# REPORT — controller v0.196.0 (R-200 Part 0) + the R-203 finding (2026-08-04)

**Deployed:** `felhom-controller:0.196.0` on demo-hp guest 9201 and demo-felhom guest 9201. Requires
agent >= v0.125.0.

## Part 0 — `--recover-offsite-install`

The sibling of `--recover-offsite-check`: same fetch → unseal → extract path through the agent, same
STDIN discipline for R, but it **places** the recovered repository password via `InjectOffboxPassword`
so a rebuilt box reopens the off-site history it inherited.

- **The confirmation is a second invocation.** Without `--confirm-install` both hashes print and
  nothing is written; the operator sees the comparison before a write is possible.
- **Three outcomes, named distinctly:** *installed* (no local password — the rebuilt-box shape),
  *unchanged* (identical key present, nothing written), *refused* (a DIFFERENT key present — exit 2,
  no force offered, because which history to keep is not this command's decision).
- It re-reads the file after writing rather than trusting the call's return.

`go build && go vet && go test ./...` rc=0; `controller_gates.py --fast` OK.
**Red-proof observed:** removing the confirmation gate makes the dry run write the password.
The R-persistence test carries a **positive control** (a planted copy found, then removed and not
found) because an absence check is worth only what its sensitivity is.

**NOT exercised against a live recovery** — the R-201 drill halted before step 9. Unit-proven only.

## The R-203 finding — see CONTEXT.md

A customer-declared **mandatory** data directory was silently absent from the off-site snapshot while
the run reported `ok`, because the deploy-time `${USERDATA_PATH}` root and the backup-time
`NamespaceRoot` disagree for an app on the system drive. It halted the drill: the sentinel file was not
in the snapshot, so a wipe would have destroyed it and proven nothing.

Full record: `felhom.eu/documentation/audits/DRILL-r201-offsite-recovery-2026-08-04.md`.

## Observations

- **The CSRF form field is `_csrf`, not `csrf_token`** — the login page uses one name and the protected
  forms another. Cost real time; worth a line in the headless-access memory.
- **`/api/stacks/<name>/deploy` accepted `HDD_PATH=/mnt/sys_drive`** one call after refusing a NAS path
  with a clear error. If the system drive is not a valid app namespace, that refusal is missing.
- **demo-hp has no registered drive usable as an app namespace** (its only drive is a NAS), which is
  why the drill's file-leg app had to go on the system drive at all.