# REPORT — v0.286.1: the box tells visitors apart (R-753, decision 63); R-772; R-773 — 2026-10-01 (night)

Full session report: `felhom.eu/REPORT-visitors-2026-10-01.md`. Evidence: `felhom.eu/documentation/audits/visitors-2026-10-01/`
(A = visitors apart, D = R-772/R-773, E = rollout). Architecture read: `01-topology-and-trust.md` §5/§7, `09` §3 decisions
45–49, 57–63.

## Baselines
controller `c1b123c64955` (v0.285.0) → `a28155f` (v0.286.1). Agent unchanged (0.138.0; MinAgent 0.131.0).

## Commits
`1e8d045` R-753 · `b53721d` R-772 · `1e216d3` R-773 · `d416742` v0.286.0 CHANGELOG/README · `79ef715` R-772 order fix
(found live) · `a28155f` v0.286.1 CHANGELOG.

## Tests and red-proofs
Full suite green (`go build/vet/test ./...`, rc 0) before each build; controller gates green (go-parity after the three
new keys were registered). Red-proofs, each seen FAILING on the mutant: RP-A1 (leftmost hop), RP-A2 (the tunnel hop as
the key), RP-A3 (no reconcile of a running traefik), RP-D1 (no-container record healthy), RP-D1b (the 0.286.0 order),
RP-D2 (no lock on a restore) — files under `audits/visitors-2026-10-01/{A,D}/RP-*`.

## Live
- **9202 (0.286.0, then 0.286.1, hand-set):** simulated tunnel — a stranger's 5 wrong dashboard logins with a rotating
  forged leftmost address locked only him; the household from another address in at once; LAN/impostor forgeries
  counted as themselves. R-772: a stopped probe container read `healthy false, not_checked true` 14 s later (0.286.1).
  R-773: Karakeep removed + restored → `opened_by: restore`, stranger `/signup` 403 and `users.create` 403, data back.
- **Both demo boxes (floor 0.286.1, min_agent 0.131.0):** each made `felhom-tunnel`, wrote the clean-up file, recreated
  traefik and moved cloudflared to `.2` by itself (~5 s). demo-hp's REAL tunnel: an app sees
  `6.6.6.6,37.191.56.193, 172.16.253.2`; `X-Forwarded-Host` forged → gone; the dashboard counter keyed on
  `37.191.56.193`, locked after 5. Every demo-hp app answers through the tunnel. **ep0's one request was refused by
  Cloudflare's edge (403) before the box** — the second outside address is unmeasured on the real tunnel (R-779).
- **Golden 0.286.1** baked, round-tripped, vouched (golden 0.286.1 / agent 0.138.0 / min_agent 0.131.0); the hub then
  refused golden 0.285.0 (R-120). `felhom.eu/documentation/tests/golden-0.286.1-2026-10-01/`.

## NOT validated live
- The app page's "not checked" line (render test only); R-773 on a block-only app (opengist/wishlist — same code path).
- A box rolling back below 0.286 with the new traefik (R-778, reasoned).