# REPORT — controller v0.195.0: prove the offsite key comes back (2026-08-04, R-200 plumbing half)

**Deployed:** `gitea.dooplex.hu/admin/felhom-controller:0.195.0` on guest 9201 (demo-felhom), `Up (healthy)`.
**Requires agent >= v0.125.0** (declared MinAgent) and hub >= v0.94.0.

## What shipped

`--recover-offsite-check` — a `docker exec` diagnostic in the shape of `--print-reset-code`. It reads
the customer's recovery code from **STDIN**, asks the agent to fetch this host's hub-held sealed bundle
and open it, and reports whether the recovered offsite repository password matches the one on disk
**by sha256**. Two hashes and a verdict; never a password, never the recovery code, never a blob.

- `internal/backup/offbox_recovery_check.go` — `CheckOffsiteKeyRecoverable`, hashes only.
- `internal/backup/offbox_recovery_cli.go` — the entry point, R from stdin.
- `internal/agentapi/escrow.go` — `RecoverOffsiteRepoPassword` (the only place R crosses outbound).
- `cmd/controller/main.go` — the flag, alongside `--print-reset-code`.

**R from stdin and not a flag** because a flag value is visible in `ps`, in shell history, in a
container's command line and in any session transcript. **It compares and never installs** (§8.5):
the recovered password is not written to `offbox/repo_password`, and link 9 — placing it so the
existing repository opens — is next session's work, with the drill around it.

## THE RESULT

On demo-felhom, 2026-08-04 13:49 CEST:

```
  on-disk   sha256: c60c8bc737a6b7c6647c7849283f52087f650a885babedb4ef5fdf9a5c9543cb
  recovered sha256: c60c8bc737a6b7c6647c7849283f52087f650a885babedb4ef5fdf9a5c9543cb
  [MATCH] the offsite repository password IS recoverable from the sealed escrow.
```

Both equal the hash the hub independently stores as `restic_pw_sha256` — three sources agree.
Confirmed non-write: `offbox/repo_password` mtime is still `2026-08-03 07:18:02` afterwards.

Five minutes earlier the same path with a deliberately wrong code returned
`[FAIL] … the recovery code did not open the sealed bundle … nothing was written`, exit 1.

## Tests

`go build ./... && go vet ./... && go test ./...` — rc=0; `controller_gates.py --fast` — all OK.
New: `offbox_recovery_check_test.go` — match/mismatch verdicts, the no-local-password shape, R passed
through verbatim, agent-failure-is-not-a-mismatch, and the four exit codes with a check that no
printed stream carries a secret.

**Red-proof observed:** adding `InjectOffboxPassword` to the check fails
`TestCheckOffsiteKeyRecoverable_WritesNothing` with *"the check INSTALLED the recovered password"*.

## Not in this release

No card, no form, no preview, no customer-facing text — building an interface on a chain nobody had
walked is how the preceding three weeks went wrong. The customer-facing shape the operator ruled on
(yell → recovery-code form → preview → proceed) is R-200's remaining half, now priced against a chain
that exists. **R-201 stays open:** no recovered password has been installed, no repository reopened,
no file restored.

## Observation

The controller binary is at `/usr/local/bin/felhom-controller`, not `/app/…` — a guessed path cost the
first diagnostic invocation. Worth a line in the runbook when one is written.