felhom-controller/REPORT.md

REPORT — v0.289.0 / v0.289.1: the off-site key cannot delete (decisions 68–69) — 2026-10-03

Full session report: felhom.eu/REPORT-offsite-lock-build-2026-10-03.md. Architecture: 07-backup-architecture.md (custody block, threat rows 9/10/12), 06 §3.6, 09 §3 decisions 68–70.

• v0.289.0: append-only rclone: transport for the hub tier; the box sends only its public key to the hub registrar and proves the pin before configuring; both forget sites, the move-aside and the abandonment leave the box on that tier; retention only inside a hub window behind the fake-snapshot guard (R-822).
• v0.289.1 (found live): the provider's rclone NOTICE broke every --json parse → the box recorded 0 snapshots as measured and the hub mailed a false offsite_snapshots_dropped. The notice is stripped; an unreadable count keeps the last value with stats_known=false. Two releases this session — the second one fixes a defect the first put live; the one-release rule was broken on purpose and is named here.
• Tests + red-proofs: felhom.eu/documentation/audits/offsite-lock-build-2026-10-03/partC/red-proofs-controller.txt.
• Live: demo-felhom 11→13 snapshots, demo-hp 91→100 (history kept); a delete from each box refused (403); restore of one file and check through the pinned key on each. Floor 0.289.1 served to both; golden 0.289.1 baked + vouched.
• MinAgent 0.131.0 (unchanged).