night 2026-10-22: REPORT; CHANGELOG corrected — a push of the installer to main publishes nothing (R-110, tag installer-v1.35.0); D4 stays a patch because both halves need a release

CHANGELOG.md

@@ -5,10 +5,7 @@
   (`PermitRootLogin prohibit-password`), a `sshd` content check (exactly `prohibit-password`; `sshd -t -f`), and after
   an install that wrote it `sshd -t` + `systemctl reload ssh`; tests `RootKeyOnly` (3), red-proved. Live on a fresh
   nested box from ISO 1.30.0: root password over SSH refused, root key works, the console and the web page still take
-  the password. It was committed (`a0c88e5`) and moved back out (this commit): the installer's uninstall must remove
-  every bundle file (felhom.eu `scripts/test_hostinstall.py`), and a push of `felhom-host-install.sh` publishes the
-  installer to every new box — forbidden tonight. Both halves are patches: `felhom-agent-bundle-D4.patch` and
-  `felhom.eu-installer-D4.patch` in that folder; apply them together with the agent release.
+  the password. It was committed (`a0c88e5`) and moved back out (`7651461`): the installer's uninstall must remove every bundle file (felhom.eu `scripts/test_hostinstall.py`), the bundle half reaches a box only with an agent release, and the installer half only with a new `installer-v…` tag (R-110 — a push to `main` alone publishes nothing) — both forbidden tonight. *(Corrected the same night: the first reason written here, „a push of `felhom-host-install.sh` publishes the installer", was wrong — the website serves `/scripts/` from the tag `installer-v1.35.0`, read live in `manifests/webpage.yaml` and the running Deployment.)* Both halves are patches: `felhom-agent-bundle-D4.patch` and `felhom.eu-installer-D4.patch` in that folder; apply them together with the agent release and the next installer tag.
 - **R-1204 — `wireguard.handshake_future_s`.** A box that ran once with its clock ahead keeps a handshake stamped in the
   future; ep0 refuses every newer one, and `last_handshake_age_s` (clamped at 0) read „just now" for ever. The heartbeat
   now carries how many seconds the handshake lies ahead (> 60 s only); the age keeps its clamp. The hub alarms on it

REPORT.md

@@ -1,17 +1,19 @@
-# REPORT — agent v0.162.0 released (2026-10-22 morning, operator yes) — NOT VOUCHED (the vouch is the operator's)
+# REPORT — night 2026-10-22: one change on `main`, one ready patch, nothing released
 
-**What:** the swap fix (R-1192: every guest may swap as much as its RAM), the host-swap report and check, and R-1194 (no
-false „operator access degraded" on a fresh box). Proven the night before on a fresh 8 GB box: 11 h, no freeze; with the
-host's swap off the freeze comes back (felhom.eu `REPORT-night-2026-10-21.md`).
+**What:** the night brief's agent parts. No agent release, no vouch (both forbidden tonight). Design read:
+`03-host-agent.md` (the WireGuard tunnel, the config bundle), `06-offsite-connectivity.md`.
 
-- **Released** with `scripts/release-agent.sh 0.162.0` from a clean clone at `b310773`: binary sha256
-  `5fd7a23bfe319cb521c4bc399612d5fb3413f1e695f79bc663c386f69c757928` (the same bytes as the night's candidate), bundle
-  `ac772967…60b5a5`, tag `v0.162.0`, round trip verified by the script.
-- **Delivered** by one signed `agent_update` job per box to demo-hp, Tester 1 and demo-felhom: all three `update
-  committed` with `capabilities self-check ok=76 total=76`; each raised its 9201's swap from 512 MB to its RAM. Evidence
-  felhom.eu `documentation/audits/morning-2026-10-22/release/04-agent-delivery.txt`.
-- **Found:** the host-swap check is too strict for a guest larger than 8 GB. demo-hp (host 8191 MB vs guests 25898 MB)
-  and demo-felhom (8191 vs 12288) warned and the hub mailed `host_swap_short`; the soak used at most 2.7 GB of host swap.
-  Filed felhom.eu R-1216 with two options for the operator.
-- **Not done:** the vouch (Configs → Day-0 artifacts, agent 0.162.0 / the sha above, the bundle with it) — the operator's
-  click; CC's token cannot. Tester 2's box was not sent the update (not a test box; the operator's word).
+- **R-1204, `a0c88e5` (on `main`, unreleased).** The heartbeat's `wireguard` block gains `handshake_future_s` when the
+  last handshake lies more than 60 s in the future (`wgtunnel.handshakeFuture`) — the clock-ahead lock-out that the
+  clamped `last_handshake_age_s` hid. Red-proved (`TestR1204_AFutureHandshakeIsReported`). The hub's alarm on it is
+  hub 0.166.0 (felhom.eu, built, not deployed).
+- **R-982 / D4 (operator 15:47: root SSH from the LAN by key only) — a ready patch, NOT on main (`7651461` moved it
+  out).** A bundle drop-in `/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf` (`PermitRootLogin prohibit-password`),
+  checked and reloaded by `felhom-os-apply`; proven on a fresh install from ISO 1.30.0 (nested VM 9343, destroyed):
+  password SSH refused, key works, the console and the PVE web login keep the password. Patches:
+  felhom.eu `audits/night-2026-10-22/P2-D4/felhom-agent-bundle-D4.patch` + `felhom.eu-installer-D4.patch`. They ship
+  with the next agent release (the operator's vouch) and the next installer tag.
+- **Correction:** the CHANGELOG first said a push of the installer would publish it. Wrong: `/scripts/` is served from
+  the tag `installer-v1.35.0` (R-110). The decision to keep D4 as a patch stands on the other two reasons.
+- **Gates:** `agent_gates.py --fast` green before each push. CI by commit: felhom.eu `REPORT-night-2026-10-22.md`.
+- **Teardown:** VM 9343 destroyed on demo-hp (own id); its hub appliance (id 49) waits for the operator's Discard.