diff --git a/.obsidian/workspace.json b/.obsidian/workspace.json
index 1302f64..c720f4a 100644
--- a/.obsidian/workspace.json
+++ b/.obsidian/workspace.json
@@ -13,12 +13,12 @@
             "state": {
               "type": "markdown",
               "state": {
-                "file": "400 resources/450 Recipes/Easy Yogurt flat bread.md",
+                "file": "300 areas/360 Dev-Ops Network Computers/Error Tracking.md",
                 "mode": "source",
                 "source": false
               },
               "icon": "lucide-file",
-              "title": "Easy Yogurt flat bread"
+              "title": "Error Tracking"
             }
           }
         ]
@@ -183,7 +183,7 @@
             "state": {
               "type": "file-properties",
               "state": {
-                "file": "400 resources/450 Recipes/Easy Yogurt flat bread.md"
+                "file": "300 areas/360 Dev-Ops Network Computers/Error Tracking.md"
               },
               "icon": "lucide-info",
               "title": "File properties"
@@ -209,8 +209,9 @@
       "templater-obsidian:Templater": false
     }
   },
-  "active": "8f0c8ae5063438f6",
+  "active": "7066c9273c6fb936",
   "lastOpenFiles": [
+    "400 resources/450 Recipes/Easy Yogurt flat bread.md",
     "300 areas/360 Dev-Ops Network Computers/Backup System — Borg, Kopia & Restic.md",
     "200 projects/240 Web Sites/Kontra Day.md",
     "000 daily/FAMILY  S3 Storage Integration & Blueprint.md",
@@ -246,7 +247,6 @@
     "300 areas/350 AI/AI Tools to try.md",
     "300 areas/360 Dev-Ops Network Computers/Error Tracking.md",
     "300 areas/360 Dev-Ops Network Computers/FAMILY CONSOLE.md",
-    "300 areas/360 Dev-Ops Network Computers/Backup Health Check Commands.md",
     "Untitled.canvas"
   ]
 }
\ No newline at end of file
diff --git a/300 areas/360 Dev-Ops Network Computers/Error Tracking.md b/300 areas/360 Dev-Ops Network Computers/Error Tracking.md
index 3d59185..15685fd 100644
--- a/300 areas/360 Dev-Ops Network Computers/Error Tracking.md	
+++ b/300 areas/360 Dev-Ops Network Computers/Error Tracking.md	
@@ -72,3 +72,27 @@ Two failures blocked the request path.
 - Changed `app.py` MQTT intake to retry and reconnect. Backup: `app.py.bak-mqtt-20260906`.
 - Run `sudo systemctl restart voice-agent` to load the change.
 - DeepSeek key is valid but the account balance is zero. Add credit at platform.deepseek.com.
+
+---
+
+# 2026-09-09 — Garage S3 web returns 404/403 for site images (anonymous hosting)
+
+## Symptom
+A Go + htmx site (being built for `kontra.day`) tried to serve uploaded images through **Garage S3 web** (`:3902`) and got `404` on the bucket root and `403 Forbidden: Garage does not support anonymous access yet` in `docker logs family-home-lab-garage-1`.
+
+## Root cause
+Two things misled the diagnosis:
+
+1. **Wrong claim (from an earlier AI):** it said `[s3_web]` was absent and the web server wasn't running. **False** — `[s3_web]` IS in `garage.toml` (`bind_addr = "[::]:3902"`, `root_domain = ".web.lab.audasmedia.com.au"`, `index = "index.html"`) and the log shows `Web server listening on http://[::]:3902`. Verified: `ss -tln` shows 3902 bound (Garage web server), 3903 admin, 3909 garage-webui.
+2. **Real issue:** Garage S3 Web is **not anonymous static hosting**. It requires **per-bucket web access + a read-scoped access key**. Without it, every request gets `403 Forbidden: Garage does not support anonymous access yet`, and the bucket root 404s with no index/perm.
+
+## Fix / correct pattern
+- **Do NOT** point site/app code at `:3902` for anonymous browsing.
+- **Use the S3 API** (`:3900`, region `garage`) with a **read-scoped key** for uploads/reads.
+- **Serve images** through the app or **Caddy** (reverse-proxy to Garage with the read key, or a Caddy `file_server` static dir) — not via `:3902` directly.
+- If web-serving a bucket is truly needed, enable **per-bucket web access + a guest/read key** in Garage (not a global switch).
+
+## Verification / non-causes
+- `[s3_web]` present; web server confirmed running (log line + port 3902 bound) → the earlier "no s3_web / not running" diagnosis was wrong.
+- Port map: 3900 S3 API · 3902 S3 web · 3903 admin API · 3909 garage-webui. No port conflict.
+- Documented in the Garage section of [[Backup System — Borg, Kopia & Restic]] and the kontra.day site handoff.