docs: R-200 diagnostic — CONTEXT + REPORT (proven live on demo-felhom)

2026-08-04 13:56:01 +02:00
parent 9640e51321
commit bdab80c933
2 changed files with 64 additions and 81 deletions
@@ -1672,6 +1672,26 @@ Last updated: 2026-06-13 (v0.60.0 backlog-Medium cleanup)

 ---

+## R-200 (v0.195.0) — the offsite key recovery diagnostic
+
+`--recover-offsite-check` is a `docker exec` escape hatch (the `--print-reset-code` shape), NOT a page
+or an API a browser can reach. R comes from **STDIN** — never argv, never `ps`, never shell history,
+never a transcript. It asks the agent (>= v0.125.0) to fetch this host's sealed bundle and open it,
+then reports whether the recovered repository password matches the on-disk one **by sha256**.
+
+    docker exec -i felhom-controller /usr/local/bin/felhom-controller --recover-offsite-check < /path/to/code
+
+**IT COMPARES AND NEVER INSTALLS.** `CheckOffsiteKeyRecoverable` must stay free of any write — if a
+future change makes it place the recovered password, it stops being a diagnostic and needs the drill's
+supervision (that is link 9, R-200's remaining half). Pinned by
+`TestCheckOffsiteKeyRecoverable_WritesNothing`, whose red-proof is adding the install call.
+
+Exit codes are load-bearing: **0** match, **2** a clean MISMATCH, **1** a step failed. A mismatch is a
+finding about the system; a failure is a finding about the run, and they must never share a status.
+
+**Proven live on demo-felhom 2026-08-04** — recovered sha256 == on-disk sha256 == the hub's stored
+hash. Nothing customer-facing ships with it: no card, no form, no preview.
+
 ## About Viktor (project owner)

 - Works at Deutsche Telekom (Budapest), building Felhom.eu as a side business