REPORT: live 422 proven on hardware; R-308 withdrawn (my quoting bug, not a stale credential)

REPORT.md

@@ -71,5 +71,19 @@ gates OK. Red-proofs, each mutation asserted to have applied:
 ## Deployed
 
 `gitea.dooplex.hu/admin/felhom-controller:0.214.0` built, pushed, deployed to guest 9201 —
-`Up … (healthy)`. Live validation of the customer screen was **endpoint/handler-level, not a
-click-through**: the dashboard password of record no longer opens this box (R-308).
+`Up … (healthy)`.
+
+**Live, on hardware:** the agent returns **HTTP 422** for the old code (`opens_retained: true`,
+`superseded_at: 2026-08-12T15:18:55Z`) and **400** for a wrong one. The hub serves the retained
+packages (200, `count=2`, `unopenable_count=1`).
+
+**What was NOT walked:** the customer's rendered sentence. `recoveryUnlockHandler` redirects to
+`/backups/remote` when `!recoveryOffer()`, and this box holds its own repository password again, so it
+is correctly not in the offered state. Forcing it would mean removing that password to fake a rebuilt
+box — destabilising a healthy machine to render a sentence pinned by six handler tests whose upstream
+422 is proven live. **Method: endpoint-level for the agent/hub, handler-level for the message.**
+
+**Correction — R-308 is WITHDRAWN.** I previously reported the stored dashboard password as stale. It
+is not: the `~/.config/credentials` values are wrapped in SINGLE quotes and I stripped only double
+ones, so I was sending a literal `'`. Unquoted correctly it logs in first try (HTTP 302 + session
+cookie). The same bug made this session's first live R-311 test read as a failure for twenty minutes.