docs: R-50 island-bridge spike attempt 2 (t740) — STILL BLOCKED (no drill VM there); nodes.md drill-host ruling; REPORT

REPORT.md

@@ -1,42 +1,54 @@
-# REPORT — SMART-coverage capability upgrade + R-50 island-bridge SPIKE (2026-07-25)
+# REPORT — R-50 island-bridge SPIKE, empirical attempt 2 (t740): STILL BLOCKED (2026-07-25)
 
-**Overwritten** per the standing rule. felhom.eu's share of the SMART-coverage task (docs) + the R-50
-spike. (Code for the SMART fix is in felhom-agent v0.95.0 + felhom-controller v0.171.0.)
+**Overwritten** per the standing rule. This session re-attempted the empirical half of
+`SPIKE-island-bridge-2026-07-25.md` on the t740 (per the operator's 2026-07-25 drill-host ruling).
+Docs-only; no code, no version bumps.
 
-## Baseline → commits
-felhom.eu `770ee5a` → `be2d90f` (capability-map) → **`1d65f44`** (island-bridge spike + ROADMAP).
+## t740 access method
+Discovery was read-only (no LAN scan): the SSH config's `demo-hp` entry (t740 = Tailscale
+`100.76.96.79` / LAN `192.168.0.87`, host_id `demo-hp-bb76ea`) + the hub registry. The t740 has **no
+baked SSH key**, so access used the **hub-vaulted G1 break-glass root credential** —
+`host_recovery/demo-hp-bb76ea` (read from the hub SQLite via `kubectl cp` + `sqlite3`), `sshpass -e`
+(secret redacted, never printed). Connected: `felhom-host`, PVE 9.2.2.
 
-## Capability map — disk-health row upgraded (evidence)
-`documentation/architecture/00-capability-map.md`: the "Lemez-egészség felügyelet" row moved
-**IMPLEMENTED → PROVEN-LIVE (healthy path + delivery)**. With agent v0.95.0 + controller v0.171.0 the
-card on 9201 shows both real disks with real verdicts + model labels ("AirDisk 512GB SSD" → Rendben,
-"TOSHIBA MQ04ABF100" → Rendben) — reversing the 2026-07-24 "Nincs adat on a raw UUID" state. Corrected
-the earlier "virtualized demo hardware" note (it is a real N100).
+## P1 inventory — the finding: there is NO drill VM to probe
+- **t740 (`demo-hp`):** `qm list` → **empty**; `/etc/pve/qemu-server/` → **empty**; standalone (no
+  cluster); only its own LXC guest 9201 + the guest-9201 LVM volumes. **No nested drill PVE VM.**
+- **Hub registry:** only `demo-hp-bb76ea` (t740) + `demo-felhom-8363b5` (N100) — **no drill appliance**
+  (no `2f4b00`/`demo-vm`/`drill` host).
+- **felhom-pve:** `qm list` empty (confirmed in attempt 1).
+- **DooPlex:** the historical drill appliance `drill.qcow2` exists (`/mnt/5_hdd/felhom.eu/drill/`, 18G)
+  but is **powered off** — a **golden-bake** VM (bake logs to 0.153.0, last Jul 18–20) whose nested
+  guest is purged after each bake, so it has **no island-bridge topology** (agent + nested guest +
+  bootstrap) to probe. DooPlex is the production k3s node and is loaded (~17G of 62G free).
 
-## R-50 island-bridge SPIKE — BLOCKED empirically; design half source-grounded
-`documentation/audits/SPIKE-island-bridge-2026-07-25.md` (+ ROADMAP R-50 → "SPIKED (partial)").
-- **Probe 1 (drill env health): ABSENT.** `qm list` on felhom-pve is EMPTY (no nested drill PVE VM
-  qm300); `pct list` shows only guest 9201; no `2f4b00`/drill config. The throwaway drill appliance was
-  torn down. **Per the hard drill-only rule, probes 3–8 (bridge / NIC hot-add / island bind / F1 replay
-  / survival) were NOT run — felhom-pve networking, guest 9201, and the live agent's `listen_addr` were
-  left UNTOUCHED.** No live GO/NO-GO.
-- **Source-grounded findings delivered (read-only):**
-  - **Address plan:** recommend **link-local `169.254.253.1/30`↔`.2/30`** — structurally uncollidable
-    with any customer LAN (RFC-3927 is neither routed nor DHCP'd), vs an obscure RFC-1918 /30's small
-    residual risk.
-  - **F1 root cause:** the LAN literal is baked in TWO places to move atomically — agent bind
-    (`config.go:229` ← `felhom-host-install.sh:2226/2162`) + guest dial (`provision/backhalf.go:129` →
-    `bootstrap.json` endpoint).
-  - **NEW finding — the dnsmasq trap (CONFIRMED in source):** `LANResolverConfig.WithDefaults`
-    (`config.go:208–210`) derives the DNS listen-address from `listen_addr`, so moving the bind to the
-    island silently kills LAN DNS → the spec MUST set `lan_resolver.host_ip = LAN IP` explicitly.
-  - **Pin:** leaf-DER-SHA256 based (address-independent) → no cert re-issue expected (source-asserted;
-    empirically unproven without the drill env).
-  - Provisioning inventory (file:line), cluster-parity (SDN on Peti's 2 nodes), and an implementation
-    skeleton recorded.
-- **Remaining:** a rebuilt drill VM to validate probes 3–8 before any production spec. **STOP —
-  implementation is a future task.**
+**Snapshot: N/A** (no drill VM existed to snapshot).
+
+## Per-probe outcomes
+P2–P7 (bridge create / NIC hot-add / island bind / pin / **F1 replay** / survival) — **NOT RUN.** The
+operator's ruling ("drill+build VMs on the HP from now on") is **forward-looking and not yet realized**:
+no probeable drill appliance exists on the t740, and the only artifact is a stale bake VM on the
+production node. **Per the hard rule ("do not improvise on production"), felhom-pve, the t740 host
+networking, and guest 9201 were left UNTOUCHED.** No config was changed anywhere → **the rollback table
+is empty**, and there is no island end-state to leave in place.
+
+## GO/NO-GO: PENDING (unchanged) — the design half still stands
+The source-grounded half of the parent doc (address plan `169.254.253.1/30`↔`.2/30`; the F1 two-place
+literal; the **dnsmasq trap** — `LANResolverConfig.WithDefaults` derives the DNS listen-addr from
+`listen_addr`, so the spec MUST set `lan_resolver.host_ip = LAN IP`; leaf-DER pin → no cert re-issue
+expected; provisioning inventory; cluster parity) is unchanged and ready. Only the **empirical**
+validation remains blocked.
+
+## Operator decision + docs
+**Operator chose (2026-07-25): they will provision a nested-PVE drill VM on the t740 (agent + a nested
+guest); this spike re-runs then.** Commits (docs-only): the spike doc amended (attempt-2 section +
+verdict), ROADMAP R-50 note appended, `documentation/operations/nodes.md` gains a "designated drill+build
+VM host" subsection (t740 ruling + the not-yet-realized state + break-glass recipe), and the
+controller/agent `CLAUDE.md` env tables gain a `demo-hp` row/note. **The build-PIPELINE relocation to the
+t740 is explicitly NOT ruled or implemented — only the VM-hosting ruling is recorded.**
 
 ## Observations
-- The island-bridge spike could not fulfill its empirical half; the honest outcome (env gone → STOP, no
-  production improvisation) is recorded, and the source analysis gives the future task a real head start.
+- The t740 is a genuinely better drill host than DooPlex (dedicated demo node, ~30G RAM / ~49G free
+  local-lvm, not the production k3s node) — the ruling is sound; it just needs the VM created.
+- The t740's agent is **0.93.0**, behind demo-felhom's 0.95.0 — a publish-when-convenient gap (noted in
+  nodes.md), unrelated to this spike.