zigbee2mqtt: raise memory limit to 1Gi

Node derives the V8 heap from the container limit: 512Mi gave a
259 MB heap, and Z2M crashed with "JavaScript heap out of memory"
(exit 134) at 2026-09-28 17:56Z and 2026-09-29 07:36Z. Request
raised to 256Mi to cover the measured 232Mi working set.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

kubernetes/apps/audiobookshelf/deployment.yaml

@@ -70,7 +70,7 @@ spec:
               mountPath: /ca
       containers:
         - name: audiobookshelf
-          image: ghcr.io/advplyr/audiobookshelf:2.37.0 # {"$imagepolicy": "flux-system:audiobookshelf"}
+          image: ghcr.io/advplyr/audiobookshelf:2.37.1 # {"$imagepolicy": "flux-system:audiobookshelf"}
           ports:
             - name: http
               containerPort: 80

kubernetes/apps/home-assistant/backup-password-externalsecret.yaml

@@ -1,15 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: home-assistant-backup-password
-  namespace: home-assistant
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  target:
-    name: home-assistant-backup-password # keeps the old Secret's name — consumers unchanged
-  dataFrom:
-    - extract:
-        key: apps/home-assistant/backup-password

kubernetes/apps/home-assistant/kustomization.yaml

@@ -1,7 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - backup-password-externalsecret.yaml
   - pvcs.yaml
   - deployment.yaml
   - service.yaml

kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml

@@ -194,12 +194,15 @@ spec:
             periodSeconds: 30
             timeoutSeconds: 5
             failureThreshold: 4
+          # Node sizes the V8 heap from this limit: 512Mi gave a 259 MB heap,
+          # and Z2M died on "JavaScript heap out of memory" (exit 134) at
+          # 2026-09-28 17:56Z and 2026-09-29 07:36Z.
           resources:
             requests:
               cpu: 50m
-              memory: 128Mi
+              memory: 256Mi
             limits:
-              memory: 512Mi
+              memory: 1Gi
         # Fires a forced interview whenever a still-un-interviewed device
         # transmits — i.e. at the only moment a sleepy battery device can
         # actually complete one. Z2M itself only retries interviews on a ZDO

kubernetes/apps/navidrome/beets.yaml

@@ -6,13 +6,12 @@
 # 5-album spot check), so beets now writes tags. Art plugins stay off: they
 # would add or embed cover files, a separate change.
 #
-# Retry trial: the write run matched 74 of 560 albums. 486 were skipped: most
-# folders hold only part of an album, and beets caps a match with missing
-# tracks below "strong", so quiet mode skipped them, and incremental import
-# never looked at them again. This trial retries them with a partial-album
-# match allowed, but imports with -W (no tag write) and skips `beet write`,
-# so no file changes until the new matches are checked. The 74 written albums
-# are re-matched too; the run lists any whose release changed.
+# Retry: the first write run matched 74 of 560 albums; most skipped folders
+# hold only part of an album. Partial-album matches are allowed now (see
+# max_rec). A -W trial matched 158 albums, all at 96% or better, and none of
+# the 74 written albums changed release, so beets now writes them. Muse "Black
+# Holes and Revelations" matched an instrumental release: it is ignored and
+# dropped from the DB (DB only, no file change).
 #
 # Lidarr does not write tags: lidarr-reconcile sets writeAudioTags "no" on
 # every pod start (lidarr.yaml), so it cannot undo the beets tags.
@@ -42,6 +41,9 @@ data:
     library: /config/library.db
     statefile: /config/state.pickle
     plugins: [musicbrainz, fetchart, embedart, lastgenre]
+    # Beets defaults plus folders whose only match is a wrong release.
+    ignore: ['.*', '*~', 'System Volume Information', 'lost+found',
+             'Black Holes and Revelations']
     # Keep the first-release date in year; reissues must not change it.
     original_date: yes
     match:
@@ -95,27 +97,39 @@ data:
       rm -f /config/state.pickle
       touch /config/.retry-ren350
     fi
+    # One-time: the trial stored an instrumental release for this album.
+    # `rm` without -d drops the DB entry only; the file is not touched.
+    if [ ! -f /config/.drop-ren350 ]; then
+      beet rm -a -f 'path:/music/Muse/Black Holes and Revelations'
+      touch /config/.drop-ren350
+    fi
     beet ls -a -f '$path $mb_albumid' | sort > /config/logs/albums-before.txt
     LOG=/config/logs/import-$(date +%Y%m%d-%H%M).log
-    # Trial: -W stores matches in the DB but writes no file.
-    beet import -W -l "$LOG" /music
+    beet import -l "$LOG" /music
     rc=$?
     beet ls -a -f '$path $mb_albumid' | sort > /config/logs/albums-after.txt
     comm -23 /config/logs/albums-before.txt /config/logs/albums-after.txt \
       > /config/logs/albums-changed.txt
     echo "== import exit $rc"
-    echo "== written albums with a changed release: $(wc -l < /config/logs/albums-changed.txt)"
+    echo "== albums with a changed release: $(wc -l < /config/logs/albums-changed.txt)"
     cat /config/logs/albums-changed.txt
     echo "== albums in library: $(beet ls -a | wc -l)"
     echo "== skipped this run: $(grep -c '^skip ' "$LOG")"
     echo "== duplicates skipped: $(grep -c '^duplicate-skip ' "$LOG")"
-    # Trial: preview only. `beet write` comes back once the matches are checked.
+    # The trial (-W) stored matches in the DB only; `beet write` puts them
+    # into the files (tags only, no move).
     beet write -p > /config/logs/write-preview.txt 2>&1
     echo "== items to write: $(grep -vc '^ ' /config/logs/write-preview.txt)"
+    beet write
+    wrc=$?
+    echo "== write exit $wrc"
+    beet write -p > /config/logs/write-after.txt 2>&1
+    echo "== items still differing after write: $(grep -vc '^ ' /config/logs/write-after.txt)"
     echo "== skipped albums"
     grep '^skip ' "$LOG"
-    echo "== changes the write would make (first 2000 lines)"
+    echo "== written changes (first 2000 lines)"
     head -n 2000 /config/logs/write-preview.txt
+    [ "$rc" -eq 0 ] && rc=$wrc
     exit $rc
 ---
 apiVersion: batch/v1
@@ -171,10 +185,9 @@ spec:
                 - name: beets-config
                   mountPath: /etc/beets
                   readOnly: true
-                # Read-only for the retry trial; writable again with `beet write`.
+                # Writable for tag writes; move/copy/delete stay off above.
                 - name: music
                   mountPath: /music
-                  readOnly: true
               resources:
                 requests:
                   cpu: 100m

kubernetes/infrastructure/post-crds/velero-schedules.yaml

@@ -196,9 +196,10 @@ spec:
   # several apps under apps/ set `namespace: home-assistant` in their
   # Kustomization, so their PVCs land here too.
   #
-  # home-assistant-config has its own restore path: the HA pod's `seed`
-  # initContainer pulls the native HAOS backup. Layering a Velero PVC restore
-  # on top of that for the same PVC needs its own review.
+  # This is the ONLY restore path for home-assistant-config (.storage,
+  # secrets.yaml, the config git checkout). The HAOS-backup `seed`
+  # initContainer that used to repopulate it was removed in 21a0a43f.
+  # Restore procedure and test: REN-249 runbook section C.2.
   schedule: "45 6 * * *"
   useOwnerReferencesInBackup: false
   template: