CHANGELOG: v0.164.0 released (the weekly upload line test, R-1247), delivered to the three test boxes, vouched by the operator; REPORT

CHANGELOG.md

@@ -1,4 +1,10 @@
-## Unreleased (next: v0.164.0; 2026-10-24 attended release run) — the weekly upload line test (R-1247)
+## v0.164.0 — the weekly upload line test (R-1247) (2026-10-24) — RELEASED on the operator's ruling (attended release run); vouched by the operator 09:44:58 CEST
+
+Binary sha256 `1b803d8b70f8afbe1546f6989f35b6b0e29c9ed63f6acb3843d3c04ef0d24b2b`; config bundle sha256
+`1d7b54d39d0c1aff682ba0c0a7f91aea0f9407a10d2f5a8bbfdc858d32c13341` (configs unchanged — no bundle job sent). Built from
+`f7e1dcb` (CI 2277 green) in a fresh clone by `scripts/release-agent.sh`. Delivered by one signed `agent_update` per box
+(07:25Z): Tester 1, demo-hp and demo-felhom — COMPLETED, self-check 76/76, committed after the 1-minute dwell, the line
+test started (felhom.eu `audits/line-test-2026-10-24/agent-0164-boxes.txt`).
 
 Operator ruling 2026-10-24 07:26: once a week the box's HOST measures its upload line with a 10-second iperf3 upload to an
 iperf3 server on ep0 that answers **only inside the WireGuard tunnel** (felhom.eu `scripts/ep0-iperf3/`; installed the same

REPORT.md

@@ -1,36 +1,28 @@
-# REPORT — day 2026-10-23: agent 0.163.0 released, delivered to the three test boxes, vouched by the operator
+# REPORT — 2026-10-24 (attended release run): agent 0.164.0 — the weekly upload line test (R-1247)
 
-**What:** the day brief's Part 2. Design read: `03-host-agent.md` (the tunnel, the bundle), `11` §5.4.2 (the step
-bundle, R-880).
+**What:** the operator's line-measure ruling (2026-10-24 07:26): once a week the host measures its upload line with a
+10-second iperf3 upload to ep0's tunnel-only server. The agent speaks iperf3 itself (the operator's pick — no host has the
+program). Design read: felhom.eu `06` §4.5/§5 (the tunnel, the endpoint), `08` §9 (the watch that uses the line).
 
-## Release
+## Built (`f7e1dcb`, CI 2277 green)
 
-- Code: `1109092` (D4 v2: the sshd drop-in `/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf`,
-  `PermitRootLogin prohibit-password`, `try-reload-or-restart`, an `sshd -T` read-back; RootKeyOnly 6 tests). CI 2246
-  success. CHANGELOG `b4721ee` (v0.163.0 header, both sha256), CI 2249 success.
-- `scripts/release-agent.sh 0.163.0`: binary sha256 `561b5316cd511de9fa9d8b8be4553da7add684f715d3bea533ca330ff7f3763c`,
-  config bundle sha256 `3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8`; tag `v0.163.0`; verified by
-  an independent download.
-- **Vouched by the operator** 07:58:46 UTC — read back from the hub DB (with its WAL) and from the running hub's
-  `/configuration` page: agent 0.163.0, both sha256 as above.
+- `internal/linetest`: `Client` (the iperf3 3.x client protocol; the value is the SERVER's received bytes) and `Tester`
+  (Tuesday 10:00–15:59 local from a per-host slot; a never-measured host is due at once inside the window; 10 quiet
+  minutes of the physical uplink; the one-heavy-op gate; best of 3; busy → later the same day, ≤ 6 tries/day; no tunnel →
+  no test). `line_test` report stanza; `GET /host/line-test`; `wgtunnel.Manager.LineTestTarget`; `line_test.disable`.
+- 15 tests, each red-proved by a mutation (listed in the CHANGELOG entry).
 
-## Delivery — three signed jobs per box (felhom-opsign, key felhom-op-1)
+## Released and delivered
 
-The D4 drop-in is a NEW bundle path, and the boxes ran bundle 0.160.0 (sha256 `6b0609…`), so: `agent_update 0.163.0`
-→ `agent_config_update 0.163.0-step1` (built with `scripts/build-step-bundle.py` from 0.160.0: only
-`felhom-os-apply` replaced; sha256 `6cbc0669…`, uploaded and read back) → `agent_config_update 0.163.0`.
+`release-agent.sh 0.164.0` from a fresh clone: tag `v0.164.0`, sha256 `1b803d8b…`, bundle `1d7b54d3…`, verified by
+download. One signed `agent_update` per test box → COMPLETED, self-check 76/76, committed (07:33Z demo-hp, 07:34Z Tester 1,
+07:40Z demo-felhom). **Vouched by the operator** (read back: the hub page and the hub's `Artifact manifest set` line).
 
-| Box | agent | bundle | self-check | swap = RAM (pool guest 9201) | drop-in, `sshd -T` | sshd reloaded | key login | felhom-sshd |
-|---|---|---|---|---|---|---|---|---|
-| Tester 1 | 0.163.0 | 0.163.0 | ok | 4096 / 4096 | in place, `without-password` | 09:27:38 SIGHUP | ok | active, listening, `sshd -t` ok |
-| demo-hp | 0.163.0 | 0.163.0 | ok | 25898 / 25898 | in place, `without-password` | 09:19:44 SIGHUP | ok | active, listening, `sshd -t` ok |
-| demo-felhom | 0.163.0 | 0.163.0 | ok | 12288 / 12288 | in place, `without-password` | 09:24:42 SIGHUP | ok | active, listening, `sshd -t` ok |
+## Proven live
 
-**Not proven, said plainly:** the real root password over SSH was not tried (CC does not hold it); a dummy password is
-refused, but OpenSSH logs that only as „Failed password", so the policy proof is `sshd -T` + the reload. felhom-sshd
-(:8822) admits only the operator peer over the tunnel, so a connection from DooPlex times out by design. The console
-login is not touched by the drop-in (`passwd -S root` = P on all three); not tried at a physical console.
+A probe built from this package on demo-hp's host: **90.7 Mbit/s** in 10.4 s; a second test 2 s later → „server busy" in
+0.1 s, the first undisturbed. ep0's port answers only in the tunnel. The boxes' own first tests follow the window.
 
-Installer 1.36.0 (the uninstall removes the drop-in) was published the same day (felhom.eu). R-982 and R-1204 closed.
-Evidence: felhom.eu `documentation/audits/day-2026-10-23/07-agent-0163-boxes.txt`, `10-vouch-readback.txt`,
-`11-installer-1360.txt`.
+## Open
+
+R-1250 — a qBittorrent that seeds all day keeps the uplink from being quiet, so that host is never tested.