# Hub 0.168.0 deploy, 2026-10-24 (attended release run). Counts only — no value was printed.
05:38:10Z first start: three seal lines, then no "config tokens" line; killed by the liveness probe at 05:39:39Z (exit 143)
05:39:39Z second start: "config tokens sealed at rest (0 legacy plaintext token(s) sealed now)"; Listening 05:40:18Z
  -> the UPDATE committed in the first start; the VACUUM after it did not finish (538 MB on Longhorn; 2.8 s on local disk)

Search of the 8 plain token values (read from the pre-deploy ep0 copy 2026-10-24T00:3xZ) as raw bytes:
  pre-deploy ep0 copy hub.db           8 of 8   (positive control)
  live hub.db (copied 05:41Z)          8 of 8   integrity ok, freelist 312 pages -> the plaintext sits in free space
  live hub.db-wal                      8 of 8
  live copy after a local VACUUM       0 of 8   (2.8 s)
  post-deploy ep0 copy 06:30:57Z       0 of 8   integrity ok; 4 customer rows carry enc:v1: tokens
  /data/snapshots: hub-20261023T180000Z.db, hub-20261024T000000Z.db are pre-deploy (plain); they roll off.

Box side (demo-hp, 05:53Z): GET /api/v1/box-config with the box's own key: HTTP 200, 0 "enc:v1:" in the served config;
  infrastructure.cf_tunnel_token and cf_api_token fingerprints EQUAL to the box's applied controller.yaml;
  hub log "Config downloaded for customer demo-hp (by box key, 2ms)"; cloudflared Up 14 hours (healthy).
Gitea: hub log "Template fetched (5881 bytes)" at start.
All copies shredded after the check.
