REPORT: night 2026-10-22/23 (D30 live, hardened; D4 patches v2)

REPORT.md

@@ -1,19 +1,23 @@
-# REPORT — night 2026-10-22: one change on `main`, one ready patch, nothing released
+# REPORT — night 2026-10-22 → 23: D30 on `main`, the D4 patches v2, nothing released
 
-**What:** the night brief's agent parts. No agent release, no vouch (both forbidden tonight). Design read:
-`03-host-agent.md` (the WireGuard tunnel, the config bundle), `06-offsite-connectivity.md`.
+**What:** the night brief's agent parts. No release, no vouch. Design read: `03-host-agent.md` (the tunnel, the key, the
+bundle), `06-offsite-connectivity.md` (the full-list push to ep0).
 
-- **R-1204, `a0c88e5` (on `main`, unreleased).** The heartbeat's `wireguard` block gains `handshake_future_s` when the
-  last handshake lies more than 60 s in the future (`wgtunnel.handshakeFuture`) — the clock-ahead lock-out that the
-  clamped `last_handshake_age_s` hid. Red-proved (`TestR1204_AFutureHandshakeIsReported`). The hub's alarm on it is
-  hub 0.166.0 (felhom.eu, built, not deployed).
-- **R-982 / D4 (operator 15:47: root SSH from the LAN by key only) — a ready patch, NOT on main (`7651461` moved it
-  out).** A bundle drop-in `/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf` (`PermitRootLogin prohibit-password`),
-  checked and reloaded by `felhom-os-apply`; proven on a fresh install from ISO 1.30.0 (nested VM 9343, destroyed):
-  password SSH refused, key works, the console and the PVE web login keep the password. Patches:
-  felhom.eu `audits/night-2026-10-22/P2-D4/felhom-agent-bundle-D4.patch` + `felhom.eu-installer-D4.patch`. They ship
-  with the next agent release (the operator's vouch) and the next installer tag.
-- **Correction:** the CHANGELOG first said a push of the installer would publish it. Wrong: `/scripts/` is served from
-  the tag `installer-v1.35.0` (R-110). The decision to keep D4 as a patch stands on the other two reasons.
-- **Gates:** `agent_gates.py --fast` green before each push. CI by commit: felhom.eu `REPORT-night-2026-10-22.md`.
-- **Teardown:** VM 9343 destroyed on demo-hp (own id); its hub appliance (id 49) waits for the operator's Discard.
+- **D30** (`ae69ad4`, hardened `39fb9cb`, `b9b831f`): a handshake stamped in the future for 15 min → a new key pair,
+  registered on `POST /hosts/<id>/wg` (the hub re-keys in place; its full-list push swaps the key on ep0 — nothing new
+  on ep0). The key file is replaced by an fsynced rename over it (never missing or empty); the first old key stays
+  `private.key.prev`, later ones dated (3 kept); the once-an-hour bound survives a restart; a wait stamp dated after now
+  is dropped. Tests `TestD30_*` (7), each red-proved.
+- **Live** (felhom.eu `audits/night-2026-10-23/P2-D30/`, test box Tester4-16fdef, fixture `ae69ad4`): with ep0 free to
+  start a handshake, a 2-hour clock jump healed by itself and no re-key ran (correct); with ep0's starts dropped on the
+  box, the tunnel stayed dead, the agent re-keyed at 15 min, the hub took the key (`existed=false generation=3
+  sync=ok`), the box switched at its next desired-state fetch and shook hands with the new key.
+- **D4 patches v2** (felhom.eu `audits/night-2026-10-23/P3-review/`), after a fresh review (A1–A7): `try-reload-or-restart`,
+  an `sshd -T` read-back reported as `sshd_dropin_not_in_force`, a reload in undo, the right citation; installer: a warning
+  when the reload fails. RootKeyOnly 6/6 (two new, red-proved); installer tests 40/40 with the patch. Both apply to
+  tonight's mains. Live by hand on the test box: root password SSH refused, key works, web password 200.
+- **Gap filed:** a reboot after the clock was corrected forgets the future stamp (felhom.eu R-1223).
+
+CI by commit: `ae69ad4` 2229, `39fb9cb` 2235 green; `b9b831f` and this docs commit: see felhom.eu
+`REPORT-night-2026-10-23.md`. Fixture names on the test box: `0.163.0-night.1` (= `ae69ad4`), then `0.162.99`
+(= `b9b831f`; a plain number, because the controller cannot compare a pre-release string — the off-site unlock refused).