Rehearsal 2026-08-09 COMPLETE: data BYTE-IDENTICAL, journey needs a shell twice

The walk finished. All four planted files came back byte-identical out of
snapshot 41c830db, including two Hungarian accented filenames verified as RAW
NAME BYTES (NFC preserved) — the discriminator the Gate 0 positive control was
built for, having been watched failing on an NFC->NFD rename that renders the
same. Unlock 21s, restore 13.2s.

It finished only because a terminal was available twice:

- R-273 CLOSED. v0.128.0 was published as a package and never git-tagged, so
  every install died at 5/8. Tag pushed on operator instruction after an
  INDEPENDENT download proved the package sha equalled the vouched value;
  --resume then reached Day-0 SUCCESS in 3m49s on controller 0.210.0. The two
  guards that would stop the class recurring are still owed.
- R-280 NEW, rank 1. A reinstalled box cannot re-attach its own data drive by
  any dashboard route: /api/disks/candidates returns empty because both lists
  are built from the UNCLAIMED-disk scan, and the drive is claimed precisely
  because it is also the backup target. Correct for "initialise", over-broad for
  "attach", which is non-destructive by definition. The restore page meanwhile
  says "Ez ket kattintas" and points at that empty list. Cleared by POSTing
  /mnt/sys_drive — an internal path no household could produce.

Also new: R-281 the hub said NOTHING through the entire reinstall and the
sealed-backup tripwire did not fire on a real unseal (positive control: 2 events
all day fleet-wide); R-282 one code with three names and a mail pointing at a
page the box does not show; R-283 hub reads "Claimed 18d ago" while the box
serves its setup page; R-284 "almost full" over a 93%-free store.

R-274 NARROWED by measurement rather than left as written: the resume path
fetched the vouched golden correctly, because --resume skips the preflight that
does local discovery. What survives is real — discovery is sort|tail -1 with no
manifest comparison — but a FRESH install taking a stale golden is still not
observed, and the row says so.

Two of my own claims were refuted by test and are recorded as refuted, not
quietly dropped: the leftover sudoers file is inert (sudo skips dotted names),
and demo-hp's off-site tier was healthy all along.

STATUS.md

@@ -23,21 +23,42 @@ destroyed on purpose and its files came back byte for byte identical — four ti
 their recovery code got everything back with **no command line inside the machine at any point**,
 in 72 seconds. The two rough edges that walk found are also gone. *(R-201, R-252, R-253 — closed.)*
 
-## Broken right now — and it stops every new machine
+## The rehearsal finished. The data came back byte for byte; the journey did not.
+
+**We wiped a working demo machine and put it back. All four test files returned identical — including
+the two with Hungarian accents, checked as raw bytes, not as text on screen.** The unlock took 21
+seconds and the restore 13. **But it only finished because I could open a terminal twice.** A
+household would have stopped, twice, and the second time the screen would have told them it was easy.
+
+**The two walls, both fixed-or-fixable, neither about the data:**
+
+- **The install died four steps in** — the agent version you approved had been published as a download
+  but never given its version label, and the installer looks it up by that label. **Now unblocked** —
+  I pushed the label after checking the published file matched what you vouched. *(R-273 — closed. The
+  two guards that would stop it recurring are still owed.)*
+- **A reinstalled machine cannot re-attach its own data drive.** Every route is a dead end, and the
+  restore page cheerfully says „**Ez két kattintás**" while pointing at an empty list. The drive is
+  fine and the machine can see it — it just is not offered, because the same drive is also the backup
+  target. I got past it by typing an internal path no customer could know. **This is the one to fix
+  before the tester's visit.** *(R-280)*
+
+**Also broken, found on the way:**
 
-- **No machine can be set up from scratch today.** The install dies four steps in, on every host, and
-  it needs one command from you to unblock (below). Nothing already running is affected — the two demo
-  machines and the tester's box are fine. It is only the *setting-up* path, which is the one his visit
-  is made of. *(R-273)*
-- **A rebuilt machine may come back on software from last week** — the install will happily reuse an
-  old copy it finds lying on the disk, without checking it against the version you approved. The copy
-  on the demo machine is old enough to predate the recovery screen. *(R-274)*
 - **Taking Felhom off a machine leaves the one thing that stops it going back on.** We install a small
-  network service at setup; removing Felhom restarts it without its settings, it takes over the port
-  the next install needs, and the next install then refuses — blaming the owner's network. *(R-272)*
+  network service at setup; removing Felhom restarts it without its settings, it seizes the port the
+  next install needs, and the next install then refuses — appearing to blame the owner's network.
+  *(R-272)*
 - **A machine we removed keeps its private line to us open.** *(R-276)*
+- **The hub said nothing at all** while a machine was wiped, rebuilt, re-claimed and had its sealed
+  backups opened. No false alarm — but also no word, and the alarm that exists for "someone is opening
+  this customer's backups" stayed silent through a real one. *(R-281)*
+- **A rebuilt machine may still come back on software from last week** — narrower than I first wrote:
+  the resumed install fetched the right version, but a fresh one takes whatever copy is newest on the
+  disk without checking it against what you approved. *(R-274)*
 - **demo-felhom has not had an off-site backup in six days** and is waiting for a recovery code nobody
   has entered. demo-hp, rebuilt the same day, recovered by itself. *(R-278)*
+- **One code, three different names**, and the email points at a page the machine is not showing —
+  this cost us a wasted code today. *(R-282, R-283)*
 
 ## What's broken
 
@@ -51,29 +72,26 @@ in 72 seconds. The two rough edges that walk found are also gone. *(R-201, R-252
   accumulates. *(R-244)*
 - **Putting restored files back where they belong is still manual.** *(R-213)*
 
-## The reinstall rehearsal — what one afternoon on one machine found
+## The rest of what the rehearsal found
 
-**We took a working demo machine, removed Felhom, and tried to put it back the way a person with their
-own hardware would.** It got three steps in. That is the finding: **nine defects, two of which stop a
-visit dead**, and none of them were visible from reading the code — the last three sessions of review
-did not see any of them.
+Sixteen findings in one afternoon, **none of them visible from reading the code** — three sessions of
+review had not seen any.
 
-- It stopped at the install, on a missing version label *(R-273)* — and the step before that had
-  already refused, because removing Felhom leaves behind the thing that blocks reinstalling it
-  *(R-272)*.
-- Removing Felhom also leaves five files holding old keys *(R-275)* and a live private line to us
-  *(R-276)*.
-- Along the way: rotating a leaked key does not actually revoke the old one until the service is
-  restarted *(R-269)*, the written-down recipe for that rotation is missing a step *(R-270)*, and the
-  alarm it raises can never be closed because the fix it recommends is what silences the all-clear
-  *(R-271)*.
-- **It also caught me being wrong.** Three separate hub screens agreed that demo-hp had no off-site
-  backup. It had eighteen. I told you the fleet's backups were down and had to take it back an hour
-  later — the screens were misleading, but I should have asked the machine before telling you. *(R-277)*
+- Removing Felhom leaves five files holding old keys *(R-275)*, and rotating a leaked key does not
+  revoke the old one until the service restarts *(R-269)* — the written recipe for it is a step short
+  *(R-270)*, and the alarm it raises can never be closed because the fix it recommends is what
+  silences the all-clear *(R-271)*.
+- **It caught me being wrong twice, and that matters more than the count.** I told you the fleet's
+  off-site backups were down; demo-hp had eighteen snapshots and I had read three misleading screens
+  instead of asking the machine *(R-277)*. And I raised a leftover permissions file as a security
+  hole, then tested it and refuted myself — it is inert.
 
-**The data was never at risk** and is not now: the test files sit in an off-site snapshot with their
-fingerprints recorded, plus two local copies. Full account:
-`documentation/audits/REHEARSAL-byo-reinstall-2026-08-09.md`.
+**What worked, and should not be lost in the count:** the machine came up on its own at the approved
+version; the setup page appeared unprompted, in Hungarian, naming the customer; **the recovery screen
+appeared without being looked for** and said plainly that unlocking changes nothing; the restore told
+the truth about putting files in a checking folder rather than back in place; and no false alarm fired.
+
+Full account: `documentation/audits/REHEARSAL-byo-reinstall-2026-08-09.md`.
 
 ## Three rulings, written down so they stop living in a conversation
 
@@ -111,17 +129,14 @@ only miss a true alarm, never raise a false one *(R-266)*.
 
 ## Waiting on you
 
-- **One command, and it unblocks every install.** The version you approved yesterday was published as
-  a download but never given its version label in the source repository, and the installer looks it up
-  by that label. The code is right and already shipped; only the label is missing.
-  `cd felhom-agent && git tag v0.128.0 28ba8593b8 && git push origin v0.128.0`. I did not do it
-  myself: publishing a release label is not a thing to do quietly in the middle of a measurement.
-  *(R-273)*
-- **Then say go, and the rehearsal resumes** where it stopped. Nothing has to be redone — the test
-  files are already in an off-site backup and their fingerprints are recorded.
-
-*(Both items previously here are done: the approval is saved — golden 0.210.0, agent 0.128.0, minimum
-0.127.0 — and the recovery fix was proved on hardware.)*
+- **Nothing blocking.** The rehearsal is finished and demo-hp is back in service: agent 0.128.0,
+  controller 0.210.0, claimed, off-site backups unlocked and intact.
+- **One decision worth taking before the tester comes:** whether to fix the drive wall *(R-280)* now.
+  It is the only finding that would stop his visit outright, and it is the difference between "his
+  data comes back" and "his data comes back if someone types a path for him."
+- **Two guards are still owed** so the install cannot break the same way twice: refuse to vouch a
+  version whose label does not resolve, and check that a published version and its label ship
+  together. *(R-273's tail.)*
 
 ## DooPlex infrastructure — separate from the product