pre-night fixes delivered; R-897, R-898 closed; night 7->8 armed (demo-felhom 7.0.14-20, demo-hp 7.0.14-22); 128 -> 126

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-07 19:05:21 +02:00
parent d14578922f
commit 0829f0346c
5 changed files with 43 additions and 59 deletions
@@ -35,6 +35,8 @@ The full text of every row below: `git show 5ba1702fcf:documentation/backlog/OPE
 | **R-105** | **Three hub-held DR records are empty on the entire live fleet.** (P2) — full text `git show 374213f279:documentation/backlog/OPEN-ITEMS.md` | CLOSED 2026-10-07 — DELIVERED (hub 0.142.0, agent 0.151.0; `09` §3 decision 169) | The never-built `hosts.dr_record_json` and `host_escrow.directive_json` have no writer and no reader any more (the columns stay, unread); the agent's `-directive` flag is gone; `05` §9/§11 and `06` §3.5 corrected. Tester 2: the operator believes it never set up off-site, so it has no escrow (decision 170). `audits/day-2026-10-07/F/`. |
 | **R-366** | **The 21 August reinstall orphaned `demo-hp`'s PBS whole-guest archives as well as its off-site repo — the box can no longer read its own pre-reinstall backups, and this surfaces only as a restore-test failure.** (P2) — full text `git show 374213f279:documentation/backlog/OPEN-ITEMS.md` | CLOSED 2026-10-07 — DELIVERED (hub 0.142.0, agent 0.151.0; `09` §3 decision 168) | Slice 1 (the hub keeps the old key on a reinstall, hub 0.141.0) and slice 2 (the restore-test's skip of another key's archives becomes one edge-triggered operator line naming the box, the count and the date range) delivered to the three boxes; red-proofs `audits/day-2026-10-07/E/`. Option C (the recovery code at reinstall) declined by the operator. Not yet seen live: a reinstall that produces other-key archives. |
 | **R-812** | **[P2] A box never receives operating-system security updates — not the Proxmox host, not the guest's Debian, not its Docker engine.** (P2) — full text `git show 374213f279:documentation/backlog/OPEN-ITEMS.md` | CLOSED 2026-10-07 — DELIVERED AND PROVEN LIVE (agent 0.151.0, hub 0.142.0; `09` §3 decision 163) | Option A, the Proxmox package lane: on demo-felhom one signed step installed 65 Proxmox packages in 70 s (`pve-manager` 9.2.2 → 9.2.21), healthy, the /etc/pve write gate held, the guest untouched (StartedAt identical), the app answered 31/31; the hub logged the run. `audits/day-2026-10-07/B/RESULT.md`. The kernel is R-836 (the spike done, `audits/kernel-spike-2026-10-07/`). |
+| **R-897** | **After a host restart the guest's first backup capture could run in the second the agent re-bound the drive and fail (`permission denied`).** (P3) | CLOSED 2026-10-07 — DELIVERED: controller v0.303.0 — for 10 minutes after the controller starts, a capture for an app on a drive runs only once the drive is a live mount in the controller's namespace (refresh skips, data run waits; after the window it runs and logs once). The agent's bind order unchanged | controller `internal/backup/driveready.go`, `TestDriveReady_*` (red-proved). Delivered by per-customer floors to demo-hp, demo-felhom, Tester 1. First live check: the kernel night 2026-10-07→08 |
+| **R-898** | **Ring 0's told kernel could be a day old: the step staged whatever was pending and refused (R23) a kernel newer than the one the household was told about.** (P3) | CLOSED 2026-10-07 — DELIVERED: agent v0.153.0 stages EXACTLY the told kernel (select `listed`, `KernelSet(kver)`); a told version no longer installable is refused before any change (R7) and the hub (v0.143.1, test-pinned) treats R7 as temporary and tells the household again for the newer kernel | `audits/kernel-night-2026-10-07/A/redproof.txt`; agent `TestKernel_Ring0ToldNightStagesThenReboots`, wrapper `test_ring0_listed_installs_the_told_kernel_not_the_newest`, `test_ring0_told_kernel_gone_is_refused_before_any_change`; hub `TestKernel_ToldKernelGoneIsTemporaryAndTheNewerIsOffered`. First live use: the night 2026-10-07→08 (demo-felhom told 7.0.14-20) |
 | **R-822** | **An add-only key does not make retention safe: an attacker who can only ADD snapshots can make the honest pruner erase every real one.** (P2) | CLOSED 2026-10-07 — BY OPERATOR RULING (`09` §3 decision 166): the residual is accepted as a stated limit of decision 68 | Guard shipped controller v0.289.0; residual (past-dated fakes steering the keeps, a box-trusted window count) in `audits/night-burndown-2026-10-06/design-R-822.md`; the hub's own count is R-895, open. |

 ## 2026-10-07 (morning) — the read-back, the releases, the Tester 1 proof