From d4eb259da241c4ae2af81d5dff6a51b86c411b42 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 30 Jul 2026 09:33:53 +0200 Subject: [PATCH] =?UTF-8?q?docs(R-116):=20record=20the=20live=20proof=20?= =?UTF-8?q?=E2=80=94=20four=20events,=20two=20matched=20pairs,=20discrimin?= =?UTF-8?q?ated?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v0.116.0 validated on a fresh box: real day-0 from the v1.25.0 ISO on a nested PVE on demo-hp (per runbooks/target-selection.md), agent installed unaided from the vouched Day-0 manifest, drives enrolled through the real endpoints, device loss a real hot-detach. 07:20:04 backup_target_absent (error) Cel meghajto <- TARGET, specific 07:22:34 backup_target_restored (info) Cel meghajto <- its matching pair 07:24:04 storage_disconnected (error) Adat meghajto <- NON-target, generic 07:25:34 storage_reconnected (info) Adat meghajto All four reached the hub; gate fired in 3 s. Discrimination is proven NON-trivially for the first time -- both prior runs had the target itself emit the generic event, so their mirror proved nothing. Over-correction passes on a POSITIVE observable: 0 ABSENT lines and 0 drive events over 2m14s with both drives present, while two RETURNED lines prove the gate was ticking rather than dead. Caveat recorded, not a regression: the drill's controller was 0.185.1 from the golden, which predates R-114, so its absent-state banner showed the old false "backup is on the system disk" copy. The R-114 guard is pinned by unit test and by the payload, but could not be confirmed on that box. Filed as R-120 -- the golden is a release behind the deployed controller, which is R-115's class one layer up. Teardown all three layers, including the hub: VM purged, storage removed with the space measured back, hub records gate-blocked on ONLINE with the command recorded. Suite rc=0 read separately from this commit. --- CHANGELOG.md | 17 +++++++++++++++++ REPORT.md | 31 ++++++++++++++++++++++++++++--- 2 files changed, 45 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 50f617d..c875476 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -60,6 +60,23 @@ the **root** filesystem (**R-118's symptom, incidentally gone; R-118 itself is N open**). No consumer of those was found: wipe/decommission need the drive present, `firstOfferableDrive` already excludes it, and the disk-health baseline excludes UNKNOWN verdicts. +**PROVEN LIVE 2026-07-30 — the full four-event sequence, on a fresh box.** Real day-0 on a nested PVE on +demo-hp, the agent **installed unaided from the vouched Day-0 manifest**, drives enrolled through the real +endpoints, device loss a real hot-detach: + +``` +07:20:04 backup_target_absent (error) Cel meghajto ← the TARGET, specific, was generic before +07:22:34 backup_target_restored (info) Cel meghajto ← its matching pair +07:24:04 storage_disconnected (error) Adat meghajto ← a NON-target, generic, same box +07:25:34 storage_reconnected (info) Adat meghajto +``` + +All four reached the hub. Gate fired in **3 s**. **Discrimination is proven non-trivially for the first +time** — both prior runs had the target itself emit the generic event, so their mirror proved nothing. +Over-correction guard passes on a *positive* observable: 0 ABSENT lines and 0 drive events over 2m14s with +both drives present, while two `RETURNED` lines prove the gate was ticking. Audit: `felhom.eu` +`audits/R116-v0116-2026-07-30.md`. + **Tests 845 → 849.** Four red-proofs, each mutation verified to have landed before the run: (1) v0.115.0's MountPath-only fallback → `isTarget[guestPath] = FALSE, rows=2`; (2) drop the guest-path dedup → `carried by 2 rows`; (3) give the absent row a MountPath → the R-114 guard fires; (4) over-broad diff --git a/REPORT.md b/REPORT.md index 75b6042..680ce4f 100644 --- a/REPORT.md +++ b/REPORT.md @@ -112,7 +112,32 @@ One red-proof was restored with `git checkout `, which discarded the whole than the one-line mutation. Re-applied and re-verified; later red-proofs restored from pristine copies kept outside the repo. `git checkout` is not an undo for a mutation on a work-in-progress file. -## NOT yet live-validated at the time of this commit +## LIVE VALIDATION — all claims PASS (`felhom.eu` `audits/R116-v0116-2026-07-30.md`) -Publish + vouch, C5 pairing, discrimination, and the over-correction guard — the session's live half. -Outcome recorded in the audit under `felhom.eu/documentation/audits/`. +Fresh box, real day-0 from the v1.25.0 ISO on a nested PVE on **demo-hp** (per `runbooks/target-selection.md`), +agent **installed unaided from the vouched Day-0 manifest**, both drives enrolled through the real endpoints, +device loss a real hot-detach. + +``` +07:20:04 backup_target_absent (error) Cel meghajto ← TARGET, specific (was generic through v0.115.0) +07:22:34 backup_target_restored (info) Cel meghajto ← its matching pair +07:24:04 storage_disconnected (error) Adat meghajto ← NON-target, generic, same box 4 min later +07:25:34 storage_reconnected (info) Adat meghajto +``` + +All four at the hub; gate fired in 3 s. **Discrimination proven non-trivially for the first time.** +Over-correction passes on a positive observable (0 ABSENT lines / 0 drive events over 2m14s with both drives +present, target `degraded:false`, while two `RETURNED` lines prove the gate ticked). Publish observables: +registry GET of the published bytes matched `b47c5c4d…`, the manifest was read back showing 0.116.0, and the +box reported it running. + +**One caveat, not a regression:** the drill's controller was **0.185.1** from the golden, which predates +R-114, so its absent-state banner showed the old false "the backup is on the system disk" copy. The R-114 +guard is pinned by unit test and by the payload (no row combines the flag with a mount path) but could not be +confirmed on that box. Filed as **R-120** — the golden is a release behind, which is R-115's class one layer up. + +## Teardown — all three §13 layers + +VM 9401 destroyed `--purge`; `r116-images` removed and the space measured back (`felhom-backup` 928787076 KiB +available vs 928787080 before); hub records **gate-blocked** — the cascade was attempted and correctly refused +`HTTP 409 host … is ONLINE`, with the command recorded for once it ages to DOWN. Secrets shredded.