From 3e3ee94b7bbe6b66663c468e22aa86616365a45a Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Wed, 12 Aug 2026 19:05:23 +0200 Subject: [PATCH] REPORT: live 422 proven on hardware; R-308 withdrawn (my quoting bug, not a stale credential) --- REPORT.md | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/REPORT.md b/REPORT.md index abce01c..abadaf7 100644 --- a/REPORT.md +++ b/REPORT.md @@ -71,5 +71,19 @@ gates OK. Red-proofs, each mutation asserted to have applied: ## Deployed `gitea.dooplex.hu/admin/felhom-controller:0.214.0` built, pushed, deployed to guest 9201 — -`Up … (healthy)`. Live validation of the customer screen was **endpoint/handler-level, not a -click-through**: the dashboard password of record no longer opens this box (R-308). +`Up … (healthy)`. + +**Live, on hardware:** the agent returns **HTTP 422** for the old code (`opens_retained: true`, +`superseded_at: 2026-08-12T15:18:55Z`) and **400** for a wrong one. The hub serves the retained +packages (200, `count=2`, `unopenable_count=1`). + +**What was NOT walked:** the customer's rendered sentence. `recoveryUnlockHandler` redirects to +`/backups/remote` when `!recoveryOffer()`, and this box holds its own repository password again, so it +is correctly not in the offered state. Forcing it would mean removing that password to fake a rebuilt +box — destabilising a healthy machine to render a sentence pinned by six handler tests whose upstream +422 is proven live. **Method: endpoint-level for the agent/hub, handler-level for the message.** + +**Correction — R-308 is WITHDRAWN.** I previously reported the stored dashboard password as stale. It +is not: the `~/.config/credentials` values are wrapped in SINGLE quotes and I stripped only double +ones, so I was sending a literal `'`. Unquoted correctly it logs in first try (HTTP 302 + session +cookie). The same bug made this session's first live R-311 test read as a failure for twenty minutes.