## 2026-09-16T10:01:44Z bind done; watching the box set itself up
## 2026-09-16T10:02:10Z inside the box (operator path, root password from the install):
Permission denied, please try again.
## 2026-09-16T10:02:14Z host record on the hub: tester-1-652049
2026/09/16 12:01:56 [INFO] host enrolled: tester-1-652049 (customer tester-1)
2026/09/16 12:01:56 [INFO] claim reenroll email sent to the registered address of tester-1
2026/09/16 12:01:56 [INFO] [claim] reenroll code (gen 3) emailed to the registered address of tester-1
2026/09/16 12:01:56 [INFO] [claim] reset code re-issued (gen 3) for tester-1 on box re-enrollment (clean-slate reinstall)
2026/09/16 12:02:14 [INFO] wg registered: host=tester-1-652049 pubkey=8Eaq0bPjRBLDfdtHzaVD8trl4NxeJ8toCQshtcDhbkA= ip=10.77.0.5/32 changed=true gen=1 sync=ok
## 2026-09-16T10:02:49Z OBSERVATION: root SSH with the password typed during the install is REFUSED after the bind ("Permission denied") — consistent with the universal-ISO flow rotating the box credential once the hub claims it. The volunteer path needs no SSH; operator shell access is the hub-vaulted break-glass credential.
## 2026-09-16T10:03:05Z hub lines for tester-1 (WG + pbsdr + claim + floor):
2026/09/16 12:01:20 [INFO] appliance credentials DELIVERED once to appliance 29 (customer=tester-1 mode=appliance; passphrase withheld)
2026/09/16 12:01:28 [INFO] Config downloaded for customer tester-1
2026/09/16 12:01:56 [INFO] host enrolled: tester-1-652049 (customer tester-1)
2026/09/16 12:01:56 [INFO] claim reenroll email sent to the registered address of tester-1
2026/09/16 12:01:56 [INFO] [claim] reenroll code (gen 3) emailed to the registered address of tester-1
2026/09/16 12:01:56 [INFO] [claim] reset code re-issued (gen 3) for tester-1 on box re-enrollment (clean-slate reinstall)
2026/09/16 12:01:57 [INFO] vaulted break-glass recovery credential for host tester-1-652049 (user=root@pam, secret 32 chars)
2026/09/16 12:01:59 [INFO] Artifact manifest served for customer tester-1 (agent=0.131.0 golden=0.243.0)
2026/09/16 12:01:59 [INFO] Config downloaded for customer tester-1
2026/09/16 12:02:14 [INFO] wg registered: host=tester-1-652049 pubkey=8Eaq0bPjRBLDfdtHzaVD8trl4NxeJ8toCQshtcDhbkA= ip=10.77.0.5/32 changed=true gen=1 sync=ok
2026/09/16 12:02:14 [INFO] host-report from tester-1-652049 (0 guests, 2 storage targets, 0 backups, 0 restore-tests, 0 pbs-snapshots, 10228 bytes)
2026/09/16 12:02:14 [INFO] DR-recipe host-half stored for customer tester-1 (host tester-1-652049, v1)
2026/09/16 12:02:15 [ERROR] pbsdr auto-provision for tester-1 (WG-registration hook): the endpoint already holds a PBS token for tester-1 but the hub has no descriptor — use the explicit "Re-issue PBS credentials" action — save the customer config to retry
2026/09/16 12:02:15 [INFO] Config downloaded for customer tester-1
2026/09/16 12:03:04 [INFO] restore-test staleness: tester-1 local tier: not restore-proven yet, but only watching for 0s (grace 168h0m0s since first contact 2026-09-16T10:02:14Z) — newborn, not a fault
[Controller] …s Hosts Offsite Configuration ← All Customers Tester 1 Last report: 1 min ago · Controller 0.243.0 Auto-refresh (paused) Tester 1 ok Controller 0.243.0 Last report 1 min ago Containers 0/0 Overview Applications Setup Edit Backup & DR Events…
[Guests] …d Generation 1 Vitals CPU 0% Memory 20% Disk (root fs) 31% Cloudflared inactive Guests 0/0 running Guests No guests reported on this host. Storage Targets Name Role Type State Fill Thin Pool SMART Temp Wear local — local attached 31% — UNKN…
[0.243.0] …site Configuration ← All Customers Tester 1 Last report: 1 min ago · Controller 0.243.0 Auto-refresh (paused) Tester 1 ok Controller 0.243.0 Last report 1 min ago Containers 0/0 Overview Applications Setup Edit Backup & DR Events Notificati…
[Agent] …ter-1-652049 → tester-1-652049 ONLINE Host ID tester-1-652049 Customer Tester 1 Agent Version 0.131.0 PBS wrapper matches vouched 104db0a4401f… Enrolled 3 min ago Last Report 2 min ago Desired Generation 1 Vitals CPU 0% Memory 20% Disk (roo…
## 2026-09-16T10:17:40Z 2026/09/16 12:17:16 [INFO] host-report from tester-1-652049 (1 guests, 2 storage targets, 1 backups, 0 restore-tests, 0 pbs-snapshots, 11172 bytes)
host: tester1
agent: felhom-agent 0.131.0
VMID       Status     Lock         Name                
9201       running    backup       tester-1            
controller image: gitea.dooplex.hu/admin/felhom-controller:0.243.0
golden marker: 
--- agent journal, golden/provision lines:
Sep 16 12:02:12 tester1 felhom-agent[3602]: time=2026-09-16T12:02:12.605+02:00 level=WARN msg="local-api leaf REGENERATED — any previously issued bootstrap pins are now INVALID; controllers will fail the pin check until re-boots
Sep 16 12:02:13 tester1 felhom-agent[3602]: time=2026-09-16T12:02:13.369+02:00 level=INFO msg="backup: restore-test scheduler starting (per-archive due-check)" eval_interval=6h0m0s settle=24h0m0s
--- install log (day-0):
/var/log/felhom-bootstrap-postinst.log
-rw-r--r--  1 root     root               408 Sep 16 11:13 felhom-bootstrap-postinst.log
--- golden lines in any felhom log:
--- vzdump/backup files present:
-rw-r--r-- 1 root root        16 Sep 16 12:08 vzdump-lxc-9201-2026_09_16-12_08_25.tar.zst.notes
-rw-r--r-- 1 root root 946388992 Sep 16 12:28 vzdump-lxc-9201-2026_09_16-12_27_11.tar.dat
drwxr-xr-x 3 root root      4096 Sep 16 12:27 vzdump-lxc-9201-2026_09_16-12_27_11.tmp
## HOW THE GOLDEN LANDING IS EVIDENCED (2026-09-16), stated because there is no single box-side line:
##  - hub, 09:01:59Z: "Artifact manifest served for customer tester-1 (agent=0.131.0 golden=0.243.0)" — the vouched set
##    is this run's own bake (GOLDEN_SHA256 e2d1843c…c10a).
##  - box: guest 9201 exists and runs `gitea.dooplex.hu/admin/felhom-controller:0.243.0`, which is the controller the
##    0.243.0 golden bakes; agent 0.131.0.
##  - NOT available: a box-side log naming the golden archive. `/var/log/` holds only `felhom-bootstrap-postinst.log`
##    (the ISO payload's own log); the agent journal has no golden/restore line. So the landing is inferred from the
##    two facts above, not read from one line — recorded as an inference, not a measurement.
golden archive on the box: /var/lib/vz/dump/vzdump-lxc-9100-2026_09_16-12_02_16.tar.zst
  size: 653997919
cut: '"': No such file or directory
  sha256: 
  expected (this drill's bake): e2d1843c8b648910ddde7cef4fe9f9ba2ee25002cdb58fbc42543a3e8967c10a
e2d1843c8b648910ddde7cef4fe9f9ba2ee25002cdb58fbc42543a3e8967c10a  /var/lib/vz/dump/vzdump-lxc-9100-2026_09_16-12_02_16.tar.zst
## CORRECTION / UPGRADE OF THE ABOVE (2026-09-16): the golden landing is MEASURED, not inferred.
##   The day-0 install leaves the golden archive on the box as `/var/lib/vz/dump/vzdump-lxc-9100-2026_09_16-12_02_16.tar.zst`
##   (the golden is baked as guest 9100), 653 997 919 B, sha256
##   e2d1843c8b648910ddde7cef4fe9f9ba2ee25002cdb58fbc42543a3e8967c10a — byte-identical to this drill's own bake output
##   (GOLDEN_SHA256 in phase0-bake-full.log). So the fresh box landed on golden 0.243.0, and no self-update was needed
##   (guest controller image is 0.243.0, the version that golden bakes).
