docs(pilot): GL-5 shipped — G8 flip + GL-4 status housekeeping + decision log

G8 -> implemented + scratch-DR live-validated (agent v0.75.0 b3446213);
G6 -> implemented-awaiting-GL-6; G1 key-pin plumbing -> done (ceremony
pending); manifest-bump guidance updated: publish + vouch 0.75.0 (0.74.0
ships broken guest-loss DR). Two live-discovered PVE restore rules recorded.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,20 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-08 — TASK GL-5 SHIPPED: DR bring-up bind overrides (agent v0.75.0, LIVE + scratch-DR
+  validated)** — go-live G8; docs-only here (GO-LIVE-PACKAGE G8/G6/G1 flips + decision log; the
+  code + full report live in felhom-agent `b3446213`). Guest-loss DR restore WORKS now: the two
+  structural binds (mp8/mp9) are overridden with throwaways at restore and swapped for the REAL
+  binds pre-start (root pct via the new Engine HostRunner seam), displaced unusedN deleted. TWO
+  live-discovered PVE rules beyond the spike: explicit-params restore needs an explicit rootfs AND
+  silently DROPS unlisted mountpoints — the full param set now derives from the archive's embedded
+  config (`ExtractArchiveConfig`, 200 under the scoped token). Live proof: scratch 9310 from a real
+  9201 archive — mp0 200G + mp1 50G restored WITH content (7m23s), real binds, zero residue, clean
+  teardown; the same op failed outright on v0.74.0. OPERATOR: **publish agent 0.75.0 + bump the
+  manifest to it** (vouching 0.74.0 ships broken DR). Follow-ups: restore-test boot-verifies
+  without mp0/mp1 (same PVE rule, reverse direction — candidate reuse of drRestoreOverrides);
+  DR-selftest KeepMAC duplicates a live source's MAC briefly; no host-loss DR runbook exists yet
+  (GL-6/S5 writes it).
 - **2026-07-08 — TASK GL-4 SHIPPED: uninstaller gap-closure + operator-key day-0 fold
   (host-install v1.11.0)** — go-live G6 + the G1 key-pin follow-up; **awaiting GL-6** for the real
   (non-dry) teardown + armed-pin install. Uninstall now removes the self-update artifacts (4b4:

documentation/pilot/GO-LIVE-PACKAGE.md

@@ -7,6 +7,7 @@
 **Baselines at creation (verified live):** agent `ced60dd`/v0.74.0 · controller `59eb3bea`/v0.103.0 ·
 catalog `2ebe082a` · felhom.eu `1a1e42ad`/hub v0.35.0 · host-install v1.9.1 · golden 0.98.3.
 **Updated 2026-07-07 (GL-2 shipped):** felhom.eu `02d63ed0` · host-install **v1.10.0** + `scripts/hostinstall-mode-harness.sh`.
+**Updated 2026-07-08 (GL-4 + GL-5 shipped):** felhom.eu `f7cc6a72` · host-install **v1.11.0** (uninstall gap-closure + key-pin plumbing) · felhom-agent **v0.75.0** (DR bind overrides, live on felhom-pve).
 
 ---
 
@@ -56,14 +57,14 @@ Status legend: ✔ DONE · ◐ PARTIAL · ○ OPEN · ⚠ BLOCKER
 
 | ID | Item | Status | Evidence / gap |
 |----|------|--------|----------------|
-| **G1** | **Publish + vouch chain current & self-update alive.** ARTIFACTS PUBLISHED (RUNBOOK GL-1, felhom.eu `a63cc715`): agent **0.74.0** sha `1ec3f588…76af05` (the exact live-proven felhom-pve bytes, hash independently re-verified anonymously) and golden **0.103.0** sha `8481e8a1…6026e` (clean-room bake on the virgin drill VM, controller 0.103.0 baked, both split volumes in the vzdump). Remaining: (a) **operator manifest bump** — until then fresh installs still land 0.63.0/0.98.3; (b) **operator-key pin** — day-0 ships NO operator pubkey (verified), so self-update stays dormant on fresh boxes; pin ceremony + a small host-install follow-up (candidate: fold into GL-4). | ◐ | RUNBOOK-GL1-publish-2026-07-07.md; felhom-agent `4c408467` |
+| **G1** | **Publish + vouch chain current & self-update alive.** ARTIFACTS PUBLISHED (RUNBOOK GL-1, felhom.eu `a63cc715`): agent **0.74.0** sha `1ec3f588…76af05` (the exact live-proven felhom-pve bytes, hash independently re-verified anonymously) and golden **0.103.0** sha `8481e8a1…6026e` (clean-room bake on the virgin drill VM, controller 0.103.0 baked, both split volumes in the vzdump). **Key-pin day-0 PLUMBING SHIPPED in GL-4** (v1.11.0: `OPERATOR_KEY_*` constants empty-by-default + `--operator-pubkey-file` → `authz.signers`; preserved-signers never clobbered; verify reports armed/dormant). Remaining: (a) **operator manifest bump** — until then fresh installs still land 0.63.0/0.98.3 — NOTE the published agent is 0.74.0 while felhom-pve now runs 0.75.0 (GL-5); consider publishing 0.75.0 + bumping straight to it; (b) the **key CEREMONY** (real keypairs + felhom-pve pin) = operator. | ◐ | RUNBOOK-GL1-publish-2026-07-07.md; host-install v1.11.0 |
 | **G2** | **BYO-host install profile.** SHIPPED as `--mode appliance\|byo` (mandatory, no default; the flag was repurposed from the retired `provision\|dr` — `dr` stub seam preserved). byo: break-glass gated OFF at its single call site (:2040–2044 — root@pam never touched, nothing vaulted), caps mandatory, `--enable-oob`/`--rotate-recovery` refused, host-mutation disclosure + typed-hostname ack, post-write config asserts (`lan_resolver`/`wg_tunnel`/`oob` must be off — asserts run BEFORE `_state_mark agent_config`, so `--resume` re-asserts). Red-proofs RP-1..3 run→fail→revert. Appliance flow unchanged (regression cases green). | ◐ | host-install v1.10.0 @ `02d63ed0`; verified at file:line 2026-07-07. **Remaining: GL-6 live drill** (C7 verify-assert firing, interactive ack) |
 | **G3** | **`git.token` scope-down + rotate — UNBLOCKED, and now coupled to a visibility ruling.** Gate 3c (GL-1): both generic packages are **anonymously world-readable**, so rotating the customer token to read-only cannot break fresh-install fetches; the empty-creds die on demo-felhom is the installer's `resolve_git_creds` precondition (:326–332), not a Gitea requirement. **NEW FINDING (project-Claude probe, 2026-07-08): the ENTIRE Gitea instance is anonymously readable — all nine repos `private=False`, including `homelab-manifests` (k3s manifests — audit for raw Secret objects) and personal repos (`work`, `revfulop-calendar`). Only the geo-fence (HU/DE/US) limits reach.** Coupling warning: if the reaction is to lock the instance ("require sign-in"), the anonymous day-0 package fetch dies and read-scoped tokens become MANDATORY — retest the fetch path with a token before any visibility change. | ○ ⚠ | GL-1 record §Gate 3c; anonymous `repos/search` probe 2026-07-08 |
 | **G4** | **Preflight guards (refuse-to-provision gate).** SHIPPED in v1.10.0: byo dies on non-9.x PVE (unless `--force`) and on missing `--acl-storages` entries (named); `:53` DNS info line + existing-guest count; `--preflight-only` runs the full mode-aware checks with a PASS/FAIL verdict and **zero state marks** (live-proven on felhom-pve, incl. the FAIL verdict on a bogus storage). Verify step now asserts pool membership + all scoped-ACL grants (user+token) in BOTH modes — R2's lesson made structural. | ◐ | host-install v1.10.0 @ `02d63ed0` (verify asserts read at source). **Remaining: GL-6** (asserts firing on real drift) |
 | **G5** | **LXC caps mandatory on BYO hosts.** SHIPPED: byo refuses to run without explicit `--cores` AND `--memory` (:947, fires before the passphrase prompt); existing cap-sanity warns retained. Appliance unchanged (optional, golden default). Cap VALUES for Peti's guest still to be chosen (§6). | ◐ | host-install v1.10.0 :947. **Remaining: pick values + GL-6** |
-| **G6** | **Uninstaller gap-closure (customer offboarding).** `--uninstall` exists and is well-shaped (guest-only mode when other Felhom guests remain, dry-run, typed-vmid confirm, legacy-ACL cleanup, opt-in golden removal — host-install.sh:469–710). Gaps: enrolled customer drives (unmount/decommission; data STAYS on the drive — additive-only doctrine), PBS namespace note (local `felhom-pbs` ns for the box), hub record + escrow blob cleanup (currently a manual NOTE at :550/:708), and a printed **kept-vs-wiped statement** at completion. | ◐ | host-install.sh as cited |
+| **G6** | **Uninstaller gap-closure (customer offboarding).** SHIPPED in host-install v1.11.0 (GL-4, `f7cc6a72`): 4b4 self-update-artifact removal (wrapper, .prev/.new.* slots, rollback unit, limits drop-in — derived from the guarded script itself), per-drive unmounts under `/mnt/felhom-drives` (plain umount ONLY, busy = warn+guidance, root-bind guarded), the **KEPT-vs-WIPED statement** in BOTH modes (drives/PBS/hub record/escrow/vaulted recovery credential named as living on), guest-only drive note from the bind store. Harness: disclosure↔uninstall parity check (GL4-D) + full-uninstall DRY transcript vs live 9201; red-proofs RP-1..3. | ◐ | host-install v1.11.0 @ `f7cc6a72`. **Remaining: GL-6** (real teardown incl. a busy drive) |
 | **G7** | **Demo-box drill: provision → uninstall → re-provision** (runbook, supervised). Proves G2/G4/G5/G6 end-to-end before they touch Peti's hardware. | ○ | D4 |
-| **G8** | **DR bring-up bind-override fix** (agent): `bring-up -mode dr` passes no `MountOverrides`; apply the spike's known-constant mp8/mp9 override reusing `bindMountOverrides`. Host-loss DR must actually work for a pilot box. | ○ | agent CONTEXT.md v0.74.0 OPEN; `SPIKE-dr-bindmount-source-2026-07-07.md` |
+| **G8** | **DR bring-up bind-override fix** (agent). SHIPPED as **v0.75.0** (GL-5, `b3446213`, LIVE on felhom-pve) + **scratch-DR live-validated end-to-end** (9310 from a real 9201 archive: mp0 200G + mp1 50G restored with content, real mp8/mp9 binds, zero unusedN, clean auto-teardown; the same op failed outright on v0.74.0). **TWO live-discovered PVE rules beyond the spike:** explicit-params restore requires an explicit rootfs AND silently drops unlisted mountpoints — the full param set now derives from the archive's embedded config (`ExtractArchiveConfig`, 200 under the scoped token; bind LAYOUT stays the known constants). | ◐ | agent v0.75.0 @ `b3446213`; REPORT.md. **Remaining: the full customer-data DR drill (GL-6/S5); publish 0.75.0 for the manifest bump** |
 | **G9** | **Auth-on onboarding.** Auth + CSRF proven in campaign 2; remaining work is procedural: Peti's onboarding sets the dashboard password via the REAL settings pipeline (anti-F9) and verifies login. Runbook step in GL-7. | ◐ | controller v0.103.0 (F-C2-1 live-validated) |
 | **G10** | **Local-API posture documented + spot-verified.** Token→vmid binding is structural (server.go:23, :53–55, :153 — verified this session); write it into the security notes, including the vmbr0-reachable surface and its TLS+token defense. One CC spot-check: a token minted for guest A is refused for a guest-B-scoped op (test exists? verify; add if hollow). | ◐ | localapi/server.go as cited |
 | **G11** | **Pilot backup statement.** Assert local backups green on Peti's box at onboarding; the tester agreement states plainly: *no offsite copy yet — a dead/stolen box or dead drive without a second local target loses data*. Honesty is the sovereignty pitch. | ○ | D3; agent CONTEXT.md v0.66/0.67 (retarget reverted; Tier-1/2 split pending) |
@@ -82,8 +83,8 @@ BUNDLE cert/key/token migration item; hub-floor auto-update.
 | **GL-1** Publish/vouch/key-pin chain | ◐ **artifacts published 2026-07-08** (`a63cc715`); manifest bump + key pin = operator | felhom-agent, felhom.eu (hub manifest), operator UI | G1 | — |
 | **GL-2** BYO-host profile + preflight + mandatory caps | ✔ **DONE 2026-07-07** (`02d63ed0`, validated) | felhom.eu/scripts | G2, G4, G5 | — |
 | **GL-3** git.token rotate + scope-down | Operator (small) | Gitea admin + config template | G3 | — |
-| **GL-4** Uninstaller gap-closure | Implementation | felhom.eu/scripts (+agent if drive-decommission call needed) | G6 | GL-2 (same file; sequence to avoid conflicts) |
-| **GL-5** DR bind-override | Implementation (agent v0.75.0) | felhom-agent | G8 | — |
+| **GL-4** Uninstaller gap-closure + key-pin fold | ✔ **DONE 2026-07-08** (host-install v1.11.0, `f7cc6a72`) | felhom.eu/scripts | G6 + G1-plumbing | GL-2 |
+| **GL-5** DR bind-override | ✔ **DONE 2026-07-08** (agent v0.75.0, `b3446213`, live-validated) | felhom-agent | G8 | — |
 | **GL-6** Demo-box drill | RUNBOOK, supervised | — | G7 | GL-1, GL-2, GL-4 |
 | **GL-7** Peti day-0 runbook + onboarding | RUNBOOK, supervised | felhom.eu/documentation/pilot | G9, G10, G11 | GL-6 green |
 
@@ -116,13 +117,33 @@ Recommended order: **GL-1 and GL-3 immediately** (operator-heavy, unblock everyt
   whole Gitea instance anonymously readable (all repos public)** — operator ruling required
   (see G3 + operator actions).
 
+- 2026-07-08 — **GL-4 SHIPPED** (host-install v1.11.0, felhom.eu `f7cc6a72`): G6 uninstall
+  gap-closure (self-update artifacts, per-drive plain-umount with busy-warn, KEPT-vs-WIPED
+  statement both modes, guest-only bind-store drive note) + the G1 key-pin day-0 PLUMBING
+  (`OPERATOR_KEY_*` constants empty-by-default + `--operator-pubkey-file` → `authz.signers`;
+  no-keys-resolved KEEPS preserved signers — a pinned box is never silently un-pinned). Harness
+  28/28 on felhom-pve incl. a full-uninstall DRY transcript vs live 9201; red-proofs RP-1..3.
+  Statuses: **G6 → implemented-awaiting-GL-6; G1 key-pin plumbing → done, ceremony pending.**
+- 2026-07-08 — **GL-5 SHIPPED** (agent v0.75.0, `b3446213`, live on felhom-pve): G8 DR bind
+  overrides + 4d real-bind swap, **scratch-DR live-validated** (see G8). The spike's
+  known-constants verdict held for the bind LAYOUT but PVE's all-or-nothing explicit-params
+  restore forced two live corrections (explicit rootfs; full storage-mpN pass-through from the
+  archive's embedded config — without it the DR guest boots WITHOUT its data volumes, a
+  data-loss restore that looks green). NOTE: no host-loss DR runbook exists yet to simplify
+  (the GL-5 spec assumed one) — the DR procedure doc is GL-6/S5 material. Follow-ups recorded:
+  publish agent 0.75.0 (the published 0.74.0 lacks working DR); restore-test has the same
+  dropped-mountpoint exposure in reverse (boot-verifies without mp0/mp1 — candidate: reuse
+  `drRestoreOverrides`); DR selftest KeepMAC=true duplicates a live source's MAC briefly.
+
 ## 6. Open questions & operator actions
 
 **Operator actions (Viktor):**
 - **Hub manifest bump** (Configs → Day-0 artifacts) — enter verbatim:
   agent `0.74.0` / `1ec3f58842edce1e9e32d022eaef15b7ff599c658c7a36bfe7833c708076af05`;
   golden `0.103.0` / `8481e8a14e2aa0abe3831cc40e5aea4c32f2017e7561c15dca8a674df6a6026e`.
-  Until then fresh installs still land 0.63.0/0.98.3.
+  Until then fresh installs still land 0.63.0/0.98.3. **UPDATE (GL-5): felhom-pve now runs agent
+  0.75.0 (working DR); prefer publishing 0.75.0 (`publish-agent.sh 0.75.0 <live binary>`) and
+  bumping straight to it — vouching 0.74.0 ships an agent whose guest-loss DR fails.**
 - **Gitea visibility ruling** (new, see G3): decide deliberately — (a) keep felhom repos public
   as an open-source posture, but audit + privatize `homelab-manifests` and the personal repos;
   or (b) lock the instance, which REQUIRES first proving the day-0 package fetch with a