# REPORT — night 2026-10-22 → 23: D30 on `main`, the D4 patches v2, nothing released

**What:** the night brief's agent parts. No release, no vouch. Design read: `03-host-agent.md` (the tunnel, the key, the
bundle), `06-offsite-connectivity.md` (the full-list push to ep0).

- **D30** (`ae69ad4`, hardened `39fb9cb`, `b9b831f`): a handshake stamped in the future for 15 min → a new key pair,
  registered on `POST /hosts/<id>/wg` (the hub re-keys in place; its full-list push swaps the key on ep0 — nothing new
  on ep0). The key file is replaced by an fsynced rename over it (never missing or empty); the first old key stays
  `private.key.prev`, later ones dated (3 kept); the once-an-hour bound survives a restart; a wait stamp dated after now
  is dropped. Tests `TestD30_*` (7), each red-proved.
- **Live** (felhom.eu `audits/night-2026-10-23/P2-D30/`, test box Tester4-16fdef, fixture `ae69ad4`): with ep0 free to
  start a handshake, a 2-hour clock jump healed by itself and no re-key ran (correct); with ep0's starts dropped on the
  box, the tunnel stayed dead, the agent re-keyed at 15 min, the hub took the key (`existed=false generation=3
  sync=ok`), the box switched at its next desired-state fetch and shook hands with the new key.
- **D4 patches v2** (felhom.eu `audits/night-2026-10-23/P3-review/`), after a fresh review (A1–A7): `try-reload-or-restart`,
  an `sshd -T` read-back reported as `sshd_dropin_not_in_force`, a reload in undo, the right citation; installer: a warning
  when the reload fails. RootKeyOnly 6/6 (two new, red-proved); installer tests 40/40 with the patch. Both apply to
  tonight's mains. Live by hand on the test box: root password SSH refused, key works, web password 200.
- **Gap filed:** a reboot after the clock was corrected forgets the future stamp (felhom.eu R-1223).

CI by commit: `ae69ad4` 2229, `39fb9cb` 2235 green; `b9b831f` and this docs commit: see felhom.eu
`REPORT-night-2026-10-23.md`. Fixture names on the test box: `0.163.0-night.1` (= `ae69ad4`), then `0.162.99`
(= `b9b831f`; a plain number, because the controller cannot compare a pre-release string — the off-site unlock refused).