docs(skill): simplify again after the code review, and demand a trigger for defensive branches

The full loop ran simplify (step 5) before Codex's code review (step 6) and never
again, so nothing walked back what the review added. Adversarial review is asked to
find what could go wrong, so its output is a list of arguments for more code and it
is never asked whether the branch it wants is reachable — accepting objections only
ratchets the diff upward. Step 6 now ends by re-running step 5's checks over the
hunks the review touched.

The other half was earlier than the review. The standing rule already said complexity
is bought only by a measurement, but it said it about performance, so a branch added
for robustness did not visibly fall under it. It now covers hypothetical hosts as
well as hypothetical performance: name the input that reaches a defensive branch and
the image it happens on, or delete it and let the case fail visibly. Step 3's
attack-your-own-plan list asks the same question before any code exists, which is
where it is cheapest to answer.

The case study in references/simplify.md is #3013: 25 lines of code at review, 10
merged. A pure-bash fallback written at implement time for images shipping
with-contenv but not s6-dumpenv — reasoned from the two binaries living in different
s6 packages, never demonstrated on a real image, and defending a case that would have
degraded to the pre-fix behaviour anyway — plus the helper function and second reset
that existed only to serve it. Deleting the fallback deleted all of it. The review's
own objections were correct and cost two tokens on an existing line.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.claude/skills/hassio-addon-workflow/SKILL.md

@@ -29,8 +29,8 @@ Triage first, then one of two paths:
   resolve bot comments.
 - **Full loop** — performance/RAM/CPU work, diagnosis, anything changing a shipped default,
   ladder levels 4-6, or an explicit Codex-check request: scope → measure → plan → Codex reviews
-  the plan → implement → simplify → Codex reviews the code → PR → resolve comments → verify in
-  production → report.
+  the plan → implement → simplify → Codex reviews the code → **simplify again** → PR → resolve
+  comments → verify in production → report.
 
 Escalate mid-flight if a light task grows — touches a default, needs a new script or service, or
 reveals a deeper problem.
@@ -42,7 +42,10 @@ where every add-on solves a problem the same way is worth more than a locally ni
 design. Prefer reusing or extending over adding a parallel implementation, and when you must add
 something new, spell it the way the rest of the repo spells it (naming, option names, script
 numbering, file layout). Complexity is bought only by a **measurement** showing a concrete,
-user-visible cost on a real host — never by reasoning about hypothetical performance.
+user-visible cost on a real host — never by reasoning about hypothetical performance, and never by
+reasoning about a hypothetical *host* either. A defensive branch is complexity like any other: name
+the input that reaches it and the image or host where that happens, or delete it and let the case
+fail visibly instead.
 
 **Repo layout.** `alexbelgium/hassio-addons`; each add-on is a top-level directory. This skill is
 checked in at `.claude/skills/hassio-addon-workflow/` (canonical copy). Set the skill root once,
@@ -113,6 +116,9 @@ Attack your own plan before implementing:
 - What is the **blast radius** if the assumption underneath it is wrong?
 - What am I **inferring** that I could instead **detect at runtime** or **record explicitly**?
   Highest-yield question here — see `references/evidence.md`'s failure-mode section.
+- For every branch that exists **only to survive something going wrong**: what input reaches it,
+  on which image? Go and look. A fallback for a configuration you cannot find an instance of is
+  not robustness, it is a second code path nobody will ever exercise or notice rotting.
 
 Full loop only, before writing code: get Codex's independent read on the plan. Spawn a subagent
 whose prompt includes the path `references/codex-review.md` and tells it to follow that file's
@@ -140,11 +146,18 @@ justify the divergence in the PR body — but never at the cost of an isolation
 numbered script, not an edit. Case studies of what happens when this check is skipped:
 `references/simplify.md`.
 
-## 6. Codex attacks the code (full loop only)
+## 6. Codex attacks the code, then simplify what the review added (full loop only)
 
 Same delegated invocation, pointed at `git diff origin/master...HEAD` plus your reasoning per
 hunk. Details in `references/codex-review.md`.
 
+Then run step 5's checks again over the hunks the review changed. Adversarial review only ever
+argues *for* another branch — that is its job — so accepting objections ratchets the diff upward,
+and nothing else in the loop walks it back down. For each accepted objection: is the case it
+defends one you have now demonstrated, or one you have merely been told about? Taking a
+correctness objection often deletes the code that made it necessary, and a fix that collapses back
+to fewer lines than you started the review with is the normal outcome, not a suspicious one.
+
 ## 7. Open the PR
 
 CI gates on a PR: **`CHANGELOG.md` updated** (hard fail), the **HA add-on linter**

.claude/skills/hassio-addon-workflow/references/codex-review.md

@@ -39,3 +39,10 @@ codex exec --model gpt-5.6-sol --sandbox read-only --skip-git-repo-check \
 **Codex agrees with confident premises.** It has confirmed a wrong conclusion stated too
 confidently, and separately caught a genuine methodology error in the same review. Treat its
 confirmations with the same scepticism as its objections — especially about the build.
+
+**Its objections ratchet complexity upward.** An adversarial reviewer is asked to find what could
+go wrong, so its output is a list of arguments for more code; it is never asked whether the branch
+it wants is reachable. Separate "this is wrong" from "this is undefended" before you write
+anything: the first is a bug and you fix it, the second is a claim about some host, and it needs
+the same demonstration you would demand of a measurement. That is what step 6's second simplify
+pass is for.

.claude/skills/hassio-addon-workflow/references/simplify.md

@@ -13,6 +13,15 @@ Being able to build the complicated thing is not a reason to.
 - A resolution cap shipped as a **new init script writing an s6 envdir** — the wrong mechanism
   entirely (ladder level 4). Renaming the option to the env var the service already reads
   (level 1) would have worked, and the new script did not.
+- A `.templates/ha_entrypoint.sh` fix went to review at 25 lines of code and merged at 10. Two
+  sources of the excess, and neither was caught by the loop: a **pure-bash fallback** written at
+  implement time for images shipping `with-contenv` but not `s6-dumpenv` — reasoned from the two
+  binaries living in different s6 packages, never demonstrated on any real image, and the case it
+  defended would have degraded to the pre-fix behaviour anyway — and a **helper function plus a
+  second reset** that existed only to serve that fallback. Deleting the fallback deleted all of
+  it. The rest of the review's objections were correct and cost two tokens on an existing line.
+  It took the maintainer asking "is this the simplest way possible?" to run the pass that step 6
+  now requires.
 
 ## Checks worth running against your own diff
 
@@ -25,6 +34,11 @@ Being able to build the complicated thing is not a reason to.
   A removal that depends on a host default still needs the same verification as an addition.
 - **Is the fix bigger than the thing it fixes?** That is a smell, not a rule — but it usually
   means the problem was framed one level too deep.
+- **For each defensive branch: what input reaches it, on which image or host?** Go and check,
+  the way you would check a measurement. If you cannot produce the case, delete the branch — the
+  situation then fails the way it already fails today, visibly, instead of through a second path
+  that is never exercised and silently rots as the base images move. Write down in the PR body
+  what you cut and why, so the next person does not re-add it from the same reasoning.
 - **How does this fail in three years**, when the base image, Electron, or upstream has moved?
   Code that reads a documented knob keeps working. Code that reaches into private internals
   does not.

.github/stargazer_countries.csv

@@ -377,6 +377,7 @@ JochenZhou,China,
 Johndrmg,,2026-08-10
 Jojo-05,Austria,
 JonBAL,,2026-08-10
+Joni12v,,2026-08-23
 JonnyMcBanjo,United States,
 JordyThery,Belgium,
 Joriex,Germany,
@@ -446,6 +447,7 @@ Lucius-Waverly,,2026-08-16
 LuciusEternal,,2026-08-10
 LuckyTriple7,Germany,
 Luckyfuzz,,2026-08-10
+Ludy87,Germany,2026-08-23
 Lukas0120,,2026-08-10
 LukasGail,Germany,
 LunyaaDev,,2026-08-10
@@ -1366,6 +1368,7 @@ fenyag7,Germany,
 fermuch,,2026-08-10
 fernbrun,,2026-08-10
 fess1100,,2026-08-10
+ffhjansen,,2026-08-23
 filiphch,Belgium,
 fischer-felix,Germany,
 fisco,,2026-08-10

aurral/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.5.1 (2026-08-22)
+- Update to latest version from lklynet/aurral (changelog : https://github.com/lklynet/aurral/releases)
+ 
 ## 2.4.0 (2026-08-13)
 - Update to latest version from lklynet/aurral (changelog : https://github.com/lklynet/aurral/releases)
  

aurral/config.yaml

@@ -1,5 +1,5 @@
 name: Aurral
-version: "2.4.0"
+version: "2.5.1"
 slug: aurral
 description: >-
   Self-hosted music discovery, request management, flows, and playlist

aurral/updater.json

@@ -1,9 +1,9 @@
 {
-  "last_update": "2026-08-13",
+  "last_update": "2026-08-22",
   "repository": "alexbelgium/hassio-addons",
   "slug": "aurral",
   "source": "github",
   "upstream_repo": "lklynet/aurral",
-  "upstream_version": "2.4.0",
+  "upstream_version": "2.5.1",
   "github_beta": false
 }

birdnet-pipy/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 0.8.8 (2026-08-22)
+- Update to latest version from Suncuss/BirdNET-PiPy (changelog : https://github.com/Suncuss/BirdNET-PiPy/releases)
+ 
 ## 0.8.6 (2026-08-13)
 - Update to latest version from Suncuss/BirdNET-PiPy (changelog : https://github.com/Suncuss/BirdNET-PiPy/releases)
  

birdnet-pipy/config.yaml

@@ -96,4 +96,4 @@ schema:
   ssl: bool?
 slug: birdnet-pipy
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pipy
-version: "0.8.6"
+version: "0.8.8"

birdnet-pipy/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-08-13",
+  "last_update": "2026-08-22",
   "repository": "alexbelgium/hassio-addons",
   "slug": "birdnet-pipy",
   "source": "github",
   "upstream_repo": "Suncuss/BirdNET-PiPy",
-  "upstream_version": "0.8.6"
+  "upstream_version": "0.8.8"
 }

browser_brave/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 1.93.138-ls124 (2026-08-22)
+- Update to latest version from linuxserver/docker-brave (changelog : https://github.com/linuxserver/docker-brave/releases)
+ 
 ## 1.93.136-ls122 (2026-08-13)
 - Update to latest version from linuxserver/docker-brave (changelog : https://github.com/linuxserver/docker-brave/releases)
  

browser_brave/config.yaml

@@ -69,5 +69,5 @@ slug: brave
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.93.136-ls122"
+version: "1.93.138-ls124"
 video: true

browser_brave/updater.json

@@ -1,9 +1,9 @@
 {
   "github_fulltag": "true",
-  "last_update": "2026-08-13",
+  "last_update": "2026-08-22",
   "repository": "alexbelgium/hassio-addons",
   "slug": "brave",
   "source": "github",
   "upstream_repo": "linuxserver/docker-brave",
-  "upstream_version": "1.93.136-ls122"
+  "upstream_version": "1.93.138-ls124"
 }

browserless_chrome/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.56.0 (2026-08-22)
+- Update to latest version from browserless/chrome (changelog : https://github.com/browserless/chrome/releases)
+ 
 ## 2.55.4 (2026-08-13)
 - Update to latest version from browserless/chrome (changelog : https://github.com/browserless/chrome/releases)
  

browserless_chrome/config.yaml

@@ -86,5 +86,5 @@ schema:
 slug: browserless_chrome
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/browserless_chrome
-version: "2.55.4"
+version: "2.56.0"
 webui: "[PROTO:ssl]://[HOST]:[PORT:3000]/docs"

browserless_chrome/updater.json

@@ -1,9 +1,9 @@
 {
   "github_tagfilter": "v",
-  "last_update": "2026-08-13",
+  "last_update": "2026-08-22",
   "repository": "alexbelgium/hassio-addons",
   "slug": "browserless_chrome",
   "source": "github",
   "upstream_repo": "browserless/chrome",
-  "upstream_version": "2.55.4"
+  "upstream_version": "2.56.0"
 }

calibre_web/CHANGELOG.md

@@ -1,4 +1,10 @@
  
+## 0.6.27.2 (2026-08-23)
+- Fix: trust the whole supervisor network range for the ingress auth header instead of the addon's own address, which changes across restarts. The list is only written when that range is missing, so an entry added in the calibre-web admin page is no longer erased on every start (https://github.com/alexbelgium/hassio-addons/pull/3010)
+
+## 0.6.27.1 (2026-08-23)
+- Fix: Ingress login was rejected since 0.6.27, which only accepts the reverse proxy auth header from trusted source addresses. The addon now adds its own ip to that list (https://github.com/alexbelgium/hassio-addons/issues/3003)
+
 ## 0.6.27 (2026-08-13)
 - Update to latest version from linuxserver/docker-calibre-web (changelog : https://github.com/linuxserver/docker-calibre-web/releases)
 

calibre_web/config.yaml

@@ -116,5 +116,5 @@ schema:
 slug: calibre-web
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/calibre_web
-version: "0.6.27"
+version: "0.6.27.2"
 video: true

calibre_web/rootfs/etc/cont-init.d/80-configuration.sh

@@ -18,6 +18,20 @@ if [ ! -f /config/app.db ]; then
     bashio::log.warning "First boot : disabling Ingress until addon restart"
 else
     sqlite3 /config/app.db 'update settings set config_reverse_proxy_login_header_name="X-WebAuth-User",config_allow_reverse_proxy_header_login=1'
+
+    # Calibre-web 0.6.27 only accepts that header from a trusted source address, and defaults the
+    # list to "127.0.0.1,::1". Ingress reaches calibre-web from the addon's own address on the
+    # supervisor network (proxy_bind $server_addr in ingress.conf) and calibre-web listens
+    # dual-stack, so it sees ::ffff:<addon ip> and drops the header. The supervisor range is
+    # listed in both forms because an ipv4 entry never matches an ipv4-mapped address.
+    # Prepended to whatever is already there, and only when the mapped form is missing : that form
+    # is the one ingress needs and the one nobody types by hand, so it doubles as the marker that
+    # this already ran. Anything the user added is kept, the statement runs at most once, and the
+    # duplicates it can leave behind are entries calibre-web skips or already trusts.
+    # The column only exists once calibre-web 0.6.27+ has migrated app.db and cont-init runs
+    # before calibre-web, so a failure here is not fatal : the next start applies it.
+    trusted_ips_error=$(sqlite3 /config/app.db "update settings set config_reverse_proxy_trusted_ips='127.0.0.1,::1,::ffff:127.0.0.1,172.30.32.0/23,::ffff:172.30.32.0/119,'||coalesce(config_reverse_proxy_trusted_ips,'') where coalesce(config_reverse_proxy_trusted_ips,'') not like '%::ffff:172.30.32.0/119%'" 2>&1) ||
+        bashio::log.warning "Could not set the ingress trusted ip list, it will be applied at next start (${trusted_ips_error})"
 fi
 
 bashio::log.info "Default username:password is admin:admin123"

claude_desktop/CHANGELOG.md

@@ -1,3 +1,7 @@
+ 
+## 07308545.4 (2026-08-22)
+- Update to latest version from aaddrick/claude-desktop-debian (changelog : https://github.com/aaddrick/claude-desktop-debian/releases)
+- Upstream tag : v3.2.2+claude1.32885.1
 ## 07308545.3 (19-08-2026)
 - Fix an incompletely installed Codex CLI, which silently broke every Codex tool call. Since
   codex-cli 0.147.0 the CLI does not execute shell commands or file reads itself; it delegates

claude_desktop/config.yaml

@@ -136,5 +136,5 @@ schema:
 slug: claude_desktop
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "07308545.3"
+version: "07308545.4"
 video: true

claude_desktop/updater.json

@@ -4,6 +4,6 @@
   "github_fulltag": true,
   "slug": "claude_desktop",
   "paused": false,
-  "upstream_version": "v3.2.2+claude1.30096.1",
-  "last_update": "2026-08-15"
+  "upstream_version": "v3.2.2+claude1.32885.1",
+  "last_update": "2026-08-22"
 }

codex/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.2.8 (2026-08-22)
+- Update to latest version from ajslater/codex (changelog : https://github.com/ajslater/codex/releases)
+ 
 ## 2.2.6 (2026-08-08)
 - Update to latest version from ajslater/codex (changelog : https://github.com/ajslater/codex/releases)
  

codex/config.yaml

@@ -101,4 +101,4 @@ schema:
 slug: codex
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "2.2.6"
+version: "2.2.8"

codex/updater.json

@@ -1,9 +1,9 @@
 {
   "github_beta": "true",
-  "last_update": "2026-08-08",
+  "last_update": "2026-08-22",
   "repository": "alexbelgium/hassio-addons",
   "slug": "codex",
   "source": "github",
   "upstream_repo": "ajslater/codex",
-  "upstream_version": "2.2.6"
+  "upstream_version": "2.2.8"
 }

emby_beta/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 4.10.0.26 (2026-08-22)
+- Update to latest version from linuxserver/docker-emby (changelog : https://github.com/linuxserver/docker-emby/releases)
+ 
 ## 4.10.0.25 (2026-08-15)
 - Update to latest version from linuxserver/docker-emby (changelog : https://github.com/linuxserver/docker-emby/releases)
  

emby_beta/Dockerfile

@@ -16,7 +16,7 @@
 
 ARG BUILD_FROM
 ARG BUILD_VERSION
-ARG BUILD_UPSTREAM="4.10.0.25"
+ARG BUILD_UPSTREAM="4.10.0.26"
 FROM ${BUILD_FROM}
 
 ##################

emby_beta/config.yaml

@@ -122,5 +122,5 @@ schema:
 slug: emby_nas
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/emby
-version: "4.10.0.25"
+version: "4.10.0.26"
 video: true

emby_beta/updater.json

@@ -1,9 +1,9 @@
 {
   "github_beta": "true",
-  "last_update": "2026-08-15",
+  "last_update": "2026-08-22",
   "repository": "alexbelgium/hassio-addons",
   "slug": "emby",
   "source": "github",
   "upstream_repo": "linuxserver/docker-emby",
-  "upstream_version": "4.10.0.25"
+  "upstream_version": "4.10.0.26"
 }

filebrowser_quantum/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 1.5.2 (2026-08-22)
+- Update to latest version from gtsteffaniak/filebrowser (changelog : https://github.com/gtsteffaniak/filebrowser/releases)
+ 
 ## 1.5.1.2 (2026-08-19)
 - Fix direct access on port 8071, which was broken in 1.5.1.1: the root
   redirect pointed at the container-internal port 8072 instead of the

filebrowser_quantum/config.yaml

@@ -118,4 +118,4 @@ schema:
 slug: filebrowser_quantum
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.5.1.2"
+version: "1.5.2"

filebrowser_quantum/updater.json

@@ -1,10 +1,10 @@
 {
   "github_beta": "false",
-  "last_update": "2026-08-08",
+  "last_update": "2026-08-22",
   "paused": false,
   "repository": "alexbelgium/hassio-addons",
   "slug": "filebrowser_quantum",
   "source": "github",
   "upstream_repo": "gtsteffaniak/filebrowser",
-  "upstream_version": "1.5.1"
+  "upstream_version": "1.5.2"
 }

flexget/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 3.20.6 (2026-08-22)
+- Update to latest version from wiserain/flexget
+ 
 ## 3.20.5 (2026-08-15)
 - Update to latest version from wiserain/flexget
  

flexget/config.yaml

@@ -95,5 +95,5 @@ schema:
 slug: flexget
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "3.20.5"
+version: "3.20.6"
 webui: "[PROTO:ssl]://[HOST]:[PORT:5050]"

flexget/updater.json

@@ -1,9 +1,9 @@
 {
   "dockerhub_list_size": "10",
-  "last_update": "2026-08-15",
+  "last_update": "2026-08-22",
   "repository": "alexbelgium/hassio-addons",
   "slug": "flexget",
   "source": "dockerhub",
   "upstream_repo": "wiserain/flexget",
-  "upstream_version": "3.20.5"
+  "upstream_version": "3.20.6"
 }

grav/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.0.20 (2026-08-22)
+- Update to latest version from linuxserver/docker-grav (changelog : https://github.com/linuxserver/docker-grav/releases)
+ 
 ## 2.0.19 (2026-08-15)
 - Update to latest version from linuxserver/docker-grav (changelog : https://github.com/linuxserver/docker-grav/releases)
  

grav/Dockerfile

@@ -16,7 +16,7 @@
 
 ARG BUILD_FROM
 ARG BUILD_VERSION
-ARG BUILD_UPSTREAM="2.0.19"
+ARG BUILD_UPSTREAM="2.0.20"
 FROM ${BUILD_FROM}
 
 ##################

grav/config.yaml

@@ -89,5 +89,5 @@ schema:
 slug: grav
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "2.0.19"
+version: "2.0.20"
 webui: "[PROTO:ssl]://[HOST]:[PORT:80]"

grav/updater.json

@@ -1,9 +1,9 @@
 {
   "github_beta": false,
-  "last_update": "2026-08-15",
+  "last_update": "2026-08-22",
   "repository": "alexbelgium/hassio-addons",
   "slug": "grav",
   "source": "github",
   "upstream_repo": "linuxserver/docker-grav",
-  "upstream_version": "2.0.19"
+  "upstream_version": "2.0.20"
 }

jackett/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 0.24.2434 (2026-08-22)
+- Update to latest version from linuxserver/docker-jackett (changelog : https://github.com/linuxserver/docker-jackett/releases)
+ 
 ## 0.24.2406 (2026-08-15)
 - Update to latest version from linuxserver/docker-jackett (changelog : https://github.com/linuxserver/docker-jackett/releases)
  

jackett/config.yaml

@@ -106,5 +106,5 @@ schema:
 slug: jackett_nas
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/jackett
-version: "0.24.2406"
+version: "0.24.2434"
 webui: http://[HOST]:[PORT:9117]

jackett/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-08-15",
+  "last_update": "2026-08-22",
   "repository": "alexbelgium/hassio-addons",
   "slug": "jackett",
   "source": "github",
   "upstream_repo": "linuxserver/docker-jackett",
-  "upstream_version": "0.24.2406"
+  "upstream_version": "0.24.2434"
 }