admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Verify the standing picture against source: 12 downgrades, and the decay ran both ways
gates / gates (push) Successful in 21s
Details

Browse Source 
55 claims verified. Twelve moved, all downwards: walked 32 -> 20, built 5 -> 17.
Register ceiling R-284 -> R-290.

THE RULE DID NOT FIRE THE WAY IT WAS EXPECTED TO. Not one downgrade came from
code moving under an old proof. All twelve came from step 1 of the same rule --
the cited evidence does not exist. Measured: of the 28 capability-map rows
behind the page's claims, 8 carry a tests/ or audits/ path and 20 carry prose
only. The green dots were drawn from rows that cite an argument, not a walk
(R-290). The map, not the dataset, is what needs fixing -- it still says
PROVEN-LIVE for all twelve.

And once it ran backwards: fault.operator-email looked contradicted by R-182,
but live source shows the backup_run_failures digest allowlisted, operator-only
and templated, with recovery_unit_capture_failed now record-only. The claim is
right and the REGISTER ROW is stale (R-289). The session went looking for stale
proofs and found a stale defect.

R-281 WITHDRAWN -- wrong in both directions, settled by the operator's mailbox.
The tripwire DID fire (escrow_blob_served 10:19:41Z = 12:19 CEST) and false
error-severity alarms fired too, for deliberate attended work (R-285). The
measurement's cause is ESTABLISHED: the P7 query copied hub.db without hub.db-wal,
and the signature is exact -- it reported "2 events all day, newest 00:30:07",
and the rows at or before 00:30:07 number exactly 2. Timezone and wrong-key were
tested and refuted. The control had been drawn from the same stale snapshot as
the measurement, which is why it agreed (R-286).

Part 4: NO WORKFLOW CHANGED, deliberately. The gate is not ref-sensitive -- it
enumerates from the Gitea tags API, and both previous tag pushes passed. The red
is TRUE: run 267 saw v0.120.0 downloadable, run 284 on the same commit saw 404.
Who deleted the package is NOT established and is not guessed (R-287).

The page is now generated from where-felhom-stands.yaml by scripts/render_stands.py:
static, zero script tags, every moved status carrying a visible "changed, was X"
chip. The React bundle -- whose content was gzip+base64 inside a JS module map --
is kept as a dated snapshot. scripts/check_stands.py gates the data and convicted
51 problems in my own first draft before the staged positive control ever ran.
This commit is contained in:
authentik Default Admin
2026-08-09 18:40:49 +02:00
parent a199c492f4
commit 6088afcbed
8 changed files with 1274 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/architecture/Where Felhom Stands.html → documentation/architecture/where-felhom-stands-2026-08-09-snapshot.html
View File
documentation/architecture/where-felhom-stands.html
+46
View File
File diff suppressed because one or more lines are too long
documentation/architecture/where-felhom-stands.yaml
+727
View File
@@ -0,0 +1,727 @@
# where-felhom-stands.yaml — the data behind documentation/architecture/where-felhom-stands.html
#
# THIS IS A VIEW, NEVER A SOURCE. Every entry cites the capability-map row, register row or
# evidence document it derives from; an entry with no source is a defect, not a claim.
# A status may not be RAISED here — if the evidence supports a stronger status than the
# capability map records, the MAP changes first and this file follows it.
# Regenerate the page after any status move: python3 scripts/render_stands.py
#
# YAML rather than JSON, deliberately: statuses move one line at a time and a YAML diff shows
# which claim moved. A JSON re-dump reflows and shows the whole file.
#
# verdict vocabulary: confirmed | downgraded | upgraded | contested | needs-hardware
# depth: source-read (opened live source or evidence) | register+map (checked against the
# register and capability map only) | needs-hardware (cannot be settled off-box)
verified_on: 2026-08-09
verified_against:
felhom-agent: 28ba8593b8
felhom-controller: c732fe1283
hub: 56f8aa611c
claims:
- id: install.iso-selfregister
band: journey
stage: 1
title: "A blank machine installs itself from our own boot image and registers itself as unclaimed — proven on two different boards"
status: walked
note: "Two boards: N100 2026-07-18, HP t740 2026-07-21."
sources:
- capability-map: "Bare-metal Felhom ISO (blank hardware → zero-touch auto-install → first-boot host-install)"
- evidence: "tests/VALIDATION-n100-rehearsal-2026-07-18.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: install.installer-by-tag
band: journey
stage: 1
title: "The installer is published rather than pushed: rolling it back is one act"
status: built
note: "Gate 6 of hostinstall_gates asserts the manifest names an installer-v tag; ran green tonight."
sources:
- capability-map: "The installer is PUBLISHED, not pushed"
- register: "R-110"
changed:
from: walked
reason: "gate 6 asserts the manifest names an installer tag, but no walk of a rollback is on file"
verified:
date: 2026-08-09
verdict: downgraded
depth: source-read
- id: install.byo
band: journey
stage: 1
title: "Installing onto hardware the customer already owns — the path exists, the first real one has not happened"
status: partial
note: "UPGRADED: a real --mode byo install completed on demo-hp 2026-08-09 (Day-0 provision SUCCESS, 3m49s). Still not a customer's own hardware, so not 'walked' — but 'has not happened' is now false."
sources:
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: upgraded
depth: source-read
- id: install.nic-selfheal
band: journey
stage: 1
title: "A machine that ends up on the wrong network port explains itself on screen and finds its way back — proven in a virtual drill, never on metal"
status: partial
note: "Map says the same: PROVEN-LIVE (nested drill — nested != metal)."
sources:
- capability-map: "Box survives a wrong-NIC install"
- evidence: "audits/SPIKE-firstboot-nic-sweep-2026-07-22.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: install.reinstall-refuses
band: journey
stage: 1
title: "Reinstalling a machine we previously installed refuses, because our own removal leaves a name service holding the port our own installer checks"
status: partial
note: "Warning card. Confirmed live 2026-08-09; dnsmasq restarted by --uninstall seizes :53."
sources:
- register: "R-272"
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: claim.one-time-code
band: journey
stage: 2
title: "An emailed one-time code; the customer sets their own password and the operator never sees it"
status: walked
note: "Exercised live 2026-08-09: reset code accepted at /claim, 302 + session."
sources:
- capability-map: "Customer claim: one-time emailed code → customer sets own password"
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: claim.selfbind
band: journey
stage: 2
title: "The customer can bind their own machine from a link, with no operator present — done once, for real"
status: walked
note: "attempts=0, locked=0, source customer_selfbind, 2026-07-18."
sources:
- capability-map: "Customer binds their own appliance (self-service)"
- evidence: "tests/VALIDATION-n100-rehearsal-2026-07-18.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: claim.never-by-non-operator
band: journey
stage: 2
title: "It has never been done by a person who is not the operator"
status: partial
note: "Map records MISSING (as evidence). Still true after 2026-08-09."
sources:
- capability-map: "A customer (not the operator) performs a restore via UI alone"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: claim.code-naming
band: journey
stage: 2
title: "The same word is used for two different secrets across three surfaces; the email points at a page a rebuilt machine does not show"
status: partial
note: "Warning card. Cost a real code on 2026-08-09."
sources:
- register: "R-282"
- register: "R-283"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: use.catalog
band: journey
stage: 3
title: "Apps installed from a catalog of about 52, with a memory guard and health-aware progress"
status: walked
note: "53 templates listed on the rebuilt box 2026-08-09; deploy driven live."
sources:
- capability-map: "Deploy an app from the catalog (env config, memory guard, health-aware progress)"
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: use.lifecycle
band: journey
stage: 3
title: "Start, stop, restart, update, logs, remove — and the parts that must not be stopped cannot be"
status: built
sources:
- capability-map: "App lifecycle: start/stop/restart/update/logs/remove/redeploy"
- register: "R-108"
changed:
from: walked
reason: "no walk document cited by the map row or anywhere else"
verified:
date: 2026-08-09
verdict: downgraded
depth: register+map
- id: use.tunnel
band: journey
stage: 3
title: "Reachable from anywhere through a tunnel, per-app addresses"
status: walked
note: "Verified tonight: the rebuilt box answered on its public URL from outside."
sources:
- capability-map: "Remote access via Cloudflare Tunnel + Traefik (per-app subdomains)"
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: use.lan-fallback
band: journey
stage: 3
title: "Reachable on the home network when the internet is down"
status: built
note: "Only an observation on a running box with WAN pulled could settle it. Boxes are off."
sources:
- capability-map: "LAN access when internet is down (lan_resolver)"
verified:
date: 2026-08-09
verdict: needs-hardware
depth: needs-hardware
- id: use.files
band: journey
stage: 3
title: "Phone photos, documents with text recognition, files from Windows Explorer or a Mac"
status: walked
sources:
- capability-map: "Files from Windows Explorer / Mac Finder (SMB server)"
- evidence: "audits/SPIKE-lan-discovery-2026-07-18.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: use.launcher
band: journey
stage: 3
title: "A one-tap launcher, and a read-only guest link for visitors"
status: built
sources:
- capability-map: "Indítópult (app launcher) — one-tap grid of the household's openable apps"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: use.dlna
band: journey
stage: 3
title: "Media to a TV"
status: missing
note: "Map: MISSING."
sources:
- capability-map: "Media to TV via DLNA"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: use.multiuser
band: journey
stage: 3
title: "Separate accounts per household member"
status: missing
note: "Map: MISSING."
sources:
- capability-map: "Multiple household users / per-person accounts"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: drives.enrol
band: journey
stage: 4
title: "A new drive is found, offered, formatted, mounted and enrolled — including on awkward older boot layouts"
status: built
note: "Applies to a NEW drive. Re-attaching an existing one after a reinstall is R-280 and fails."
sources:
- capability-map: "Drive wizard: scan/format/mount/enroll, incl. legacy-boot LVM-root hosts"
- register: "R-220"
changed:
from: walked
reason: "the 2026-08-09 walk exercised RE-attach (which failed, R-280); first-enrolment of a NEW drive has no walk on file"
verified:
date: 2026-08-09
verdict: downgraded
depth: source-read
- id: drives.migrate
band: journey
stage: 4
title: "Moving data between drives, crash-safe; removing a drive safely; unplug detected"
status: built
sources:
- capability-map: "Data migration between drives (all / per-app), crash-safe"
changed:
from: walked
reason: "no walk document cited"
verified:
date: 2026-08-09
verdict: downgraded
depth: register+map
- id: drives.nas
band: journey
stage: 4
title: "A network drive can be browsed and hold bulk media, but may not hold an app's data — enforced"
status: walked
note: "RefuseAsAppNamespace is the fail-closed predicate."
sources:
- capability-map: "Network storage (NAS) is browse + bulk-media only"
- register: "R-108"
- evidence: "audits/R108-network-app-namespace-2026-07-30.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: drives.reattach-wall
band: journey
stage: 4
title: "After a reinstall the data drive cannot be re-attached through any dashboard route"
status: partial
note: "Warning card. /api/disks/candidates returns empty; the restore page promises two clicks."
sources:
- register: "R-280"
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: backup.tier1
band: journey
stage: 5
title: "App data on the machine, nightly database dumps, a copy on a second drive"
status: built
sources:
- capability-map: "Tier-2 secondary-drive copy: class-driven legs"
changed:
from: walked
reason: "no walk document cited"
verified:
date: 2026-08-09
verdict: downgraded
depth: register+map
- id: backup.whole-machine
band: journey
stage: 5
title: "A whole-machine archive that lands off the guest's own disk — a single-drive machine is recorded as degraded rather than pretending"
status: built
sources:
- capability-map: "Whole-guest backup lands OFF the guest's own physical device"
- register: "R-165"
changed:
from: walked
reason: "no walk document cited"
verified:
date: 2026-08-09
verdict: downgraded
depth: register+map
- id: backup.offsite
band: journey
stage: 5
title: "An encrypted off-site copy, sealed with a key the operator cannot read"
status: walked
note: "Verified tonight from the repo itself: 18 snapshots, daily, unbroken."
sources:
- capability-map: "Offsite (restic → Hetzner Storage Box)"
- register: "R-199"
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: backup.restore-proof
band: journey
stage: 5
title: "The backups prove themselves: a restore is actually performed, unattended, on every tier, on both machines"
status: built
note: "'on both machines, unattended, every tier' is a continuing claim about scheduled runs. Both boxes are off; the last recorded restore-test on demo-hp FAILED (notification_log 2026-08-05 restore_test_failed). Cannot be settled tonight."
sources:
- capability-map: "Restore-proof is UNATTENDED — the scheduler covers EVERY tier"
- register: "R-86"
changed:
from: walked
reason: "no walk document cited, and the last recorded restore-test on demo-hp FAILED (2026-08-05)"
verified:
date: 2026-08-09
verdict: downgraded
depth: needs-hardware
- id: backup.fill-warning
band: journey
stage: 5
title: "The customer is warned before a drive fills, per drive, in their own language"
status: walked
note: "R-177 (no operator-triggerable run) limits testing, not the capability."
sources:
- capability-map: "The customer is warned BEFORE a filesystem fills"
- register: "R-167"
- evidence: "audits/SPIKE-r165-mp1-merge-2026-08-02.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: backup.sikeres
band: journey
stage: 5
title: "A backup that covered nothing still calls itself successful"
status: partial
note: "Warning card."
sources:
- register: "R-240"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: fault.selfheal
band: journey
stage: 6
title: "The machine watches itself and repairs some faults without telling anyone it had to"
status: built
note: "R-264 records that the self-heal counters reach the hub and are decoded nowhere."
sources:
- capability-map: "Box survives an unattended app or guest-network failure"
- register: "R-264"
changed:
from: walked
reason: "no walk document cited"
verified:
date: 2026-08-09
verdict: downgraded
depth: source-read
- id: fault.operator-email
band: journey
stage: 6
title: "Failures reach the operator by email, one mail per run, every failing app named"
status: built
note: "CONFIRMED against source: backup_run_failures digest is allowlisted (api/handler.go:1837), operator-only (dispatcher.go:423), templated (templates.go:48); recovery_unit_capture_failed is record-only (dispatcher.go:376). NOTE: R-182's register row still describes the PRE-FIX behaviour — see R-289."
sources:
- capability-map: "A failed per-app Tier-1 backup reaches the OPERATOR — EVERY failing app, in ONE mail per run"
- register: "R-182"
changed:
from: walked
reason: "the digest is wired and source-verified, but no run of it has been observed delivering"
verified:
date: 2026-08-09
verdict: downgraded
depth: source-read
- id: fault.customer-email
band: journey
stage: 6
title: "Failures reach the customer"
status: built
note: "The customer leg is built; today's log shows customer-channel rows skipped as operator_only."
sources:
- capability-map: "App crashes → customer notified (one event per transition, no flapping spam)"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: fault.already-paired
band: journey
stage: 6
title: "An already-paired box is still told to pair itself"
status: partial
note: "Warning card."
sources:
- register: "R-214"
- register: "R-235"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: recover.screen
band: journey
stage: 7
title: "A rebuilt machine shows a full-page recovery screen without anyone looking for it, and says plainly that nobody can replace a lost recovery code"
status: walked
note: "Seen unsought on the rebuilt demo-hp 2026-08-09, seal date matching host_escrow.created_at."
sources:
- register: "R-193"
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: recover.byte-identical
band: journey
stage: 7
title: "The customer's code opens the sealed package and the data returns byte for byte — including accented Hungarian filenames, verified as raw bytes"
status: walked
note: "Reproduced 2026-08-09: 4/4 byte-identical, name bytes NFC-preserved, out of snapshot 41c830db."
sources:
- register: "R-201"
- evidence: "tests/walk5-r201-2026-08-07/journal.md"
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: recover.no-shell
band: journey
stage: 7
title: "Walked end to end with no command line inside the machine (2026-08-07)"
status: walked
note: "CONTESTED-RESOLVED: not a contradiction. The walk proves the ROUTE needs no guest shell; the map's MISSING row is about a NON-OPERATOR doing it, which has still never happened. Two questions, one word 'customer'."
sources:
- register: "R-201"
- evidence: "tests/walk5-r201-2026-08-07/journal.md"
- capability-map: "A customer (not the operator) performs a restore via UI alone"
verified:
date: 2026-08-09
verdict: contested
depth: source-read
- id: recover.putback
band: journey
stage: 7
title: "Putting restored files back where they belong is still manual"
status: partial
note: "Warning card. Confirmed 2026-08-09: the restore lands in a verification folder and says so."
sources:
- register: "R-213"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: recover.tripwire
band: journey
stage: 7
title: "The tripwire that says someone is opening this customer's backups does fire"
status: walked
note: "CONFIRMED tonight from the hub store: escrow_blob_served 2026-08-09 10:19:41Z = 12:19 CEST in the operator's mailbox. R-281's original claim of silence is WITHDRAWN."
sources:
- register: "R-281"
- register: "R-285"
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: fail.disk-failing
band: failures
title: "A disk starts failing — healthy path only; a genuinely failing disk has never been seen"
status: partial
note: "Only a failing disk on a running box could settle it."
sources:
- capability-map: "Lemez-egészség felügyelet: per-disk SMART kártya"
- evidence: "audits/SPIKE-smart-coverage-2026-07-25.md"
verified:
date: 2026-08-09
verdict: needs-hardware
depth: needs-hardware
- id: fail.backup-drive-unplugged
band: failures
title: "The backup drive is unplugged"
status: walked
sources:
- capability-map: "An ABSENT backup-target drive raises its OWN alarm"
- evidence: "audits/R116-v0116-2026-07-30.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: fail.drive-filling
band: failures
title: "A drive is filling up"
status: built
sources:
- register: "R-167"
changed:
from: walked
reason: "no walk document cited"
verified:
date: 2026-08-09
verdict: downgraded
depth: register+map
- id: fail.app-crash
band: failures
title: "An app crashes — the email leg has never been confirmed end to end"
status: built
note: "Consistent with fault.operator-email: the digest is wired but its delivery is unobserved."
sources:
- capability-map: "App crashes → customer notified (one event per transition, no flapping spam)"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: fail.power-cut
band: failures
title: "Power cut mid-backup"
status: walked
sources:
- evidence: "audits/AUDIT-power-outage-recovery-2026-07-22.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: fail.guest-destroyed
band: failures
title: "The guest is destroyed"
status: walked
sources:
- register: "R-201"
- evidence: "audits/DRILL-r201-night-run-2026-08-04.md"
- evidence: "audits/DRILL-r201-night-run-2026-08-04.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: fail.wiped-reinstalled.data
band: failures
title: "The whole machine is wiped and reinstalled — the data comes back"
status: walked
note: "4/4 byte-identical 2026-08-09."
sources:
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: fail.wiped-reinstalled.journey
band: failures
title: "The whole machine is wiped and reinstalled — the journey needs a terminal twice"
status: partial
note: "CONTESTED-RESOLVED against the map: the map's PROVEN-LIVE row is scoped to a controller-data-volume REBUILD (2026-08-04), not a whole-host reinstall. The map has no row for the host case, so there was no contradiction — only a gap."
sources:
- register: "R-273"
- register: "R-280"
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: fail.stolen-machine
band: failures
title: "The machine is stolen, and someone opens the backups — the operator is told"
status: walked
note: "Confirmed 2026-08-09 from the store and the mailbox."
sources:
- register: "R-281"
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: fail.forgot-password
band: failures
title: "The customer forgets their dashboard password"
status: walked
note: "Exercised 2026-08-09 via the reset code."
sources:
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: fail.lost-recovery-code
band: failures
title: "The customer loses their recovery code — by design, the data is unrecoverable"
status: built
note: "The recovery screen states it in Hungarian."
sources:
- capability-map: "Escrow ceremony: customer-facing wizard, one-shot R claim, operator zero-knowledge"
- register: "R-198"
changed:
from: walked
reason: "a by-design refusal; no walk document cited"
verified:
date: 2026-08-09
verdict: downgraded
depth: source-read
- id: fail.moves-house
band: failures
title: "The machine moves house / new network"
status: walked
sources:
- capability-map: "Box survives a site/network change (relocation, different subnet, DHCP re-lease)"
- evidence: "audits/AUDIT-vacation-remote-ops-2026-07-20.md"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: fail.internet-down
band: failures
title: "The internet goes down — built, never walked"
status: built
note: "Needs a running box with WAN pulled."
sources:
- capability-map: "LAN access when internet is down (lan_resolver)"
verified:
date: 2026-08-09
verdict: needs-hardware
depth: needs-hardware
- id: fail.hub-down
band: failures
title: "The hub is down"
status: built
sources:
- capability-map: "Config/state change round-trips in seconds (hub↔box immediacy"
changed:
from: walked
reason: "no walk document cited"
verified:
date: 2026-08-09
verdict: downgraded
depth: register+map
- id: fail.broken-release
band: failures
title: "We ship a broken release — the guard is missing"
status: missing
note: "Proven the hard way on 2026-08-09: a vouched agent version had no git tag and every install died at 5/8. Both guards still owed."
sources:
- register: "R-273"
- register: "R-287"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: fail.stale-image
band: failures
title: "A fresh install picks up an old image"
status: partial
note: "Narrowed 2026-08-09: the resume path fetched the vouched golden; a fresh install still takes the newest LOCAL archive with no manifest comparison."
sources:
- register: "R-274"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: fail.offsite-account-deleted
band: failures
title: "The off-site provider account is deleted"
status: partial
note: "The credential that holds the customer's documents can still delete."
sources:
- register: "R-95"
verified:
date: 2026-08-09
verdict: confirmed
depth: register+map
- id: fail.expected-downtime
band: failures
title: "The machine is switched off for an afternoon — no notion of expected downtime"
status: missing
note: "Confirmed 2026-08-09: eight operator mails for deliberate, attended work."
sources:
- register: "R-285"
verified:
date: 2026-08-09
verdict: confirmed
depth: source-read
- id: fail.customer-self-restore
band: failures
title: "A customer restores their own data with no help"
status: partial
note: "CONTESTED-RESOLVED: the map's MISSING is about a NON-OPERATOR performing it; the walks prove the route, not the person. Neither record was wrong."
sources:
- capability-map: "A customer (not the operator) performs a restore via UI alone"
- register: "R-201"
verified:
date: 2026-08-09
verdict: contested
depth: source-read