docs: FrankBook-Pro active-tunnel reality (PA-12, 6881 retirement, qB wiring + save-path convention)

serverAppConfigs-docs/log.md

@@ -11,6 +11,33 @@ timestamp: 2026-09-14
 
 # Bundle Change Log
 
+## 2026-09-01 (late) — FrankBook-Pro stack completed: tunnel live, qB wired into the arrs
+- WireGuard credentials provisioned (second Proton config, server `PA-12`,
+  endpoint `51.179.177.2:51820`) → `/home/core/Containers/gluetun/env`
+  (0600, VM-local); `deploy.sh frankbook-pro --service gluetun --service
+  qbittorrent` brought both up; egress verified (Proton PA exit, ~19 MB/s
+  on a live torrent). The `.conf` stays in `~/Downloads`; the private key
+  never enters the repo.
+- gvproxy binds wildcard `*:6881/udp` (Go sets `SO_REUSEADDR` on TCP but not
+  UDP) → the socat 6881 tcp+udp LaunchAgents collided at every boot and
+  were retired; swarm inbound (if ever needed) is the Proton NAT-PMP path.
+  macOS application firewall still filters gvproxy inbound from non-local
+  sources (stealth mode) — cross-host 8080 needs `socketfilterfw` allow.
+- qB wiring: first-seed bug (hash under legacy `WebUI\Password` key, ignored
+  by qB ≥ 4.2) fixed live (`WebUI\Password_PBKDF2`) and in
+  `scripts/deploy-remote.sh`; `DefaultSavePath` repointed to
+  `/Volumes/COMPLETE/Finished Torrents` — qB 5.2 API adds with a category
+  do not inherit the category save path (no auto-TMM); download clients
+  created in all four arrs (sonarr/radarr/lidarr via API, tests pass;
+  readarr by direct `readarr.db` insert — its EOL validator rejects qB 5's
+  `204` login as auth failure); Prowlarr Applications sync sonarr/radarr/
+  lidarr (readarr omitted: prowlarr's indexer push 500s on EOL schema).
+  Legacy `Prowlarr-*` indexer rows (hostname `prowlarr:9696`, unresolvable
+  on the Mac default network) deleted. E2E: Sintel fetched + downloaded
+  through the tunnel at ~19 MB/s, completed into `Finished Torrents`.
+- Docs: [[FrankBook-Pro]] rewritten to the active-tunnel reality.
+
+
 ## 2026-09-01 - WG endpoint identified as ProtonVPN Seattle; Mac gate is a second dashboard config
 - RDAP: `149.102.254.77` = CDNEXT-CG-SEA (Datacamp Limited, Proton's Seattle
   hosting partner); Dankclaw's tunnel v6 `2a07:b944::2:2` sits in