== RED-PROOF 1 (R-133): SaveHostRecoveryCredential stores the plaintext (pre-v0.135.0)
FAIL	gitea.dooplex.hu/admin/felhom-hub/internal/store [build failed]
FAIL

== RED-PROOF 2 (R-133 wiring): main.go does not call SealLegacyRecoverySecrets
=== RUN   TestR133_MainSealsLegacyRecoverySecrets
    r133_wiring_test.go:28: cmd/hub/main.go never calls SealLegacyRecoverySecrets — legacy console passwords stay in plaintext
--- FAIL: TestR133_MainSealsLegacyRecoverySecrets (0.00s)
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-hub/cmd/hub	0.028s
FAIL

== restored
ok  	gitea.dooplex.hu/admin/felhom-hub/internal/store	0.139s
ok  	gitea.dooplex.hu/admin/felhom-hub/cmd/hub	0.022s

== RED-PROOF 1 (re-run, compiling): SaveHostRecoveryCredential stores the plaintext (pre-v0.135.0)
=== RUN   TestR133_RawRowHoldsNoPassword
    r133_recovery_seal_test.go:29: raw host_recovery.secret is not sealed: "Console-Pw-7741"
--- FAIL: TestR133_RawRowHoldsNoPassword (0.04s)
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-hub/internal/store	0.043s
FAIL
== restored
--- PASS: TestR133_RawRowHoldsNoPassword (0.03s)
--- PASS: TestR133_SealLegacyRecoverySecrets (0.03s)
--- PASS: TestR133_WrongKeyFailsClosed (0.03s)
--- PASS: TestR133_NoKeyRefusesToSave (0.03s)
ok  	gitea.dooplex.hu/admin/felhom-hub/internal/store	(cached)
