installer 1.34.0 (pushed; tag follows): vault-first step 4b (R-1145), --rotate-recovery-only (R-1141), harness gate (R-1146); R-895 dated check

documentation/backlog/OPEN-ITEMS.md

@@ -353,6 +353,7 @@ stopping line that lies.
 | item | due (UTC) | what to measure |
 |---|---|---|
 | R-887 | 2026-10-19 | no CI job lost in the 7 days after the S21 DooPlex change (act-runner fetch timeout + crawler rate limit); detail in the R-887 row |
+| R-895 | 2026-10-20 | the first verdict of the hub's own off-site snapshot check (hub 0.158.0; 2026-10-19 07:10 is the baseline): read the 07:10 log lines (count, newest upload vs the box's last run) and whether either alarm fired; detail in the R-895 row |
 | R-435 | 2026-10-20 | Tester 1's weekly off-site clean-up ran inside a hub window with no drop alarm (box log + mailbox); detail in the R-435 row |
 | R-1050 | 2026-11-15 | HSTS one year if no https trouble since 2026-10-15; detail in the R-1050 row |
 | R-1035 | 2026-11-11 | „felhő tárhely” + „saját felhő tárhely” impressions and average position, and the new page's own impressions/clicks/position, 4 weeks after publishing; operator supplies the read; detail in the R-1035 row |

scripts/CHANGELOG.md

@@ -1,4 +1,7 @@
-## 2026-10-18 — step 4b vaults FIRST, then sets the password (R-1145); the host key off curl's argv; the harness is a gate (R-1146); not yet tagged
+## 2026-10-18 — felhom-host-install.sh 1.34.0 (tag `installer-v1.34.0`, published on the operator's yes 2026-10-18): step 4b vaults FIRST, then sets the password (R-1145); the host key off curl's argv; the harness is a gate (R-1146)
+
+**1.34.0 carries every untagged entry below it since 1.33.0:** this one, `--rotate-recovery-only` (R-1141) and the
+uninstall of `felhom-thin-check` (R-1012).
 
 - **R-1145:** step 4b (the full install and `--rotate-recovery-only`) now runs generate → PUT to the hub vault (200 =
   stored) → chpasswd (one retry) → a PVE API login with the new value. A refused vault (a stale key included — the
@@ -12,7 +15,7 @@
   `hostinstall-harness` (`hostinstall_harness_gate.py`, fast; skips out loud on a runner without bash) with two decoys.
   Harness: 52 passed, 0 failed (was 45/2). New cases R1145-a..e run the REAL step with fake commands; red-proofed against
   HEAD (all five fail there).
-- Pushing to `main` publishes nothing — this rides the next `installer-v…` tag. SCRIPT_VERSION unchanged.
+- SCRIPT_VERSION 1.33.0 → 1.34.0.
 
 ## 2026-10-18 — `felhom-host-install.sh --rotate-recovery-only` (R-1141); not yet tagged
 

scripts/felhom-host-install.sh

@@ -194,7 +194,7 @@
 
 set -euo pipefail
 
-SCRIPT_VERSION="1.33.0"   # the SINGLE version source (F-1): -h and the run banners follow it.
+SCRIPT_VERSION="1.34.0"   # the SINGLE version source (F-1): -h and the run banners follow it.
                           # The hub used to carry a copy for its Setup tab; R-94 DELETED it
                           # (2026-08-02) because the hub cannot know which version a box runs —
                           # the Setup command fetches this script at run time. scripts/