SABnzbd.

• "qbittorrent"

  qBittorrent's WebUI API.

• "seerr"

  Seerr.

• "bindery"

  Bindery.

• "jellyfin"

  Jellyfin — a media server whose account lemonfiber creates rather than a key it reads.

• "bazarr"

  Bazarr — the subtitle finder, which is told which *arrs to watch.

• "audiobookshelf"

  Audiobookshelf — a listening server whose first account lemonfiber creates, like Jellyfin's. The token it hands back on sign-in is stable, so it is read again rather than recorded twice.

• "nzbhydra2"

  NZBHydra2 — the Usenet indexer aggregator, which starts with no authentication, so lemonfiber turns it on with an administrator it names and a password it mints.

Askable

One title a member's search found.

Field	Type	Required	What it is
id	string	yes	The id it is asked for by.
kind	TitleKind	yes	Whether it is a series or a film.
stands	Stands	yes	Where it stands in the house.
title	string	yes	What it is called.
year	integerornulluint16, ≥ 0, ≤ 65535	no	The year it came out, where that is known.

AskableReport

One page of what a member's search found, under their limits.

Field	Type	Required	What it is
approval	string	yes	Whether what they ask for waits for whoever runs the house, as one sentence.
asking	MemberAsking	yes	What the member may ask for: what their period allows and has left of each kind.
kinds	array ofTitleKind	yes	The kinds of title the house can fetch now, which are the kinds searched.
member	string	yes	The member the search was made for, by the name they are known by.
next	stringornull	no	Where the next page begins, absent on the last.
term	string	yes	The words searched for, trimmed.
titles	array ofAskable	yes	The titles on this page, in the order they were found.

AskedReport

What asking for one title came to, or would come to under a rehearsal.

Field	Type	Required	What it is
kind	TitleKind	yes	Whether it is a series or a film.
leaves	LeftAfter	yes	What is left of the member's allowance once it is counted.
member	string	yes	The member it was asked for, by the name they are known by.
outcome	Became	yes	What it came to.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done.
released	boolean	yes	Whether the title has come out yet. One that has not is asked for, and arrives once it is out.
said	string	yes	All of it, in one household sentence.
seasons	array ofintegeruint32, ≥ 0	yes	The seasons asked for, none for a film.
title	string	yes	The id of the title asked for.

AskingStanding

Where one member stands against what a period allows them.

Four, and the one worth having is the middle: somebody told only when they have run out has been told too late to do anything but wait, which is the answer this whole feature exists to avoid handing anybody.

One of these:

• "unlimited"

  Nothing is counted against them.

• "within-quota"

  There is room, and comfortably.

• "near-quota"

  A fifth of the period's limit or less is left, and at least one of it.

• "quota-exhausted"

  Nothing is left, so the next thing they ask for is refused as they ask.

Assessment

Whether a pass could assess drift — whether it had the record of what lemonfiber last wrote to compare against.

One of these:

• "assessed"

  The expected-state record was read, or genuinely absent as on a first seed, so each connection was judged against it.

• "unassessable"

  The expected-state record was there but could not be read — lost. Drift could not be judged this pass, and re-baselining from the current state is offered.

Awaiting

What an operation with no bound on it is waiting for.

A case rather than a sentence, so what an operation is waiting for is a value something can be asked about. The words are built from it in one place below; a phrase carried here instead would be a phrase every later surface had to parse back into the fact it came from.

One of these:

• "downloads"

  Everything still coming down has finished arriving.

• "images"

  A form's images have come down the line.

BackupManifest

The record written inside an archive, and read back to decide a restore.

Everything a restore needs to know before it overwrites anything: what made the archive, when, what data root it was taken against, what it covers, whether it is sensitive, and the contents to list. Round-trips through JSON so the same value the capture wrote is the value the restore reads.

Field	Type	Required	What it is
created_at	string	yes	When it was taken. Opaque here; the surface stamps it from the clock.
data_root	string	yes	The data root it was taken against, to notice a restore to a different one.
members	array ofMember	yes	What is inside, for a listing shown before anything is overwritten.
product_version	string	yes	The lemonfiber version that wrote it, checked against the one restoring.
schema	integeruint32, ≥ 0	yes	The archive format, checked before anything inside is trusted.
scope	Scope	yes	What it covers.
sensitive	boolean	yes	Whether it carries credentials, and so must be handled as sensitive.

BackupReport

What a capture produced.

Field	Type	Required	What it is
pace	Pace	yes	What the capture moved, against what a capture is meant to stay inside. Read off the room check that already ran, so saying it costs nothing: the trees were walked to decide whether the archive would fit, and this is the same number put to a second use.
path	string	yes	Where the archive was written, or — on a run that only said what it would capture — where it would have gone.
pruned	array ofstring	yes	The older backups retention pruned, oldest first — or would prune.
rehearsed	boolean	yes	Whether this run only said what it would capture. A flag rather than a second shape, because every other field means the same thing either way: a capture is settled before it is written — the room is measured, the manifest described, the name and the path derived, and retention worked out — so what a rehearsal reports is what a real run would report, with the one write left out. What changes is the tense a surface says it in.
scope	Scope	yes	What the backup covers.
sensitive	boolean	yes	Whether it carries credentials, and so must be handled as sensitive.

BandwidthHeld

One direction on one client: what it was asked for, took, and is doing.

Field	Type	Required	What it is
accepted	integerornulluint64, ≥ 0	no	What it reports as in force.
asked	integerornulluint64, ≥ 0	no	What it was asked to hold to, in bytes a second, where anything was.
moving	integerornulluint64, ≥ 0	no	What it is moving right now, where it reported a figure.
verdict	BandwidthVerdict	yes	What that adds up to.

BandwidthReading

One direction's limit, as declared and as it comes to.

Field	Type	Required	What it is
limit	Limit	yes	The limit as it was expressed.
resolved	Resolved	yes	What it comes to against the measured line.
says	string	yes	The limit and the line it was measured against, in one sentence. Carried rather than left to each surface, so the rule that a share is never shown without the figure it is a share of is kept in one place instead of three.

BandwidthVerdict

What became of one limit, in one direction, on one client.

One of these:

• "unasked"

  Nothing was asked for, so there is nothing to hold to.

• "nothing-to-limit"

  This client has no such direction to limit at all.

  Apart from a limit that was ignored, and deliberately: a Usenet client does not upload, so an upload limit on one is not a setting it refused.

• "holding"

  It took the limit and is inside it.

• "ignored"

  It reports a figure other than the one it was given.

• "overrunning"

  It reports the right figure and is moving faster than it.

Became

What asking for a title came to.

One of these:

• "asked"

  Asked for, and on its way without anybody saying yes first.

• "waiting"

  Asked for, and waiting for whoever runs the house to say yes.

• "on-its-way"

  Somebody already asked for it, so nothing new was asked for.

BesideReport

What standing lemonfiber beside an existing setup came to, or would come to.

Field	Type	Required	What it is
ports	array ofMovedReport	yes	Where each service would listen instead, lowest original port first.
refusal	stringornull	no	Why nothing was written, where nothing was.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
stance	Stance	yes	Where the act stands.
written	stringornull	no	The settings file the moves were recorded in.

Beyond

A repair that has run out of chances, and where to go instead.

Field	Type	Required	What it is
check	string	yes	The check whose fault has outlasted every attempt at it.
remedy	Remedy	yes	What to do about it now that lemonfiber has stopped offering to.

Bundle

What a support request said: what a bundle holds, and where it is if it exists.

One record with an absent path rather than two shapes, because the two answers are the same answer at two moments: both list what goes in the file and say how large it is, and only one of them has a file to point at. A caller reads whether there is a path to know which it has.

Field	Type	Required	What it is
bytes	integeruint64, ≥ 0	yes	How large the file is, or would be.
contents	Contents	yes	Everything it holds, gathered, redacted and read back.
path	stringornull	no	Where it was written, or nothing where a run that writes nothing described it.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
would_go	stringornull	no	Where it would be written, on the run that only describes one. The other half of what a description is for. What goes in the file and how large it is answer whether to make it; where it lands answers where to find it, and an operator deciding at a shell needs both at the one moment the answer can still change what they do. Resolved by the same function the run that writes resolves it with, so the path shown and the path written are one. Absent on a run that wrote one — path is then where it went — and absent on a machine that would not say where lemonfiber keeps its own files, which is the one destination of the three that needs that answer.

Candidate

One completed download, and what reclaiming it would come to.

Field	Type	Required	What it is
bytes	integeruint64, ≥ 0	yes	What it occupies.
consequence	stringornull	no	What removing it costs, where it costs anything.
name	string	yes	What both sides call it.
standing	SeedingStanding	yes	Where it stands.

Cap

A monthly allowance, and what to do at the end of it.

Field	Type	Required	What it is
exceeded	WhenExceeded	yes	What happens when it is reached, chosen when the cap was declared.
monthly	integeruint64, ≥ 0	yes	The allowance, in bytes.

Capabilities

Every capability this stack has, by the path its request is served at.

Field	Type	Required	What it is
capabilities	map ofCapabilityState	yes	What each comes to for the credential that asked. A request this stack does not have is absent rather than listed as anything.
scope	CredentialScope	yes	Whose credential asked.
stack	stringornull	no	The stack's own identifier, the one pairing material carries, to every credential alike: what tells two credentials apart from two stacks. Never the address or the certificate, which re-pairing exists to change. Absent only where this machine has nowhere to keep one.

CapabilityState

What one capability comes to for the credential that asked.

One of these:

• "available"

  This stack can do it, and this credential may.

• "unconfigured"

  The stack has it, and a setting this machine has switched off has to be turned back on first.

• "unpermitted"

  The stack has it, and this credential may not ask for it.

Capacity

What the line was measured to carry.

Field	Type	Required	What it is
down	integeruint64, ≥ 0	yes	Bytes a second down.
source	Source	yes	Where the figure came from.
taken	integeruint64, ≥ 0	yes	When it was taken, in seconds since the epoch.
through_tunnel	boolean	yes	Whether the path it was measured over goes through the VPN tunnel.
up	integeruint64, ≥ 0	yes	Bytes a second up. Measured apart from the download, because a home connection is asymmetric and a single figure for both would make every upload share far larger than the operator meant.

CarryingReport

What adopting one existing service would come to.

Field	Type	Required	What it is
backup_first	boolean	yes	Whether its database must be backed up before lemonfiber opens it.
because	string	yes	What that means for this service's data, in the operator's terms.
existing	string	yes	The version standing here now.
ours	string	yes	The version lemonfiber pins.
refused	boolean	yes	Whether lemonfiber will not do this at all.
service	string	yes	The service, by the name lemonfiber runs it under.
verdict	string	yes	Which of the two is the later, in one word.

CataloguedService

What one service is for, as the stack declares it.

Field	Type	Required	What it is
criticality	Criticality	yes	How much its absence matters.
describes	string	yes	What it does for the operator, in plain language.
id	string	yes	The service's id, which is also its Compose service name.
name	string	yes	What it is called in front of an operator.
without_it	string	yes	What going without it costs. Carried beside the description rather than left to a separate question, because the pair is what turns an inventory into a judgement: knowing that Bazarr finds subtitles says nothing about whether its being down matters.

CatalogueReport

What this stack holds, and what it used to.

Field	Type	Required	What it is
removed	array ofRemovedService	yes	The services this stack has dropped, in the order it records them. Empty for a stack that has never dropped anything, which is a different thing from a stack that keeps no record — and told apart by the fact that a stack keeping no record cannot be read as having dropped something it did.
services	array ofCataloguedService	yes	The services, in the order the stack declares them. Every service the manifest holds rather than the ones some form would start: what a service is for is the question being asked, and an answer narrowed to what is running would leave the operator unable to ask about the one they are deciding whether to run.

Cause

One thing that could be behind a symptom, and how to tell it from the others.

Field	Type	Required	What it is
because	string	yes	What is wrong.
fix	string	yes	What to do about it.
tell	string	yes	How to tell this cause from the others under the same symptom.

CertificateReport

What asking for the certificate to be replaced came to.

Field	Type	Required	What it is
consequence	string	yes	What replacing it means for every phone already paired.
fingerprint	stringornull	no	What a phone would pin now: the new certificate where it was replaced, the one kept where it was not, and nothing where none has been made.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
replaced	boolean	yes	Whether it was replaced. Unconfirmed, it is not, and what replacing it costs is what is said.

Changed

What one run of this command did to the machine.

Field	Type	Required	What it is
installed	boolean	yes	Whether it installed it, rather than took it back.
name	string	yes	The command it acted on.
rehearsed	boolean	yes	Whether this was a rehearsal, in which case nothing above happened.
started	boolean	yes	Whether it started the command, which only installing does.
touched	array ofstring	yes	Everything it wrote or removed, so nothing goes unnamed in either direction.

ChangelogState

Whether the record describes what this build could have shipped.

The three the specification names, and the distinction between the last two is the one worth keeping: being behind the tags is a lag, and contradicting them is a fault.

One of these:

• "current"

  The record holds this build's release, and claims nothing later.

• "pending"

  This build's release has no notes yet, which is where a tag leaves things.

• "stale"

  The record and what this build could have shipped disagree.

ChangeReport

One change lemonfiber made, and whether it could be put back.

Field	Type	Required	What it is
alongside	integeruint, ≥ 0	yes	How many changes that one operation made, this one among them. An operation is the unit an operator agreed to, and undoing half of one leaves a machine in a state nobody chose — so what a single line would take with it is on the line rather than left to be counted off the list.
at	string	yes	When it was made, as whole seconds since the Unix epoch, written in decimal. A string of digits rather than a number, because it is the stamp the record keeps and a stamp is compared and stored as text; what it counts is stated here so a reader can turn it into a time without guessing at a format. 0 means the clock was unreadable when the change was written, not that it was made at the epoch: it is how a machine whose clock would not answer stamps a change. It is not an instant, so two changes both stamped 0 were not made at the same moment, and a reader showing it as a date in 1970 would be inventing one.
because	stringornull	no	Why it could not go further, where it could not.
did	string	yes	What it did, in the operator's terms.
instead	stringornull	no	What to do instead, where there is something.
operation	string	yes	The operation that made it — a seed, a reconfigure, an applied fix — so a history reads as what happened rather than as bare diffs.
reversal	ChangeReversal	yes	How far it could be put back.
target	string	yes	What it was made to.

ChangeReversal

How far a change can be put back.

Published as the closed set it is, rather than as a word a reader has to trust will be one of three: a surface that lays out a history branches on it, and a set the contract names is one a generated reader can match exhaustively.

One of these:

• "whole"

  It can be put back exactly.

• "partial"

  Some of it can, and the rest is stated rather than attempted.

• "none"

  None of it can.

Chosen

How the front door came to be the one it is.

One of these:

• chosen: "derived"

  Worked out from what the stack declares, which is what a stack whose operator has named nothing answers.

• chosen: "named"

  Named by the operator, by the id the stack declares it under, and it is the door.

  • door string
• chosen: "refused"

  Named by the operator and refused. The worked-out door stands, and this carries what was named and why it is not it.

  • door Refusal

Code

A stable identifier for a kind of problem.

Stability is the whole point: an operator who searches for a code should find the same answer a year later. Every code is declared in the error crate's codes module, and a code is never recycled.

It is string

Coming

One download still coming down when the removal was asked for.

Field	Type	Required	What it is
name	string	yes	What it is, as the client names it.
progress	integeruint8, ≥ 0, ≤ 255	yes	How far along, from zero to a hundred.

Condition

What a whole set of services amounts to.

One of these:

• "inactive"

  Nothing is running.

• "degraded"

  Running, with at least one service in a state that wants attention.

• "partial"

  Some services are up and others are not.

• "active"

  Everything expected is up and answering.

ConfigChange

The difference between the configuration in force and the one proposed.

One setting, because one call changes one setting. What makes it a diff rather than a value is from: an operator deciding whether to go ahead is deciding between two things, and a report that showed only the new one would be asking them to remember the old one correctly.

Field	Type	Required	What it is
cost	Cost	yes	Whether applying it is cheap or consequential.
from	stringornull	no	What it holds now, withheld where it is a credential, and absent where the setting holds nothing yet.
key	string	yes	The setting the change names.
to	string	yes	What it would hold, withheld the same way.

ConfigReport

The answer to a configuration command.

Field	Type	Required	What it is
changed	boolean	yes	Whether this command changed, or would change, a setting.
consequence	stringornull	no	What this change costs, where making it decides something with a consequence — moving the library, turning port forwarding off, or naming a front door. Stated for a change that is only staged as well as one that landed, since the moment before it happens is the moment it is worth reading. Absent for a read, and for a change to a setting nobody catalogued a cost for.
rehearsed	boolean	yes	Whether this was a rehearsal, so a change that changed reports was one that would be made rather than one that was.
review	Reviewornull	no	The difference between the configuration in force and the one proposed, and where that proposal stands: applied, staged for a confirmation, turned away, or nothing to do. Absent for a read, which proposes nothing.
settings	array ofSettingReport	yes	The settings asked about — one for a lookup, all of them for a listing.

ConflictReport

A port lemonfiber wants for a service that something else already answers on.

Field	Type	Required	What it is
held_by	string	yes	The project already holding it.
port	integeruint16, ≥ 0, ≤ 65535	yes	The host port both want.
wanted_by	string	yes	The lemonfiber service that would publish it.

Consumption

One line of the accounting.

Field	Type	Required	What it is
category	SpaceCategory	yes	What it is about.
reclaim	Reclaim	yes	What getting it back would cost.
tally	Tally	yes	What it occupies, counted both ways.

Contents

Everything gathered for a bundle, and everything that could not be.

Field	Type	Required	What it is
missing	array ofstring	yes	What could not be collected, named. Named rather than passed over: a bundle from a machine whose diagnostics will not run is exactly the bundle worth having, and a gap nobody mentions reads as an absence of trouble rather than as an absence of information.
pieces	array ofPiece	yes	The files, in the order a reader would want them.
taken	Taken	yes	Where and when it came from.
terms	Terms	yes	How it was made, and what its operator chose.

Contribution

A row in a register lemonfiber already runs.

The fields beyond at and id are the row its point declares, and the point is published — so the required set, the optional set, the closed sets and the bounds are read from extension-points.json rather than restated here. What this type fixes is that a contribution is declared in this block and nowhere else, and that it carries nothing outside the union of the rows the published points take.

Field	Type	Required	What it is
action	stringornull	no	What to do, in the imperative.
at	string	yes	A point the build publishes. One it does not is refused by name.
category	stringornull	no	Which family a check is narrowed to.
detail	stringornull	no	The technical half of a remedy, which must not lead.
expect	Expectornull	no	What the answer must be.
expected	array ofPluginExpectedFailure	no	Recordings the check fails on, each with the constraint that fails there and why.
fixture	stringornull	no	The recorded response the check is proved against.
for	stringornull	no	The check a remedy is for, which must be one this same plugin declared.
id	string	yes	Namespaced with the declaring plugin's id, always.
request	PluginRequestornull	no	Method and path on the plugin's own service. There is no field for a host, so a check cannot be pointed at another service, at the machine, or off it. A plugin wanting to say something about a service it did not install is asking to speak for somebody else's software.
service	stringornull	no	Which service the finding is about. Defaults to the plugin's own.
timeout_s	integerornulluint32, ≥ 0	no	How long a check may run, within the bounds the point declares.
title	stringornull	no	The one-line summary of what was checked.
why	stringornull	no	Why this is worth checking.

Cost

What changing a decision costs.

One of these:

• "cheap"

  Applied with a restart of the services it affects, and nothing else moves.

• "consequential"

  Said and confirmed before it is applied: it may move data, invalidate library paths, or take a service away.

Counted

One of the two counts the request service keeps, and what it has left.

Field	Type	Required	What it is
limit	integerornulluint32, ≥ 0	no	How many the period allows. Absent where nothing limits them, which is a different answer from a limit of nought.
period	stringornull	no	How long the period is, in the words a household says it in — absent where the count runs from the beginning rather than over a window.
remaining	integerornulluint32, ≥ 0	no	How many more they may ask for. Absent where nothing limits them.
used	integeruint32, ≥ 0	yes	How many the period has already counted against them.

Coverage

How much of a traced series is here, season by season — the aggregate that turns a single furthest stage into an answer about the whole. The counts are of parts someone asked for; what nobody asked for is reported beside them, never folded in.

Field	Type	Required	What it is
have	integeruint, ≥ 0	yes	How many wanted parts are here, across every season.
seasons	array ofSeasonCoverage	yes	Each season, in order.
unmonitored	integeruint, ≥ 0	yes	How many parts nobody asked for, across every season.
wanted	integeruint, ≥ 0	yes	How many parts were asked for, across every season.

CredentialGranted

A credential of another service granted to a third-party plugin, named by the setting it is held under and never by its value.

Field	Type	Required	What it is
at	string	yes	When the operator approved it.
credential	string	yes	The setting the credential is held under, as the inventory names it.
for	string	yes	The capability of the plugin's own it was granted to fill.
of	string	yes	The service whose credential it is.
plugin	string	yes	The plugin it is granted to.

CredentialHeld

One credential, described without being disclosed.

There is deliberately no value here, and no field a value could be put in later without the change being visible in review.

Field	Type	Required	What it is
advisory	stringornull	no	What is worth saying about this one, where anything is.
consumers	array ofstring	yes	Everything that authenticates with it. Named individually, because a consumer left off this list is a consumer a rotation would silently strand.
fingerprint	stringornull	no	A short likeness of the value, for telling two copies apart in a report. Absent where there is no value to take one of. Never reversible and never a proof — see [fingerprint].
from	ValueOrigin	yes	Whose line it is: the stack's own, or an installed plugin's, named. A different question from who produced it. A plugin's secret is minted by the service it belongs to like any other, and what the operator needs to know as well is that the service is one a plugin brought.
location	string	yes	Where the value lives, as a path or a description of one.
name	string	yes	What it is, in the operator's words — Jellyfin administrator password.
origin	Origin	yes	Who produced it.
setting	string	yes	The setting it is recorded under, which is a name and never a value.
state	CredentialState	yes	Where it stands.

CredentialReach

How far a rotation reached one consumer.

One of these:

• reach: "updated"

  It now holds the replacement.

• reach: "pending"

  It will hold the replacement once one more thing happens, and that thing is named. A consumer reading the value out of a container's environment has it fixed at the moment the container was created, so recording a new one is only half of reaching it.

  • detail string

    What still has to happen, written as the command that does it.

• reach: "failed"

  It could not be updated. Named rather than dropped, because a consumer left holding the old value is the failure this list exists to surface.

  • detail string

    Why it could not be.

CredentialRevoked

What revoking one grant came to, or would come to.

Field	Type	Required	What it is
agreement	string	yes	The name this reading goes by, which the revoke takes as its yes.
ended	boolean	yes	Whether the grant was ended, rather than read or rehearsed.
grant	CredentialGranted	yes	The grant it ends.
restarts	array ofstring	yes	The plugin's services that read the credential, restarted once it is withdrawn.
unrestarted	stringornull	no	Why its services did not restart, where they did not.

CredentialScope

Whose credential asked, as a client is told it.

Said rather than left to be inferred from which requests are permitted: a client guessing a member from a missing read would guess wrong the day that read moves.

One of these:

• "operator"

  The operator: the password's session, or the token printed at this machine.

• "read"

  A key that reads and acts on nothing.

• "act"

  A key that reads, and calls the actions the contract publishes for a key.

• "member"

  A household member: their own session, or a key scoped to them.

CredentialState

Where a credential stands, as far as lemonfiber can tell without spending it.

Six states rather than a boolean because the operator's next move differs for each: an absent credential is one to supply, a stale one is one to prove, an invalid one is one to replace, and the two rotation states exist so a run interrupted half-way through a replacement is legible rather than mysterious.

One of these:

• "absent"

  Required by what this stack runs, and not supplied.

• "active"

  Present, and proven against the service it authenticates to.

• "stale"

  Present, and never proven — or not proven since it was last written.

• "invalid"

  Present, and refused by the service the last time it was offered.

• "rotating"

  A replacement is being proven; the existing value is still the one in force.

• "superseded"

  Replaced. What is left is the old value, waiting to be destroyed.

Criticality

How much a service's absence costs.

Serialisable as well as readable, because it reaches an operator: a status report that says a service is down without saying whether that matters leaves them to guess, and the manifest already holds the answer.

One of these:

• "critical"

  Its failure has consequences outside the machine.

• "core"

  The form does not work without it.

• "important"

  The form works, badly.

• "enhancing"

  Makes things better.

• "optional"

  Nice to have.

DashboardProtocol

Which protocol a transfer is moving over, since the same download reads differently on each — a Usenet download has no peers, a torrent has no server.

One of these:

• "usenet"

  A Usenet download.

• "torrent"

  A torrent download.

DashboardReading

A figure a source reports, kept apart from the two ways it can be missing.

Zero is a value a source gave; stale is the last value a source that has since gone quiet gave; unknown is a source that never answered at all. Collapsing any two of them sends an operator after the wrong problem — a stalled download and a dashboard that simply stopped polling look identical only if the code lets them.

One of these:

• reading: "known"

  The source answered this refresh with a value — which may legitimately be zero.

  • value integeruint64, ≥ 0
• reading: "stale"

  The source did not answer this refresh; this is the last value it gave.

  • value integeruint64, ≥ 0
• reading: "unknown"

  The source has never answered, so nothing can be said about it.

Device

A kind of device somebody in the house might watch on.

Field	Type	Required	What it is
caution	stringornull	no	What is worth knowing before starting, where anything is.
client	string	yes	What to use on it.
deep_link	stringornull	no	A link that opens the app already pointed at this server, where the app is known to take one, with {address} where the server's address goes. Absent otherwise, and a hand-off then carries the address alone as its code, which the app is pointed at by scanning or typing.
device	string	yes	What somebody would call the device they are holding.
instead	stringornull	no	What to do instead where this is a bad device to be stuck with.
open_source	boolean	yes	Whether the app named is open source. A closed one may be named, with this false beside it, and is never the one recommended.
support	Support	yes	How well served it is.

DeviceChallenge

A challenge, as the phone is handed it to sign.

Field	Type	Required	What it is
challenge	string	yes	The challenge, in base64url, signed as it is written here.
expires	string	yes	When it stops standing, one minute after it was issued.

DeviceKeyBacking

Where a device key lives, as its attestation says.

One of these:

• "strongbox"

  A separate secure chip on an Android phone, as the hardware attested.

• "enclave"

  The Secure Enclave of an iPhone: App Attest vouched that the genuine app placed the key there, not that the hardware proved it.

• "tee"

  The processor's trusted environment on an Android phone, as the hardware attested; outside the operating system's reach, without a chip of its own.

DeviceKeyListing

Every device key this machine has registered, and what became of a revoke.

Field	Type	Required	What it is
keys	array ofListedDeviceKey	yes	In the order they were registered.
rehearsed	boolean	yes	Whether this was a rehearsal: what revoking would come to, with nothing revoked.
revoked	stringornull	no	The device key this request revoked, where it revoked one.

Disposition

What a quality command did to the stored choice.

One of these:

• "shown"

  The choice was only shown; nothing was asked to change.

• "recorded"

  The choice was recorded.

• "rehearsed"

  The choice would be recorded; this was a rehearsal, so it was not.

• "held"

  The choice needs transcoding this host cannot do well, so it was held rather than recorded without explicit confirmation.

• "reapplied"

  The recorded preset was re-asserted over the quality sync config, overwriting a hand-edit where an ordinary run would have preserved it.

• "would-reapply"

  A re-assert that was a rehearsal: it reports whether it would overwrite a hand-edit, and writes nothing.

Disruptive

What checking a finding disturbs, and the narrowing a diagnosis runs it under.

Field	Type	Required	What it is
bounded	integerornulluint64, ≥ 0	no	The whole seconds the disturbance is bounded to, where the stack bounds it.
disturbs	string	yes	What checking it disturbs, in the stack's words.
only	string	yes	The check or group a diagnose action takes as only to run it.

Disturbances

What acting on this stack would take away, one answer per way of acting.

Named by the situation rather than by the verb, because the verb has two spellings: the command line stops named services with stop and the HTTP surface spells that same operation down. These bytes are what both surfaces answer with, so a table keyed by verb would be right for one caller and wrong for the other. A field each caller maps its own word onto is right for both.

Carried on the status reading because a surface deciding whether to stop something has already read that, and because none of these lengths depends on what the stack is currently doing — they are the clocks the run is held to, which is a property of the configuration. A second read to learn a length is a read a surface would skip, and then it would estimate.

Field	Type	Required	What it is
fetching	TakesAway	yes	Fetching a form's images.
restarting	TakesAway	yes	Restarting services.
starting	TakesAway	yes	Bringing services up, whether a whole form or named services inside one.
stopping	TakesAway	yes	Taking services down, interrupting anything still arriving.
stopping_after_downloads	TakesAway	yes	Taking the stack down once everything still arriving has landed. Whole forms only: stopping named services has no such wait to ask for, and a caller that asks for both at once is refused.
switching	TakesAway	yes	Changing the running set, which stops whatever falls outside the new one.

DoctorCategory

The family a check belongs to, so a run can be narrowed to one of them.

These are the diagnostic categories the product recognises; the checks that fill each one arrive over time, so a category may name more than lemonfiber can yet establish.

One of these:

• "environment"

  Docker present, the daemon reachable, the platform understood.

• "storage"

  The data root: reachable, writable, one filesystem, room to grow.

• "network"

  Ports free, bindings matching policy, services reachable.

• "vpn"

  Torrent traffic genuinely leaves through the tunnel.

• "credentials"

  Each credential still valid.

• "services"

  Health, crash loops, version skew, the wiring between services.

• "providers"

  Provider quota, subscription validity, indexer responsiveness.

• "queue"

  Stuck items, repeated import failures, orphaned downloads.

• "config"

  Drift from lemonfiber-managed state, permissions, manifest validity.

DoctorReport

What a diagnostic run found, and what it amounts to.

Field	Type	Required	What it is
findings	array ofFinding	yes	Each finding, in the order the checks produced them.
overall	Overall	yes	What the findings amount to, as one word.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.

DoctorVerdict

How a single check turned out.

"Could not check" (Unverified) is its own variant rather than a level of severity, so a check that could not run can never be mistaken for one that passed — the dishonesty this whole subsystem exists to prevent.

One of these:

• outcome: "pass"

  Verified working, with the evidence worth showing.

  • note stringornull optional

    What was observed, where stating it helps — an address, a port.

• outcome: "warn"

  Working, but degraded or risky.

  • cause Problemornull optional

    The problem that produced this one, where several share a root.

  • code Code

    The stable identifier for this kind of problem.

  • detail stringornull optional

    The underlying technical detail, available but never leading.

  • meaning string

    What it means for the operator.

  • remedies array ofRemedy

    What to do, most likely first.

  • severity ProblemSeverity

    How much it matters.

  • state ProblemState

    Where it stands with respect to being fixed.

  • steps array ofProblemStep optional

    Every step a run declares, with what each came to, where the problem ended a run of steps part-way; absent from every other problem.

    Data beside the detail rather than in it, so a client reads what changed somewhere going back cannot reach without parsing a sentence written for a person.

  • summary string

    What happened, in one plain sentence.

• outcome: "fail"

  Not working.

  • cause Problemornull optional

    The problem that produced this one, where several share a root.

  • code Code

    The stable identifier for this kind of problem.

  • detail stringornull optional

    The underlying technical detail, available but never leading.

  • meaning string

    What it means for the operator.

  • remedies array ofRemedy

    What to do, most likely first.

  • severity ProblemSeverity

    How much it matters.

  • state ProblemState

    Where it stands with respect to being fixed.

  • steps array ofProblemStep optional

    Every step a run declares, with what each came to, where the problem ended a run of steps part-way; absent from every other problem.

    Data beside the detail rather than in it, so a client reads what changed somewhere going back cannot reach without parsing a sentence written for a person.

  • summary string

    What happened, in one plain sentence.

• outcome: "unverified"

  Could not be established. Never a pass.

  • reason string

    Why it could not be determined.

  • remedy Remedy

    What the operator can do to get an answer.

• outcome: "skipped"

  A prerequisite was absent, so the check did not apply.

  • reason string

    Why the check did not apply.

Downloader

One download client, and whether it is paused.

Field	Type	Required	What it is
client	string	yes	The client, by the name the stack knows it under.
state	DownloaderState	yes	Whether it is paused, as the client reads it back.

DownloaderState

Whether a download client is fetching, as it reads it back.

One of these:

• "paused"

  It said it is paused.

• "fetching"

  It said it is fetching.

• "unknown"

  It could not be asked, which is a different thing from either.

Dropped

A profile left out of a closure, and what it would have needed.

The provider travels with the profile because a name on its own sends the operator looking for a fault. What they have is a stack not configured for one of the two ways of downloading, which is a sentence rather than a word.

Field	Type	Required	What it is
needs	StackProtocol	yes	The provider it cannot run without.
profile	string	yes	The profile that will not run.

Duration

The artefact says nothing more about it.

Field	Type	Required	What it is
nanos	integeruint32, ≥ 0	yes
secs	integeruint64, ≥ 0	yes

Edited

A setting changed outside lemonfiber since it last wrote one.

Both sides, so the operator chooses between them rather than being told one of them lost. Values a listing withholds are withheld here too — a report a script can log must not be the one place a password is printed.

Field	Type	Required	What it is
found	string	yes	What the file holds now.
secret	boolean	yes	Whether either value was withheld rather than shown.
wrote	string	yes	What lemonfiber last wrote there.

Elsewhere

A request one of the stack's services makes, which is not lemonfiber's.

Field	Type	Required	What it is
destination	string	yes	Where its requests go, in the terms an operator would recognise. Empty means it reaches nothing, which is an answer. It never means and we do not know: that is [Self::recorded], and the two must not be read as one — an unknown service rendered as an empty destination would be this product claiming nothing leaves the machine on the strength of having no idea.
origin	ValueOrigin	yes	Whose request it is: the stack's own, or an installed plugin's, named. A column in this account rather than an account of its own, because what leaves this machine is one question however many parties are asking it.
purpose	string	yes	What it asks for.
recorded	boolean	yes	Whether lemonfiber ships a record of what this service reaches. False for a service that arrived in the stack after this build was made, or from an operator's own fork. It is listed anyway, because the alternative — leaving it out — is a privacy inventory that is complete-looking and short, and a reader counting the services on their machine against the ones on this list is the reader this surface exists for.
service	string	yes	The service, by the id the stack declares it under.

Ending

How one service's update ended.

One of these:

• "updated"

  Updated, and answering again afterwards.

• "not-fetched"

  The newer image was never fetched, so nothing about this service changed.

• "not-started"

  It was started on the newer image and did not come back.

• "not-reached"

  The run halted before reaching it, so it is standing where it was.

Entry

One change, as a reader meets it.

Field	Type	Required	What it is
reference	stringornull	no	Where it was reviewed, where it was reviewed anywhere.
requirements	array ofstring	yes	The requirements it served, which are the link rather than the headline.
summary	string	yes	What changed, in the words it was written in.

Episode

One episode, with where it is served.

Field	Type	Required	What it is
backdrop	stringornull	no	Where its backdrop is served, where it has one.
door	Pinnedornull	no	The certificate the door presents, which a client pins, beside any location.
id	string	yes	The identifier the server tells it apart by, which is what asking to play one of them names.
medium	Medium	yes	Which of the kinds this product deals in it is.
minutes	integerornulluint32, ≥ 0	no	How long it runs, in whole minutes, where the server knows.
number	integerornulluint32, ≥ 0	no	Its number in the season, where it has one.
overview	stringornull	no	What happens in it, where the server holds a description.
poster	stringornull	no	Where its poster is served, where it has one.
stream_from	stringornull	no	Where it streams from, where it plays.
title	string	yes	What it is called, in the words the server holds it under.
unlocated	stringornull	no	Why no location is stated, where none is.
year	integerornulluint16, ≥ 0, ≤ 65535	no	The year it came out, where the server knows one. Absent rather than guessed: two films share a title far more often than they share a title and a year.

Estimate

About how much room one request will want.

Carried as a number and a word rather than as a rendered string, so a surface can put it in a column and still say what it is. The word is not decoration: a figure with nothing hedging it is a promise, and this cannot keep one.

Field	Type	Required	What it is
bytes	integeruint64, ≥ 0	yes	About how many bytes it will take.
measured	boolean	yes	Whether this was measured. Always false — nothing here has measured anything, and the field is present so that a surface rendering it cannot forget to say so.

ExceptionReport

One event kind the operator set apart from the preset.

Field	Type	Required	What it is
kind	string	yes	The kind of event, by the name a finding gives it.
wanted	boolean	yes	Whether it is heard about, whatever the preset would say.

Expect

What the answer has to be.

A status is a claim about the network path rather than about the service: Docker publishes a port by putting a proxy in front of it, and that proxy accepts a connection before knowing whether anything inside is listening. So a status alone is not evidence — except for a refusal or a redirect to HTTPS, answers no port proxy produces.

A key of the four key-wise constraints is a place rather than a name. A plain name is a top-level member, and one beginning with / is a JSON Pointer, extended with a step that picks an entry of a list by a field it holds. A flat name was enough while every service answered a flat object, and the only thing it could say about a service that nests its payload was that the envelope was there — which is a probe that passes by observing that something replied.

Field	Type	Required	What it is
body_starts_with	stringornull	no	What the body must begin with, where it is not JSON.
content_type	stringornull	no	A substring of the content type the answer was served as.
exit	integerornullint64	no	The exit status a run must end with. Not sufficient alone.
json	map ofExpectedornull	no	Places the answer must carry, each with the exact value it must hold.
json_array_min	integerornulluint64, ≥ 0	no	The answer read as an array, with at least this many entries. A catalogue is very often a list rather than an object, and none of the object-shaped constraints can say anything about one.
json_at_least	map ofintegerint64ornull	no	Places the answer must carry, each with a number it must not be below.
json_has_keys	array ofstringornull	no	Places the answer must carry, whatever they hold.
json_is_absent	booleanornull	no	The answer did not parse as JSON at all. Which is what a service that serves its application shell for every path it does not implement answers — and the reason a status alone proves nothing against one: the shell comes back 200 whether the API behind it exists or not, so what has to be said is that the body was not a document.
json_types	map ofExpectedKindornull	no	Places the answer must carry, each with the kind of value it must be.
status	integerornulluint16, ≥ 0, ≤ 65535	no	The status the answer must carry.
stdout_starts_with	stringornull	no	What a run's standard output must begin with.

Expected

Exactly what a place must hold.

Three kinds and no nesting: a flag that must be set, a number that must match, or a word. A value deeper than this is asking about a document rather than about a claim — and where the thing worth asserting is deeper in the answer, the key reaches it rather than the value growing to match.

It is booleanorintegerint64orstring

ExpectedKind

The kind of value a key must hold.

Five, and closed. A name outside them is one no runner could evaluate, and an assertion nothing evaluates is a proof that silently checks less than it says — which is worse than one that fails.

Named for what it is the kind of, rather than Kind, because this is published and whoever generates from it flattens every definition into one scope. Kind is the one name there a generator is certain to want for itself: every envelope this contract describes is keyed by its kind, so the union of them is a Kind too, and two of them in one module is a definition nothing can be compiled against.

One of these:

• "bool"

  A true or a false.

• "int"

  A whole number.

• "str"

  A string.

• "list"

  An array.

• "dict"

  An object.

Facing

What a service published to the local network is to the people in the house.

One of these:

• "asking"

  Where asking for something begins, and where what was asked for is followed. It links onward to the library, which is what makes it a place to start rather than one more address to be sent.

• "watching"

  The library, where what arrived is watched. A place to start only where there is nothing to ask for, because somebody sent there has no way to ask.

• "shelf"

  One kind of media and no other, reached from the library rather than instead of it.

• "operators"

  An index over every service, including the ones nobody in the house should learn exist.

• "carriage"

  How the others are reached, rather than one of them.

• "unstated"

  Published to the household, and nothing here says what it is to them.

Filenames

Whether media filenames are shown as they are.

Replaced unless asked otherwise. A library's contents are not a credential, but they are the one thing in a bundle that says something about the person rather than about the machine, and replacing them costs a diagnostic a reader can still follow — the marks keep two mentions of one file recognisable as one file.

Read from the bare flag a surface carries rather than from a name of its own, because that is what both surfaces have: --filenames on a command line and a filenames in a request body are one word that is there or is not. Which way round it reads is decided here, once — a surface that read it the other way round would put a library's contents in a file people post in public.

It is boolean

Filtered

A service a closure asked for that the configuration leaves out, and why.

Field	Type	Required	What it is
forms	array ofstring	yes	The forms that asked for it, in the order the stack declares them.
id	string	yes	The service's identifier.
name	string	yes	What it is called in front of an operator.
needs	StackProtocol	yes	The provider it cannot run without.
profile	string	yes	The profile it belongs to, which is what the configuration leaves out.

Finding

One thing a check established, and how it turned out.

Field	Type	Required	What it is
category	DoctorCategory	yes	The family this belongs to.
caused_by	stringornull	no	The check whose finding explains this one, where another does. Set after the run rather than by the check itself: a check is independent by construction and cannot see what any other found, which is a property worth keeping.
check	string	yes	A stable identifier for the thing checked, such as vpn.egress-match.
disruptive	Disruptiveornull	no	What checking it disturbs, where the read left it unverified because checking it disturbs something, and how a diagnosis is asked to run it.
onset	stringornull	no	When the stack first saw this check wrong since it last saw it right, in whole seconds since the epoch. Set after the run from the store of conditions, like [Self::said], so it is the moment the health summary names for the same check and a restart does not move it. Absent where the finding says nothing is wrong, and where the checks ran for something other than a diagnosis.
origin	ValueOrigin	yes	Whose check this is: one this build ships, or one a named plugin contributed. Carried rather than read off the identifier. A contributed check's id is namespaced with the plugin's, and a reader could decode that from the colon — but an origin a reader has to decode is one a reader gets wrong, and the day a bundled id grew a colon every such reader would misattribute it in silence.
said	stringornull	no	What the service said for itself, lately. Carried on the finding rather than left for the operator to go and fetch, because the explanation is almost always in it: a check can say a service is not answering, and only the service can say why. Absent where the finding is not about a service, where the service is fine, or where the engine would not say — an empty section would be a promise of evidence that is not there. Set after the run, like [Self::caused_by], since reading a service's output is not the check's own business and a check that did it would be doing two things.
service	stringornull	no	The service this is about, where it is about one. Absent for the checks that are about the machine rather than about something running on it — the environment, the filesystem, the operator's own choices. Carried so that one service's trouble can be attributed to the service underneath it rather than counted as one more independent thing wrong.
service_name	stringornull	no	What the stack calls that service in front of an operator. Carried beside the id rather than left for a surface to derive, because the id is a key and not a name: capitalising qbittorrent does not arrive at qBittorrent, and the stack has already written the name down. Absent where the finding is about no service, and where the stack declares no service by that id — an id standing in for a name would put the key back in front of the operator. Set after the run, like [Self::caused_by], from the same manifest that says which service depends on which.
title	string	yes	The one-line summary of what was checked.
verdict	DoctorVerdict	yes	How it turned out.

Findings

What a proposed change comes to on this machine.

Empty on every change that comes to nothing beyond its value, which is most of them: a report full of empty lists about a timezone would teach the operator to skip the one that matters.

Field	Type	Required	What it is
active	array ofActive	yes	What is still coming down, where a reduction would interrupt it.
edited	Editedornull	no	The hand-edit found in the configuration file, where one was found.
keeps	array ofstring	yes	What this change leaves exactly as it is, said in full — because an operator dropping a way of downloading is weighing whether they lose what they built with it.
library	array ofLibraryPath	yes	The library paths the services hold, and what moving the data location does to each. Empty for every change that does not move it.
opens	array ofOpening	yes	What this change newly asks the operator for, in the order they meet it.
stops	array ofstring	yes	What this change stops running, by service name.

Footprint

The memory the stack estimates a set of services needs.

An estimate by name as well as by description, because a figure read as a measurement is one an operator believes and acts on. It is the sum of what each service declares; nothing here has looked at anything running.

Field	Type	Required	What it is
estimated_mib	integeruint64, ≥ 0	yes	The sum of the estimates the services declare, in MiB.
unestimated	array ofstring	yes	The services that declare no estimate, and so are not in the sum.

Foreign

Something beneath the data location that the stack did not put there.

Field	Type	Required	What it is
at	string	yes	The directory it is in, relative to the data location — or the file itself, where it sits directly in the data location.
bytes	integeruint64, ≥ 0	yes	What they occupy.
files	integeruint64, ≥ 0	yes	How many files were found under it.

FormReport

One form the stack declares, as a listing shows it.

The manifest's own words rather than lemonfiber's: forms come from the stack, so a stack of somebody's own names and describes them however it likes, and a listing that paraphrased would be describing a different stack from the one being run.

Field	Type	Required	What it is
composable	boolean	yes	Whether it can be started alongside another form. Worth saying in the listing rather than only when a combination is refused: an operator choosing between two forms is exactly who needs to know they are a choice.
description	string	yes	What it is for, in one line.
id	string	yes	What to type to start it.
name	string	yes	What it is called.

FormsReport

Every form this stack declares.

Field	Type	Required	What it is
forms	array ofFormReport	yes	The forms, in the order the stack declares them.

Freshness

How much a reading can be relied on.

One of these:

• as: "live"

  Read off a local disk, so it is true as of now.

• as: "as_of"

  Read across a network share, which answers with what it was last told — carrying the moment it was taken, in seconds since the epoch, so a figure nobody can refresh is at least dated.

  • at integeruint64, ≥ 0

FrontDoorBeside

A service the household can reach that is not the front door, and why it is not.

Carried rather than left out, because the decision is the useful part: an operator who can see that the index over every service was considered and refused has been told something, where one shown a single name has only been given an answer.

Field	Type	Required	What it is
address	Addressornull	no	The address to hand somebody for this service, read from this machine at the moment of asking rather than remembered. Carried because not-the-door is not nowhere. A household member wanting to watch something, or to ask for something, wants the service that faces them — and which of the two happens to be the front door is an operator's arrangement, not an answer to their question. Without this a surface can hand them only whichever one the door turned out to be, and say nothing at all about the other. Absent where the stack declares no port for it, for the reason the door's own address is absent then: an address with no port on it is one a browser answers with a refusal, and the manifest is where a port is declared.
because	string	yes	Why it is not somewhere to begin.
facing	Facing	yes	What it is to the household.
service	string	yes	The service, by the name it shows itself under.

FrontDoorReport

The household's one front door: which service it is, where it stands, and what else they can reach that is not it.

Field	Type	Required	What it is
address	Addressornull	no	The address to hand them, read from this machine at the moment of asking rather than remembered. Absent where there is no door, and where there is one on a machine that will say neither what it is called nor where it is.
beside	array ofFrontDoorBeside	yes	Everything else the household can reach, and why none of it is the door.
chosen	Chosen	yes	How this came to be the door: worked out from what the stack declares, named by the operator, or named by them and refused. Carried as a state rather than left to the sentence beneath it, for the reason the standing is: an operator whose setting was refused reads the sentence, and a browser, a script or a dashboard reads this.
facing	Facingornull	no	What that service is to them. Absent for the same reason.
meaning	string	yes	What this comes to, in the words an operator would say it in — including, where there is no door, that there is none.
service	stringornull	no	The service the household begins at, by the name it shows itself under. Absent where this stack publishes nothing they could begin at.
standing	FrontDoorStanding	yes	Where the front door stands.

FrontDoorStanding

Where the household's one front door stands.

One of these:

• "established"

  The door is the request surface, and it is running.

• "library-only"

  This stack has no request surface, so the library is the door — there is nothing here to ask for.

• "unreachable"

  There is a door and it is not answering.

  The service's own state. What fixes it is starting the service.

• "stranded"

  There is a door, it is answering, and nothing here can say where another device would reach it.

  The other way a door is unreachable, and a different thing to do about it: the service is fine and the way to it is what is missing. Told apart from [Standing::Unreachable] because the two are fixed at opposite ends — one by starting a service, the other by giving this machine an address the household's devices can use — and a household member who cannot arrive needs to know which of the two they are looking at before they start blaming their own device.

• "none"

  Nothing at all is published to the household: an operator-only configuration.

Gone

What became of a download the client was asked to let go.

Field	Type	Required	What it is
bytes	integeruint64, ≥ 0	yes	What it occupied, as the client reported it.
name	string	yes	What the client is no longer holding.
rehearsed	boolean	yes	Whether this was a rehearsal, which asks the client for nothing.

GrantReport

A grant to play on a member's own account, the token the device plays with, and how long it lasts.

Field	Type	Required	What it is
granted	boolean	yes	Whether a session was opened for the device. A rehearsal opens none.
lasts_until	string	yes	The last day the grant holds unless the member's client speaks to the core before then, as YYYY-MM-DD.
member	string	yes	The member the device now plays as, by the name they are known by.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done.
token	stringornull	no	The token the device presents at the guarded front door, as Authorization: Bearer <token>. Answered once, here, and kept by nothing in the core; absent where nothing was granted.

Group

The entries of one kind, under the name an operator reads them by.

Field	Type	Required	What it is
entries	array ofEntry	yes	The changes, in the order they were made.
title	string	yes	What this group of changes is: new, fixed, faster, or maintenance.

Guidance

The guidance in full, for a surface that shows all of it.

Field	Type	Required	What it is
devices	array ofDevice	yes	Every device, in the order somebody is likely to be holding one.
nothing_is_installed	string	yes	What this will not do for them.
only_at_home	string	yes	True of every device, said once.
straining	Strainingornull	no	Why playback here is likely to struggle before any app is chosen, or None where the preset in force asks for nothing this platform cannot serve. Absent far more often than present, and it must be: a caution shown to everybody says nothing about anybody's machine, and a reader who meets one every time stops reading it.
trouble	array ofTrouble	yes	What to do when it does not work, keyed by the symptom.

HandoffClient

One app a device can be pointed at the stack with, and the code that points it.

Field	Type	Required	What it is
client	string	yes	What to use on it.
code	string	yes	What the code for this app carries: a link that opens the app at this server where the app takes one, and the server's address otherwise.
deep_link	boolean	yes	Whether [code](Self::code) is such a link rather than the address alone.
device	string	yes	What somebody would call the device they are holding.
open_source	boolean	yes	Whether that app is open source. A closed one is never the recommended path.

HandoffRemedy

What there is to do next about a hand-off, which each surface says in its own words.

Carried as a name rather than as a sentence because the act is the same everywhere and the way to take it is not: a terminal names a command, and an app offers a control. A sentence written here would have to pick one of them, and every other surface would then be showing somebody an instruction it cannot carry out.

One of these:

• "invite"

  Invite them, which makes the account and is where what they may watch is chosen.

• "ask-again"

  Ask again: once they have signed in on the device, or once the media server answers the question it would not.

• "start-server"

  See whether the media server is running, and start it where it is not.

• "record-address"

  Record the address the household reaches this machine at.

HandoffReport

Where one person's hand-off stands, and what to hand them.

The code is an address and nothing more. Whoever holds a copy of it can find the server and still has to sign in as somebody, so a code sent to the wrong phone, or photographed over a shoulder, gives away where the server is and nothing else.

Field	Type	Required	What it is
address	stringornull	no	The address the code carries. Absent where there is no address to carry, which is one of the ways a hand-off fails.
caution	stringornull	no	What is worth knowing about that address, where anything is: most often that it answers only on the home network.
clients	array ofHandoffClient	yes	The apps to point a device at the stack with, each with its code.
issued	stringornull	no	When a code was first issued for them, as an instant. Absent until one is.
name	string	yes	Who it is for, as the media server spells their account where it holds one, and as it was asked for otherwise.
quick_connect	boolean	yes	Whether the media server offers the sign-in by short code, where one account already signed in approves another device.
reason	stringornull	no	Why it stands there, where that is not the state itself: why an account that is not there stops it, and what stopped one that failed. In words any surface can show, so it names no command; what to do about it is [remedy](Self::remedy).
rehearsed	boolean	yes	Whether this was a rehearsal, in which no issue was written down.
remedy	HandoffRemedyornull	no	What there is to do next, where there is anything: named rather than said, so that each surface offers it in its own way.
sessions	array ofHandoffSession	yes	The devices signed in to the account now, as the media server lists them.
state	HandoffState	yes	Where it stands.
steps	array ofstring	yes	How the person signs in on the new device, one step at a time. Every step is something the person does on their device, in words any surface can show. Asking again afterwards is not one of them: that is [remedy](Self::remedy). Guidance and never an approval. Where the sign-in asks for a short code to be approved from a device they are already signed in on, that approval is theirs: it is the step that proves the person holding the new device is the person the account is for, and a program that took it for them would have proved nothing.

HandoffSession

One device the media server lists as signed in to the account.

Field	Type	Required	What it is
client	string	yes	The app it signed in with.
device	string	yes	What the device calls itself.
last_seen	stringornull	no	When the media server last heard from it, where it says.

HandoffState

Where one person's hand-off stands.

Read from the media server each time rather than remembered, apart from when a code was first issued and which devices were signed in then: whether a device is signed in is the server's to say, and a copy kept here would go on saying it after the person signed out.

One of these:

• "unprovisioned"

  Nobody by that name holds an account yet, so there is nothing to sign in to.

  No account is made here. Making one is an invitation, which is where what the person may watch is chosen; an account made on the way to handing over a phone would be one nobody chose anything for.

• "ready"

  The account is there and the code was issued by this run.

• "pending"

  The code went out on an earlier run and no device of theirs has signed in since.

  Told apart from [Failed](Self::Failed) because nothing has gone wrong: the next step is on the person's device, and until they take it there is nothing to prove.

• "connected"

  The media server lists a device signed in to their account now that was not signed in when the code was first given.

  A phone they already had proves nothing about the one just handed over, so the devices signed in at that moment are not counted.

• "failed"

  The hand-off could not go ahead, for the reason given beside it.

Handover

Where a finished walkthrough leaves the operator.

Field	Type	Required	What it is
next	array ofNext	yes	What to do next, in order.

Hardlink

Whether imports are hardlinking or copying — the difference between an import that is free and one that doubles the disk it uses.

One of these:

• "linking"

  Imports hardlink, as they should.

• "copying"

  Imports copy, doubling space and slowing every import.

• "unknown"

  It could not be established which.

HealthStanding

What the stack amounts to.

Ordered from best to worst, so the worst of several is a max and there is no second place to encode the ranking.

One of these:

• "healthy"

  Nothing is wrong.

• "stopped"

  Nothing is running, and that was on purpose.

• "unconfigured"

  Nothing is set up.

• "advisory"

  Worth knowing, nothing to do.

• "degraded"

  Working, with something wrong.

• "broken"

  Something is broken.

• "critical"

  Something is wrong outside this machine, or data is at risk.

• "unknown"

  It could not be established. Never reported as healthy.

HealthSummary

The one-line summary, and what it expands to.

Field	Type	Required	What it is
affected	array ofAffected	yes	Everything that is wrong, worst first, so the line expands to the affected items and their remedies rather than to a number nobody can act on.
standing	HealthStanding	yes	The one word.
wanting_attention	integeruint, ≥ 0	yes	How many things are wrong — root causes, counted once each, so a disk that filled and the nine imports that then failed is one thing and not ten.
worst	stringornull	no	The worst thing, named, so the line says something rather than only grading. Absent where nothing is wrong.

Held

One thing the household holds, as a member is shown it.

What a person recognises and nothing else. There is no file path, no container, no bitrate and no library id: a member deciding what to watch is not choosing a transcode, and a surface handed those would have to decide not to draw them.

Field	Type	Required	What it is
backdrop	stringornull	no	Where its backdrop is served, where it has one.
door	Pinnedornull	no	The certificate the door presents, which a client pins, beside any location.
id	string	yes	The identifier the server tells it apart by, which is what asking to play one of them names.
medium	Medium	yes	Which of the kinds this product deals in it is.
poster	stringornull	no	Where its poster is served, where it has one.
stream_from	stringornull	no	Where it streams from, where it plays.
title	string	yes	What it is called, in the words the server holds it under.
unlocated	stringornull	no	Why no location is stated, where none is.
year	integerornulluint16, ≥ 0, ≤ 65535	no	The year it came out, where the server knows one. Absent rather than guessed: two films share a title far more often than they share a title and a year.

HeldReport

What one member can watch, and who they are.

Field	Type	Required	What it is
available	boolean	yes	Whether the shelf could be read at all. An empty shelf and an unread one are different answers, and collapsing them would tell a household they own nothing on the day the media server rebooted. Anything that could not be read is said in findings and this goes false.
findings	array ofstring	yes	What is worth saying about this shelf, in the words its reader would use. Always written, empty or not. A field the schema requires and the document sometimes omits is one a reader has to guess about, and an empty list already says the thing it would say: there is nothing to report about this shelf.
holdings	array ofHeld	yes	What they hold, newest first.
id	string	yes	The identifier the media server files them under.
member	string	yes	The member this was asked for, by the name they are known by.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.

HistoryReport

Everything lemonfiber changed, most recent first.

Field	Type	Required	What it is
changes	array ofChangeReport	yes	The changes, newest first.
horizon	string	yes	How far back the record goes, in the operator's terms. Stated rather than left to be inferred from the oldest entry: a record that has been trimmed and one that has always been short look identical from the entries alone, and only one of them means something is missing.

Holding

One download client, and what became of the limits it was given.

Field	Type	Required	What it is
answer	Answer	yes	What it said.
client	string	yes	The client, by the name the stack knows it under.
pulling	Pullingornull	no	Whether it is fetching at all, where a declared cap made that a question. Absent on a stack with no cap rather than assumed to be fetching: asking every client whether it has stopped, on a stack where nothing would ever stop it, is traffic spent on a figure nothing would act on.

HostedCommand

One long-running command, and what stands between it and this machine.

Field	Type	Required	What it is
command	string	yes	How it is typed in a terminal, which is what hosting installs.
definition	stringornull	no	The service definition installed for it, where there is one.
guarantees	string	yes	What it does for as long as it runs, in one sentence.
missing	stringornull	no	The program the definition names, where nothing is there any more.
name	string	yes	lemonfiber's own name for it.
output	stringornull	no	Where a hosted run writes the words it would have said on a terminal.
runs	stringornull	no	The whole command line that definition runs.
standing	Hosting	yes	What stands between it and the machine.

Hosting

What stands between one long-running command and the machine.

Written with hyphens because these are the words the operator reads and the requirement names, and a reading that spelled them differently would be a second vocabulary for one set of facts.

One of these:

• "not-hosted"

  Nothing is installed; it runs only while a terminal holds it.

• "hosted"

  Installed, and the manager confirms it is running.

• "installed-unverified"

  Installed, and the manager would not say whether it is running.

• "stopped"

  Installed, and the manager says it is not running.

• "orphaned"

  Installed against a program that is no longer there.

• "unsupported"

  This platform has no service manager lemonfiber configures.

HostingReport

What this machine keeps running on lemonfiber's behalf.

Defaultable so a test can read one out of a Result without a branch it can never take: a closure standing in for the impossible arm is a region no passing run enters, and the coverage gate counts those.

Field	Type	Required	What it is
caveat	stringornull	no	What is true of this manager and worth knowing before it is relied on.
changed	Changedornull	no	What this run changed, where it was asked to change something.
commands	array ofHostedCommand	yes	Every long-running command there is, hosted or not.
instruction	stringornull	no	What to do instead, where lemonfiber cannot configure this platform.
manager	Manager	yes	The service manager this platform has, or the absence of one.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.

HouseholdMember

One household member: who they are, what they may watch, when they were last seen, and everything they have asked for.

Field	Type	Required	What it is
access	MemberAccess	yes	What they may watch.
asking	MemberAskingornull	no	What they may ask for, and what their period has left of it. Absent where the request service holds no account for them, and where it could not be asked — an unread answer is not an unlimited member, and reporting one as the other would tell an operator their quota was never applied.
claimed	boolean	yes	Whether somebody has set a password on the account. False is an invitation nobody has taken up rather than a member who is not here.
last_seen	stringornull	no	When the media server last saw them, as it timestamps it. Absent where nobody has ever signed in, which is exactly the unclaimed invitations.
name	string	yes	The member, by the name their account is held under.
requests	array ofMemberRequest	yes	What they asked for, newest first.
standing	MemberStanding	yes	Where the account stands: an invitation still out or run out, a member who can sign in, or one switched off.
to_hand_over	array ofstring	yes	What this member would be told, in the words they would read it in. Everything a household member is owed at the moment of asking and cannot be shown where they ask: what happens to what they ask for, what their period has left and when it makes room, what is still waiting on an answer, and what was refused and why. Written to them rather than about them, in the household's own words, so it can be handed over as it stands. Empty where there is nothing to tell them — a member the request service holds no account for has no standing to report and nothing waiting.

HouseholdRemoval

What removing somebody costs, and what it did.

Read before anything is written: the whole point of the unconfirmed run is that every figure here is knowable without removing anybody.

Field	Type	Required	What it is
asks-through-the-request-service	boolean	yes	Whether the request service holds an account for them at all. False where they never signed in there, which is nothing to revoke rather than a revocation that failed.
confirmed	boolean	yes	Whether it was carried out, or only described pending confirmation.
findings	array ofstring	yes	What could not be done, and anything else worth the operator's attention.
name	string	yes	The name their account is held under, as the media server spells it rather than as the operator typed it.
offer	string	yes	The name of this reading, which the removal takes as its yes.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
requests	integeruint, ≥ 0	yes	How many of their requests go with them. They are destroyed, not reassigned. The request service removes them by hand so that a title still waiting goes back to being unrequested rather than pointing at nobody — so this is a count of things that will stop existing.
revoked	Revoked	yes	How far it got.
watch-history	string	yes	What removing them does to their watch history, in the stack's words.

HouseholdReport

Who is in the household, what each may watch, and what each has asked for.

Field	Type	Required	What it is
allows	stringornull	no	What that policy allows in a period, in the words a household says it in. Absent where nothing limits the household, which is not the same as a policy that could not be read: that one leaves [Self::policy] absent too.
available	boolean	yes	Whether the household could be read at all. A false here is why the list is empty, and keeps an unread record from being mistaken for an empty house — the same honesty a trace keeps about a silence it did not hear.
filtering	stringornull	no	What the limits on this household are and are not, where anybody carries one. Absent on a household nobody has limited, because there is no claim to be modest about. Present the moment there is one, because a parent who has set a limit is exactly the reader who might take it for a lock.
findings	array ofstring	yes	What could not be read, and anything else worth the operator's attention.
members	array ofHouseholdMember	yes	Everybody the media server holds an account for, in name order — including those who have never asked for anything, and the invitations nobody has taken up yet.
policy	Policyornull	no	What happens to what the household asks for where nobody chose otherwise for one person. Absent where the request service could not be asked.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.

ImportReport

What copying an operator's own records across came to, or would come to.

Field	Type	Required	What it is
carried	array ofRecordReport	yes	What was carried across.
not_carried	array ofUnsupportedReport	yes	What could not be carried, and why.
project	stringornull	no	The project the records were read from.
refusal	stringornull	no	Why nothing was carried, where nothing was.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
stance	Stance	yes	Where the act stands.
would_carry	array ofRecordReport	yes	What would be, where nothing has been yet.

Installed

How this copy of lemonfiber got onto the machine.

Nothing known is the default. Every other answer is a claim about somebody's machine, and a value that arrived by nobody filling it in has established none of them.

One of these:

• "homebrew"

  Homebrew put it here, on macOS or on Linux.

• "scoop"

  Scoop put it here.

• "winget"

  winget put it here.

• "cargo"

  cargo install built and placed it.

• "distribution"

  A distribution's own package manager placed it.

• "installer"

  The shell installer this project publishes wrote it.

• "elsewhere"

  Downloaded, unpacked or built by hand, and owned by nobody but the operator.

• "image"

  Running in a container, from an image. The binary is part of the image, so moving to another version is pulling that version's image and recreating the container on it; a binary replaced inside goes when the container does.

• "untellable"

  This machine would not say where the running binary is, so none of the above can be told apart. Not a failure, and not a licence to guess.

Interrupted

An import that stopped part-way, in the words of whatever stopped it.

Field	Type	Required	What it is
name	string	yes	What the service calls it.
partial	integeruint64, ≥ 0	yes	What is on disk for it already, where the walk could find it.
said	string	yes	What the service said, verbatim.

Inventory

The whole answer to a question about credentials.

Every ask answers with the inventory as it now stands, and adds what became of whatever else was asked for. An operator who has just rotated something wants to see the inventory that rotation produced, not a receipt they have to go and check against one.

Field	Type	Required	What it is
grants	array ofCredentialGranted	yes	Every credential granted to a third-party plugin.
held	array ofCredentialHeld	yes	Every credential, whether or not it is present.
protection	Protection	yes	What keeping them in files does and does not protect against.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
revealed	Revealedornull	no	One value, where one was asked for.
revoked	CredentialRevokedornull	no	What became of revoking a grant, where one was asked for.
rotated	Rotationornull	no	What became of a rotation, where one was asked for.

Invitation

One invitation, as it was just made.

Carries what the operator has to pass on and nothing else: a name to sign in with, the address to sign in at, the link the app opens, the address that declines it, and how long it stands. The address is the media server's, where a first password is set in a browser; the link sets it through the core instead.

Field	Type	Required	What it is
address	string	yes	The one address to send them. Where a person reaches the media server: built from what this machine is called on the network, not from either of the hosts the stack wires itself with — those resolve only on this machine or inside the stack, and an invitation carrying one sends somebody an address that cannot open.
applied	InvitationAppliedornull	no	What this offer wrote on the account, where it wrote anything.
caution	stringornull	no	What is worth knowing about the address itself, where anything is. An address that is a number is one a router can hand elsewhere, so a bookmark made from it stops working with nothing here having changed. Carried on the invitation because that is the copy somebody keeps.
decline	stringornull	no	Where they can decline it instead, where the stack runs the decline service. A page on the household's own network that refuses this invitation and nothing else, and switches the account made for it off. Its token is in this address alone: offering the same person again mints a new one, and the old address stops declining anything. Absent on a rehearsal, for somebody already in the household, and where the stack runs no decline service.
hours	integerint64	yes	How many hours it stands before it is withdrawn. Counted from when it was offered, which for an account whose password was taken off is the moment of the reset rather than when the account was made. What happens at the end depends on the account: one nobody has been in is removed, and one somebody has is switched off and kept.
join	stringornull	no	The link the companion app opens this invitation at, lemonfiber://join with the address, certificate fingerprint and identifier pairing names, the name to sign in as, when it lapses in seconds since the Unix epoch, and a claim token where there is an account to claim. Absent on a rehearsal, and where unjoinable says why.
linked	Linked	yes	Whether the request service knows about the household yet. Separate from standing, which is about the media-server account alone. The two can disagree — an account made while the request service was unreachable is Made and NotYet — and that disagreement is the state this reports.
name	string	yes	The name they sign in as.
rehearsed	boolean	yes	Whether the account was made, or only described. A rehearsal can say the whole answer without writing any of it — the name is the one asked for, the address is the stack's, and what has run out has just been read — so the only thing separating it from the real run is this.
standing	InvitationStanding	yes	What was found where this was going.
suspended	array ofstring	yes	Accounts somebody had been in, reset and not claimed again in time, switched off on the way past rather than removed. Kept because removing one takes what they watched with it. Switched off because an account with no password that anybody may still claim is the thing a window exists to close. Offering it again, or reissuing it, switches it back on. On a rehearsal these are the ones that would be switched off.
unjoinable	stringornull	no	Why there is no join link, in words every surface can show. Absent where there is one, and on a rehearsal.
withdrawn	array ofstring	yes	Invitations nobody claimed in time, removed on the way past. Reported rather than done quietly: an operator who invited somebody last week and hears nothing would otherwise have no way to learn the account is gone. On a rehearsal these are the ones that would be removed.

InvitationApplied

What an invitation wrote on the account, in the household's own words.

Said back so an absence later is explicable. A member held to a rating who cannot find half the library is either this working or a defect, and an operator with nothing on record cannot tell which. So the limit, the libraries, what happened to content the media server has no rating for, and whether the request service was held to the same decision all travel back on the answer that applied them.

Absent where the offer set nothing at all, which is not the same as an offer that set no restrictions: naming neither a library nor a limit is saying nothing about access, and nothing is what gets written.

Serialised in the field names the household read uses for the same facts, rather than in the invitation's own spelling: one setting named two ways across two shapes is two shapes a client has to be told are about the same thing.

Field	Type	Required	What it is
filtering	string	yes	What a limit here is, and what it is not. Carried on the answer rather than left to a document, because the reader who most needs it is the parent who has just set one.
libraries	array ofstring	yes	The libraries they may open, as the operator named them. Empty is every one.
limit	stringornull	no	How far up the ratings they may watch, in the words and the certificates this media server names in the operator's own country. Absent where no limit was set.
requesting	Linked	yes	Whether the request service was held to the same decision. The same three answers a link carries, and for the same reason: what somebody may ask for is a second service's business, and that service can be down while the media server is not. NotTried here is a service with no account for them yet — nothing to hold rather than a failure to hold something.
unrated	Unrated	yes	What becomes of content the media server has no rating for. Held back by default on somebody being narrowed, because a rating limit cannot decide about a thing that carries no rating. The cost is real and is why this is reported rather than assumed: some legitimate content becomes invisible to them.

InvitationStanding

What was found where the invitation was going.

Offering somebody an account twice is a thing operators do — they forget, or the first message went unanswered — and it is not a mistake to be refused. Each of these is an answer, and which one it is decides what there is to say rather than whether anything worked.

One of these:

• "made"

  The account did not exist, and was made.

• "waiting"

  An invitation was already out for them, and it still stands.

  The same account, offered again: nothing is made, and the message to send is the one that was already true.

• "joined"

  They have set a password, so they are already in the house.

  Nothing to claim and nothing to send. An account is not made, because the one they have is theirs and a second under a nearly identical name is how a household ends up with two of somebody.

• "reset"

  The account was theirs already, and its password has been taken off.

  Told apart from [Made](Self::Made) because what the person needs to hear is different. Nobody is being invited: they are already in the household, and the news is that the password they had has stopped working. It runs out on the same window an offer does, counted from the reset — and what is at stake if it does is larger, because the account being withdrawn is one they have watched on.

Item

One thing a removal reaches, said to be going or said to be kept.

Field	Type	Required	What it is
bytes	integerornulluint64, ≥ 0	no	What it occupies, where that is knowable. Absent for a container or a network, whose room is the image's rather than their own.
kept	stringornull	no	Why it is being kept rather than removed, where it is being kept. None is the ordinary case: this line is going. A reason here is the whole of how an image shared with another project, or a path this run could not confirm, stays on the list without being taken.
name	string	yes	What it is called — a container name, an image reference, or a full path.
secret	boolean	yes	Whether it holds a credential, so a report can say what destroying it destroys.
sort	Sort	yes	Which of the four sorts of thing it is.
what	string	yes	What it is, in the operator's words.

Jump

How large a step from one version to another is.

Named after the part of the version that moved rather than after a size, because that is the fact an operator weighs: a first-number change is where a project puts the work that breaks configurations, and the two behind it are where it puts the work that does not.

One of these:

• "major"

  The first number moved.

• "minor"

  The second number moved, and the first did not.

• "patch"

  Nothing before the third number moved.

• "untellable"

  One of the tags is not a run of numbers, so the size of the step is unknown.

Kept

One thing lemonfiber keeps on this machine.

Field	Type	Required	What it is
at	string	yes	Where it is, in full.
secret	boolean	yes	Whether it holds a credential, which is what decides how carefully a copy of it has to be treated.
what	string	yes	What it is, in the operator's words.
why	string	yes	Why it is kept.

KeyClaim

A key minted as a claim: the link that collects it, and no secret.

Field	Type	Required	What it is
lapses	string	yes	When the claim stops collecting the key, written as every other instant is.
link	string	yes	The key link: lemonfiber://key with the address, the certificate fingerprint, the stack, when the claim lapses and the claim. Shown once, and drawn as a code.
name	string	yes	The name it was minted under.
purpose	KeyPurpose	yes	What the minter said it is for.
scope	string	yes	What it admits: read, act or member:<name>.

KeyListing

Every key this machine has minted, and what became of a revoke.

Field	Type	Required	What it is
keys	array ofListedKey	yes	In the order they were minted.
purposes	string	yes	What a purpose in the listing is worth, said with it.
rehearsed	boolean	yes	Whether this was a rehearsal: what revoking would come to, with nothing revoked.
revoked	stringornull	no	The key this run revoked, where it revoked one.

KeyPurpose

What the minter said a key is for.

A label and nothing more. The core cannot tell what a program does with a key, so the listing shows this as the minter's own declaration rather than as anything verified.

One of these:

• "home-assistant"

  Home Assistant.

• "mcp"

  An assistant reaching the stack through the Model Context Protocol.

• "other"

  Anything else.

KeyState

Where a key stands.

One of these:

• "active"

  Admitted within its scope.

• "waiting"

  Minted as a claim and not collected yet: it has no secret, admits nothing, and is revoked when its claim lapses.

• "revoked"

  Refused as a wrong token is, and kept in the listing with when it was revoked.

• "orphaned"

  A member's key whose account has left the household: refused, and listed so it can be revoked.

• "unconfirmed"

  A member's key whose account the media server could not be asked about just now.

Leaving

Everything that leaves this machine: lemonfiber's own requests, those it makes on an installed plugin's behalf, and the stack's.

Field	Type	Required	What it is
on_behalf	array ofOnBehalf	yes	Every request lemonfiber makes on an installed plugin's behalf.
ours	array ofOutbound	yes	Every request lemonfiber makes on its own account, in a fixed order.
theirs	array ofElsewhere	yes	The requests made by services this stack runs, attributed to them.

LeftAfter

What is left of a member's allowance once an ask is counted, for each kind a limit holds them to.

Field	Type	Required	What it is
films	integerornulluint32, ≥ 0	no	Films still to ask for, absent where nothing limits them.
television	integerornulluint32, ≥ 0	no	Seasons of television still to ask for, absent where nothing limits them.

Letting

One completed download, what letting it go would cost, and what became of it.

Field	Type	Required	What it is
agreement	string	yes	What this offer names itself, so an answer to it can say which offer it answered.
download	Candidate	yes	The download, in the same words the account names it in: where it stands, what it occupies, and what removing it costs.
goes	string	yes	What goes with it, carried rather than left for a surface to remember.
gone	Goneornull	no	What became of an answered offer, and nothing where the offer is all this is.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.

Level

Where a volume stands.

One of these:

• "unknown"

  Usage cannot be determined.

  Ordered first so that it never wins a comparison against a level that was actually measured: a volume nobody could read must not make a stack that is visibly full read as merely unknown.

• "ample"

  Comfortable headroom.

• "advisory"

  Below comfortable, not urgent.

• "warning"

  Projected to exhaust within the horizon.

• "critical"

  Nearly exhausted.

• "exhausted"

  Full; acquisitions halted.

LibraryPath

One library path a service files into, and what moving the data location does to it.

Field	Type	Required	What it is
because	string	yes	Why it does or does not, in the operator's terms.
carried	boolean	yes	Whether the library at this path survives the move.
host	stringornull	no	The host directory it would resolve to after the move, where the move can resolve it at all.
path	string	yes	The path as that service holds it, which is a path inside its container.
service	string	yes	The service holding it.

LifecycleReport

What a lifecycle command did, or would have done.

Field	Type	Required	What it is
action	string	yes	The Compose subcommand that was run.
command	array ofstring	yes	The exact command, so what happened is never a matter of trust.
condition	Conditionornull	no	What those services amount to, as one word.
forwarding	stringornull	no	What starting the stack did about the VPN's forwarded port, where it did anything. Absent in the ordinary case — the client was already on it, or there is no tunnel to forward through — and a sentence where the client was moved, or could not be.
held	stringornull	no	Why nothing was run, where a start declined to run anything. Absent for every ordinary command, which is what makes it readable: a lifecycle report with an empty plan and a status of nothing is a report of something that did not happen, and without this there is nowhere to say whether that was a fault or the correct answer. A start at a login declines for three reasons the operator would each act on differently — the stack was stopped on purpose, autostart was never asked for, or this machine is on its battery and nobody said to start anyway — and a run nobody is watching has to leave the reason somewhere a reader finds later.
moves	array ofMoveOffered	no	Each part this release installs as a plugin that the stack still runs as its own service: a move in place on offer, named by every start and taken by none.
offer	stringornull	no	The offer a restart answers: the services it would restart, named so that a restart carrying it back is carried out against those services or refused. Absent for every other action.
passing	stringornull	no	Why the pass service is left out of the project a start writes, where the stream guard is filled and it is. Absent for every other action.
plan	Plan	yes	What the named forms came to: the profiles, the services they hold, and what the configuration left out. The resolved plan itself rather than a copy of its parts, because it is stated to the operator before the command runs and read out of the report afterwards — two accounts of one run, and a second shape for it would be a way for them to differ.
port_conflicts	array ofConflictReport	no	Host ports this start wants that another Compose project on this machine already answers on, each named on both sides. Empty for every action that starts nothing, and empty on a machine running one stack. Reported rather than refused: a port somebody deliberately shares is their business, and the start goes ahead — what this changes is whether an operator meeting a bind failure knows who is holding the port.
rehearsed	boolean	yes	Whether this was a rehearsal.
services	array ofService	yes	What each service ended up doing, where the action waited to find out, or where a start did not complete, read once when it ended. Empty for actions that do not wait. Stopping is finished when Compose says it is, and surveying afterwards would only report the absence it was asked to produce. A start that failed is not waited on, and names every service it addressed and those they depend on as the engine had them then.
stack_edits	array ofStackEdit	yes	Stack files the operator has edited, left as they set them rather than overwritten with lemonfiber's own. Empty in the ordinary case; a named entry warns that an upgrade would change a file they changed, and shows the diff.
status	integerornullint32	no	The exit status, absent for a rehearsal or a signalled process.
swept	array ofstring	no	Every network the engine holds for the project that the project no longer declares, by the engine's name: disconnected and taken away before a start, or named and left by a rehearsal. Empty for every other action.
switched	Switchedornull	no	What narrowing moved, where the command was a switch. Absent for every other action, which is what tells a reader that nothing was left running on purpose.
unvetted	Unvettedornull	no	The operator's overlay and every service it changes, where there is one: merged over the project this run starts, and held to nothing lemonfiber vets.

Limit

How much of the line something may take.

One of these:

• as: "unlimited"

  Nothing holds it back.

• as: "share"

  A proportion of what the line was measured to carry, in whole per cent.

  • at integeruint8, ≥ 0, ≤ 255
• as: "absolute"

  A figure in bytes a second, as it was given.

  • at integeruint64, ≥ 0

Line

One narrated line: a step, and what was specifically true of it.

Field	Type	Required	What it is
detail	string	yes	What was specifically true — the evidence that makes the line worth reading rather than a spinner. Empty where there is nothing particular to say.
said	string	yes	What it is doing, in plain language.
step	WalkthroughStep	yes	The step being narrated.

Link

What the import did with the finished download — the difference between one copy of a file and two.

One of these:

• "hardlinked"

  The library entry and the download are the same file under two names, which is what a correctly-shared volume allows and what costs no extra disk.

• "copied"

  The file was copied, so it now exists twice. Works, but every import costs its own size again and seeding a torrent holds the second copy for as long as it seeds.

Linked

Whether the request service has been given an account for the household yet.

The account somebody watches with is made on the media server, and it stands on its own from that moment — nothing has to be running for them to claim it. Being able to ask for something is a second account, on a second service, and that service can be down while the first is not.

So this is reported rather than made a condition of the invitation: an operator who invites somebody during an outage has still invited them, and what they cannot do yet is worth one line rather than a refusal.

One of these:

• "made"

  It holds an account for everybody the media server does.

• "not-yet"

  It could not be told. The media-server account stands, and the next run tells it — the service skips anybody it already knows, so nothing has to be remembered in between.

• "not-tried"

  Nothing was tried: a rehearsal, or a stack with no request service at all.

  Not a failure either way, and nothing a later run would put right — which is what separates it from NotYet.

LinkingReport

What an existing layout costs, where it cannot hold a hardlink.

Field	Type	Required	What it is
because	string	yes	Why they cannot, naming the filesystems it is about.
cost	string	yes	What that costs, in room rather than in adjectives.
filesystems	array ofstring	yes	The filesystems the existing setup keeps its data on.
forced	boolean	yes	Whether lemonfiber will do it. Always false: the layout and the library in it are the operator's, and correctness does not outrank their data.
links	boolean	yes	Whether imports can be hardlinks across this layout. False whenever this is reported at all, since a layout that links is not reported.
remedy	string	yes	What would fix it, offered.

ListedDeviceKey

One device key as the listing shows it.

Field	Type	Required	What it is
app	string	yes	The app that made it.
backing	DeviceKeyBacking	yes	Where it lives, as its attestation said.
fingerprint	string	yes	The SHA-256 of its public half's SubjectPublicKeyInfo, in lower-case hex.
name	string	yes	The name it was registered under.
registered	string	yes	When it was registered.
revoked	stringornull	no	When it was revoked, where it has been.
used	stringornull	no	When it last proved a mint, where it has.

ListedKey

One key as the listing shows it, without its secret.

Field	Type	Required	What it is
member_minted	boolean	yes	Whether a household member minted it for themselves.
minted	string	yes	When it was minted.
name	string	yes	The name it was minted under.
proved_by	stringornull	no	The device key whose signature proved its mint, absent where none did.
purpose	KeyPurpose	yes	What the minter said it is for. A declaration, not something the core verified.
revoked	stringornull	no	When it was revoked, where it has been.
scope	string	yes	What it admits: read, act or member:<name>.
state	KeyState	yes	Where it stands.
used	stringornull	no	When it was last admitted, where it has been.

Listing

The archives this machine has kept.

Field	Type	Required	What it is
archives	array ofstring	yes	Each one by the name it was written under, newest first. The name is the whole of what another surface needs: it is what a restore asks for, and it carries the moment the archive was taken and what it covers, because that is how a capture names one.

LogLevel

How bad a line says it is.

Ordered, so a filter can ask for "warnings and worse" without a table of which level outranks which. Deliberately coarse: these six are what services agree on, and a seventh that only one of them writes would be a level nobody could filter by across the stack.

One of these:

• "trace"

  Detail a developer asked for.

• "debug"

  Detail beyond the ordinary account of what happened.

• "info"

  The ordinary account of what happened.

• "warn"

  Something the operator may want to know about, that did not stop the service.

• "error"

  Something that failed.

• "fatal"

  Something that failed and stopped the service.

LogLine

One line of output from one service, and how bad it says it is.

What a machine-readable surface hands on, rather than the engine's line alone, so a consumer can mark the lines that say they failed, or find the first of them, without reading the text for itself — a second reading of severity would be a second answer, and the two would disagree about some service's spelling.

Field	Type	Required	What it is
at	stringornull	no	When the container itself says it wrote the line, where it said so. Kept verbatim and unparsed. Containers disagree with the host clock and with each other, and the only defensible ordering is each container's own account of itself — which a reader can only apply if it is carried rather than replaced by an arrival time.
level	LogLevelornull	no	How bad the line says it is, in one lowercase word. Absent where the line says nothing about itself. It is never guessed from the stream the line arrived on or from the words in it: most of this stack writes ordinary progress to standard error, and a line saying it could not find something is often a routine miss.
line	string	yes	The line, without its trailing newline.
service	string	yes	The Compose service it came from.
stream	Stream	yes	Which stream it arrived on.

Manager

The service manager a machine has, or the absence of one lemonfiber configures.

The absence is the default, because a machine nobody has told is a machine nothing is known about, and guessing at a manager is how a report comes to claim a platform it never asked.

One of these:

• "launchd"

  macOS, through a launch agent in the operator's own login session.

• "systemd"

  Linux, through a user service in the operator's own session.

• "unsupported"

  A platform lemonfiber does not configure.

Medium

The kinds of thing a household holds.

Named rather than passed through as the server's own word, because a surface drawing "Series" against one server and "tvshow" against another would be rendering a detail of which server this household runs.

Medium rather than Kind, Holding or Sort: this product already calls the two request services a [crate::media::Kind], a request's suspension a [crate::service::asking::Holding], and what one line of a manifest is a uninstall::Sort — and one word meaning two things in one vocabulary is how a reader comes to trust the wrong one. The contract flattens every type name into one namespace, so a clash there is a clash for anything reading it by name.

One of these:

• "film"

  One film.

• "series"

  A television series, rather than one episode of one.

• "episode"

  One episode of a series.

• "other"

  Something the server holds that is neither, and is not hidden for that.

Member

One entry in an archive's contents listing.

Field	Type	Required	What it is
archive_path	string	yes	Where it sits inside the archive.
label	string	yes	What it is, in the operator's terms.

MemberAccess

What one member may watch, in the household's own words.

Read off the media server's account rather than kept here: that is where access is decided, and a second copy is a copy able to disagree.

Field	Type	Required	What it is
administrator	boolean	yes	Whether the account administers the media server.
age_limit	integerornulluint32, ≥ 0	no	The highest rating they may watch, where the operator set a limit.
disabled	boolean	yes	Whether the account is switched off — held, but unable to sign in.
every_library	boolean	yes	Every library, rather than a chosen few. The ordinary case.
libraries	array ofstring	yes	The libraries they may watch where it is not every one, by the names the operator gave them — or by the server's identifiers where the library list could not be read, which a finding says.
rated	Ratedornull	no	What that limit comes to in the certificates this media server names, in the operator's own country. Absent where no limit is set.
restriction	Restriction	yes	What they are held to, in one word — including where what they may watch and what they may ask for disagree.
unrated	Unrated	yes	What becomes of content the media server has no rating for. Said either way, because an unexplained absence is the thing this answers: a restricted member missing half the library is either this setting or a defect, and an operator cannot tell which from silence.

MemberAsking

What one member may ask for, where the request service could be asked.

Both counts, because the service keeps them apart and folding them would report a household as within its limit while the half that matters is spent: television is counted a season at a time, so one ask for a six-season series spends six.

Field	Type	Required	What it is
films	Counted	yes	Films, counted one to a request.
frees_up	stringornull	no	When the count next lets go of something, so one more becomes possible. Absent where nothing limits them, and where the request service's own dates could not be read — an invented one would be a promise about a day on which nothing happens. The period is a window that rolls rather than a month that ends, so this is the moment their earliest counted request ages out.
policy	Policy	yes	What happens to what they ask for.
standing	AskingStanding	yes	Where they stand against what their period allows, taken over both counts.
television	Counted	yes	Television, counted one to a season.

MemberRequest

One thing a household member asked for, and where it stands in their words.

Field	Type	Required	What it is
arrived	stringornull	no	When the title arrived on the media server, as the request service timestamps it. Absent, not null, until it is there.
estimate	Estimateornull	no	About how much room it will want, at the quality in force. A guess and labelled as one — see [crate::asking::Estimate]. Absent where the request service names a kind this build does not know, since there is nothing to guess the length of.
id	integerint64	yes	The number the request service files it under, which is how one is named again when somebody rules on it.
media	stringornull	no	What kind of thing it is — a series, a film — in the household's own words. Absent where the request service names a kind this build does not know.
refused	Refusedornull	no	Why it was turned down, where it was turned down from here. The request service keeps none, so this is lemonfiber's own record and is said to be — a reason presented as delivered would end the operator's job at exactly the point it begins. Absent on a request nobody has refused, and on one refused in the request service itself, where there are no words to report and inventing some would put them in somebody's mouth. Whether the words were carried to the person who asked is the record's own told, which is why the two travel together: what an operator does next turns on it, and a reason read without it is a reason of unknown standing.
shelf_id	stringornull	no	The identifier the media server holds the title under, which is the one the held read names it by, so a request that has arrived can be found on the shelf. Absent, not null, until it is there.
state	RequestStateornull	no	Where the request stands, or absent where the request service reports a status this build does not know rather than guessing it into the nearest word.
title	stringornull	no	What it is called: from the library of the service filing it, where it has been told about it and that library could be read, and otherwise from the request service's own record of the title. Absent where neither names it.
waiting_days	integerornulluint64, ≥ 0	no	How many whole days it has been waiting on somebody, where it is waiting at all and the service's own date could be read. Only on the ones nobody has ruled on. A request already answered has not been waiting since it was made, and a figure beside one would be counting the wrong thing.
year	integerornulluint16, ≥ 0, ≤ 65535	no	The year that title came out, where the service that named it knows one. Absent, not null, otherwise.

MemberStanding

Where one member's account stands.

Switched off is its own answer rather than a flag beside another. An account the media server switched off after too many wrong passwords reads, on every other field, exactly like one that works — and the person holding it has only been told their password is wrong. What unlocks it is a reissue, which is the operator's to do, so the operator is the one who has to be able to see it.

One of these:

• "invited"

  Offered, and the offer still stands: nobody has set a password yet.

• "expired"

  Offered, and the offer ran out before anybody claimed it. The stack takes it back within a minute: an account nobody was seen in is removed and still listed as this until the next invitation, and a reset is switched off and kept.

• "declined"

  Offered, and the person refused it at its decline address. The account is kept, switched off, until the operator removes it or reissues it; no sweep takes it back as run out.

• "active"

  Claimed, and able to sign in.

• "suspended"

  Switched off — by the operator, or by the media server after too many wrong passwords. The account and what they watched are kept, and a reissue switches it back on.

Mended

One repair, and what became of it.

Field	Type	Required	What it is
outcome	RepairOutcome	yes	How it turned out, once the check was asked again.
repair	Repair	yes	What was proposed.

Metered

What the stack itself moved in a calendar month, and what that leaves out.

Field	Type	Required	What it is
down	integeruint64, ≥ 0	yes	Bytes pulled down, as far as the clients count them.
excludes	string	yes	What this count does not include, always said.
incomplete	array ofstring	yes	What is known to be missing from the count itself, where anything is.
month	string	yes	The month, as the client that dated the figures dates them.
up	integeruint64, ≥ 0	yes	Bytes given back.

MigrationReport

What is already on this machine, before anything is proposed.

Field	Type	Required	What it is
beside	array ofMovedReport	yes	Where each service would listen to run beside the existing setup.
carrying	array ofCarryingReport	yes	What adopting each recognised service would come to, by service name.
conflicts	array ofConflictReport	yes	Ports wanted by lemonfiber that an existing service already holds.
linking	LinkingReportornull	no	What the existing layout costs where it cannot hold a hardlink, absent where it can.
modes	array ofModeReport	yes	What may be done about what was found, least destructive first.
not_carried	array ofUnsupportedReport	yes	What no migration carries across, whatever mode it runs in.
read	boolean	yes	Whether the engine answered at all. False means the survey found nothing because it could not look, which is a different answer from finding nothing, and the only one that must never be read as an empty machine.
standing	array ofStandingReport	yes	Existing projects, by project name.
unsupported	array ofUnsupportedReport	yes	What was found and cannot be adopted.

MintedKey

A key minted, with everything a client on another machine needs to use it.

The only document that ever carries the secret. Every surface that renders it does so once, and nothing here writes it down.

Field	Type	Required	What it is
address	stringornull	no	Where a client on another machine reaches the stack: the https address it was last served at on the network. Absent where it has never been served that way.
caution	stringornull	no	What is worth knowing before handing the key over, where anything is: how to serve the stack so another machine can reach it.
name	string	yes	The name it was minted under.
pin	stringornull	no	The certificate that address presents: SHA-256 over its DER encoding, in lower-case hex. A client off this machine pins it.
purpose	KeyPurpose	yes	What the minter said it is for.
scope	string	yes	What it admits: read, act or member:<name>.
secret	Secret	yes	The secret, sent in X-Lemonfiber-Token. It is not shown again.

ModeReport

One thing an operator may do about a setup already here.

Field	Type	Required	What it is
disturbs	boolean	yes	Whether carrying it out stops or alters what is already running.
mode	string	yes	The word an operator types for it.
preselected	boolean	yes	Whether it is offered already chosen. Only adopting is.
what	string	yes	What choosing it would come to, in the operator's terms.

Moment

Which way a condition went.

Both directions are worth saying and neither is worth saying twice. An operator told a disk filled up and never told it was resolved goes on believing it — so resolution is an alert in its own right rather than the absence of one.

One of these:

• "onset"

  It started.

• "resolved"

  It stopped, having previously started.

MovedReport

Where one service would listen to run beside what is already here.

Field	Type	Required	What it is
from	integeruint16, ≥ 0, ≤ 65535	yes	The port it would ordinarily take.
service	string	yes	The lemonfiber service being moved.
to	integeruint16, ≥ 0, ≤ 65535	yes	The port it would take instead.

MoveOffered

A move in place the bundle offers: the plugin and the stack's own service of its id it would take the place of.

Field	Type	Required	What it is
plugin	string	yes	The plugin the bundle installs.
service	string	yes	The stack's own service it would take the place of, under the same container name, configuration directory, data and names.

MusicChoice

One audio-format choice in force, for media that has no resolution — the same question as a [PresetChoice], answered in format terms rather than resolution.

Field	Type	Required	What it is
format	string	yes	The format's plain-language name.
means	string	yes	What it means, in the operator's terms.
note	string	yes	The practical caveat worth knowing — playing it, or finding it.
scope	string	yes	What this applies to — music.
size_per_hour	string	yes	Roughly how much disk an hour of it takes.
targets	string	yes	The audio format it targets, in plain terms.

MusicReport

What choosing an audio format for music did: the choice, whether it was recorded or only rehearsed, and — once recorded — what became of applying it to the music service.

Music has no resolution and no community profile to lean on, so unlike a resolution preset the choice is carried straight to the service through its API. The choice is still recorded first, so it is remembered even when the service cannot be reached.

Field	Type	Required	What it is
changes	string	yes	What the choice changes, in the stack's words.
choice	MusicChoice	yes	The format chosen, what it means, and what it costs.
disposition	Disposition	yes	Whether the choice was recorded, or only rehearsed.
outcome	Triggeredornull	no	What became of applying it to the music service, or None for a rehearsal that applied nothing.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.

Newest

The newest of each kind, by what names them and nothing else.

What the event stream says. A surface marks a tab from it without reading the items, and reads [News] on the screen that lists them.

Field	Type	Required	What it is
problems	array ofNewsCheck	yes	The checks most recently found wrong, each with its onset.
requests	array ofintegerint64	yes	The numbers of the household's newest requests.
unread	array ofNewsKind	yes	The kinds that could not be read, as [News::unread] names them.
updates	array ofstring	yes	The versions of the newest releases in the record this build carries.

News

What a surface can mark as new, newest first within each kind.

Field	Type	Required	What it is
problems	array ofNewsProblem	yes	The checks found wrong, the most recent onset first.
requests	array ofNewsRequest	yes	What the household has asked for, highest number first.
unread	array ofNewsKind	yes	The kinds that could not be read. A kind named here has an empty list because nothing could be read, not because nothing is there. A surface that took the empty list as everything there is would mark all of it as new once it could be read again.
updates	array ofNewsUpdate	yes	The releases in the record this build carries, newest first.

NewsCheck

A check found wrong, by the check and when it went wrong.

Field	Type	Required	What it is
check	string	yes	The check that raised it.
onset	string	yes	When the stack first saw it wrong since it last saw it right, in whole seconds since the epoch.

NewsKind

One of the three kinds of thing a surface can mark as new.

One of these:

• "updates"

  Releases of lemonfiber.

• "requests"

  What the household has asked for.

• "problems"

  Checks found wrong.

NewsProblem

One check found wrong, by the check and when it went wrong.

Field	Type	Required	What it is
check	string	yes	The check that raised it.
onset	string	yes	When the stack first saw it wrong since it last saw it right, in whole seconds since the epoch: the same moment the health summary names for it.
summary	string	yes	What is wrong, in one line.

NewsRequest

One request, by its number.

Field	Type	Required	What it is
by	string	yes	Who asked for it, by the name the media server holds them under.
number	integerint64	yes	The number the request service files it under.
title	stringornull	no	What it is called, where a service has been told about it.

NewsUpdate

One release, by its version.

Field	Type	Required	What it is
delivers	stringornull	no	What it set out to deliver, where the record says.
version	string	yes	The version, without the tag's leading letter.

Next

One thing to do next.

One of these:

• "more-content"

  Add more content, now that the shape of it is understood.

• "household"

  Let the rest of the household ask for things themselves.

• "client-apps"

  Watch it somewhere other than the machine it is running on.

Notes

What a surface shows about the record, given the version asking.

Field	Type	Required	What it is
releases	array ofReleaseSummary	yes	Every release the record holds, newest first.
requirements	map ofRequirement	yes	What each requirement the running release cites is, and where it is defined.
running	Releaseornull	no	What the running version changed, where the record holds its release.
state	ChangelogState	yes	Whether the record describes what this build could have shipped.

OccupantReport

One container of somebody else's stack, as the engine reports it.

Field	Type	Required	What it is
adoptable	boolean	yes	Whether lemonfiber knows this service and could take it over as it stands.
ports	array ofintegeruint16, ≥ 0, ≤ 65535	yes	Every host port it publishes, lowest first.
running	boolean	yes	Whether it is running now, as against present but stopped.
service	string	yes	The Compose service name it answers to.

OnBehalf

A request lemonfiber makes on an installed plugin's behalf, attributed to it.

Field	Type	Required	What it is
destination	string	yes	Where it goes, as the plugin declared it.
plugin	string	yes	The plugin that declared it, by its id.
purpose	string	yes	Why it may be made.

Opening

One thing a way of downloading newly asks the operator for.

What is opened and nothing beside it: an operator adding Usenet is shown the Usenet provider and the settings its login is kept in, and never the tunnel, which they neither need nor asked about.

Field	Type	Required	What it is
because	string	yes	Why this protocol needs it.
setting	stringornull	no	The setting its answer is kept in, where it is kept in one. Absent for an account the operator has to go and obtain, which no setting holds.
what	string	yes	What it is, in the operator's terms.

Origin

Who produced a credential, which decides what can be done about it.

One of these:

• "operator"

  The operator supplied it, from an account they hold somewhere else.

• "service"

  The service minted it for itself and wrote it into its own configuration.

• "lemonfiber"

  lemonfiber minted it, because the service offers nothing durable to read.

Outbound

One request lemonfiber makes, where it goes, and what refusing it costs.

Field	Type	Required	What it is
allowed	boolean	yes	Whether this machine's settings allow it.
cost	string	yes	What stops working once it is off.
destination	array ofstring	yes	Where it goes as this machine is configured. Empty where nothing is configured to reach, which is not the same as switched off.
purpose	string	yes	Why lemonfiber asks.
reach	OutboundReach	yes	Which request this is.
sends	string	yes	Exactly what travels in the request.
switch	string	yes	The setting that switches it off.

OutboundReach

One of the requests lemonfiber makes on its own account.

Ten, and the closed set is the claim. An eleventh is a decision somebody makes by adding a variant here and answering four questions about it, rather than one that happens by somebody building a request.

The sixth is the one that carries somebody's words rather than a credential or a name, and it was added deliberately and late: five of these prove or fetch something and could say what travels in a phrase, and this one travels to a person. What that costs is the same four answers as the rest, and one more thing the others do not owe — it is the only entry whose destination is somebody else's choice, so the list names the two services it can reach and the sender is handed them rather than holding addresses of its own.

The seventh is the only one this program makes about itself, and the one most easily left off a list of what this program reaches. What it costs to allow is the shortest answer on the list: it carries nothing at all, so the only thing switching it off keeps from anybody is the knowledge that a version came out.

The eighth goes where the operator points it and nowhere else: a plugin's git source, named at install. It is the only entry whose destination nobody chose in advance, which is why it is made only when somebody names one.

The ninth goes to one place this build names, and only when an operator installs a plugin by name: the catalogue's newest release, for its index and the signature over it.

The tenth is made for a member rather than for the operator: the poster of a title their search found, from the one catalogue address this build names, so their client draws it without ever being sent there.

One of these:

• "registry"

  Fetching the service images the stack runs.

• "guides"

  Probing the source the community quality guides are synced from.

• "echo"

  Asking what public address this machine's traffic comes out of.

• "indexer"

  Proving an indexer key against the indexer.

• "usenet"

  Proving a Usenet login against the provider.

• "household"

  Telling a household member the one thing the request service cannot carry.

• "updates"

  Asking which version of lemonfiber itself has been released.

• "plugin-source"

  Fetching a plugin from a git source the operator names.

• "catalogue"

  Reading the catalogue's index to resolve a plugin installed by name.

• "posters"

  Fetching the poster of a title a member's search found.

Outside

Something an uninstall leaves behind, and how to remove it by hand.

Field	Type	Required	What it is
by_hand	string	yes	How to remove it on this platform, as the operator would type or do it.
found	boolean	yes	Whether this machine was found to have it. A survey that could not look says nothing was found rather than that nothing is there, which is why the entry is listed either way and this field carries the difference.
what	string	yes	What it is.
why	string	yes	Why it is not lemonfiber's to take away.

Outsized

One file far larger than the rest.

Field	Type	Required	What it is
bytes	integeruint64, ≥ 0	yes	What it occupies.
path	string	yes	Where it is.
times_typical	integeruint64, ≥ 0	yes	How many times the middle file of this walk it is.

Overall

What a run's findings amount to.

One of these:

• "healthy"

  Everything that ran passed.

• "degraded"

  Warnings, but nothing broken.

• "broken"

  Something is broken.

• "unknown"

  Something could not be determined, so health is not a settled fact.

Owner

Whose a setting or a secret is.

One of these:

• of: "core"

  The core's.

• of: "namespace"

  A plugin's, or a stack service's, by its namespace.

  • namespace string

    The namespace.

Pace

What a capture came to, against the time a capture is meant to take.

Reported and never enforced. The room check already walks the trees to decide whether the archive fits, so the bytes are in hand before anything is written and cost nothing extra to say — and what they are measured against is the work, not a clock. A wall-clock gate on a machine whose disk throughput varies by more than the margin either passes for reasons unrelated to this product or fails for them, and neither reading is worth having.

Field	Type	Required	What it is
brisk	boolean	yes	Whether this capture is inside it.
budget	integeruint64, ≥ 0	yes	The bytes a capture may move and still be expected to finish in time. Carried with the reading rather than left for a reader to look up, so a surface showing this does not need a second copy of the number to compare against.
moved	integeruint64, ≥ 0	yes	The bytes the captured trees came to, as the room check measured them.

Pairing

Pairing material, and what the operator is told beside it.

Field	Type	Required	What it is
caution	stringornull	no	What is worth knowing about the address itself, where anything is.
compare	string	yes	The fingerprint in the short form a person compares with what the phone shows after typing the line in, as [comparable] derives it.
material	PairingMaterial	yes	The material itself.
replacing	string	yes	What would make every paired phone refuse this machine, said now rather than discovered then. In words any surface can show: how the certificate is replaced is each surface's own to say, so this names no command.
until	string	yes	When it stops being good, as a date and a time of day.
written	string	yes	The material as the one line a code carries and a person types.

PairingMaterial

What a phone is handed, exactly as it reads it.

Four fields and no more: a reader refuses one it does not know, which is what keeps a credential from ever riding along under a name nobody thought to forbid.

Field	Type	Required	What it is
address	string	yes	Where the phone reaches the stack: an https address on the household network.
expires	integeruint64, ≥ 0	yes	When the material stops being good, in seconds since the Unix epoch.
fingerprint	string	yes	The certificate that address presents: SHA-256 over its DER encoding, in lower-case hex. Not the digest of its public key.
stack	string	yes	The stack's own identifier: opaque, minted once from nothing and kept, and the same across every issue of the material, a change of address and a replacement of the certificate. Not the stack's name and not its version, and it carries nothing about the household or anybody in it.

PanelArray_of_Downloader

A panel's content, or the reason its source could not fill it.

The difference between "this panel is up to date" and "this panel's source is unreachable" is the whole of degrading honestly: an unavailable panel says so, in its own words, rather than showing stale data as current or blank data as zero — and the panels beside it stay live.

One of these:

• panel: "ready"

  The source answered; here is the panel.

  • data array ofDownloader
• panel: "unavailable"

  The source could not be reached, for this stated reason.

  • data object

PanelArray_of_Queue

A panel's content, or the reason its source could not fill it.

The difference between "this panel is up to date" and "this panel's source is unreachable" is the whole of degrading honestly: an unavailable panel says so, in its own words, rather than showing stale data as current or blank data as zero — and the panels beside it stay live.

One of these:

• panel: "ready"

  The source answered; here is the panel.

  • data array ofQueue
• panel: "unavailable"

  The source could not be reached, for this stated reason.

  • data object

PanelArray_of_Service

A panel's content, or the reason its source could not fill it.

The difference between "this panel is up to date" and "this panel's source is unreachable" is the whole of degrading honestly: an unavailable panel says so, in its own words, rather than showing stale data as current or blank data as zero — and the panels beside it stay live.

One of these:

• panel: "ready"

  The source answered; here is the panel.

  • data array ofService
• panel: "unavailable"

  The source could not be reached, for this stated reason.

  • data object

PanelArray_of_Transfer

A panel's content, or the reason its source could not fill it.

The difference between "this panel is up to date" and "this panel's source is unreachable" is the whole of degrading honestly: an unavailable panel says so, in its own words, rather than showing stale data as current or blank data as zero — and the panels beside it stay live.

One of these:

• panel: "ready"

  The source answered; here is the panel.

  • data array ofTransfer
• panel: "unavailable"

  The source could not be reached, for this stated reason.

  • data object

PanelFrontDoorReport

A panel's content, or the reason its source could not fill it.

The difference between "this panel is up to date" and "this panel's source is unreachable" is the whole of degrading honestly: an unavailable panel says so, in its own words, rather than showing stale data as current or blank data as zero — and the panels beside it stay live.

One of these:

• panel: "ready"

  The source answered; here is the panel.

  • data FrontDoorReport
• panel: "unavailable"

  The source could not be reached, for this stated reason.

  • data object

PanelHouseholdReport

A panel's content, or the reason its source could not fill it.

The difference between "this panel is up to date" and "this panel's source is unreachable" is the whole of degrading honestly: an unavailable panel says so, in its own words, rather than showing stale data as current or blank data as zero — and the panels beside it stay live.

One of these:

• panel: "ready"

  The source answered; here is the panel.

  • data HouseholdReport
• panel: "unavailable"

  The source could not be reached, for this stated reason.

  • data object

PanelStorage

A panel's content, or the reason its source could not fill it.

The difference between "this panel is up to date" and "this panel's source is unreachable" is the whole of degrading honestly: an unavailable panel says so, in its own words, rather than showing stale data as current or blank data as zero — and the panels beside it stay live.

One of these:

• panel: "ready"

  The source answered; here is the panel.

  • data Storage
• panel: "unavailable"

  The source could not be reached, for this stated reason.

  • data object

PanelVpn

A panel's content, or the reason its source could not fill it.

The difference between "this panel is up to date" and "this panel's source is unreachable" is the whole of degrading honestly: an unavailable panel says so, in its own words, rather than showing stale data as current or blank data as zero — and the panels beside it stay live.

One of these:

• panel: "ready"

  The source answered; here is the panel.

  • data Vpn
• panel: "unavailable"

  The source could not be reached, for this stated reason.

  • data object

Part

One part of a traced item — an episode of a series. A film has no parts: the item is the whole, and a trace of it says all there is to say. A series does not, which is the gap this closes: "the show is imported" is true the moment one episode lands, and reads as done while nine are still missing.

Field	Type	Required	What it is
number	integeruint32, ≥ 0	yes	Its number within that season.
season	integeruint32, ≥ 0	yes	Which season it belongs to.
stage	Stage	yes	How far this one part got, on the same scale as the item as a whole.
title	string	yes	Its title, as a person would name it.

PartWay

Something a member was part-way through, and how far.

Field	Type	Required	What it is
backdrop	stringornull	no	Where its backdrop is served, where it has one.
door	Pinnedornull	no	The certificate the door presents, which a client pins, beside any location.
id	string	yes	The identifier the server tells it apart by, which is what asking to play one of them names.
length	integerornulluint64, ≥ 0	no	How long it runs, in whole seconds, where the server knows.
medium	Medium	yes	Which of the kinds this product deals in it is.
position	integeruint64, ≥ 0	yes	How far in they got, in whole seconds.
poster	stringornull	no	Where its poster is served, where it has one.
stream_from	stringornull	no	Where it streams from, where it plays.
title	string	yes	What it is called, in the words the server holds it under.
unlocated	stringornull	no	Why no location is stated, where none is.
year	integerornulluint16, ≥ 0, ≤ 65535	no	The year it came out, where the server knows one. Absent rather than guessed: two films share a title far more often than they share a title and a year.

PartWayReport

What one member was part-way through, most recent first.

Field	Type	Required	What it is
available	boolean	yes	Whether it could be read at all. An empty list and an unread one are different answers, and what could not be read is said in findings.
findings	array ofstring	yes	What is worth saying about this read, in the words its reader would use.
id	string	yes	The identifier the media server files them under.
member	string	yes	The member this was asked for, by the name they are known by.
part_way	array ofPartWay	yes	Each title or episode, how far in, and where it is served.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done.

Passed

Where a refusal's words were carried, and when.

Field	Type	Required	What it is
at	stringornull	no	When the attempt was made, absent where the clock could not be written down.
to	array ofstring	yes	The services they reached, by the names the member knows them by. Empty where there was nowhere this could send.

PausedClient

What one download client said about being paused or resumed.

Field	Type	Required	What it is
client	string	yes	The client, by the name the stack knows it under.
now	Pullingornull	no	What it read back after it was asked. Absent on a rehearsal, which asks nothing, and where the client could not be reached.
unreached	stringornull	no	Why it could not be reached, in its own words where it gave any.
was	Pullingornull	no	Whether it was fetching before it was asked, where it said.

Pausing

Which of the two was asked for.

One of these:

• "pause"

  Stop every download client fetching.

• "resume"

  Let every download client fetch again.

PausingReport

What pausing or resuming every download client came to.

Field	Type	Required	What it is
asked	Pausing	yes	Which of the two was asked for.
caution	stringornull	no	What a resume runs into where a spent cap had stopped the clients: they are let go as asked, and the cap stops them again the next time the line is checked.
clients	array ofPausedClient	yes	Every download client the stack runs, in the order the stack declares them.
offer	string	yes	The offer this answers: every client and what it said it was doing before it was asked anything, named so that a request carrying it back acts on those clients in those states or is refused.
rehearsed	boolean	yes	Whether this was a rehearsal: what each client is doing now, with nothing asked of any of them.

Period

Which side of the household's day a moment falls on.

One of these:

• "active"

  People are up and using the line, so the stack is held back.

• "quiet"

  The house is asleep and the line is the stack's.

Phase

Where an in-flight or finished setup stands in its lifecycle.

The persisted marker a later run reads to tell answers still being gathered from a half-written apply. Only these four are ever written: the two states a run infers instead of storing — no setup at all, and an apply that stopped mid-write — are read off the world rather than trusted from a file (see [Status]).

One of these:

• "in-progress"

  Still gathering answers. Resumable, and nothing has touched disk.

• "reviewing"

  Every applicable question answered, awaiting the operator's confirmation.

• "applying"

  Writing configuration and starting services — the one non-atomic phase, and so the only marker whose persistence signals an interrupted run.

• "applied"

  Configuration written and valid.

Piece

One file inside a bundle: the name it will carry, and what it holds.

Held in memory rather than written as it is gathered, because everything is read back before anything is written. A bundle that had already put one file on disk when it found a credential in the next would have to be unwritten, and unwriting is the kind of thing that half-works.

Field	Type	Required	What it is
body	string	yes	What it holds, already redacted.
name	string	yes	What it is called inside the bundle.

Pinned

The certificate a guarded door presents, as a client pins it.

Field	Type	Required	What it is
fingerprint	string	yes	SHA-256 over the certificate's DER encoding, lower-case hex.

Plan

What will be run, and what was left out.

Serialisable because it is an answer in its own right: asking what a form would do is a question a script asks as readily as a person, and the plan a lifecycle report carries is this same value rather than a retelling of it.

Field	Type	Required	What it is
dropped	array ofDropped	yes	Profiles the closure asked for that the configuration does not support.
filtered	array ofFiltered	yes	The services those profiles hold, each with what it needed and who asked. The same answer as [Self::dropped], a service at a time. A surface showing what did not start shows services, and one holding its own copy of which service sits in which profile would be a second copy of the stack's vocabulary.
footprint	Footprint	yes	What the stack estimates the services that would start need.
forms	array ofstring	yes	The forms the operator named, in the order they named them.
profiles	array ofstring	yes	The profiles to activate, sorted so the command is reproducible.
running	array ofstringornull	no	Which of [Self::services] are already running, where a form's introspection asked the engine. Starting a form leaves what is already running as it is, so a running service is not one the start would bring up. Absent where nothing asked, which is every plan but a preview's; null where the engine would not say, which is never said as nothing running.
services	array ofstring	yes	The services those profiles start, in the order the stack declares them. A service belongs to exactly one profile, so a service two named forms both reach is here once. That is a property of the manifest rather than of a pass over this list: the union is over profiles, and a service appearing twice is not a state this can hold.

Playback

Somebody watching something now, as the media server lists the session.

Who and what, and where: what a household recognises about somebody watching. No stream, no bitrate and no transcode reason, because a member is not choosing one and a surface handed those would have to decide not to draw them.

Field	Type	Required	What it is
device	string	yes	What the device it plays on calls itself.
episode	integerornulluint32, ≥ 0	no	The episode's number within its season, where the server numbers one.
medium	Medium	yes	Which of the kinds this product deals in it is. An episode is of a series.
member	string	yes	The name the account is known by.
member_id	string	yes	The identifier the server files the account under.
paused	boolean	yes	Whether it is paused rather than playing.
season	integerornulluint32, ≥ 0	no	The season an episode is in, where the server numbers one.
series	stringornull	no	The series an episode belongs to, where it is one.
title	string	yes	What is playing, in the words the server holds it under: an episode's own name where it is an episode.

PlayingReport

What is playing now, and whose sessions were asked about.

Field	Type	Required	What it is
available	boolean	yes	Whether the media server could be asked at all. Nobody watching and a server that would not say are different answers, and collapsing them would report a quiet house on the day the media server was down. Anything that could not be read is said in findings and this goes false.
findings	array ofstring	yes	What is worth saying about this reading, in the words its reader would use. Always written, empty or not, so a reader never has to guess what an absent field means.
member	string	yes	The member this was narrowed to, by the name they are known by, or empty where it is every session in the house.
sessions	array ofPlayback	yes	Every session playing something, in the order the media server lists them. How many are playing is how many these are, rather than a count kept beside them.

PluginAdapterOwner

Whose an adapter is.

One answer, and the field exists so that the answer is on the wire: an adapter a plugin could bring would be code a stranger wrote running with lemonfiber's authority, which nothing here can load.

One of these:

• "lemonfiber"

  lemonfiber's own, from the set contract/adapters.json publishes.

PluginAsking

One capability a placed service asks for.

Field	Type	Required	What it is
capability	string	yes	The core capability asked for.
each	boolean	no	Whether every service that fills it is reached rather than one.
native	stringornull	no	The upstream's own API it talks in, which it reaches in place of the adapter.

PluginChange

One change installing a plugin makes to the machine.

A path and what goes at it, which is the whole of what an install touches. Two of them can be edits to a file the stack already has — the proxy's and the dashboard's — and those say so, as a region, so an operator reading the account knows which of their files the install writes into.

Field	Type	Required	What it is
path	string	yes	Where it lands, in full. In full rather than relative to the stack, because what is this about to do to my machine is answered by a path somebody can go and look at — and a relative one is right about a directory the reader has to work out for themselves.
puts	PluginPuts	yes	What lands there.

PluginChangedCheck

One check that stands differently after an install than it did before.

Field	Type	Required	What it is
before	DoctorVerdictornull	no	How the same check read before the install, or nothing where it was not raised at all. Absent means the check produced no finding beforehand, which is read as it holding: a finding no longer raised is a fault no longer there, and the same rule read backwards is that one not yet raised was not yet a fault.
now	Finding	yes	The check as it reads now, with everything the diagnosis says about it. The finding itself rather than a summary of it, because what an operator does next is read the remedy, the service's own output and what else is causing it — and a second, thinner shape of the same fact is where those stop arriving.

PluginConstraint

A kind of constraint an expectation can put on a body.

The same vocabulary a proof's expectation and a contributed check's use, so that "a status alone is not evidence" is one rule rather than three. Read as well as written: a declaration that an assertion fails on a recording names the one of these that fails there.

One of these:

• "status"

  The status alone.

• "json"

  Keys carrying exactly these values.

• "json_has_keys"

  Keys that must be present, whatever they hold.

• "json_types"

  Keys that must hold a given kind of thing.

• "json_at_least"

  Keys that must hold at least a given number.

• "json_array_min"

  The answer read as an array, with at least a given number of entries.

• "json_is_absent"

  The answer did not parse as JSON at all.

• "content_type"

  The content type it is served as.

• "body_starts_with"

  What the body must begin with.

• "exit"

  The exit status a run ends with.

• "stdout_starts_with"

  What a run's standard output begins with.

PluginDeclaration

What a plugin declared about itself, as its install read it.

Field	Type	Required	What it is
claims	array ofstring	no	Every capability it claims, core and its own, in the order it declares them. Apart from what its services fill: a claim is what it says it can do and has to demonstrate, and a capability of its own is claimed without anything asking for it.
license	string	no	The licence it is distributed under.
overrides	array ofPluginOverriding	no	Every bundled setting it declares it may change.
reaches	array ofstring	no	Every destination a recipe of its could reach that is not one of its own services: a service of this stack's, or a name outside it. Recorded as declared rather than sorted into the two here, because which names are this stack's is a question about the stack, and the stack a record is read against is the one on the machine when it is read.
reviewed	boolean	no	Whether anybody reviewed it before it was installed. True for a plugin installed by name through a catalogue index whose signature verified, and false for every install from a source an operator named. Carried rather than left implicit, because an unreviewed plugin is to be said to be one for as long as it is installed.
secrets	array ofPluginSecret	no	Every credential it says it will hold.
upstream	string	no	Where its source is published, as the plugin names it.

PluginDeclaredVerdict

The one verdict a declaration may name.

One of these:

• "fails"

  The assertion fails on the recording, on the constraint the declaration names.

PluginDemand

What asking for one of an installed plugin's demand recipes came to.

Field	Type	Required	What it is
plugin	string	yes	The plugin whose recipe it is.
ran	PluginRecipeRanornull	no	What running it came to, or nothing where it was only read.
recipe	PluginRecipe	yes	The recipe as the operator agrees to it: its calls, what it asks for, and every value it would carry where.

PluginEvidence

What the verdicts in a report were reached against.

One value, because one is all this build can produce: nothing here asks a service anything. It is a field rather than a sentence for the reason a verdict is one — a reader handed demonstrated has nothing else in the document to tell a recording that answered from a service that did, and the weaker of those two claims must not be readable as the stronger. The prose says it on the page; this says it to whatever consumes the report: an author's own CI, a catalogue, anything counting passes. Naming the axis now is what made the second kind of evidence a change the compiler walked somebody through rather than one they had to remember.

One of these:

• "recordings"

  The recordings the plugin ships. No service was asked anything.

• "service"

  The service itself, running on this machine and asked.

  The stronger of the two and the one only an install can reach: an author has no instance to ask and the catalogue has none either, which is the whole reason recordings exist. A verdict reached here says the service did the thing on the machine it is installed on, and it must not be readable as the weaker claim any more than the weaker may be read as this.

PluginExpectedFailure

A recording an assertion fails on, the one constraint of its expectation that fails there, and why.

For an assertion whose passing state nobody can record, such as a check that a server has an owner where claiming one needs an account the plugin's CI does not hold: the state it exists to find can be recorded, and the declaration says which constraint tells the two states apart. It changes the verdict on that recording and on nothing else — the live service and every other recording are held to the expectation as it is written.

It names a constraint rather than only a recording, because a recording that began failing for another reason — a truncated file, an error recorded by mistake — would otherwise read as failing as declared, excusing a failure nobody had looked at.

Field	Type	Required	What it is
constraint	PluginConstraint	yes	The key of the expectation that fails on the recording, and one it carries.
fixture	string	yes	The recording the assertion fails on. It may be the assertion's own fixture.
place	stringornull	no	Where within that constraint it fails, written exactly as the expectation writes it. Present for a key-wise constraint and absent for one about the whole answer.
reason	string	yes	Why this recording is one the assertion fails on. Reported with the verdict every time.
verdict	PluginDeclaredVerdict	yes	fails, and nothing else: passing is what the expectation already says, and could-not-run is never excused.

PluginFailingAsDeclared

One recording an assertion fails on as its manifest declares.

Field	Type	Required	What it is
constraint	PluginConstraint	yes	The constraint of the expectation that fails there.
fixture	string	yes	The recording.
held	string	yes	What the recording held there.
place	stringornull	no	Where within that constraint, for one that looks at places.
reason	string	yes	Why the manifest says this recording is one the assertion fails on.

PluginGrant

A credential of another service the operator granted a third-party plugin, named by the setting it is held under and never by its value.

Field	Type	Required	What it is
at	string	yes	When the operator approved it, as the record stamps every change.
credential	string	yes	The setting the credential is held under, as the credentials read names it.
for	string	yes	The capability of the plugin's own it was granted to fill.
of	string	yes	The service whose credential it is.

PluginGranting

One credential that would cross to a plugin, as the reading states it.

Field	Type	Required	What it is
approval	string	yes	What approving it is written as, apart from the offer.
credential	string	yes	The setting the credential is held under, as the credentials read names it.
for	string	yes	The capability of the plugin's own it would be granted to fill.
of	string	yes	The service whose credential it is.

PluginInstall

What an install came to, and what it took to get there.

The three lists below are stated whether the run wrote anything or not, and that is the whole of what makes a rehearsal worth running. A rehearsal that reported less than the real run would be a preview of a different operation; one that reported it from code of its own would be a second derivation free to disagree with the one that acts. So they are filled in one place, from the manifest and from the very list of writes the install is carried out from, and the surface says them in whichever tense recorded calls for.

Field	Type	Required	What it is
against	PluginEvidenceornull	no	What those verdicts were reached against, or nothing where none were reached. Carried rather than assumed, because the two kinds of evidence are not the same claim: an author's read asks the recordings a plugin ships, and an install asks the service running on this machine. The weaker must not be readable as the stronger, and a reader handed a verdict has nothing else in the document to tell them apart.
asks	array ofWired	yes	Every ask its services would make, each with what it would reach and how that would be settled.
changes	array ofPluginChange	yes	Every change it makes to the machine, in the order it makes them.
contests	array ofWiringContest	yes	Every ask of the stack's the install leaves contested that is not contested now, as it would then stand. A plugin's service that claims what the stack asks for is a candidate like any other, so installing it leaves the ask refused until somebody chooses — which is a change to what the stack does, and stated with the rest before it happens.
granting	array ofPluginGranting	yes	Every credential of another service that would cross to the plugin, each approved apart from the offer as its approval names it.
overrides	array ofPluginOverriding	yes	Every bundled thing the plugin declares it will change. The full extent rather than a sample of it: a manifest may change a bundled setting only through a recipe, and a recipe reaching one no [[override]] names is refused before anything is written.
proofs	array ofPluginProving	yes	Every proof that has to hold before the plugin is installed, and on a run that asked them, what each came to.
recipes_ran	array ofPluginRecipeRan	yes	Every install recipe the act ran, in order, with what each step came to; an empty list where none ran, which is every rehearsal and every plugin declaring no install recipe. A recipe that did not hold ends the act with a problem carrying the same account, so this is the account of recipes that held.
recorded	boolean	yes	Whether it was written down. A rehearsal leaves this false.
reversed	UndoReversalornull	no	What putting the install back came to, where something failed and it was. The rollback layer's own report rather than a shape of this verb's: what went back, and what did not with the reason each is still standing. Absent on a run that had nothing to put back, which is both a rehearsal and an install that held.
taking	array ofPluginTaking	yes	Every service taking a privileged shape, with what it is given, each approved apart from the offer.
verified	PluginVerificationornull	no	What the stack's own checks made of the install, or nothing on a run that asked them nothing. The other half of what an install has to establish, and the half a plugin cannot establish for itself: its proofs say the plugin works, and this says the stack still does. Absent on a rehearsal, which writes nothing and so has nothing to hold a reading against.
would	PluginInstalled	yes	What the install settled, said whether or not it was written down.

PluginInstalled

One plugin's install, as it was decided.

Field	Type	Required	What it is
contributions	array ofContribution	no	Every row it adds to a register lemonfiber already runs, as the install settled them, so the doctor reads them off this record rather than off the plugin's files. Defaulted for a register written before this field existed.
declared	PluginDeclaration	no	What the plugin declared about itself: where it is published, whether it was reviewed, what it claims, what it may change, where it may reach and what it will hold.
description	stringornull	no	What it does for the operator, in its author's words. Absent alike.
from	string	no	The source it was installed from, as the operator named it. Empty for a record written before this was kept. A rehearsal's account carries the source it was asked about, because that is what it would record.
granted	array ofPluginGrant	no	Each credential of another service the operator granted it, as a third-party plugin.
installed_at	string	no	When it was installed, as the record stamps every change: whole seconds since the epoch. The install's own stamp, the one its changes are journalled under, so the listing and the history name the same moment. Empty where the record predates it; a rehearsal's account carries the moment it was asked, which is the stamp the install would have run under.
manifest	string	no	The SHA-256 of the manifest it was installed from, in lower-case hexadecimal.
name	stringornull	no	What the plugin calls itself, for a person to read. Absent on a record written before it was kept, and never filled in from the id: a name is the author's, and one made up here would be lemonfiber's.
plugin	string	yes	The plugin's id: the name it is installed and journalled under.
provides	array ofstring	no	Every core capability its services fill, as the install settled them, core names only, which is what a removal reads to say what would go unfilled. Defaulted for a register written before the field existed, which reads as filling nothing.
recipes	array ofPluginRecipe	no	Every recipe it declares: each call in order with the adapter it reaches through, and every value that could leave for somewhere else. Empty for a plugin that declares none and for a record written before these were kept, so a list is always there to read.
request_proofs	array ofPluginRequestProof	no	Every proof it declares that asks one of its services a question.
revision	string	no	The commit it was installed at, where it came from a git source. The one commit the revision named at install resolved to, so what was installed can be told from whatever that source serves now. Empty for a plugin installed from a directory, which has no revision to name, and for a record written before this was kept.
run_proofs	array ofPluginRunProof	no	Every proof it declares that runs the image's own program.
services	array ofPluginPlaced	yes	What was placed, one entry per service the plugin declares.
signed	string	no	What signed it: the key the catalogue index it was resolved through verified against, named with its fingerprint; empty where nothing signed it.
tree	string	no	The digest of the plugin's tree it was installed from, sha256:<hex>; empty where the tree could not be read whole, or the record predates it.
version	string	yes	The plugin's own content version, as it stood when it was installed.

PluginInstalls

What is installed, and what installing one came to.

One answer for the reading and for the verb, because they are one question: an operator who has just installed something wants to see it among what they had, and a rehearsal that showed only the new entry would not say what it is joining.

Field	Type	Required	What it is
agreement	stringornull	no	What this run's reading names itself, so an answer to it can say which reading it answered; nothing on the reading of what is installed, which offers nothing. Named part by part, so an answer refused because something moved is told which part did.
demand	PluginDemandornull	no	What asking for one of a plugin's demand recipes came to, or nothing where none was asked for. Boxed for the reason the install is: it carries a whole recipe, and every other run's report would otherwise be as large as the one run that asks for one.
install	PluginInstallornull	no	What this run's install came to, or nothing where it only read. Boxed for the reason the update is: it carries a whole account, and every other run's report would otherwise be as large as the one run that installs.
installed	array ofPluginInstalled	yes	Every plugin the record holds. What it holds, rather than what it would hold: a rehearsal wrote nothing, so what it settled is in install and not here. A listing that counted it would report an install that did not happen.
nonconforming	array ofPluginNonconforming	no	Every answer an installed plugin's adapter gave outside its contract, kept until a proof it passes clears it: the plugin fills none of those capabilities meanwhile. Filled on the reading of what is installed, as substituted is.
proof	PluginReproofornull	no	What proving a plugin again came to, or nothing where nothing was proved.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
removal	PluginRemovalornull	no	What this run's removal came to, or nothing where it removed nothing. Beside the install rather than in place of it, and never both at once: an install and a removal are two verbs with two accounts, and a field that held whichever happened would make a reader ask which one this was before they could read it.
sources	array ofPluginSource	no	Whether each installed plugin's source can still be fetched, asked now. Filled on the reading of what is installed and nowhere else, for the reason substituted is: it is the one read an operator makes of what each plugin is doing, and the one moment this machine asks anybody where a plugin came from. A run that installs, updates or removes one leaves it empty.
substituted	array ofPluginSubstituted	no	Every capability the operator chose an installed plugin's service to fill. Filled on the reading of what is installed, which is the one read of what each plugin is doing; a run that installs, updates or removes one leaves it empty, because none of them changes a choice.
unvetted	Unvettedornull	no	The operator's overlay and every service it changes, where there is one: merged over the project this run would start, and held to nothing lemonfiber vets.
update	PluginUpdateornull	no	What this run's update came to, or nothing where it updated nothing. A third field rather than an install and a removal filled in together, for the reason those two are apart: an update is one operation with one account. Boxed because it carries a whole install's account beside the reversal, and every other run's report would otherwise be as large as the one run that updates.

PluginNonconforming

One answer a plugin's adapter gave outside a contract it speaks.

Field	Type	Required	What it is
at	string	yes	When it answered so, as RFC 3339.
capability	string	yes	The capability it was asked as.
operation	string	yes	The operation it was asked.
plugin	string	yes	The plugin whose adapter answered.
why	string	yes	What was outside the contract.

PluginOverriding

One bundled thing a plugin declares it will change.

Field	Type	Required	What it is
setting	string	yes	Which bundled setting it changes.
why	string	yes	What changing it is for.

PluginPair

One value a recipe could carry to one destination, as the operator agrees to it.

Field	Type	Required	What it is
approval	string	no	What approving this pair is written as, on the command line and over the web, where it carries the value to a host outside the stack or carries a release. Absent on any other pair to a service in this stack, which takes nothing off the machine or away from the service it came from, and asks for no approval.
from	string	no	The service in this stack the released value was read from, where the pair releases it. Absent on every other pair.
origin	string	yes	Whose value it is, as its input or the step that captures it says; empty where neither does.
release	string	no	Why the value is carried away from the service it was read from, in the manifest's own sentence, where the pair releases it. Absent on every other pair.
to	string	yes	Where it may be carried, by the name the manifest gives it.
value	string	yes	What the value is called within the recipe.

PluginPlaced

One service of an installed plugin, as it was placed.

Field	Type	Required	What it is
asks	array ofPluginAsking	no	Every capability it asks for.
asks_for	stringornull	no	What it asks for there, where it says.
config_path	string	yes	Where inside the container its one configuration directory is mounted. Resolved rather than optional. The record answers where the directory is, and a run that re-derived the fallback would answer for a container it did not write the day that fallback moved.
description	string	no	The line its dashboard entry shows beside it: the one its wiring names, or what the plugin says it does for the operator.
digest	string	yes	The digest that fixes what runs.
fields	ServiceFields	no	Its container fields beyond those above.
fronts	stringornull	no	The service of the same plugin it stands in front of, as an adapter.
health	stringornull	no	The path it answers over HTTP to say it is up, where its health is asked that way.
hidden	boolean	no	Whether its wiring hid it from the dashboard.
icon	stringornull	no	The icon its dashboard entry shows, where its wiring names one.
image	string	yes	The registry path, carrying no pin of its own.
listens	integerornulluint16, ≥ 0, ≤ 65535	no	The port it answers on inside the stack's network, where it declared one.
media_types	array ofstring	no	The media it files, in the stack manifest's vocabulary, which decides what it comes to in each service that asks for what it provides; none in an older record.
name	string	no	What it is called, for a reader, which is what its dashboard entry is listed as; a record written before this was kept lists it by its id.
native	stringornull	no	The API it answers the stack's other services in, where it names one.
networks	array ofstring	no	Networks an older record named for it. Nothing reads them: each service's place on the networks is derived with the project, and a record written now holds none.
provides	array ofstring	no	Every core capability this one service fills, which is what makes it a candidate when the stack asks for one. Per service rather than read off the plugin's whole list, because a wiring reaches a service and not a plugin: of a plugin's two services, the one that fills a capability is the one an ask for it would reach. Defaulted for a record written before this was kept, which reads as filling nothing — a service nothing is wired to, rather than one wired to on a guess.
reached	PluginReachedornull	no	How it is reached, or nothing where it has no listener.
reaches	stringornull	no	Where it reaches outside the machine, where it says.
replaces	stringornull	no	The stack's own service it moves in place of, where it names one.
service	string	yes	The service's id, which is the name its container is written under.
shape	PluginShapeornull	no	The privileged shape lemonfiber writes for it, where it took one.
speaks	array ofstring	no	Each capability contract it answers as an adapter, as capability@major.
starting	stringornull	no	The digest of the starting files kept for its run proofs, where it has any.
tag	string	yes	The readable name that digest went by when it was installed.
takes_data	boolean	yes	Whether the library is mounted for it.
upstream	map ofstring	no	Each field of the upstream.json lemonfiber writes for it as an adapter, to the id of the plugin's secret that field holds.

PluginProving

One proof that has to hold before a plugin is reported installed.

Field	Type	Required	What it is
asks	string	yes	What it asks, as the method and the path it is asked at.
came_to	PluginVerdictornull	no	What asking it came to, or nothing where it was not asked. Absent on a rehearsal, which asks nothing. That is a different fact from a proof that was asked and established nothing, and the two must not read alike: one is an account of what would happen, the other is a service that did not answer.
establishes	string	yes	What it establishes, in one line.
of	stringornull	no	Which of the plugin's services it asks, where the manifest settles that. Nothing where it does not, which is a manifest the reader has already refused — carried as an absence rather than as a guess, so that a report built from a manifest nobody held to the reader says this was not settled instead of naming whichever service came first.
proof	string	yes	The proof's id, which its verdict is reported against.
why	string	yes	Why it is worth asserting.

PluginPuts

What an install puts at one path.

One of these:

• "directory"

  A directory brought into being, which is where one service keeps its own configuration.

• "document"

  The project written again, holding the container lemonfiber derives for the plugin.

• "key"

  The key lemonfiber asks one of the plugin's adapters with, minted as it is written and never shown.

• "region"

  A region written into one of the stack's own files, marked out as the plugin's: its route through the proxy, or its entry on the dashboard.

• "secrets"

  A service's own secrets file, readable by its owner alone, its values never shown.

• "starting"

  A file the plugin ships for one of its services, written where none is yet; one naming a secret is readable by its owner alone and shown with the secret's name.

• "upstream"

  The credentials an adapter reads its upstream's with, readable by its owner alone, their values never shown.

PluginReached

How an installed service is reached, where it is reached at all.

The tier is the arm, so the label a tier earns lives only in the arm entitled to one. Only a household service is proxied — the bundled policy is that an admin surface does not get a name on the household network — and a record able to carry a loopback service with a hostname would be a record able to describe the thing that policy exists to prevent.

The group is on both arms, and that is not an oversight. Only the proxy is the household tier's alone; the bundled dashboard carries an entry for an operator surface too, with the address it links to rendered from the tier — nine of the shipped stack's own entries point at this machine. A record that kept the group for the wider tier alone would leave a loopback service off the panel its bundled neighbours are on.

A tier and never an address, either way: lemonfiber renders one from the other exactly as it does for a bundled service, so the two-tier policy stays a property of the system rather than a request a plugin made.

One of these:

• tier: "loopback"

  From this machine and nowhere else. No route, and no label to route to.

  • group stringornull optional

    The group on the bundled dashboard, where the manifest named one.

  • port integeruint16, ≥ 0, ≤ 65535

    The port the service listens on.

• tier: "household"

  From the household, through the stack's own proxy, at this label.

  • group stringornull optional

    The group on the bundled dashboard, where the manifest named one.

  • hostname string

    The single label in front of the operator's domain.

  • port integeruint16, ≥ 0, ≤ 65535

    The port the service listens on.

PluginRecipe

One recipe, as an operator agrees to what it does.

Field	Type	Required	What it is
id	string	yes	The recipe's id within the plugin.
inputs	array ofPluginRecipeInput	no	Every value it asks the operator for when it runs, in the order it declares them.
on	PluginRecipeOn	no	When it runs: as part of an install and an update, or only when asked for by name.
pairs	array ofPluginPair	yes	Every value it could carry, and where to.
steps	array ofPluginStep	yes	Every call, in the order the recipe makes them.
title	string	yes	What it accomplishes, in one line.
why	string	yes	Why it is worth running.

PluginRecipeInput

One value a recipe asks the operator for when it runs.

Never the value: a reading says what will be asked, and what is given for it is handed to the recipe and said back by nothing.

Field	Type	Required	What it is
ask	string	yes	What the operator is asked for it.
name	string	yes	What the input is called, which is what a value is given for it under.
secret	boolean	yes	Whether the value may be a secret, so a surface takes it without showing it.

PluginRecipeOn

When a recipe runs.

One of these:

• "install"

  During an install and an update, after the plugin's proofs and the stack's checks hold and before the install is recorded. What a recipe that says nothing does, because a first-run flow is what a recipe is for.

• "demand"

  Only when the operator asks for it by name, with approvals of its own.

PluginRecipeRan

What one recipe came to.

Field	Type	Required	What it is
held	boolean	yes	Whether every step it made came to what it should.
recipe	string	yes	The recipe's id.
steps	array ofPluginStepRan	yes	Every step it declares, in order, with what each came to.
why	stringornull	no	Why it did not, where it did not.

PluginRemoval

What taking a plugin off the machine came to, or would come to.

Field	Type	Required	What it is
interrupts	array ofstring	yes	Every service that stops when it goes, named before any of them does. By service rather than by plugin, because a service is what an operator notices stopping: a plugin that brought two containers takes two things away, and the plugin's name alone would not say which of the addresses they use goes quiet. None of them comes back — a removal is not a restart — which is why this is stated before the run rather than discovered after it.
leaves	array ofPluginUnfilled	yes	Every capability that would have nothing filling it afterwards. Stated before it happens rather than reported after, which is the requirement and also the only useful order: an operator told afterwards that their requests no longer reach anything has been informed rather than asked.
plugin	string	yes	The plugin this is about.
removed	boolean	yes	Whether the record of what is installed was written without it. False on a rehearsal and on a run that got as far as putting the files back and no further, which are two different machines and are told apart by what the reversal says rather than by a second flag here.
went_back	UndoReversal	yes	What putting its changes back came to, or would come to. The rollback layer's own report rather than a shape of this verb's: a removal is a reversal with a name on it, and an account of its own would be a second description of the same work.

PluginReproof

What asking an installed plugin's adapters again came to.

Field	Type	Required	What it is
asked	boolean	yes	Whether its adapters were asked, rather than only said to be.
cleared	boolean	yes	Whether every answer kept against the plugin was cleared, which a proof that did not hold never does.
kept	array ofPluginNonconforming	yes	Every answer kept against the plugin when it was proved, which a pass clears.
plugin	string	yes	The plugin proved.
proofs	array ofPluginProving	yes	Each proof asked, or that would be asked, with what it came to.

PluginRequest

What is asked, and where.

Three fields and no more, and the third is the one worth explaining. A service that answers XML unless a caller asks for JSON cannot satisfy a capability whose probe requires a JSON assertion, and until this field there was nowhere to ask: Plex answers text/xml at every path, including the one its health probe uses, unless the request carries Accept: application/json.

It is one media type and not a header map, and the difference is the point. A probe declares who it is asked as, and none on every guarded probe has meant what it says partly because nothing could be presented. A map of headers would make that a convention a reviewer has to hold — any service may name its credential header whatever it likes, so no list of refused names could ever be closed — where one named field keeps it a property of the format. A probe still cannot present anything, because there is nowhere to write it.

Field	Type	Required	What it is
accept	stringornull	no	The one representation the answer is asked for, as a media type. Absent where the service needs no asking, which is most of them.
method	string	yes	The HTTP method.
path	string	yes	The path on the service being asked.

PluginRequestProof

One proof that asks one of the plugin's services a question, kept so the doctor can ask it again without the plugin's source.

Field	Type	Required	What it is
expect	Expect	yes	What the answer must be.
proof	string	yes	The proof's id.
request	PluginRequest	yes	What it asks.
service	string	yes	The service it asks.
title	string	yes	What it establishes, in one line.
why	string	yes	Why it is worth asserting.

PluginRestored

Where an update did not hold: what putting the version it replaced back came to.

Field	Type	Required	What it is
placed	boolean	yes	Whether everything its record says it placed is on the machine again.
running	boolean	yes	Whether its containers are running again. Apart from placed, because the two fail differently: a document that would not land is a disk, and a container that would not start is the engine — and an operator fixes them in different places.
version	string	yes	The version put back, which is the one the record still names.

PluginRun

A run of the image's own program, as a proof declares it.

Field	Type	Required	What it is
args	array ofstring	yes	Each argument handed to the image's entrypoint, one string each: one to 64, each at most 4096 bytes and none holding a NUL.
timeout_s	integerornulluint32, ≥ 0	no	How long the run may take, from 1 to 120 seconds. Default 30.

PluginRunProof

One proof that runs the image's own program, kept so the doctor and a later proof can run it again without the plugin's source.

Field	Type	Required	What it is
expect	Expect	yes	What the run must come to.
proof	string	yes	The proof's id.
run	PluginRun	yes	What the image's own program is handed.
service	string	yes	The service whose image it runs.
title	string	yes	What it establishes, in one line.
why	string	yes	Why it is worth asserting.

PluginSecret

One credential a plugin says it will hold, without a value and with no place for one.

Field	Type	Required	What it is
for	stringornull	no	The capability of the plugin's own that a credential crossing to it is needed to fill.
id	string	yes	What the value is, within the plugin.
minted	boolean	no	Whether lemonfiber made the value at install.
of	string	yes	Whose credential it is.
why	string	yes	What holding it is for.

PluginShape

A privileged shape lemonfiber writes for a service.

One of these:

• "egress-guard"

  NET_ADMIN and the tunnel device.

• "render"

  The host's render devices and the group that owns them.

PluginSource

Whether one installed plugin's source can still be fetched.

Field	Type	Required	What it is
from	string	yes	The source the record says it came from.
plugin	string	yes	The plugin, by its id.
standing	PluginSourceStanding	yes	What asking it came to.

PluginSourceStanding

What asking a plugin's source came to.

Unreachable is not untrusted. A plugin whose source has gone keeps running as it was installed; what it loses is the way to a newer version, and that is said now rather than found out at the next update.

One of these:

• standing: "reachable"

  It answered, so the plugin can be updated from it.

• standing: "unreachable"

  It did not answer, or is no longer there, so the plugin cannot be updated from it.

  • why string

    What asking it said.

• standing: "unasked"

  Nothing was asked, so nothing is known either way.

  • why string

    Why nothing was asked.

PluginStep

One call a recipe makes, in the order it makes them.

Field	Type	Required	What it is
adapter	PluginStepAdapterornull	no	The adapter the destination is reached through, or nothing where it is a name outside the stack, which no adapter of lemonfiber's speaks to.
id	string	yes	The step's id within its recipe.
method	string	yes	The HTTP method it calls with.
path	string	yes	The path it calls.
to	string	yes	Where it calls: a service of this stack's or the plugin's own, or a name outside both, as the manifest wrote it. Never a resolved address.

PluginStepAdapter

The adapter a call reaches its destination through.

Field	Type	Required	What it is
kind	ApiKind	yes	Which of lemonfiber's adapters it is.
owner	PluginAdapterOwner	yes	Whose it is, which is lemonfiber's.

PluginStepRan

What one step came to.

Field	Type	Required	What it is
came	StepCame	yes	What it came to.
landed	boolean	yes	Whether it reached somewhere other than this plugin's own services, which an install going back cannot undo.
status	integerornulluint16, ≥ 0, ≤ 65535	no	The status its last answer carried, where anything answered.
step	string	yes	The step's id.
to	string	yes	Where it calls, by the name the manifest gives it.
tries	integeruint32, ≥ 0	yes	How many times it was made.
why	stringornull	no	Why it came to what it did, where that wants saying.

PluginSubstituted

A capability the operator chose one of a plugin's services to fill.

The only way anything a plugin brought comes to fill what the stack asks for in place of the stack's own: a plugin cannot choose, and wiring by name is not something a plugin can introduce. So what a plugin substituted is what the operator substituted with it, and it is read off the recorded choices rather than off the plugin.

Field	Type	Required	What it is
capability	string	yes	The capability it fills.
plugin	string	yes	The plugin whose service it is.
service	string	yes	The service chosen.

PluginTaking

One service taking a privileged shape, as the reading states it.

Field	Type	Required	What it is
approval	string	yes	What approving it is written as, apart from the offer.
devices	array ofstring	yes	The devices it is given.
grants	array ofstring	yes	The kernel capabilities it is given.
service	string	yes	The service taking it.
shape	PluginShape	yes	The shape it takes.

PluginUnfilled

A capability that would have nothing filling it.

Field	Type	Required	What it is
capability	string	yes	The core name nothing would fill.
filled_by	string	yes	The plugin that is filling it now, which is the one going. Named rather than left to the reader, because the sentence an operator has to act on is this is the only thing filling it and a capability on its own does not say that.

PluginUpdate

What updating a plugin came to, or would come to, as one account.

One account, because it is one operation. An update is the version installed going back and another coming on, and a report that gave those as a removal and an install side by side would invite reading them as two things that might each have happened. What an operator has to be able to read off this is which version the machine is on, and there are exactly two answers: the new one, where install.recorded is true, or the one it replaced, which restored says the state of.

Field	Type	Required	What it is
from	string	yes	The version the record named before this run.
install	PluginInstall	yes	The new version's own account: what it writes, what it has to prove, what it proved and what the stack's checks made of it — the same one an install gives, because it is the same work. recorded is whether the update holds.
interrupts	array ofstring	yes	Every service of the installed version that stops, named before any of them does.
plugin	string	yes	The plugin this is about.
restored	PluginRestoredornull	no	Where the update did not hold, what putting the version it replaced back came to. Absent on a rehearsal and on an update that held.
stopped	stringornull	no	What stopped the new version before its proofs could be asked, where something did: a write that would not land, a container that would not start, or a record that could not be written. A proof or a check that did not hold is in install.
to	string	yes	The version this run installs, or would.
went_back	UndoReversal	yes	What putting the installed version's changes back came to, or would come to. Where the plugin's own configuration directory holds what its service wrote, it is named here as still standing, which on an update is the point: the new version is started against the same directory, and an update that took it would be a reinstall that lost everything the old one knew.

PluginVerdict

What one assertion came to, whatever answered it.

One of these:

• outcome: "passed"

  The recording answers what the binding declares.

• outcome: "failed"

  It does not, in every way it does not.

  • faults array ofstring

    Every way the recorded answer is not the declared one.

• outcome: "unproven"

  It could not be run, and so established nothing either way.

  • why string

    What stopped it being run.

• outcome: "failing-as-declared"

  It fails on the recordings its manifest declares it fails on, on the constraint each declaration names and on nothing else, and holds on every other recording it was run against.

  Apart from passed and from failed, and counted as neither. The assertion does not hold there, so a pass would say the opposite of what the recording shows; and the failure is the one its author described and gave a reason for, so it does not fail the run. Only ever reached against recordings: the live service is held to the expectation as it is written.

  • declared array ofPluginFailingAsDeclared

    Each declared recording, what it held, and why it is one the assertion fails on.

PluginVerification

What the stack's own checks made of an install.

Field	Type	Required	What it is
broke	array ofPluginChangedCheck	yes	Every check this install made worse. Empty is the answer an install needs, and it is the common one. What is here is what takes the install back.
unsettled	array ofPluginChangedCheck	yes	Every check nothing could be concluded about across the two readings. Reported and never acted on. I could not tell is not it is still broken, and an install reversed because a check could not reach a provider it also could not reach an hour ago would be punishing a plugin for the weather. It is said out loud rather than dropped, because the assurance an operator thought they had is the thing that went.

Policy

What happens to what a household member asks for.

Three, and they are the three the request service can actually be put into. A household is in one of them because of two settings taken together — whether requests arrive unseen, and whether a period limits how many — so the words here are a reading of that pair rather than a fourth setting kept beside it.

Choosing per person is not a fourth policy. It is one of these three chosen for one member rather than for the house, which is why what a surface offers is a policy and, separately, who it is for.

One of these:

• "trusted"

  Everything asked for arrives, and nothing is counted against anybody.

• "within-a-limit"

  Everything asked for arrives until the period's limit is spent, and what would go past it is refused at the moment of asking.

• "everything-waits"

  Everything asked for waits for the operator to rule on it.

PresetChoice

One preset in force, and what it means for the media it applies to — the operator's question answered in their own terms, with no scoring vocabulary.

Field	Type	Required	What it is
means	string	yes	What it means, in the operator's terms rather than the tool's.
needs_transcoding_here	boolean	yes	Whether this host would have to transcode it in software — the caution stated before a choice a household cannot smoothly play.
preset	string	yes	The preset's plain-language name.
resolution	string	yes	The resolution and encode it targets.
scope	string	yes	What this applies to: everything, or a specific media type.
size_per_hour	string	yes	Roughly how much disk an hour of it takes.
transcoding	string	yes	What playback costs, in plain terms.

Preview

What a restore would do, shown before anything is overwritten.

Field	Type	Required	What it is
agreement	string	yes	What this listing is, so consent given for it can name which listing it read. Carried on every listing rather than only on the ones that would re-point something: a surface that has to look for it is a surface that can fail to find it, and a restore that would overwrite the same configuration in place is still one somebody may agree to.
downgrade	boolean	yes	Whether the archive is old enough that a compatibility warning applies.
manifest	BackupManifest	yes	The archive's own account of itself — its scope, version and contents.
relocation	Relocationornull	no	The data-root difference, where the archive was taken against another one.

Problem

Something that went wrong, in the form an operator can act on.

Field	Type	Required	What it is
cause	Problemornull	no	The problem that produced this one, where several share a root.
code	Code	yes	The stable identifier for this kind of problem.
detail	stringornull	no	The underlying technical detail, available but never leading.
meaning	string	yes	What it means for the operator.
remedies	array ofRemedy	yes	What to do, most likely first.
severity	ProblemSeverity	yes	How much it matters.
state	ProblemState	yes	Where it stands with respect to being fixed.
steps	array ofProblemStep	no	Every step a run declares, with what each came to, where the problem ended a run of steps part-way; absent from every other problem. Data beside the detail rather than in it, so a client reads what changed somewhere going back cannot reach without parsing a sentence written for a person.
summary	string	yes	What happened, in one plain sentence.

ProblemSeverity

How much a problem matters.

Four levels, deliberately. More would not be applied consistently, and inconsistent severity is worse than coarse severity.

One of these:

• "advisory"

  Informational; nothing is required.

• "warning"

  Degraded or risky, still working.

• "error"

  Something is broken.

• "critical"

  Consequences outside the machine, or data at risk.

ProblemState

Where a problem stands with respect to being fixed.

One of these:

• "actionable"

  A remedy is available here.

• "guided"

  The operator must act, somewhere else.

• "remediable"

  lemonfiber can fix this itself.

• "unknown"

  No known remedy; escalation is offered instead.

• "suppressed"

  Acknowledged, and not re-shown until it recurs.

ProblemStep

What one step of a run that stopped part-way came to.

Field	Type	Required	What it is
came	StepCame	yes	What it came to.
landed	boolean	yes	Whether it reached somewhere other than the plugin's own services, which going back cannot undo.
recipe	string	yes	The recipe the step belongs to.
step	string	yes	The step's id within it.

Propagation

One consumer, and how far the rotation reached it.

Field	Type	Required	What it is
consumer	string	yes	What authenticates with the credential.
reach	CredentialReach	yes	How far the rotation reached it.

Protection

The honest account of what the credential store protects against.

Two lists and a sentence, carried as data rather than printed here, so the API serves the same words the terminal prints and neither can drift into a claim the other does not make.

Field	Type	Required	What it is
against	array ofstring	yes	What it protects against.
not_against	array ofstring	yes	What it does not protect against.
summary	string	yes	What the storage is, before any claim about it.

Protocols

Which download protocols the operator actually has accounts for.

A form names both, because a form describes what it does rather than what this operator has paid for. Narrowing happens afterwards, so a tunnel is never started with credentials that were never supplied.

Field	Type	Required	What it is
torrent	boolean	yes	A VPN and torrent client are configured.
usenet	boolean	yes	A Usenet provider is configured.

ProvenanceReport

Where every service in this stack comes from.

Field	Type	Required	What it is
services	array ofServiceProvenance	yes	The services, in the order the stack declares them. Every service the manifest holds rather than the ones some form would start: what is in this stack is the question being asked, and an answer narrowed to what is running would leave the operator unable to ask about the service they are deciding whether to run.

Pulling

Whether a client is fetching at all, where a cap made it a question.

Apart from the limits above rather than folded in with them, because it answers a different question and a client held to a crawl is not a client that stopped. A word that named both would be the vocabulary this whole path exists to avoid.

One of these:

• "fetching"

  It is fetching, or would start on the next thing handed to it.

• "stopped"

  Nothing is moving and nothing new would start.

QualityOffered

What a quality choice may be made from, each in the plain terms the command takes it in.

Field	Type	Required	What it is
formats	array ofstring	yes	Every format music may take, least to most demanding.
media_types	array ofstring	yes	Every kind of media a choice may be made for apart from everything at once.
presets	array ofstring	yes	Every resolution preset, least to most demanding.

QualityReport

The operator's quality choice, what each preset means, and what the command did with it.

Field	Type	Required	What it is
changes	stringornull	no	What a choice changes, in the stack's words; present where this answers one.
choices	array ofPresetChoice	yes	The global choice first, then each media type set apart from it.
customised	boolean	yes	Whether the quality sync config has been hand-edited since lemonfiber wrote it — the customised state, in which the preset is no longer authoritative until it is deliberately re-asserted. For a reapply, whether an edit was overwritten.
disposition	Disposition	yes	What became of the choice.
music	MusicChoiceornull	no	The audio-format choice for music, where one is set — media that has no resolution, so it is reported apart from the resolution presets rather than forced into their shape.
offered	QualityOffered	yes	What a choice may be made from.
overwritten	StackEditornull	no	The hand-edited config a reapply replaced — or, rehearsed, would replace — with the diff of what goes against what lands in its place. Absent everywhere else, and absent for a reapply over a config already in lemonfiber's own hand. Consent given against a yes-or-no is consent to something the operator was never shown: they know a file they edited is about to go, and not which of their lines is in it. The lines are masked the way every stack-file diff is, so a key that drifted is named without its value.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.

Queue

One curator's queue, and how much of it is stuck.

Field	Type	Required	What it is
depth	integeruint, ≥ 0	yes	How many items are queued.
service	string	yes	The service whose queue this is.
stuck	integeruint, ≥ 0	yes	How many of them are stuck rather than progressing.

Ran

Whether a walk through setup was carried out or rehearsed, written as the bare true or false every other report writes its rehearsed as.

Two words rather than a fourth switch on a report that already holds three, which is a report somebody reads by remembering which true means what. On the wire it is the same boolean every report carries, so a client reads one shape.

It is boolean

Rated

What one age limit comes to, in the certificates named for it.

Both sides, because either alone misleads. What is allowed without what is held back reads as a limit that stops nothing; what is held back without what is allowed reads as a limit that stops everything.

Field	Type	Required	What it is
allows	array ofstring	yes	The certificates at the highest age this limit still lets through. Empty where the table names nothing at or below the limit, which is a limit that lets nothing rated through at all.
fell_back	boolean	yes	Whether these came from lemonfiber's own mapping because the media server's table named no certificates. Carried rather than hidden: a certificate said to be this household's when it is this program's is the kind of claim a parent would act on.
holds_back	array ofstring	yes	The certificates at the lowest age this limit holds back. Empty where the table names nothing above the limit, which is a limit that holds nothing rated back at all.

Reached

Where a month stands against a declared cap.

One of these:

• "within"

  Comfortably inside it.

• "warning"

  Close enough that there is still time to do something.

• "exceeded"

  Reached, and the declared behaviour applies.

Reaches

What one link reaches, and how that was settled.

One of these:

• how: "asked"

  An ask for a capability.

  • capability string

    The capability asked for.

  • native stringornull optional

    The upstream's own API the ask talks in, where it reaches the upstream an adapter fronts rather than the adapter.

  • origins map ofValueOrigin

    Where each service that claims it came from: this build's stack, or a named plugin.

    Every claimant rather than only what the ask reaches, because a contest reaches nothing and is exactly where an operator most needs to know which of the names in front of them is not the stack's.

  • services array ofstring

    What the ask reaches — empty where nothing fills it or a contest stands.

  • settled WiringSettled

    How it was settled.

• how: "by-name"

  A link deliberately kept to a named service, shown as the exception it is.

  • service string

    The service named.

  • why string

    Why it is by name.

Reader

One service reading a setting or a secret.

Field	Type	Required	What it is
default	stringornull	no	What the service's manifest declares while no value is recorded.
service	string	yes	The service.
variable	string	yes	The variable it is read into.

Reason

Why a walkthrough could not go on.

One of these:

• "no-indexers"

  No indexer is configured, so there is nothing to search. Not a failure of the walk — a reason not to offer it at all.

• "indexers-failed"

  The search could not be run: the indexers, or the service holding them, would not answer.

• "nothing-matched"

  The search ran cleanly and matched nothing. An entirely different problem from the one above, and the one operators most often mistake for it.

• "none-met-the-preset"

  Releases exist, but none meets the chosen quality preset. The stack is working; the preset and what is out there disagree.

• "tunnel-down"

  Torrents are in play and the tunnel is not verified up. Nothing is grabbed.

• "not-grabbed"

  The release was never handed to a download client.

• "stalled"

  The download stopped making progress.

• "import-failed"

  The download finished and the library manager would not take it.

• "no-media-server"

  There is no media server in the running form to make it playable.

• "not-visible"

  It was imported, the media server was told, and it still cannot be found there.

Reckoning

Where the disk stands, what is on it, and what could be got back.

Field	Type	Required	What it is
agreement	string	yes	What this offer names itself, so an answer to it can say which offer it was answering. The answer is this name, and nothing else is a yes to a cleanup.
candidates	array ofCandidate	yes	The completed downloads, each with where it stands and what removing it would cost.
consumption	array ofConsumption	yes	Where the room went, one line per tree plus the services' own files, and one line for what is committed but has not landed yet.
halted	boolean	yes	Whether new acquisitions are halted to keep the services writable.
interrupted	array ofInterrupted	yes	The imports that stopped part-way, with what is on disk for each.
level	Level	yes	Where the stack stands, which is where its worst volume stands.
outsized	array ofOutsized	yes	The files far enough out of line with the rest to be worth pointing at.
reclaimable	array ofConsumption	yes	What of that room could be got back, and what each would cost. A second reading of bytes already counted above rather than more of them: a seeding torrent's file is in the tree it lives in and here. Summing the two lists together would double what is on the disk, which is the mistake this whole module is arranged to avoid.
reclaimed	Reclaimedornull	no	What became of an answered cleanup, where the offer was answered.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
volumes	array ofVolume	yes	The volumes watched. Either filling stops the stack, so both are reported whether or not they are the same drive.

Reclaim

What getting a line's room back costs.

One of these:

• "by_losing_content"

  Only by deciding to lose something you chose to keep.

• "in_progress"

  Nothing to reclaim: it is being written right now.

• "at_the_cost_of_ratio"

  Yes, and it costs standing with the trackers it came from.

• "the_easy_win"

  Yes, and it costs nothing — the usual easy win.

• "already_have_it"

  Yes: the unpacked copy is the one being used.

• "marginally"

  A little, and rarely worth it.

• "you_said_not"

  No, because you said so.

Reclaimed

What became of an answered cleanup.

Field	Type	Required	What it is
bytes	integeruint64, ≥ 0	yes	What they occupied.
gone	array ofstring	yes	The paths that were taken, or would have been in a rehearsal.
left	array ofSpaceLeft	yes	What could not be taken, and what the platform said about it.
rehearsed	boolean	yes	Whether this was a rehearsal. Rehearsed, gone and bytes are what would have been taken and nothing was: no room was freed.

RecordedWith

What a recording gives a service in the operator's place: a constant reaching no third party, or, written "minted", a value made for that run alone.

It is stringorintegerint64orboolean

RecordReport

One record carried across, or that would be.

Field	Type	Required	What it is
kind	string	yes	What kind of record it is, in the plural a person reads.
name	string	yes	What it is called.
service	string	yes	The service it belongs to.

Refusal

A named front door that is not one, and why it is not.

Field	Type	Required	What it is
because	string	yes	Why this stack will not send a household there.
named	string	yes	What the operator recorded, as they wrote it.

Refused

What was said when one request was turned down.

Field	Type	Required	What it is
at	stringornull	no	When it was turned down, so somebody reading it later knows which answer this was rather than assuming it is the newest. Absent where the machine's clock could not be written as a date, which is a refusal worth keeping the words of and not worth losing them over.
expired	boolean	no	Whether nobody ruled on it and the period the household agreed to closed it, rather than an operator turning it down. The words are then this program's own, which is why the two are told apart here and not left to be read off the sentence: an operator scanning for what happened while they were away is looking for exactly the ones nobody answered, and a member is owed the difference between having been refused and having run out. Absent from every record written before a household could arrange this, which is the right reading of them — they are all somebody's own refusals.
reason	string	yes	Why, in the words it was turned down in.
told	Passedornull	no	Whether the words have been carried to whoever asked, and where to. Absent until the one attempt has been made. This is what makes a second one impossible rather than unlikely: carrying happens only where this is absent, and it is written whether anything was reached or not — so a member with nowhere to send to is asked about once, and a household is never told the same thing twice by a run that happened to be started twice.

RegisteredDeviceKey

A device key registered.

Field	Type	Required	What it is
app	string	yes	The app that made it, as LEMONFIBER_DEVICE_KEY_APPS spells an identity.
backing	DeviceKeyBacking	yes	Where it lives, as its attestation says.
fingerprint	string	yes	The SHA-256 of its public half's SubjectPublicKeyInfo, in lower-case hex.
name	string	yes	The name it was registered under.
registered	string	yes	When it was registered.

Release

One release, and everything the record holds about it.

Field	Type	Required	What it is
carried	stringornull	no	The version whose goals this tag carried, where that is not its own.
delivers	stringornull	no	What it set out to deliver, in the words the version was staged under.
groups	array ofGroup	yes	The changes, gathered by what kind of change each is.
patches	stringornull	no	The version this one patched, where it is a patch.
released_on	stringornull	no	The day it was published, where the record of it says.
tag	string	yes	The tag it was cut from.
user_facing	boolean	yes	Whether anything in it is a change an operator would notice.
version	string	yes	The version, without the tag's leading letter.
withdrawn	stringornull	no	Why it was withdrawn, where it was.

ReleaseSummary

One release as a listing shows it: everything but what it changed.

Kept apart from [Release] rather than being it with the entries left out, because the two are read for different things. A listing answers which releases there have been and which of them was taken back; only the one being read needs to carry every line of what it changed.

Field	Type	Required	What it is
delivers	stringornull	no	What it set out to deliver.
patches	stringornull	no	The version this one patched, where it is a patch.
released_on	stringornull	no	The day it was published, where the record of it says.
user_facing	boolean	yes	Whether anything in it is a change an operator would notice.
version	string	yes	The version.
withdrawn	stringornull	no	Why it was withdrawn, where it was.

Relocation

A restore whose archive was taken against a different data root than the one configured now, so its stored paths would land where nothing exists.

Field	Type	Required	What it is
now	string	yes	The data root configured now.
was	string	yes	The data root the archive was taken against.

Remedy

One thing the operator can do about a problem.

Field	Type	Required	What it is
action	string	yes	The action, phrased as something to do rather than something to know.
detail	stringornull	no	Where to look, when that helps.

RemovedService

A service this stack used to carry, and what became of it.

Field	Type	Required	What it is
id	string	yes	The id it was declared under, which is the name an operator will look for.
reason	string	yes	Why it went.
removed_in	string	yes	The stack version whose catalogue stopped carrying it.
replaced_by	stringornull	no	What took its place, where anything did. Absent is an answer and the commonest one: most things that go are not replaced, and a record that named the nearest surviving service to avoid an empty field would be pointing an operator at something that does not do the job they are looking for.

Repair

One repair lemonfiber could carry out.

Field	Type	Required	What it is
check	string	yes	The check whose finding this answers, as the finding names it.
does	string	yes	What it would do, in the words the operator will read before confirming.
effects	array ofstring	yes	What else changes if it does. Stated before it is confirmed and never afterwards, because an effect an operator learns about after the fact is not something they agreed to. Empty where a repair touches nothing but the thing it names.
reversible	boolean	yes	Whether carrying it out is recorded well enough to be undone. A repair that cannot be reversed is still worth offering — restarting a container is not undoable and is usually right — but the operator confirming one deserves to know which kind they are agreeing to.

RepairOutcome

How a repair turned out, once the check that raised the finding has been asked again.

Deliberately not a boolean. "It ran" and "it worked" are different claims, and a model that cannot tell them apart will eventually report the first as the second.

One of these:

• outcome: "fixed"

  It ran, and the check now passes.

• outcome: "fix_failed"

  It ran, and the check still fails.

• outcome: "stopped"

  It stopped partway, leaving this.

  Named precisely rather than as "failed": a half-applied change is a different state to be in from an unchanged one, and the operator has to know which they are looking at before they try anything else.

  • leaving string

    What the machine is now in, said plainly.

• outcome: "declined"

  Not carried out, because the operator said no.

• outcome: "would_overwrite"

  Refused, because it would have written over something changed by hand.

• outcome: "unmanaged"

  Not carried out, because the operator declared the area it would write unmanaged.

  Apart from [Self::WouldOverwrite], which is lemonfiber declining to write over a change it can see. This is lemonfiber obeying an instruction it was given, and telling somebody the first when they wrote the second would send them looking for a change they did not make.

RepairReport

What a repairing run offered, and what it did.

Field	Type	Required	What it is
acted	boolean	yes	Whether this run was allowed to act at all.
agreement	string	yes	What this offer is, so consent given for it can name which offer it read. Carried on every report rather than only on the ones that offer something: a surface that has to look for it is a surface that can fail to find it, and an offer of nothing is still an offer somebody may agree to nothing of.
beyond	array ofBeyond	yes	What has been tried too often to keep offering. Said rather than passed over. A repair that quietly stopped being offered leaves the operator watching a fault nobody mentions any more, which is worse than being told plainly that this is past what lemonfiber can work out.
mended	array ofMended	yes	What was carried out, in the order it was.
offered	array ofRepair	yes	What could be put right, whether or not it was.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.

ReplaceReport

What standing in place of a setup already here came to, or would come to.

Field	Type	Required	What it is
agreement	string	yes	What this offer names itself: the project and every service it would stop. The answer to it is this name, and nothing else is a yes to a replacement. Empty where there is nothing to stand in place of, because there is nothing to agree to.
project	stringornull	no	The project that would be stood in place of.
refusal	stringornull	no	Why nothing was stopped, where nothing was.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
stance	Stance	yes	Where the act stands.
still_running	array ofstring	yes	The services that would not stop and are still up.
stopped	array ofstring	yes	The services that were stopped.
would_stop	array ofstring	yes	The services that would be stopped, by name.

RequestState

Where one request stands, in the words the person who made it would use.

Deliberately coarser than a [crate::trace::Stage]: a member does not need to know that a release was grabbed but not imported, only that it is on its way. The trace is where that detail stays, and a request names the item so it can be asked for.

One of these:

• "waiting-for-approval"

  Asked for, and nobody has approved or refused it yet.

• "declined"

  Turned down — it will not be fetched.

• "failed"

  Approved, but the attempt to fetch it failed.

• "getting"

  Approved and on its way — being searched for, downloaded or imported.

• "partly-here"

  Some of it is here: a series with only some of its episodes.

• "here"

  Here, and playable.

• "gone"

  It was here and has since been removed.

Requirement

One requirement, and every release that shipped something citing it.

Field	Type	Required	What it is
feature	string	yes	The feature it belongs to, in words.
shipped_in	array ofstring	yes	Every version that shipped something citing it, newest first.
url	stringornull	no	Where it is defined, unless it has since been withdrawn.
withdrawn	boolean	no	Whether it was withdrawn after it shipped.

ResetReport

What a full reset did, or — until it is confirmed — would do: the operator edits it reverts back to lemonfiber's own state, and whether it was carried out or only shown.

Field	Type	Required	What it is
confirmed	boolean	yes	Whether the reset was carried out, or only previewed pending confirmation.
offer	string	yes	The name of this reading, which the reset takes as its yes.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
reverted	array ofStackEdit	yes	The operator's edits that were reverted — or, unconfirmed, that a reset would revert — each with the diff of what is lost against what lemonfiber restores.
reverted_connections	array ofstring	yes	The service connections whose drifted value was reverted to lemonfiber's — or, unconfirmed, would be — each named as it reads in a seed report.

Resolved

What a limit comes to once it is weighed against a measured line.

One of these:

• is: "unlimited"

  Nothing holds it back.

• is: "at"

  This many bytes a second.

  • bytes_per_second integeruint64, ≥ 0
• is: "unmeasured"

  A proportion was asked for and nothing has measured the line.

  Deliberately not folded into [Self::Unlimited]. "Half of an unknown number" resolving to "no limit at all" is the shape of a setting an operator believes is in force while the stack takes the whole line.

RespiteStanding

Where a respite stands against the clock.

One of these:

• standing: "none"

  None was asked for.

• standing: "in-force"

  In force, with this long left.

  • seconds integeruint64, ≥ 0
• standing: "expired"

  It ran out, this long ago. Said once, then cleared.

  • seconds integeruint64, ≥ 0

Restoration

What a restore said: what it would overwrite, and whether it did.

The listing is present either way, and that is the point of the shape. It is not a separate request a surface may or may not make — it is the half of a restore that happens before anything is overwritten, so every answer carries it and an answer that overwrote nothing is one whose done is absent.

Field	Type	Required	What it is
done	RestoreReportornull	no	What was put back, or nothing where nothing was.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
would	Preview	yes	What the archive holds and what restoring it would come to, read before anything was touched.

RestoreReport

What a restore did.

Field	Type	Required	What it is
from_version	string	yes	The lemonfiber version the archive was written by.
relocated	Relocationornull	no	The data root that was re-pointed, where the restore accepted one.
scope	Scope	yes	What was restored.

Restraint

Where the line stands.

One of these:

• "unlimited"

  Nothing is configured.

• "limited"

  Limits are in force, with no schedule to switch them.

• "scheduled-active"

  Inside the household's active hours, so the limits apply.

• "scheduled-quiet"

  Outside them, so the line is the stack's.

• "overridden"

  A temporary override is lifting the limits, and will expire.

• "cap-warning"

  The month is close enough to a declared cap to say so.

• "cap-exceeded"

  The cap has been reached and the declared behaviour applies.

Restriction

What one member is held to, in the words a household would use.

The two restrictions are one decision and two services: the media server decides what may be watched and the request service what may be asked for. Setting one without the other is the hole this vocabulary exists to name — a child who cannot watch something but can pull it into the library has parents who set a limit and got half of one.

One of these:

• "unrestricted"

  Nothing is held back from them.

• "rating-limited"

  Held to a highest rating.

• "library-limited"

  Held to some of the libraries.

• "both"

  Held to both a rating and some of the libraries.

• "inconsistent"

  What they may watch is limited and what they may ask for is not.

Revealed

One stored value, handed back because the operator asked for it and said so.

Separate from [Held] rather than a field on it, so that the inventory cannot carry a value by accident: a surface that renders the inventory has nothing to render, whatever it does.

Field	Type	Required	What it is
name	string	yes	Which credential this is.
value	stringornull	no	The value, present only where the ask was confirmed.
warning	string	yes	What the operator is told before it appears, whether or not it appears.

Review

A proposed change, read against what is in force, and where it stands.

Field	Type	Required	What it is
change	ConfigChange	yes	The difference, as it would be applied.
findings	Findings	no	What the change comes to on this machine, beyond the value it changes. Filled by whoever went and asked — the services where they file, the clients what they are fetching — and empty on every change that comes to nothing beyond its value. Carried on a staged proposal as well as an applied one: a review that withheld this until after the yes would be asking for a yes to something unstated.
proof	Validationornull	no	What proving the replacement credential came to, where one was proven. A replacement is proven against its live service before the credential it replaces is discarded, so this is present for exactly those settings and absent everywhere else.
refusal	stringornull	no	Why nothing was written, where nothing was and the reason is not simply that somebody has yet to say yes.
stance	Stance	yes	Where the proposal stands.

Revoked

How far a removal got, across the two services a household member exists on.

The media server is removed first and the request service second, because the request service authenticates through the media server — so once the first is gone they can do nothing either way, and a failure at the second leaves an account that cannot sign in rather than somebody who can still watch.

One of these:

• "everywhere"

  Both, which is what removal means.

• "media-server-only"

  The media server only, and the request service still holds an account.

  They can neither watch nor ask — the account left behind signs in through the one that is gone — but something is there that should not be, and the next run of this command takes it.

• "nothing"

  Nothing was removed, because nothing was confirmed.

Rhythm

The hours the household is awake, declared once for every download client.

Field	Type	Required	What it is
from	string	yes	When the household's day starts.
to	string	yes	When it ends, which may be the next morning.

Role

Which of the two volumes a reading is about.

One of these:

• "data"

  Where the media and the downloads live.

• "services"

  Where the services keep their own configuration and databases.

Root

A directory everything lemonfiber keeps sits under.

Field	Type	Required	What it is
at	string	yes	The directory itself.
what	string	yes	What lives under it, and what losing it would cost.

Rotation

What one rotation came to.

Field	Type	Required	What it is
consumers	array ofPropagation	yes	Every consumer, and how far the rotation reached it.
credential	string	yes	Which credential was to be replaced.
settled	Settled	yes	What became of the replacement.

Scope

How much of the stack a backup covers.

Whole-stack is the common case, but restoring one service is often what is actually wanted — one curator's configuration mangled while the rest is fine — so the scope is recorded in the archive and honoured on the way back.

One of these:

• scope: "whole_stack"

  Every service's configuration, plus lemonfiber's own and the stack.

• scope: "service"

  One named service's configuration alone.

  • name string

    The service whose configuration this covers.

• scope: "existing"

  An existing setup's own configuration, at the host paths it keeps it in.

  The one scope whose sources are not lemonfiber's layout. A capture taken before a takeover has to cover the tree that is already there — lemonfiber's own holds nothing worth protecting until the takeover has happened — so the host path each tree was read from is recorded here, in the manifest, rather than inferred from a layout that does not describe it.

  Recording those paths is also what makes putting one back an ordinary extraction the operator performs deliberately, rather than something lemonfiber does on their behalf into a tree it does not manage.

  • project string

    The Compose project the capture was taken from.

  • trees array ofTree

    The host trees captured, in the order the survey reported them.

Searchable

What a search that could tell this trace's stall apart would spend, and what it covers.

Field	Type	Required	What it is
covers	string	yes	What the search covers: the curator's wanted list at the quality in force.
spends	string	yes	What the search spends, in the stack's words.

Season

One season of a series, with its episodes.

Field	Type	Required	What it is
episodes	array ofEpisode	yes	Its episodes, in order, each with where it is served.
id	string	yes	What the server tells it apart by.
name	string	yes	What it is called.
number	integerornulluint32, ≥ 0	no	Its number in the series, where it has one. Specials often have none.

SeasonCoverage

How much of one season is actually here, and what is outstanding — the season-level answer, which for a series is the one an operator can act on.

Field	Type	Required	What it is
have	integeruint, ≥ 0	yes	How many of the wanted parts are here.
outstanding	array ofPart	yes	The wanted parts that are not here yet, each carrying the stage it rests at, so one that stalled is told apart from one still downloading.
season	integeruint32, ≥ 0	yes	The season number. Season zero is where a service files specials.
unmonitored	integeruint, ≥ 0	yes	How many parts nobody asked for — unmonitored and not on disk.
wanted	integeruint, ≥ 0	yes	How many parts were asked for, or are already here — the denominator. Parts nobody asked for are counted separately rather than inflating this, so a season with every wanted episode present reads as complete even where specials are not.

Secret

A key's secret, as it is handed over once.

It has no Debug that prints it and no way back from its digest, and nothing here writes it anywhere: the one reply that carries it is the only place it appears.

It is string

SecretFrom

Where a secret's value came from.

One of these:

• "operator"

  The operator entered it.

• "recipe"

  A recipe captured it.

• "granted"

  It is another service's credential, granted to cross.

• "minted"

  lemonfiber made it at install.

SecretRead

One secret, without its value.

Field	Type	Required	What it is
from	SecretFromornull	no	Where its value came from, where one is held or granted.
held	boolean	yes	Whether a value is held.
name	string	yes	Its name.
readers	array ofReader	yes	Each service that reads it.
whose	Owner	yes	Whose it is.

SeedingStanding

Where one completed download stands.

One of these:

• standing: "never_imported"

  Nothing ever linked it into a library: it was never imported, and removing it loses nothing.

• standing: "seeding"

  It was imported and is still seeding, so removing it has a consequence outside this machine.

  • ratio integeruint32, ≥ 0

    What it has uploaded against what it downloaded, in hundredths, as the client reports it.

    A whole number rather than a fraction because every report this product makes is compared for equality somewhere, and a fraction cannot be — two figures a client would call the same would not be. The hundredth is finer than any decision made on a ratio.

• standing: "left_alone"

  The operator asked for this one to be left alone.

SeedReport

What a seed pass amounted to.

Field	Type	Required	What it is
assessment	Assessment	yes	Whether drift could be assessed, or the expected-state record was lost.
rehearsed	boolean	yes	Whether this pass only said what it would do. A flag rather than a second shape, because every connection above means the same thing either way: what the service holds is what it holds, and what lemonfiber would write is what it would write. What changes is that two of the states are reachable only here, and that the last line of the report is an instruction to run it for real rather than to run it again.
wirings	array ofWiring	yes	Every connection attempted, and how each turned out.

SeedSeverity

How serious a reported connection is.

Drift is normal and usually the operator's own harmless edit, so it is reported as information rather than a failure. It escalates to a warning only when the drift breaks the stack — a root folder pointing where nothing exists, a download client that no longer answers — and a warning that cannot be acted on is noise, so a warning always names both what broke and what to do about it.

One of these:

• severity: "informational"

  Nothing is broken: the connection is settled, or its drift is the operator's own edit that still works.

• severity: "warning"

  The connection breaks the stack. Both the breakage and a remediation are named, because a warning the operator cannot act on is noise.

  • breakage string

    What is broken, in the operator's terms.

  • remediation string

    What to do about it.

SeedState

How one connection turned out after a seed pass.

One of these:

• state: "wired"

  Written and read back.

• state: "already-wired"

  Present and correct; nothing was done.

• state: "drifted"

  Present but operator-changed; preserved.

• state: "stale"

  Present and still lemonfiber's own value, but behind lemonfiber's intent — it should be brought up to date. Reported until an update path applies it, and never overwritten in the meantime.

• state: "conflicted"

  Both the service's value and lemonfiber's intent moved away from the baseline. The conflict is presented — the value the operator set beside the one lemonfiber would write — and the value left as it is; lemonfiber does not resolve it on its own.

  Both values are shown in the report and serialized with it, so a secret-bearing field must not report a conflict through this variant: a conflict in a secret is to be reported without either value on show, and wants a masked shape of its own rather than this one.

  • ours string

    The value lemonfiber would write in its place.

  • yours stringornull optional

    The value the service now holds, as the operator set it; None where they cleared it.

• state: "adopted"

  An operator's edit adopted as the accepted state, kept across seeds and restores. Settled: lemonfiber leaves it as it is.

• state: "unmanaged"

  A value the service already held that lemonfiber never wrote — the operator's own, pre-existing. Adopted as the baseline this run rather than reported as drift, so an existing setup is taken on instead of flagged wholesale. Its value is not shown, so a secret among the adopted is never put on display.

• state: "would-wire"

  Not there, or not at what lemonfiber would have it be, and this run only said so.

  The one outcome a pass that writes nothing can reach where a pass that writes would have written. What a real run would leave the service holding sits beside what it holds now, because a report saying a connection would be made without saying what it would be made to is a count rather than an account — and a count is what an operator asking for a rehearsal already has.

  Both values are serialized, so a secret-bearing field must not report through this variant carrying one. It does not have to: ours is absent exactly where a real run would generate the value rather than read it, which is the only place a credential arises — the media server's admin account. A value minted to describe a rehearsal is a secret that exists because somebody asked a question, and it would then have to be kept or thrown away.

  yours is absent where the service holds nothing, and where this run could not ask without writing — reading the household's telling means signing in as the owner, and a session is state on somebody else's service.

  • ours stringornull optional

    What a real run would leave it holding, or None where that value would be generated rather than read.

  • yours stringornull optional

    What the service holds now, or None where it holds nothing or could not be asked.

• state: "would-adopt"

  An operator's own value a real run would take on as the accepted state, and this one did not.

  Apart from [Self::WouldWire] because it is the other direction: nothing would be written to the service at all, and what would move is lemonfiber's record of what it expects. Its value is not shown, exactly as [Self::Unmanaged] does not show one, so a secret among the adopted is never put on display by a question.

• state: "observed"

  An area the operator declared unmanaged. Nothing was read from the service and nothing was written to it, and the reason they gave is carried so a report says whose decision it was.

  Apart from [Self::Unmanaged], which lemonfiber infers from a value it has no record of having written, and which it adopts as the baseline so that later runs recognise it. This one is a decision somebody wrote down, and it holds whether or not lemonfiber would have had anything to say — nothing is adopted, because adopting would be the first half of managing it again.

  • reason string

    Why the operator said to leave it alone, in their own words.

• state: "unmatched"

  Something on this machine fills what a service asks for, and nothing lemonfiber does connects the two — the filler names no API of its own, or one lemonfiber pairs with nothing the asker speaks.

  Settled, because no run changes it: the stack, or what is installed, has to. Said rather than left out, because a filler nothing reaches and a filler lemonfiber forgot would otherwise read the same, and the operator who installed one to stand in for another is the one who needs to know which.

  • reason string

    What fills it, what asked, and why nothing connects them.

• state: "skipped"

  Prerequisite unavailable; a later run will complete it.

  • reason string

    Why it could not be attempted.

• state: "failed"

  Attempted and rejected, carrying the service's own words.

  • detail string

    What the service said.

• state: "refused"

  Refused by lemonfiber's own policy, carrying the reason a re-run will not resolve — such as two curators pointed at one root folder. Nothing it names was written, whether it was refused before the write or the write itself found nothing to land in.

  • reason string

    Why it was refused, in lemonfiber's own words.

SelfUpdateStanding

Where a copy of lemonfiber stands, in the words the specification uses.

Nothing known is the default, and it is the right one: a report built before anything has been read has not established that this copy is current, and a default that said so would be a claim made by an empty value.

One of these:

• "current"

  The version running is the newest known.

• "update-available"

  A newer version exists, and replacing this copy is lemonfiber's own to do.

• "managed-externally"

  A newer version exists and a package manager owns this copy, so the update is that tool's to make.

• "check-failed"

  Availability could not be determined, which is not a fault and stops nothing.

Service

One service, as it stands.

Field	Type	Required	What it is
criticality	Criticality	yes	How much its absence costs, so a summary can weigh it.
depends_on	array ofstring	yes	The services it needs before it can work: the one whose network it runs inside. Carried so a failure can be attributed to the thing underneath it rather than counted as one more independent thing wrong.
describes	string	yes	What it does for the operator, in the stack's own words. Carried on the service rather than looked up where it is shown, because this is the one struct every surface reads: a listing, the machine-readable reply, the web API and the terminal's panel all render this, and a description fetched separately by each of them would be four chances to render three. The stack's words rather than lemonfiber's, for the reason its absence cost is: a stack that adds a service should not need a lemonfiber release before it can say what that service is for.
exit	integerornullint32	no	How it exited, where it has exited.
forms	array ofstring	yes	Every form it is running for, in the order the stack declares them. All of them rather than one, because a service two forms share is there for both, and stopping one of them leaves it running for the other. Empty where no form it belongs to is up: a service nobody's form holds is not missing from one.
id	string	yes	The service's identifier, which is also its Compose service name.
name	string	yes	What it is called in front of an operator.
profile	string	yes	The profile that declared it.
state	ServiceState	yes	What it is doing.

ServiceConstant

A value written exactly as declared.

It is stringorintegerint64orboolean

ServiceFields

The container fields an install record keeps for a service, beyond those every record already holds.

Field	Type	Required	What it is
config_ro	boolean	no	Whether its configuration directory is read-only.
env	map ofServiceValue	no	Its environment.
mem_limit_mib	integerornulluint32, ≥ 0	no	Its memory ceiling.
mount	array ofServiceMount	no	Its further mounts.
network	ServiceNetworkornull	no	The network it runs inside.
posture	ServicePosture	no	How tightly it is held.
publish	array ofServicePublish	no	Its further published ports.
tmpfs	array ofstring	no	Its scratch paths in memory.
user_mode	ServiceUserModeornull	no	Who it runs as, where declared.

ServiceMount

A further path mounted from the service's own mount tree.

Field	Type	Required	What it is
from	string	yes	The relative path inside the mount tree.
ro	boolean	no	Whether it is mounted read-only.
to	string	yes	The absolute path inside the container.

ServiceNetwork

The network a service runs inside instead of its own.

Field	Type	Required	What it is
via	string	yes	The capability whose filler's network it runs inside.

ServicePosture

How tightly the container is held.

One of these:

• "standard"

  Six kernel capabilities, no privilege gained, a bounded process count.

• "confined"

  A read-only root and no kernel capability at all, besides.

ServiceProvenance

Where one service comes from, as the stack declares it.

Field	Type	Required	What it is
digest	stringornull	no	The digest of the image that runs, where the stack names one. Beside the tag rather than instead of it: the tag is the version somebody reads, and the digest is the one image that version was when it was pinned, which is what is pulled and what somebody verifies against the registry.
id	string	yes	The service's id, which is also its Compose service name.
image	string	yes	The image it runs, without a tag.
license	string	yes	The SPDX identifier of the licence it is published under. Stated rather than summarised as open source, because the identifier is what somebody checks against the project — and because the four in this stack are not interchangeable to anybody deciding what to do with what they run.
name	string	yes	What it is called in front of an operator.
pinned	string	yes	The exact tag this stack pins it at. Kept apart from the image rather than written as one reference, so that a caller comparing what is pinned against what a project has released is comparing versions rather than parsing them out of a string. The two are printed together for a person, because a version without the image it belongs to names nothing that can be fetched.
upstream	string	yes	The project it is built from. The whole point of the entry for anybody verifying: the licence is a string this stack wrote down, and this is where somebody goes to find out whether the project still agrees with it.

ServicePublish

A further port a service publishes on its tier.

Field	Type	Required	What it is
listens	integerornulluint16, ≥ 0, ≤ 65535	no	Where it answers inside the container, port where absent.
port	integeruint16, ≥ 0, ≤ 65535	yes	Where it is published on the host.

ServiceSecretOf

A secret the manifest declares.

Field	Type	Required	What it is
secret	string	yes	The declared secret's name.

ServiceSetting

An operator setting, with what is written while none is recorded.

Field	Type	Required	What it is
default	ServiceConstant	yes	What is written while the operator has recorded no value.
recorded_with	RecordedWithornull	no	What a recording gives the service in the operator's place, where only the operator holds the value and the service needs one to start.
setting	string	yes	The setting's name.

ServiceState

What one service is actually doing.

Ordered from worst to best, so a form's condition is the minimum across its services and needs no comparison table. The declaration order is therefore load-bearing.

One of these:

• "failed"

  Exited without being asked to, and is not coming back on its own.

• "crash-looping"

  Exiting and restarting repeatedly.

• "unhealthy"

  Running, and its own probe says it is not working.

• "absent"

  No container exists.

• "stopped"

  A container exists and is not running.

• "starting"

  Running, and still inside its probe's start period.

• "running"

  Running, and declaring no probe by which to know more.

  Distinct from healthy on purpose. A service that cannot be asked is not a service that answered, and rendering the two identically is how a dashboard comes to be believed about something it never checked.

• "healthy"

  Running and passing its own probe.

• "host-managed"

  The operating system owns this one, not lemonfiber.

ServiceUrlOf

The address of a capability's filler.

Field	Type	Required	What it is
files	stringornull	no	The medium the filler asked for files.
native	stringornull	no	The upstream's own API, where the ask reaches the upstream an adapter fronts.
url_of	string	yes	The capability asked for.

ServiceUserMode

Who the container runs as.

One of these:

• "image"

  No user: the image decides.

• "puid-env"

  PUID and PGID set to the operator's.

• "uid"

  The operator's uid and gid as the container's user.

ServiceValue

One environment variable's value.

It is ServiceConstantorServiceSettingorServiceUrlOforServiceSecretOf

SettingChange

A change to one setting.

Field	Type	Required	What it is
agreement	string	yes	What this reading names itself, part by part.
applied	boolean	yes	Whether it was written.
consequence	stringornull	no	What the change costs, where it costs anything.
regenerates	array ofstring	yes	Every service whose entry the change regenerates.
restarts	array ofstring	yes	Every running service the change restarts.
setting	string	yes	The setting.
unrestarted	stringornull	no	Why the services it restarts were not restarted, where they were not.
value	stringornull	no	What it is to hold, or nothing where it is cleared.
was	stringornull	no	What it holds now.

SettingRead

One setting.

Field	Type	Required	What it is
environment	stringornull	no	The environment file's key it is held under, where it is held there.
name	string	yes	Its name.
readers	array ofReader	yes	Each service that reads it.
value	stringornull	no	The operator's value, where one is recorded.
whose	Owner	yes	Whose it is.

SettingReport

One setting, as it is safe to show.

Field	Type	Required	What it is
key	string	yes	The setting's name.
origin	ValueOrigin	yes	Where the value came from, beside the value rather than behind a second request — reading a setting and reading what put it there are one act.
secret	boolean	yes	Whether the value was withheld.
value	string	yes	Its value, or a note that it is set and withheld.

SettingsReport

Every setting and secret the stack's services read, and what changing a setting came to.

Field	Type	Required	What it is
change	SettingChangeornull	no	The change asked for, where one was.
rehearsed	boolean	yes	Whether this was a rehearsal.
secrets	array ofSecretRead	yes	Every secret a service's environment names, in name order, never with its value.
settings	array ofSettingRead	yes	Every setting, in name order.
unvetted	Unvettedornull	no	The operator's overlay and every service it changes, where there is one: merged over the project this run would start, and held to nothing lemonfiber vets.

Settled

What became of a rotation.

One of these:

• settled: "replaced"

  The replacement was proven and is now the value in force.

  • observed string

    What the service did while proving it — an observation, never the value.

• settled: "refused"

  The service answered and refused the replacement. Nothing was changed.

  • detail string

    What the service said, with any credential in it withheld.

• settled: "unproven"

  Nothing usable answered, so the replacement could not be proven. Nothing was changed, because an unproven replacement is not a better one.

  • detail string

    Why nothing could be concluded.

• settled: "replaced-unproven"

  The service replaced the credential itself, and the replacement did not answer.

  The one way of not landing that keeps nothing: a service asked to replace its own key drops the old one the moment it makes the new one, so there is no order that proves first. What is owed is the command that hands the new one out once the service answers.

  • detail string

    What did not answer, and what to run once it does.

• settled: "rehearsed"

  Nothing was attempted, because this run only said what a rotation would do.

  Its own outcome rather than one of the refusals above, because it is not a refusal: nothing went wrong, and what an operator is being told is what would happen if they ran it again meaning it. Carrying its own three fields rather than one sentence, because "it would rotate the administrator's password" is not a report — where the value lives is what would be written over, and what is owed afterwards is the half nobody finds out about until a consumer stops working.

  No value appears here and none is generated to put here. A replacement minted to describe a rotation is a secret that exists because somebody asked a question, and it would then have to be kept or thrown away — and one thrown away may be one the service has already taken.

  • afterwards array ofstring

    What would still need doing before every consumer held the replacement.

  • detail string

    What a real run would do, step by step, in lemonfiber's own words.

  • location string

    Where the value that would be replaced is kept.

• settled: "unknown"

  Nothing in this stack holds a credential by that name.

  • known array ofstring

    The names that would have been accepted.

• settled: "elsewhere"

  A replacement for this one does not come from here.

  Either the operator's provider issued it, in which case inventing one would produce a credential no service has ever heard of; or the service that holds it offers no way to change it in place. Either way what is owed is a sentence saying where a replacement does come from, not an attempt.

  • detail string

    Where a replacement comes from, and what to do once it exists.

SetupOutcome

How a setup run ended.

One of these:

• "applied"

  The reviewed answers were written.

• "abandoned"

  The plan was seen and not applied; nothing was written.

• "already-set-up"

  Nothing was asked, because this machine was already set up.

SetupReport

What a setup run came to, and what it settled on.

Deliberately not the settings themselves. Setup writes an indexer key and a service password among them, and a report a script can read is a report a script can log — into a file, a CI transcript, somebody's terminal history. So this says what was decided and never what was entered, and the fields are chosen one at a time rather than by serialising a struct that might later gain a secret.

The indexer's address is left out for that reason rather than because it is itself a secret: it is entered beside its key, and the two travel together in every place an operator copies them from.

Field	Type	Required	What it is
data_root	stringornull	no	Where the library was put, where a location was chosen.
outcome	SetupOutcome	yes	How the run ended.
protocols	Protocols	yes	Which ways of downloading the stack was set up for.
service_user	stringornull	no	The user the services run as, as uid:gid, where one was set.

Shape

Which walkthrough this stack is offered.

One of these:

• "pipeline"

  The full walk: search, grab, download, import, and see it in the library.

• "library-only"

  The walk for a stack that acquires nothing: point at media already on disk and confirm the media server can see it.

Sharing

How the line is shared, and what that costs.

Field	Type	Required	What it is
acting	stringornull	no	What a spent cap is doing to the figures above, where one is spent.
applied	boolean	yes	Whether this run wrote the limits to the clients or only read them.
cap	Capornull	no	The monthly cap, where one was declared.
capacity	Capacityornull	no	What the line was measured to carry.
cautions	array ofstring	yes	What is worth knowing about that reading before trusting it.
clients	array ofHolding	yes	What each download client was asked and what it is doing about it.
down	BandwidthReading	yes	The download limit.
means	string	yes	What that means for the household.
metered	Meteredornull	no	What the stack itself moved this month.
ratio	stringornull	no	What throttling the upload costs, where an upload limit is in force.
reached	Reachedornull	no	Where the month stands against it.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
respite	RespiteStanding	yes	The override, where one is running or has just run out.
respite_says	stringornull	no	What the override amounts to, in words.
restraint	Restraint	yes	Where the line stands.
rhythm	Rhythmornull	no	The household's hours, where any were declared.
untouched	array ofstring	yes	What is outside every limit here.
up	BandwidthReading	yes	The upload limit, which is declared apart and defaults lower.
zone	stringornull	no	The zone the clients read those hours in, where the stack says.

Snapshot

Everything the dashboard shows at one moment.

Each source's panel is filled or marked unavailable on its own, so one dead source degrades one region rather than the screen. The surface builds this from what it gathered; the standing is read from the same facts so it cannot disagree with the panels.

Field	Type	Required	What it is
alerts	array ofAlert	yes	What the operator has been told, newest first: what is owed them where a channel is refusing, then what has already been said.
door	PanelFrontDoorReport	yes	The one address to hand somebody who lives here. On the screen rather than only behind a question, because the operator who needs it is not the one who thought to ask: they have just been asked "what do I open?" by somebody in the next room. Built from the same reading as the panels beside it, so the screen and front-door cannot name different doors.
downloaders	PanelArray_of_Downloader	yes	Every download client the stack runs, and whether each is paused.
health	HealthSummary	yes	The one-line health summary — the same computation every other surface uses, so no two of them can grade the same stack differently. Always present, unlike the panels: a stack that could not be reached has a summary, and it says unknown. An absent summary would leave the operator to infer health from a blank space, which is the one reading this must never be open to.
household	PanelHouseholdReport	yes	What the household has asked for that is not moving. On the screen rather than only behind a question, for the reason the door beside it is: a request waiting on a decision or failed after one is waiting on the operator, and an operator who has to think to ask is one who finds out when somebody comes to complain.
queue	PanelArray_of_Queue	yes	The per-service queues.
services	PanelArray_of_Service	yes	Every service and what it is doing.
storage	PanelStorage	yes	The storage picture.
stuck	array ofStuck	yes	What in the pipeline has stopped, worst first — assessed across the download clients and the curators together, because the failure that matters most is invisible inside either.
telemetry	Telemetry	yes	Whether the screen itself can be trusted to be current.
transfers	PanelArray_of_Transfer	yes	The active transfers.
vpn	PanelVpnornull	no	The VPN, or None where no VPN is configured and the panel is omitted rather than shown permanently red.

Sort

What sort of thing one line of a manifest is.

One of these:

• "container"

  A container the engine is holding.

• "network"

  A network the containers were on.

• "image"

  An image that was pulled.

• "path"

  A directory or file on this machine.

Source

Where a figure for the line came from.

One of these:

• "declared"

  The operator gave it, presumably off the plan they pay for.

• "observed"

  The fastest the stack has been seen to move, which is what it achieved rather than what the line is sold as.

SpaceCategory

What one line of the accounting is about.

One of these:

• of: "tree"

  One directory beneath the data root, named as the operator named it.

  Per directory rather than one figure for the library, because several libraries commonly share a volume and "the library is large" tells nobody which of them is growing.

  • name string
• of: "landing"

  What the download clients still have to write.

• of: "seeding"

  Completed downloads the client is still seeding.

• of: "orphaned"

  Downloads on disk that no service ever took.

• of: "extracted"

  Archives whose extracted contents sit beside them.

• of: "services"

  The services' own configuration and databases.

• of: "unmanaged"

  What the operator said to leave alone.

SpaceLeft

Something a cleanup could not take.

Field	Type	Required	What it is
at	string	yes	Where it is.
why	string	yes	What the platform said, verbatim.

StackEdit

A stack file the operator edited, preserved rather than overwritten, with the change an upgrade would make shown against it.

Field	Type	Required	What it is
diff	string	yes	The lines that differ between the operator's file and what lemonfiber would write — theirs marked -, lemonfiber's +, the matching head and tail left out. Empty where the two differ only in ways lines does not see.
path	string	yes	The file's path within the stack directory.

StackMoveTaken

A move in place this run took, or tried to take and could not.

Field	Type	Required	What it is
plugin	string	yes	The plugin the bundle installs.
service	string	yes	The stack's own service it took, or would have taken, the place of.
taken	boolean	yes	Whether the plugin now runs in the service's place.
why	stringornull	no	Why it was not taken, where it was not.

StackProtocol

A download provider a profile can depend on.

Serialisable as well as readable, for the same reason [Criticality] is: it reaches an operator. A profile left out of a closure is only half reported without the provider it wanted.

One of these:

• "usenet"

  Needs a Usenet provider.

• "torrent"

  Needs a VPN and a torrent client.

StackUpdateReport

What updating the stack would change, or what a run of it came to.

Field	Type	Required	What it is
applied	array ofUpdateApplied	yes	What became of each service the run reached, in the order it reached them.
backup	stringornull	no	Where the backup taken before anything moved was written.
changelog	Notes	yes	What the release that brought these pins changed. The stack this would move to is the one this build carries, and the release that carried this build is what says why it moved. An operator weighing a stack update is weighing that, and being shown only which image numbers go up is being shown the arithmetic rather than the reason.
changes	array ofUpdateChange	yes	What would move, and what taking each step means.
confirmed	boolean	yes	Whether the steps were agreed to, or only shown.
halted	stringornull	no	Why the stack is not as the run found it, where it is not. Two runs end that way and an operator has the same thing to do about either: one that met a service which would not come back and stopped there, and one where every step succeeded and the stack would not start again afterwards. The second is not a failure of the update — state still says Updated, because it is — but the stack came down for the capture and something has to say that it is still down.
in_flight	array ofstring	yes	What the download clients are still working on, named so an operator can tell whether the thing they have been waiting for is among them.
moved	array ofStackMoveTaken	no	Each move in place this run took, or tried to take and could not, with why.
moves	array ofMoveOffered	no	Each part this release installs as a plugin that the stack still runs as its own service after this run: a move in place on offer, which a confirmed update takes.
offer	string	yes	The offer this answers: every step, from the release each service stands on to the one it would move to, named so that an update carrying it back takes those steps or is refused.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
stack_edits	array ofStackEdit	yes	Stack files the operator had edited, left as they set them rather than overwritten with this build's own, each with the change that was held back.
state	UpdateState	yes	The one word the run comes to.
unvetted	Unvettedornull	no	The operator's overlay and every service it changes, where there is one: merged over the project this run would start, and held to nothing lemonfiber vets.

Stage

A stage in an item's journey, ordered from "nobody asked for it" to "playable". The declaration order is the pipeline order, so one stage compares less than a later one.

One of these:

• "not-monitored"

  Nobody has asked for it — no *arr is monitoring it.

• "monitored"

  Monitored, waiting to be searched for.

• "searching"

  A search is running.

• "found"

  Releases were found by an indexer.

• "grabbed"

  A release was sent to the download client.

• "downloading"

  The download is in progress.

• "downloaded"

  The download finished.

• "importing"

  The *arr is importing it to the library.

• "imported"

  It was imported to the library on disk.

• "available"

  It is visible and playable in the media server.

Stall

Why an item is not moving.

Ordered by how much of the operator's attention each deserves, worst first, so a summary that leads with the worst category needs no second ranking.

One of these:

• "redownload-loop"

  Fetched over and over: import is failing silently and being retried, which spends bandwidth and Usenet allowance indefinitely while looking normal.

• "repeated-import-failure"

  The same item has failed to import more than once. Structural — it will not resolve itself.

• "completed-not-imported"

  Downloaded successfully and never imported. The failure nobody owns: the client considers it finished, the curator never picked it up, and from each service's own perspective there is nothing wrong.

• "orphaned"

  On disk, and no curator knows about it.

• "stalled-download"

  No progress at all beyond the threshold.

• "waiting-indefinitely"

  Monitored, never grabbed — nothing matched, or the indexers are answering with nothing.

• "slow"

  Moving, but slowly enough to be worth knowing about. Deliberately its own category rather than a stall: something still arriving needs patience, not intervention, and reporting the two alike is how a queue check gets muted.

Stance

Where a proposed change stands once it has been read against what is in force.

One of these:

• "unchanged"

  The setting already holds what was asked for. Nothing to apply, nothing to confirm, and the file is not touched — a write of the same value would move the file's own timestamp and read afterwards as an edit somebody made.

• "pending"

  Staged and not applied: nothing has been written. Either it is consequential and nobody has said yes to it yet, or it was rehearsed.

  The default, because nothing having happened yet is what every act starts as, and a report built and not filled in should say that rather than claim it acted.

• "blocked"

  Turned away. It cannot be applied safely, the file is exactly as it was, and the refusal says why.

• "applied"

  Written.

StandingReport

One Compose project on this machine that is not lemonfiber's.

Field	Type	Required	What it is
project	string	yes	The Compose project name.
services	array ofOccupantReport	yes	Its containers, by service name.

Stands

Where a title a member's search found stands in the house.

One of these:

• "here"

  All of it is here.

• "partly-here"

  Some of it is here, and the rest may be asked for.

• "on-its-way"

  Somebody asked for it and it is coming.

• "askable"

  It may be asked for.

Started

Work that outlives the request that started it: its name, and what it was.

The action is carried beside the name because a client holding several has to tell them apart, and asking it to remember which name it gave which request is asking it to keep a second copy of what this already knows.

Field	Type	Required	What it is
action	string	yes	The action that was asked for, as it was named.
job	string	yes	The name to ask what became of this work by.

StatusReport

What each service is doing, and what that adds up to.

Field	Type	Required	What it is
active_forms	array ofstring	yes	The forms the running services are up for, in the order the stack declares them. Read from the whole stack whichever forms were asked about. A form counts while every service it holds has been started and none has been stopped, and one wholly inside a broader form that counts is left out. Each service names the ones it is running for.
condition	Condition	yes	What the services amount to, as one word. For the whole stack, counted over what the active forms hold and whatever else is there, so a stack running part of itself on purpose reads as active. With no form up, and for the forms asked about, counted over every service listed.
disturbs	Disturbances	yes	How long each way of acting on these services takes them away for. Here so that a surface can say it before it asks the operator to confirm, which is the only moment saying it is any use.
filtered	array ofFiltered	yes	What those forms left out for want of a configured provider, service by service. Beside the services rather than among them: a service filtered out is the configuration being honoured, not a service that did not start.
forms	array ofstring	yes	The forms asked about; empty means the whole stack was.
services	array ofService	yes	Each service, worst first. A service the active forms filtered out is listed only while it is there; one that is not is in filtered and nowhere else.
undeclared	array ofUndeclared	yes	The containers running under this project that the stack never declared. Kept apart from the services rather than mixed in with them, because what is known about each is different: a service has a profile, a criticality and a description, and one of these has a name and a state and nothing else. Shown all the same — something running under this project's name that lemonfiber did not put there is the operator's business whether or not lemonfiber understands it.

StepCame

What one step of a recipe came to.

One of these:

• "answered"

  It was answered with what it should be, and took what it captures.

• "skipped"

  Its guard did not hold, so it was not made.

• "not-reached"

  An earlier step did not come to what it should, so this one was not made.

• "unreachable"

  Nothing answered it.

• "refused"

  It was not sent: its host stands for an address not out on the internet, or could not be resolved.

• "withheld"

  It was not sent: a value it carries may not go where it was going.

• "unexpected"

  It was answered with something other than what it expects.

• "uncaptured"

  Its answer held nothing where a capture reads.

• "oversized"

  Its answer was larger than any answer a recipe reads.

Stopped

A walkthrough that stopped: where, why, what the services were saying, and what to do.

Field	Type	Required	What it is
logs	array ofstring	yes	What the services involved were saying at the time, shown inline rather than left for the operator to go and find — a fault report they have to research is a fault report they abandon.
reason	Reason	yes	Why.
remedy	string	yes	The one thing to try.
step	WalkthroughStep	yes	The step it stopped at.

Storage

The storage picture: what is free, when it runs out, and whether imports link.

Field	Type	Required	What it is
config_free	DashboardReading	yes	Bytes free on the volume the services keep their configuration and databases on, which fills apart from the data volume where the two are different disks and stops every service when it does. A [Reading] for the same reason.
exhaustion	Durationornull	no	The time until the disk fills at the current rate of the queue draining onto it, or None where it is not projected to fill.
free	DashboardReading	yes	Bytes free on the data volume — a [Reading], since a volume that could not be read this refresh must not render as zero free.
hardlink	Hardlink	yes	Whether imports are linking or copying.

Stored

Everything lemonfiber keeps on this machine, and what became of it.

Field	Type	Required	What it is
beside	array ofStoredBeside	yes	What is on this machine that is not lemonfiber's to keep or remove.
kept	array ofKept	yes	Each thing kept, configuration first and then what can be made again.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
removal	StoredRemoval	yes	Whether this run removed any of it.
roots	array ofRoot	yes	The two directories all of it lives under.

StoredBeside

Something on this machine that lemonfiber neither keeps nor removes.

Field	Type	Required	What it is
what	string	yes	What it is.
why	string	yes	Whose it is, and why it is not lemonfiber's to take away.

StoredLeft

Something a removal could not take away.

Field	Type	Required	What it is
at	string	yes	The path that is still there.
why	string	yes	What the machine said about it, so it can be finished by hand.

StoredRemoval

Whether anything was removed on this run, and what became of it.

One of these:

• state: "not-asked"

  Nobody asked. This is a listing.

• state: "unconfirmed"

  Asked for without the agreement it takes, so nothing was touched.

• state: "done"

  Carried out.

  • gone array ofstring

    The directories that are gone.

  • left array ofStoredLeft

    What could not be removed, each with the reason.

Straining

Why playback here is likely to struggle, whatever app the household installs.

Present only where the preset in force asks for transcoding this platform cannot do in hardware. It belongs to the guidance rather than to any one device: the preset and the platform decide it between them, and every device in the table meets it.

Field	Type	Required	What it is
caution	string	yes	What that preset asks of this machine, and what playback does where this machine cannot give it.
instead	string	yes	What makes it stop.
preset	string	yes	The preset in force, under the name it was chosen by.

Stream

Which stream a log line arrived on.

One of these:

• "stdout"

  Standard output.

• "stderr"

  Standard error.

Stuck

One thing that is wrong, and why.

Field	Type	Required	What it is
blocking	stringornull	no	What the service said was blocking it, in its own words, where it said anything. A permission denial from an import log is worth more than any interpretation of it, and it is the difference between "stuck" and something an operator can fix.
held_for	integeruint64, ≥ 0	yes	How long it has been that way, in seconds — what turns "stuck" into a sentence an operator can weigh.
items	integeruint, ≥ 0	yes	How many items this stands for. One in the ordinary case; more where they share a cause and the cause is what is wrong — twenty downloads stopped by a full disk are one thing to fix, and twenty alerts about it are how an operator learns to mute the queue check.
name	string	yes	Which item — or, where several share one cause, that cause.
stall	Stall	yes	What is wrong with it.

StuckEntry

One stuck item queue health found, named so it links straight to its own trace.

Field	Type	Required	What it is
service	string	yes	The curator whose queue is holding it.
stage	Stage	yes	The stage its download is stuck at.
title	string	yes	The item's title — the term a trace searches by.

StuckReport

The items whose downloads are stuck, across the curators — the landing point for "N items stuck" that queue health reports, each entry naming the item so the operator goes straight to its per-item trace rather than to a count to investigate.

Field	Type	Required	What it is
incomplete	boolean	yes	Whether a curator's queue could not be read, so the list may be short — reported rather than read as "nothing stuck", the same honesty a trace keeps.
items	array ofStuckEntry	yes	The stuck items, each linkable to its trace.

Substitution

One service standing in for another, worked out before anything is written.

Field	Type	Required	What it is
asked_by	array ofstring	yes	Every service that asks for it, so the reach of the change is visible.
capability	string	yes	The capability whose filler changes.
leaves_unfilled	array ofUnfilled	yes	What this would leave with nothing filling it, each naming what asked. The one thing an operator cannot find out afterwards. A service filling two capabilities is replaced for one of them, and the other stops being filled — which is a working stack becoming a broken one, on a change that reads as swapping like for like.
now	string	yes	What would fill it.
setting	string	yes	The setting the change writes.
was	stringornull	no	What fills it now, where anything does.
why	stringornull	no	What the operator said about the choice, where they said anything. Read back as the choice's own why wherever the choice is read, and absent where nothing was said: nothing supplies a reason on the operator's behalf.

SubstitutionReport

What substituting one service for another would come to.

Field	Type	Required	What it is
agreement	string	yes	What this reading names itself, so a choice answering it can say which reading it answered. Named part by part — the choice itself, what fills the capability now, what asks for it, and what the change would leave unfilled — so a choice refused because the wiring moved is told which of those moved.
applied	boolean	yes	Whether it was written, or only worked out. A run that only says what it would do writes nothing and reports the same answer, so the two are told apart here rather than by the caller remembering which flags it passed.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
substitution	Substitution	yes	The change itself, and what it would leave with nothing filling it.
unvetted	Unvettedornull	no	The operator's overlay and every service it changes, where there is one: merged over the project this choice would write, and held to nothing lemonfiber vets.

SupervisionReport

What a watch saw, once the data root it was guarding was lost.

Field	Type	Required	What it is
forms	array ofstring	yes	The forms that were being watched, and are now stopped.
reason	string	yes	Why the watch ended: the data root vanished, or a different volume took its place — or, on a run that only said what a watch would do, that nothing was watched at all.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
stopped	boolean	yes	Whether stopping the services succeeded.
would	Vigilornull	no	The watch this run would have kept, where it only said what it would do. A guard is the one command with no ending of its own, so a rehearsal of it cannot be the command with its last step left out — it would hold until the drive was pulled. What it answers with is this instead, and the fields above then describe a watch that never began: nothing ended, and nothing was stopped. Absent on every watch that actually ran.

Support

How well a device is served.

One of these:

• "good"

  An official app that works. Most people, most of the time.

• "workable"

  It works, with something worth knowing before starting.

• "poor"

  Poorly served. Said plainly, with somewhere else to go.

• "fallback"

  No installation, works anywhere, and is never unavailable.

Switched

What narrowing the active set moved.

Three lists rather than a before and an after, because the operator's question is not "what is running now" — they can ask that — but "what did that do". The middle list is the one that makes the verb worth having: it is the promise that a download in flight was not interrupted to change the shape of the stack around it.

Field	Type	Required	What it is
kept	array ofstring	yes	Left running: the new closure holds them too, so nothing here asked them to stop. Not a promise that nothing touched them — Compose recreates a container whose configuration changed — but a promise that narrowing did not.
started	array ofstring	yes	Started, because the new closure holds them and they were not up.
stop_command	array ofstringornull	no	The exact Compose invocation that stopped what fell outside, so a switch is no more a matter of trust than any other action. Absent where nothing had to stop.
stopped	array ofstring	yes	Stopped, because the new closure does not hold them.

Taken

What a reader needs to know before reading a word of the bundle.

An operator pasting last week's bundle into this week's thread is the commonest way one of those threads goes wrong, and nothing in the contents tells either of them.

Field	Type	Required	What it is
at	string	yes	When, as a service writes a moment.
lemonfiber	string	yes	The lemonfiber that wrote it.
stack	string	yes	The stack it was written from.

TakesAway

How long one way of acting on the stack takes something away for.

Two cases rather than a length and a flag, because no bound is not a long bound and a surface offered a number plus a "really, though?" beside it will show the number. A reader that handles both arms has said both things; one that handles only the first does not compile.

One of these:

• bound: "bounded"

  It ends, and this is the longest the run is held to.

  • seconds integeruint64, ≥ 0

    The length, in seconds.

    Seconds rather than the engine's own duration shape, because every caller of this turns it into a sentence and none of them wants nanoseconds to do it.

• bound: "open-ended"

  Nothing bounds it, and this is what it is waiting for.

  • until Awaiting

    What has to happen before it ends.

Tally

What a set of files occupies, counted both ways.

Field	Type	Required	What it is
files	integeruint, ≥ 0	yes	How many names were counted.
logical	integeruint64, ≥ 0	yes	The bytes the names add up to — what this would take with nothing shared.
physical	integeruint64, ≥ 0	yes	The bytes the underlying files add up to — what the volume has actually lost to them.
shared	integeruint, ≥ 0	yes	How many of those names pointed at a file already counted.

Telemetry

How the screen itself is doing, which is a different question from how the stack is doing.

The stack's own verdict is [crate::health::Standing]; this is only whether the picture can be trusted to be current. Kept apart because they disagree in both directions: a healthy stack can be shown through half-failing telemetry, and a perfectly refreshing screen can be reporting a stack that is on fire.

One of these:

• "live"

  Telemetry is current and refreshing normally.

• "degraded"

  Some sources are unavailable; their panels are marked.

• "disconnected"

  The engine cannot be reached, though the CLI path may still work.

• "no-stack"

  Configured, but nothing is running.

• "unconfigured"

  No configuration; setup is offered instead.

Term

A word this product uses, and what somebody meeting it needs to know.

Field	Type	Required	What it is
also_called	array ofstring	yes	What other services in this stack call the same thing. A curator and a Usenet client do not agree on words, and an operator moving between their screens should not have to work out that two of them are one.
deep	stringornull	no	More, for somebody who asks — never needed in order to act.
forms	array ofstring	yes	The other forms this product itself writes the word in, where a state or a stage is named by one — grabbed for grab, seeding for seed. Apart from [Self::also_called], which is another service's word and one this product must never write as its own. These are this product's own words, and a surface explaining a word it was sent looks for the word it was sent here, so that nothing on the far side has to guess which term an inflection belongs to.
short	string	yes	One sentence: what it is for and what it costs or gains. Enough to act on. Somebody who reads only this should not be stuck.
word	string	yes	The word as it appears in the interface.

Terms

How a bundle was made: what was bounded, what was replaced, and what its operator asked to have shown as it is.

Carried in the bundle rather than known only to the command that wrote it, because the person who reads one is usually not the person who chose any of this.

Field	Type	Required	What it is
filenames	Filenames	yes	Whether media filenames were shown.
revealed	array ofstring	yes	The settings the operator asked to have shown as they are.
window	string	yes	How much of the logs was taken, said as it would be said aloud.

Tier

Which of the four removals was asked for.

One of these:

• "stop"

  Nothing removed. The services are stopped and everything stays where it is.

• "services"

  The containers, the networks between them, and the images that were pulled.

• "configuration"

  Each service's own configuration, lemonfiber's own state, and the credentials in both.

• "media"

  The library and the downloads.

Title

What one title is, as a member's own account reads it.

What a person deciding whether to watch it wants, and nothing about how it is stored: no file, no container, no bitrate.

Field	Type	Required	What it is
backdrop	stringornull	no	Where its backdrop is served, where it has one.
certificate	stringornull	no	The certificate it carries where the operator lives, where it carries one.
door	Pinnedornull	no	The certificate the door presents, which a client pins, beside any location.
genres	array ofstring	yes	The genres the server files it under.
id	string	yes	The identifier the server tells it apart by, which is what asking to play one of them names.
medium	Medium	yes	Which of the kinds this product deals in it is.
minutes	integerornulluint32, ≥ 0	no	How long it runs, in whole minutes, where the server knows.
overview	stringornull	no	What it is about, where the server holds a description.
poster	stringornull	no	Where its poster is served, where it has one.
released	stringornull	no	When it came out, as a calendar date, where the server knows.
seasons	array ofSeason	yes	A series' seasons, each with its episodes, in order. Empty for anything else.
stream_from	stringornull	no	Where it streams from, where it plays.
title	string	yes	What it is called, in the words the server holds it under.
unlocated	stringornull	no	Why no location is stated, where none is.
year	integerornulluint16, ≥ 0, ≤ 65535	no	The year it came out, where the server knows one. Absent rather than guessed: two films share a title far more often than they share a title and a year.

TitleKind

Whether a title is a series or a film, as a member's search and ask name it.

The web surface's own name for [Kind], whose name an SDK already gives to the kinds of envelope: the same two words on the wire, under a name nothing else takes.

One of these:

• "tv"

  A series.

• "movies"

  A film.

TitleReport

One title, as the member it was asked for may see it.

Field	Type	Required	What it is
id	string	yes	The identifier the media server files them under.
member	string	yes	The member this was asked for, by the name they are known by.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done.
title	Titleornull	no	The title, with where it and each of its episodes is served.

TraceConfidence

How sure the correlation behind a trace is — a release renamed between services can only be matched fuzzily, and a guess presented as fact is worse than a marked one.

One of these:

• "certain"

  Joined on identifiers the services agree on.

• "uncertain"

  Joined by fuzzy matching; the trace may not be the item asked for.

TraceMoment

One moment in a traced item's history: what happened and when. Where [TraceStage] is the linear progress, this is the log a curator kept — the grabs, the failed downloads, the import and any later removal — so a repeated attempt is seen as the pattern it is rather than flattened to a single furthest stage.

Field	Type	Required	What it is
at	string	yes	When the service reported it.
outcome	TraceOutcome	yes	What happened.

TraceOutcome

A notable thing that happened to an item, as an *arr's history records it. Where the furthest stage answers "how far did it get?", the sequence of outcomes answers "what has been tried?" — a release grabbed more than once, a download that failed and was tried again, a file imported and later removed. Repeated failed grabs are a pattern worth seeing, not something a single furthest-stage reading can show.

One of these:

• "grabbed"

  A release was sent to the download client.

• "download-failed"

  The download client failed the release it was handed.

• "imported"

  The item was imported to the library on disk.

• "removed"

  The item's file was removed.

TraceReport

Where one item is in the pipeline: how far it got, why it stopped if it did, and the stages it passed through — the answer to "where is my show?".

Field	Type	Required	What it is
confidence	TraceConfidence	yes	How sure the trace is of the item it followed.
coverage	Coverageornull	no	How much of the item is actually here, season by season — present for an item made of parts, absent for a film, which is the whole item and has none. The furthest stage alone cannot answer this: a series is "imported" the moment one episode lands, which reads as done while the rest are missing.
findings	array ofstring	yes	Disagreements between the services about this item, each in plain language — a media server holding what no service is monitoring, and the like. Orthogonal to the linear pipeline: not where the item got to, but where two services' views of it contradict, surfaced rather than silently reconciled.
furthest	Stage	yes	The furthest stage the item reached.
history	array ofTraceMoment	yes	The notable events in its history, oldest first — the grabs, failed downloads, imports and removals. Repeated attempts show here as the pattern they are, which the single furthest stage cannot.
item	string	yes	The term the item was searched for by.
matched	boolean	yes	Whether a monitored item matched the term at all — a false here is itself the answer: nobody asked for it.
searchable	Searchableornull	no	What a search would spend to tell nothing at the quality from nothing at all, where the trace stopped at monitored with that open and a search would spend something.
stages	array ofTraceStage	yes	The stages it passed through, in order.
stall	stringornull	no	Why it stopped, where it plainly has — or absent where it is progressing or done.

TraceStage

One stage a traced item reached, named as the operator would read it: the stage, the service that recorded it, and when.

Field	Type	Required	What it is
at	stringornull	no	When it happened, as the service reported it — absent for a stage inferred rather than timed, such as being monitored.
service	string	yes	The service that recorded it.
stage	Stage	yes	The stage reached.

Transfer

One active download, as the dashboard shows it.

Field	Type	Required	What it is
eta	Durationornull	no	The time left, or None where it is stalled and there is none to give.
name	string	yes	What is being downloaded.
progress	integeruint8, ≥ 0, ≤ 255	yes	How far along, as a percentage from zero to a hundred.
protocol	DashboardProtocol	yes	How it is being downloaded.
speed	DashboardReading	yes	The current speed in bytes per second — a [Reading], because a genuine zero (stalled) and a source that has gone quiet mean opposite things here, and this is the very figure that difference is about.

Tree

One host tree captured from a setup lemonfiber does not manage.

Both halves are needed to find it again: the archive path says where it sits inside the archive, and the host path says where it was read from. Nothing derives the second from the first, because a tree outside lemonfiber's layout has no layout to derive it from.

Field	Type	Required	What it is
archive_path	string	yes	Where it sits inside the archive.
host_path	string	yes	Where it was read from, on the machine whose setup was taken over.

Triggered

What became of asking one service to re-search its existing content.

One of these:

• state: "started"

  The re-search was accepted and now runs in the service's background.

• state: "not-started"

  The service had not finished starting — no key yet — so nothing was asked of it; running the upgrade again once it is up will reach it.

• state: "failed"

  The service refused the command or could not be reached.

  • detail string

    The service's own account of why.

Trouble

Something somebody reports, and what is likely behind it.

Keyed by the symptom rather than the cause: the person asking has the symptom, and which cause it is is the thing they cannot yet say.

Field	Type	Required	What it is
causes	array ofCause	yes	What is likely behind it, most likely first.
symptom	string	yes	What somebody says is happening, in their words.

Undeclared

A container running under this project that the stack description never declared.

Its own type rather than a [Service] with the fields left blank. A service carries a profile and a criticality, and there is no honest value for either here: filling them in would have lemonfiber asserting how much something matters when the only thing it knows about it is that it exists.

Field	Type	Required	What it is
describes	string	yes	What it does for the operator — which is exactly what is not known.
id	string	yes	The Compose service name the engine reports it under.
state	ServiceState	yes	What it is doing, read the same way a declared service's state is.

Undo

A single reversal, for the surface to carry out.

Field	Type	Required	What it is
action	Action	yes	What reversing it does.
target	string	yes	The service or file to reverse it against.

UndoLeft

One change a reversal did not put back, and why it did not.

Field	Type	Required	What it is
because	string	yes	Why it is still standing, in the operator's terms.
target	string	yes	What the change was against — a service, or lemonfiber's own environment file.

UndoNoted

What putting one change back means beyond the change itself.

Field	Type	Required	What it is
because	string	yes	What goes back, what does not go with it, and what to do instead.
target	string	yes	What the change was against.

UndoReversal

What putting a run back came to.

A report rather than a bare list, because it is what an envelope carries and an envelope carries a document. Two lists, and the second is the one that matters when it is not empty: what went back, and what did not with the reason it did not.

Field	Type	Required	What it is
left	array ofUndoLeft	yes	What was not put back, each with the reason it was not. A reversal an operator asked for by name has to say what it did not do. Five changes asked back and three carried out is a machine in a state nobody has been told about, and "some of it worked" is the sentence that makes somebody go looking by hand. Empty where everything went back, which is the common case. On a run that only said what it would do, this is what it cannot promise: a change that goes back through the service that made it goes back only where that service is answering, and a rehearsal has not asked one.
noted	array ofUndoNoted	no	What putting these changes back means beyond the changes themselves. Empty on almost every run. What lands here is a change the judgement can put back in full and that still leaves something behind — the one in force today being a setting that re-points where data lives, which goes back while the library stays exactly where it was moved to. Neither list above can carry it. It did not fail to go back, so it is not what was left; and reporting only that it went back would send an operator looking for their files at an address that no longer names them.
rehearsed	boolean	yes	Whether this run only said what it would put back. A flag rather than a second shape, because the two lists mean the same thing either way and a caller reading them should read one document. What changes is the tense a surface says them in.
reversed	array ofUndo	yes	What was put back, in the order it was — or, on a run that only said what it would do, what would go back.

Unfilled

A capability something asks for and nothing fills, and what asked for it.

The pair rather than the name: a capability nothing fills is a fact about the stack, and a capability *seerr asks for* and nothing fills is a thing somebody can act on. Reporting the first and leaving the second to be worked out is the obscure failure at the point of use this exists instead of.

Field	Type	Required	What it is
by	string	yes	The service that asked.
capability	string	yes	What it asked for.
native	stringornull	no	The upstream's own API it asked in, where no upstream filling it declares that API.

Uninstall

A removal, before or after it happened.

Field	Type	Required	What it is
manifest	UninstallManifest	yes	What removing would come to, or what it came to.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
removal	UninstallRemoval	yes	Whether anything was removed on this run.

UninstallConfidence

How much of a manifest was read and how much stood in for what could not be.

Field	Type	Required	What it is
complete	boolean	yes	Whether every source this tier needed answered.
unread	array ofstring	yes	What could not be read, each in the words of whatever refused. The point of the field: a manifest that is short says so and says why, rather than reading as a machine with less on it than it has.

UninstallLeft

Something a removal could not take.

Field	Type	Required	What it is
by_hand	string	yes	How to finish it by hand.
name	string	yes	What is still there.
why	string	yes	What the machine said about it, verbatim.

UninstallManifest

What removing would come to, shown before anything is removed.

Field	Type	Required	What it is
agreement	string	yes	What this reading names itself, so an answer says which reading it answered.
backup	stringornull	no	Whether a backup was offered before configuration is destroyed, and how.
bytes	integeruint64, ≥ 0	yes	What the lines that are going occupy, where that is knowable.
coming	array ofComing	yes	What is still coming down, which stopping would interrupt.
confidence	UninstallConfidence	yes	How much of this was read, and what could not be.
foreign	array ofForeign	yes	What is beneath the data location that the stack did not put there. Not a warning. While this is non-empty the data location is never removed as one tree, and only the stack's own directories beneath it are offered.
items	array ofItem	yes	Every line it reaches, each said to be going or said to be kept.
keeps	string	yes	What it leaves alone, in the operator's words.
outside	array ofOutside	yes	What lemonfiber cannot remove, each with how to remove it by hand.
removes	string	yes	What it takes, in the operator's words.
tier	Tier	yes	Which removal this is.
volume	stringornull	no	Whether the data location is on a network share or a drive that unplugs. Said where it is, so removing across a mount an operator forgot was a mount is something they read before agreeing rather than after.

UninstallRemoval

Whether anything was removed on this run, and what became of it.

Four states rather than the five a removal passes through. removing is the interval between the last two and is said through the narrator as it happens — a value returned at the end cannot be the state a run is in while it runs, and a variant nothing could ever answer with would be a state that is documentation pretending to be a value.

One of these:

• state: "surveyed"

  Everything is enumerated with its size, and nothing has been removed.

• state: "confirmed"

  The tier and the manifest were agreed to, and this run changes nothing — the state a rehearsal ends in.

• state: "complete"

  Everything the manifest named as going is gone.

  • credentials array ofstring

    The credentials this destroyed, said rather than left to be inferred.

  • gone array ofstring

    What went, by the name the manifest gave it.

• state: "partial"

  Some of it could not be removed, and each of those is named with how to finish it by hand.

  • credentials array ofstring

    The credentials this destroyed.

  • gone array ofstring

    What went, by the name the manifest gave it.

  • left array ofUninstallLeft

    What is still there, and how to remove it.

Unrated

What is to happen to content the media server has no rating for.

A choice rather than a default, because a great deal of content carries no rating and either answer is wrong for somebody: holding it back makes legitimate content invisible, and letting it through lets through the one thing nobody vetted.

Spelled HeldBack and LetThrough rather than blocked and allowed, because [Allowed] is the shape this sits on and a field called unrated: Allowed would read as the opposite of what it is.

A word rather than a flag on both the read and the write, so the setting is named the same in the answer that reports it as in the call that made it — and so neither [Access] nor the report built from it becomes a row of four unlabelled booleans.

Letting it through is the default because it is the media server's: a new account is made holding nothing back, so that is the state an account is found in rather than a decision anybody took.

One of these:

• "held-back"

  Content with no rating is held back.

• "let-through"

  Content with no rating is let through.

UnsupportedReport

Something lemonfiber cannot act on, named rather than passed over.

Written for a migration survey and read by two reports now. The second is the status of a stack the operator maintains themselves, where a service declaring an API this build cannot reach is named the same way — what, and why — rather than being dropped from every feature that would have used it. One shape for both, because "named rather than passed over" is the whole of what either is saying and two shapes would be two ways of saying it.

Field	Type	Required	What it is
because	string	yes	Why lemonfiber cannot act on it, in the operator's terms.
what	string	yes	What was found, by the name the thing that found it gives it — a project and service for a survey, a service id for a stack lemonfiber runs.

Unvetted

The operator's own overlay, named because nothing in it was held to the model.

Field	Type	Required	What it is
overlay	string	yes	Where the overlay is.
services	array ofstring	yes	Every service it changes, by the names it gives them.

UpdateApplied

What one service's update came to.

Field	Type	Required	What it is
detail	stringornull	no	What went wrong, where anything did.
ending	Ending	yes	How it ended.
from	string	yes	The version it was standing on before the run.
reversal	UpdateReversal	yes	How it could be put back, given how it ended.
service	string	yes	The service it is about.
to	string	yes	The version the run was moving it to.

UpdateChange

What updating one service would change.

Field	Type	Required	What it is
because	string	yes	What the step means, in the words an operator decides on.
current	string	yes	The version it is standing on now.
irreversible	boolean	yes	Whether taking it is a step nothing walks back.
jump	Jump	yes	How large the step between them is.
refused	boolean	yes	Whether lemonfiber refuses to take it at all.
service	string	yes	The service, by its manifest id, which is also its Compose service name.
target	string	yes	The version this build pins for it.

UpdateReport

Where this copy of lemonfiber stands, and what moving it would come to.

Field	Type	Required	What it is
afterwards	string	yes	What updating leaves alone, and what it needs afterwards.
asked	stringornull	no	The version the operator asked to move to, where they asked for one.
at	stringornull	no	Where the running binary is, with any link followed, or nothing where this machine would not say. The answer to which of several copies on a search path is the one that ran, so a version somebody quotes can be attributed to a file rather than to a name.
carries	string	yes	What a release brings besides the program, and when any of it is fetched.
changed	stringornull	no	What the version on offer says it changed, as its release page words it. The question an operator is actually weighing. Carried as the notes were written rather than taken apart here, because what a surface does with them is a surface's business — a terminal flattens them, a browser renders them, and a script wants them as they came.
command	stringornull	no	Exactly what to type, where there is something exact to type.
configuration	stringornull	no	Whether the version named can read the configuration on this machine. Only where a version was named, since it is the question a downgrade asks and nothing else does.
installed	Installed	yes	How this copy got onto the machine.
instead	stringornull	no	Why there is nothing exact to type, where there is not; or, where typing the command is not the whole of the move, what has to follow it.
offered	stringornull	no	The newest version released, where the check could read one.
owner	stringornull	no	The tool that owns this copy, where one does.
replaceable	booleanornull	no	Whether the directory holding the running binary can be written to. Nothing where it was not asked, which is every copy a package manager owns — replacing one of those is that tool's business and not this one's. Asked by trying rather than by reading permission bits, and reported rather than acted on: a copy this operator cannot replace is a thing to say with the path, never a reason to go looking for a way to become somebody else.
running	string	yes	The version running now.
standing	SelfUpdateStanding	yes	Which of the states this is.
untold	stringornull	no	Why availability could not be told, where it could not.

UpdateReversal

How a service could be put back the way it was.

The distinction is the whole of why this is reported rather than left to be worked out: pinning the previous image again is a minute's work, and restoring a backup is an evening. Offering the first where only the second can succeed is worse than offering nothing, because it is acted on.

One of these:

• "rollback"

  Nothing opened its state on the newer image, so the previous one runs again exactly as it did.

• "restore"

  The newer image was started, so its state may already have been migrated and the backup is the only way back.

UpdateState

Where the stack stands against the versions this build pins.

Exactly one of these is true of a run at a time. A surface that had to say "updates available, and also partly applied" would be reporting the question rather than the answer.

One of these:

• "current"

  Every service is standing on the version pinned for it.

• "updates-available"

  Newer versions are pinned than what is running, and nothing has been applied.

• "updated"

  Everything that had an update took it.

• "partial"

  Some were updated and one was not; the run stopped there.

• "failed"

  Nothing was updated, and the run stopped where it did.

UpgradeMedia

One media type an upgrade covers: its chosen quality, that quality's cost, and — once confirmed — what became of asking its service to re-search.

Reported per media type rather than as one figure, because each type carries its own preset and so its own cost: film at maximum and television at space-saving are upgraded to different bars, and a single number would misstate one of them.

Field	Type	Required	What it is
media_type	string	yes	The media type — tv or movies.
outcome	Triggeredornull	no	What became of the re-search, or None where the upgrade was not confirmed and only the cost was stated.
preset	string	yes	The preset in force for it.
size_per_hour	string	yes	Roughly what an hour of it costs at that preset.

UpgradeReport

What upgrading existing content did, or — unconfirmed — would do.

Upgrading re-acquires the existing library at the chosen quality, which is a large, bandwidth-expensive operation, so it is a separate explicit action whose cost is stated before it runs and which does nothing until confirmed. Each curator re-searches against its own current cutoff, so the report speaks per media type rather than asserting one preset across the library.

Field	Type	Required	What it is
confirmed	boolean	yes	Whether the operator confirmed; without it nothing was triggered, only the cost stated.
media	array ofUpgradeMedia	yes	Per media type: its preset, that preset's cost, and — confirmed — the outcome.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.

Validation

What proving a credential against its live service established — never the input, only the outcome.

Read back as well as built. A surface that is not in this process asks setup to prove a credential and is told what came of it, so the four outcomes are tagged by name rather than distinguished by which field is present — the same reason an answer carries the step it belongs to.

One of these:

• outcome: "valid"

  Proven working, carrying the capability observed while proving it.

  • observed string

    The observed fact — what the service did, not that it merely answered.

• outcome: "rejected"

  The service answered and refused: the credential is wrong for it.

  • detail string

    What the service said, in terms the operator can act on.

• outcome: "unreachable"

  Nothing usable answered, so nothing can be concluded about the credential.

  • detail string

    Why nothing usable came back.

• outcome: "degraded"

  It authenticated, but cannot do the job it is for — exhausted, limited, or otherwise unable.

  • detail string

    What it can no longer do, and why where the service says.

ValueOrigin

Where a value in force came from.

Published under a name of its own because the generated schema keys on the type's bare name, and a second Origin in the crate would be merged with this one into a single definition carrying the variants of both — a published contract saying a credential may be unknown and a setting may be service, neither of which is true, and neither of which the additive-only surface check would refuse.

One of these:

• origin: "bundled"

  This build's own, out of what lemonfiber ships rather than out of a choice.

• origin: "operator"

  The operator settled it, whether by answering for it or by editing it since.

• origin: "plugin"

  A named plugin set it.

  • named string

    Which one, so the thread back to it is a name rather than a search.

• origin: "unknown"

  It could not be established, and what stopped it.

  • why string

    What stopped it being established, so the gap reads as a reason rather than as a shrug.

• origin: "overridden"

  An installed plugin set it over a value that was there before, and that value is carried with it: what is in force and what it replaced are read together.

  • named string

    Which plugin set what is in force.

  • replaced ValueReplaced

    What it replaced, and where that came from.

• origin: "orphaned"

  A plugin set it and is no longer installed, and the value is still in force.

  Only where the record of what is installed was read and does not hold that plugin. A record that would not read cannot say a plugin is gone, so that is an unknown rather than this.

  • named string

    Which plugin set it.

ValueReplaced

The value a plugin's change replaced, and where that value came from.

Its own origin rather than assumed to be this build's default: before a plugin set a value, the operator may have, or another plugin, and calling that value bundled would tell somebody putting it back that they are returning to a default when they are returning to a choice.

Field	Type	Required	What it is
from	ValueOrigin	yes	Where the replaced value came from, read from the record of the change that wrote it, and unknown where nothing recorded one.
value	stringornull	no	What it held, where there was a value and it may be shown. Nothing where nothing was set — this build's default was in force — or where it is withheld.
withheld	boolean	yes	Whether a value is withheld because the setting holds a credential. A replaced credential is shown as sealed and never in clear, as the one in force is.

VersionReport

What versions are in play: the binary, the stack it operates, and what changed.

The changelog is here rather than behind a request of its own because it answers the second half of the same question. "Which version am I on" is asked by somebody deciding whether to move, and what they need next is what the version they are on actually brought — so every surface that already reaches this read reaches both halves, and none of the three had to learn a new question.

Field	Type	Required	What it is
attestation_status	stringornull	no	When the snapshot of Google's attestation status list this build carries was taken, which an Android device key's chain is checked against; nothing where it does not read.
binary	string	yes	The running binary's version.
changelog	Notes	yes	What this build's release changed, and every release there has been.
compose	stringornull	no	What the container engine reports, when it could be asked.
stack	string	yes	The version of the stack this build operates.
supported_schema	array ofintegeruint32, ≥ 0	yes	The manifest schema generations this build reads.

Vigil

The watch a run would keep, and what it would do at the end of it.

Field	Type	Required	What it is
command	array ofstring	yes	The invocation it would run the moment that location went, word for word. Built by the same path a real watch stops the services through, rather than described beside it: an argv reported from a second reckoning is one nobody runs, and the one nobody runs is the one that stops being right.
every	integeruint64, ≥ 0	yes	How often it would look, in seconds.
root	string	yes	The data location it would hold.

Vocabulary

Every word this product explains, for somebody who asked what there is to ask about.

Field	Type	Required	What it is
words	array ofTerm	yes	The words, in the order somebody meets them.

Volume

One volume, as one run measured it.

Field	Type	Required	What it is
at	string	yes	The path that was measured.
committed	integeruint64, ≥ 0	yes	The bytes already committed to landing here.
free	integerornulluint64, ≥ 0	no	Bytes free, or nothing where the volume could not be read.
level	Level	yes	Where it stands.
limit	integerornulluint64, ≥ 0	no	The effective limit — the mount's own size, which on a dataset given a quota is the quota rather than the device beneath it.
point	string	yes	Where the volume holding it is mounted, which is what the limit belongs to.
projected	integerornulluint64, ≥ 0	no	What would be free once the committed content has landed.
reading	Freshness	yes	What the reading is worth.
role	Role	yes	Which of the two this is.

Vpn

What the VPN is doing, and whether the download client is actually behind it.

Field	Type	Required	What it is
country	string	yes	The country that address is in.
egress_matches	boolean	yes	Whether the download client's own egress address matches the tunnel's — the one thing that proves traffic is genuinely leaving through it.
exit_ip	string	yes	The tunnel's exit address as the outside world sees it.
forwarded_port	integerornulluint16, ≥ 0, ≤ 65535	no	The port the provider forwards, where forwarding is on.

WalkthroughReport

What a first-content walkthrough did — the whole of it, narrated line by line as it happened and gathered here so the ending can be rendered, serialised and exited on.

Field	Type	Required	What it is
already_here	boolean	yes	Whether what was asked for was already here, and so was not acquired again.
handover	Handoverornull	no	Where it leaves the operator, where it worked.
in_background	boolean	yes	Whether the download was handed to the background rather than waited out.
item	stringornull	no	What it walked, where it got as far as choosing something.
lines	array ofLine	yes	Every line it said, in order — the same lines the operator watched arrive, kept so a machine-readable run is not a silent one.
link	Linkornull	no	What the import did with the file, where it got that far.
proves	string	yes	What it set out to prove, said so the operator knows what they watched.
shape	Shape	yes	Which walk this was.
state	WalkthroughState	yes	Where it ended up.
stopped	Stoppedornull	no	Where and why it stopped, where it did.
suggestions	array ofstring	yes	What could have been walked instead, where nothing was chosen — the safe first attempts, so an operator with an empty library is not left guessing.

WalkthroughState

What has become of a walkthrough.

One of these:

• "offered"

  Presented at the end of setup, not yet answered.

• "skipped"

  Declined. Available later, and carrying no penalty — a stack that was set up is set up whether or not anyone watched it fetch something.

• "searching"

  Looking for releases.

• "grabbing"

  Sending a release to the download client.

• "downloading"

  The download is running.

• "importing"

  Moving the finished download into the library.

• "complete"

  It is in the library and playable.

• "failed"

  Stopped at a named step, with a diagnosis.

• "abandoned"

  The operator left part-way. Whatever was in flight stays in flight.

WalkthroughStep

One step of the walk, ordered from picking something to watching it play.

One of these:

• "choosing"

  Picking something to add, and confirming it is not already here.

• "searching"

  The indexers are being searched for releases.

• "grabbing"

  A release is being sent to the download client.

• "downloading"

  The download is running.

• "importing"

  The curator is moving the finished download into the library.

• "scanning"

  The media server is being told to look at what arrived.

• "available"

  It is in the library and playable.

WatchedReport

A player's report of how far a member got, as the media server now holds it.

Field	Type	Required	What it is
ended	boolean	yes	Whether it was recorded as finished.
id	string	yes	The title or episode, by the identifier the shelf lists it under.
position	integeruint64, ≥ 0	yes	How far in, in whole seconds, as recorded.
rehearsed	boolean	yes	Whether this was a rehearsal: what would have happened, with none of it done.

WhenExceeded

What to do when a declared cap is reached.

One of these:

• "pause"

  Stop fetching until the month turns over.

• "throttle"

  Keep going, slowly, so what is half-finished can finish.

• "continue"

  Carry on. Some caps cost money and some only cost speed.

Whose

Who settled a contest between claimants.

One of these:

• "stack"

  The stack shipped the choice, in the file the operator can read.

• "operator"

  The operator chose, and the change is in the journal.

Wired

One of the stack's links, answered.

Field	Type	Required	What it is
by	string	yes	The service the link runs from — what asked.
origin	ValueOrigin	yes	Where the service that asked came from: this build's stack, or a named plugin.
reaches	Reaches	yes	What it reaches.

Wiring

One connection, and how it turned out.

Field	Type	Required	What it is
connection	string	yes	What was being connected, such as SABnzbd into Sonarr.
severity	SeedSeverity	yes	How serious the outcome is — information by default, a warning where the connection breaks the stack.
state	SeedState	yes	How it turned out.

WiringContest

An ask several services claim and nothing has chosen between, so it reaches nothing.

Field	Type	Required	What it is
by	string	yes	The service that asked.
capability	string	yes	What it asked for.
claimants	array ofstring	yes	Every claimant, named — a plugin's with the plugin beside it.

WiringReport

What this stack wires to what.

Field	Type	Required	What it is
unfilled	array ofUnfilled	yes	Every capability something asks for and nothing fills, naming what asked. Repeated out of the links above rather than left to be found among them: a stack with one unfilled ask among twenty working ones is a stack whose one problem is a line in a list, and a consumer that had to notice it would be the reason nobody did.
wired	array ofWired	yes	Every link, in the order the stack declares them.

WiringSettled

How an ask was settled.

One of these:

• settled: "outright"

  One claimant, and nothing to settle.

• settled: "each"

  Every claimant, because the link asked for all of them rather than one.

• settled: "contested"

  Several claimants and the link asked for one. Refused until somebody chooses: install order, precedence and recency are each a way of being right most of the time, and the times they are wrong are somebody's stack answering to the wrong software.

  • claimants array ofstring

    Every candidate, named, so a choice is made from a list.

• settled: "chosen"

  Several claimants, and a choice is recorded.

  • over array ofstring

    The ones not chosen, so the choice reads as a choice.

  • whose Whose

    Who chose.

  • why stringornull optional

    Why, where the chooser said.

• settled: "unfilled"

  Nothing claims it. What asked is named beside this, which is the point.

WizardReport

Where a setup run stands, and what it is still asking for.

The answer to every step of setup driven from outside this process: a surface asks where the walk is, submits one answer, and is told where the walk is now. Nothing here is a copy of the wizard's own state — it is read off the wizard each time, so a surface cannot hold a stale one and act on it.

The answers themselves are never in it. Setup gathers an indexer key and a provider password, and this report is one a script can log, so it says what was decided and never what was entered — the same line [SetupReport] holds. What will be written is in plan, with every credential withheld exactly as config show withholds one.

Field	Type	Required	What it is
asks	boolean	yes	Whether that step asks a question, as opposed to only informing.
at	WizardStep	yes	The step the operator is on.
offered	boolean	yes	Whether this machine has setup left to do. False once configuration exists and nothing is part-way through, which is when a surface directs the operator to reconfiguration instead of asking the first question again.
phase	Phase	yes	Where this run stands in its lifecycle. applying read back here means an apply stopped part-way, because an apply that is still running is one this answer is waiting on.
plan	array ofSettingReport	yes	What applying will write, in the order it will be written, with any value nobody has argued for showing withheld.
proof	Validationornull	no	What proving the credential just given came to, where one was given. Setup tests an indexer key and a Usenet login against their live services as they are entered, and this is what the service answered — never what was entered. Absent for every other answer, and for a step that gave none.
ready_for_review	boolean	yes	Whether every applicable question is answered, so the plan can be applied.
rehearsed	Ran	yes	Whether this was a rehearsal: what would have happened, with none of it done. Said in a field of its own so that a rehearsal is never told from the real run by its wording alone.
unanswered	array ofWizardStep	yes	Every question that applies on this machine and has no answer yet, in the order they are put.
written	array ofstring	yes	What an apply that stopped part-way had already written, each said plainly. The partial state a recovery is chosen about, so whoever chooses has seen it. Empty for every other phase, and empty too for an apply that stopped before it wrote anything.

WizardStep

A step of setup, in the order the operator meets it.

Some steps only inform (they detect and state, and the operator acknowledges); others ask a question whose answer the wizard records. The apply-and-onward steps — writing config, pulling images, wiring services — are not modelled here yet: they arrive with the features they drive, and this machine covers the read-only phase that precedes them.

One of these:

• "welcome"

  States what is about to happen and roughly how long it takes. Informs.

• "preflight"

  Detects the environment: OS, Docker, Compose, daemon reachability. Informs.

• "prerequisites"

  The account checklist derived from the protocol choice. Informs.

• "protocols"

  Usenet, torrents, both, or neither.

• "vpn"

  Whether a VPN carries the torrent traffic. Asked only where torrents were chosen, and after the checklist has explained what one is for.

• "data-location"

  Where downloads and the library are kept.

• "credentials"

  The indexer credential, tested against the live service. Asked only where a download protocol was chosen.

• "provider"

  The Usenet provider login, tested over NNTP. Asked only where Usenet was chosen.

• "service-user"

  The user and group the containers run as. Asked only where it is visible.

• "library"

  Whether to run the media server, and if so how.

• "household"

  Whether others in the home will use it.

• "notifications"

  How much the operator wants to be told about — one question, three presets.

• "autostart"

  Whether to start on boot.

• "review"

  The complete summary, before anything is written. Informs.

Read from the revisions this site pins:lemonfiber/lemonfiber at 3d26c96, 2026-10-27