hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

Four paper debts and one fact given a reader. Hub-only — nothing to bake.

A4 — the entry about "the tester's machine" named a risk correctly and labelled it
in a way that invited deleting it. Established from the hub's own store: `peti-felhom`
is a REAL machine (482 reports, 2026-02-27 → 2026-07-15, a named person's own box) and
the 3.6 GB with no key and no backup is real. `david` → `tester-1` is a DIFFERENT record
with no host, no escrow and no report, ever — deleted 07:55:49 and re-created 07:56:47
this morning. The prompt's premise conflated the two; the register now says which is which.

A1 — R-312/R-313/R-303 recorded as DECIDED with their re-open triggers, and moved out
of STATUS's "Waiting on you", which is now empty.

A3 — day0-install §C.1 said pushing the installer publishes it. It has not since
R-110. Corrected, with the two manifest pins named and an outside-verification command;
the one copy that repeated it (a dated audit, true when written) carries a superseded note.

A5 — standing rule 5: evidence comes off the machine at the end of the phase that
produced it, before any revert. Earned twice in three days on the same box at the same
point (R-320). Four homes, plus what to do when it is already gone.

R-295 hub half — „Beállító kód" everywhere; „Visszaállító kód" retired. New `reenroll`
mail kind so the mail names the page a REBUILT box actually shows („A szerver
beállítása"), not the „Elfelejtett jelszó" page it has no login screen to reach.
Naming only; the acceptance pin proves the secret is untouched.

R-319 — the hub models `guest_net` after 23 days of receiving and discarding it. The
signal is `heals_last_hour`, not `state`: a guest the watchdog keeps repairing reads
healthy between repairs. `heal_succeeded` decoded too (R-260's lesson). Unknown is never
drawn as healthy — three absences, three sentences. No alarm, deliberately.
Three red-proofs, mutations asserted applied. Wire-gate checked tags 182 → 190.

B1 — the operator's 2026-08-12 dispositions were NOT in the register; they are now.
Third allowlist kind for the five ruled "no reader wanted"; `reporting_disabled`
reclassified redundant. 8 read · 5 deliberately unread · 1 redundant · 6 still owed.

Also filed: R-321 (a deliberately-silent box still alarms stale/down — the checker is
age-only, and decoding the flag would not have fixed it), R-322 (the claim guard has
never scanned the hub; a hand scan returns zero, so it is a scope gap, not a defect).

documentation/runbooks/RUNBOOK-rehearsal-v3.md

@@ -26,6 +26,13 @@
 > **Point of no return:** booting the install-armed stick (the auto-installer needs no confirm).
 > Recovery unchanged: stock ISO + `felhom-host-install.sh` — and since RESET is the plan, there
 > is nothing to restore. Demo-felhom.eu is down for the window (~2 h).
+>
+> **EVIDENCE RULE — standing rule 5 (R-320), and it applies to every phase boundary below.** The logs
+> of a phase are copied OFF the machine at the end of **that** phase, before any revert, snapshot
+> restore or teardown — **including the intermediate ones, which are the ones that get forgotten.**
+> Two sessions lost a phase's logs exactly this way on 2026-08-12 and 2026-08-13, same machine, same
+> point. Make the pull the last act of the phase. **If evidence is already gone: say so plainly and
+> reproduce the finding independently** — do not let a lost log quietly become a softer claim.
 
 ---
 

documentation/runbooks/day0-install.md

@@ -167,9 +167,44 @@ chmod +x felhom-host-install.sh
 ./felhom-host-install.sh -h | head -3      # sanity: must print v1.15.0 (or newer) — DR-tier-by-default ships the full plumbing
 ```
 
-This URL is the website's git-sync working tree tracking `main` on a 30-second period
-(`manifests/webpage.yaml`) — it is always the current `main` script. There is no release tag, no
-staging copy and no version selector; pushing `scripts/felhom-host-install.sh` publishes it.
+**⚠ THIS PARAGRAPH USED TO SAY THE OPPOSITE OF THE TRUTH, and two sessions were misled by it before
+it was corrected on 2026-08-13 (R-309, R-110).** The old text read *"it is always the current `main`
+script … pushing `scripts/felhom-host-install.sh` publishes it."* **Pushing publishes NOTHING, and has
+not since R-110 shipped on 2026-08-03.** Believing the old sentence is dangerous in **both**
+directions: it makes an operator think a pushed fix is live when it is not, and think a pushed mistake
+is live when it is not. (Measured 2026-08-12: this URL served `1.25.0` while `main` held `1.27.0`,
+three and a half hours after the push.)
+
+`manifests/webpage.yaml` runs **two** git-syncs against **different refs**: the website tracks `main`,
+and `/scripts/` is checked out from the tag **`installer-v<SCRIPT_VERSION>`**. So this URL serves the
+**tagged** installer, not `main`.
+
+**What actually publishes it — three acts, and the middle one is two lines, not one:**
+
+1. Bump `SCRIPT_VERSION` in `scripts/felhom-host-install.sh` (the single version source) and push to
+   `main`. *Nothing is published yet.*
+2. Cut and push the tag `installer-v<new SCRIPT_VERSION>`.
+3. Move **BOTH** `--ref=installer-v…` pins in `manifests/webpage.yaml` — the git-sync **sidecar** and
+   the **init container** (today lines 327 and 372) — commit, and sync ArgoCD. **Moving one pin is the
+   trap**: the running pod keeps serving until it restarts, and then a fresh pod seeded by the stale
+   init container serves the OLD script with no error anywhere.
+
+**To roll back:** move the tag back and wait ~30 s. No ArgoCD sync, no deploy — that is the emergency
+lever; fix forward afterwards. **Do not pin the website to the tag**, or every copy edit becomes a
+release. `hostinstall_gates.py` gate 6 fails if the manifest stops naming an `installer-v…` tag or if
+the website stops tracking `main`.
+
+**How to verify from OUTSIDE that the published version actually changed** — a push, a green sync and a
+correct-looking manifest are each consistent with nothing having been published, so ask the public URL
+rather than the repository:
+
+```bash
+curl -fsS https://felhom.eu/scripts/felhom-host-install.sh | grep -m1 '^SCRIPT_VERSION'
+```
+
+It must print the **new** version. Confirmed by this method on 2026-08-13: served `1.28.0`, `main`
+`1.28.0`, both manifest pins `installer-v1.28.0` — the three agreeing is the observation, and any one
+of them alone is not.
 
 ### C.2 Preview (recommended)
 

documentation/runbooks/target-selection.md

@@ -25,6 +25,25 @@ Fences name **acts**, not machines. "Do not destroy demo-hp's `drill-r50` fixtur
 demo-hp to host a throwaway VM" are unrelated; only the first has ever been meant. Read a per-machine
 prohibition as covering the act it names and nothing more.
 
+## Before you revert it — take the evidence off first
+
+> **A phase's evidence is copied off the machine at the end of THAT phase, before any revert, snapshot
+> restore or teardown. Not at the end of the session.** (Standing rule 5, R-320.)
+>
+> **The intermediate revert is the one that gets forgotten.** Both losses this project has recorded
+> were the *middle* teardown, never the final one — the Phase A logs of the 2026-08-12 retained-key
+> drill and the Part 1 logs of the 2026-08-13 R-316 run, both on `drill-r50`, both destroyed by a
+> revert to `virgin` between phases, three days apart. Both times the conclusions survived only
+> because the quotations had been read live and an independent reproduction happened to exist. **That
+> is luck.**
+>
+> **The mechanism:** make the pull the last act of the phase, not a step to remember later —
+> `pct pull` / `scp` into `documentation/audits/evidence-<topic>-<date>/` on DooPlex, then revert.
+> Tier 0 machines are *disposable*, which is precisely why nothing you need may be left on one.
+>
+> **If you notice it is already gone:** say so plainly in the report and **reproduce the finding
+> independently**. That is the documented expectation, not an improvisation.
+
 | Tier | Meaning | Machines |
 |---|---|---|
 | **0 — disposable. Reach here first.** | Exists to be broken; reinstalling is a routine afternoon, not an incident. **A drill that needs a victim uses one of these.** | `demo-hp` (t740), `demo-felhom` (N100) |

documentation/runbooks/workspace-CLAUDE.md

@@ -56,6 +56,15 @@ roles. **A file being open in the editor is NOT an instruction. If no task is st
    "working" and "stopped entirely".
 4. **A recommendation that is not followed gets one line saying why.** Silence reads as agreement and
    the disagreement is lost.
+5. **Evidence is copied off the machine at the end of the phase that produced it — before any revert,
+   snapshot restore or teardown. Not at the end of the session.** The intermediate revert is the one
+   that gets forgotten; both losses were the *middle* teardown, never the final one. **The mechanism,
+   because a rule without one is a wish:** the last act of a phase that ran on a machine is `scp`/`pct
+   pull` its logs to the evidence directory on DooPlex — the same act that ends the phase, not a
+   separate step to remember later. **And when a session notices the evidence is already gone: say so
+   plainly in the report and REPRODUCE it independently.** That is the documented expectation, not an
+   improvisation to be invented under pressure — it is what both sessions did, and it is the only
+   reason two sets of conclusions survived.
 
 <!--
 R-96 incident record (committed 2026-07-27) — rationale, not directives.
@@ -72,6 +81,16 @@ R-96 incident record (committed 2026-07-27) — rationale, not directives.
 4. Twice in the R-88/R-97 arc a review point was absorbed rather than argued: R-84 was folded into
    R-82 without a word, and R-97a's operator-only guard was dropped while the claim it was meant to
    enforce got committed as a comment — which is how a false guarantee shipped and survived a release.
+5. Twice in three days, on the SAME machine and at the SAME point. 2026-08-12, the retained-key drill:
+   the Phase A logs lived on `drill-r50`'s disk and were destroyed by the revert to `virgin` between
+   Phase A and Phase B (`audits/DRILL-retained-key-2026-08-12.md` §11.5). 2026-08-13, R-316: the Part 1
+   logs, same disk, same revert, between Part 1 and Part 2 (`audits/REPORT-r316-installer-v1.28.0-2026-08-13.md`
+   §9 — "the same mistake as Tuesday, in the same place"; preserved out of `REPORT.md`, which is
+   overwritten every session). Both times the golden-bake runbook's existing "scp the log OUT first"
+   was applied to the FINAL teardown and not the intermediate one. Both times the conclusions survived
+   only because the quotations had been read live and an independent reproduction happened to exist —
+   that is luck, and the second occurrence is what makes it procedural rather than another apology.
+   Filed as R-320.
 -->
 
 ## Shared conventions