Release close-out (attended, 2026-10-25): hub 0.170.0, agent 0.165.0 (vouched), controller 0.343.0 (global floor), catalog ebbf1f4; D49 = A and D44–D46 recorded (09 §3 258–261, CONTEXT, 07 §6.3/§8.2e); 9 rows closed, R-1254 hub half, R-1250 dated check 2026-10-27; R-1287–R-1290 filed; STATUS, map, REPORT-release-2026-10-26

documentation/audits/release-2026-10-26/byo/uninstall-console.txt

@@ -0,0 +1,85 @@
+
+[INFO] felhom-host-install v1.36.0 — mode=uninstall
+
+[STEP] UNINSTALL — local host teardown
+[INFO]   no --vmid given; using recorded provisioned_vmid=9201 from /var/lib/felhom-install/state.json
+[INFO]   vmid 9201 looks like a Felhom guest (has the /etc/felhom-bootstrap mount)
+[INFO]   pct config 9201:
+    arch: amd64
+    cores: 2
+    features: nesting=1,keyctl=1
+    hookscript: local:snippets/felhom-guest-hook.sh
+    hostname: tester4
+    memory: 4096
+    mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=50G
+    mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
+    mp9: /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1
+    net0: name=eth0,bridge=vmbr0,hwaddr=BC:24:11:4B:04:4E,ip=dhcp,type=veth
+    onboot: 1
+    ostype: debian
+    rootfs: local-lvm:vm-9201-disk-0,size=32G
+    swap: 4096
+    unprivileged: 1
+Type the vmid (9201) to confirm PERMANENT destruction: 9201
+  Logical volume "vm-9201-disk-0" successfully removed.
+byo-test
+  Logical volume "vm-9201-disk-1" successfully removed.
+[OK]   guest 9201 destroyed
+[STEP] host-level removal
+Removed '/etc/systemd/system/multi-user.target.wants/felhom-agent.service'.
+[OK]   removed /etc/felhom-agent (the agent config and every copy of it)
+Removed '/etc/systemd/system/multi-user.target.wants/wg-quick@wg-felhom.service'.
+[OK]   WireGuard tunnel to the Felhom off-site endpoint is down (wg-quick@wg-felhom disabled, conf removed)
+Removed '/etc/systemd/system/timers.target.wants/felhom-mgmt-watchdog.timer'.
+The unit files have no installation config (WantedBy=, RequiredBy=, UpheldBy=,
+Also=, or Alias= settings in the [Install] section, and DefaultInstance= for
+template units). This means they are not meant to be enabled or disabled using systemctl.
+ 
+Possible reasons for having these kinds of units are:
+• A unit may be statically enabled by being symlinked from another unit's
+  .wants/, .requires/, or .upholds/ directory.
+• A unit's purpose may be to act as a helper for some other unit which has
+  a requirement dependency on it.
+• A unit may be started when needed via activation (socket, path, timer,
+  D-Bus, udev, scripted systemctl call, ...).
+• In case of template units, the unit is meant to be enabled with some
+  instance name specified.
+Removed '/etc/systemd/system/multi-user.target.wants/felhom-shared-parent.service'.
+Removed '/etc/systemd/system/pve-guests.service.wants/felhom-shared-parent.service'.
+Generating grub configuration file ...
+Found linux image: /boot/vmlinuz-7.0.2-6-pve
+Found initrd image: /boot/initrd.img-7.0.2-6-pve
+Found memtest86+ 64bit EFI image: /boot/memtest86+x64.efi
+Found memtest86+ 32bit EFI image: /boot/memtest86+ia32.efi
+Found memtest86+ 64bit image: /boot/memtest86+x64.bin
+Found memtest86+ 32bit image: /boot/memtest86+ia32.bin
+Adding boot menu entry for UEFI Firmware Settings ...
+done
+[SKIP]   old broad role FelhomAgent already absent
+[SKIP]   golden vzdump left in place (pass --remove-golden to remove)
+
+[STEP] kept vs wiped — read before pulling drives or closing the customer out
+  WIPED (this run):
+    - guest 9201 (container + its OS/Docker/user-data volumes)
+    - the felhom-agent: binary, unit, sudoers (+ its copies), state dir, service user, and its config
+      directory with every copy of the config in it
+    - the WireGuard tunnel to the Felhom off-site endpoint (wg-quick@wg-felhom disabled, /etc/wireguard/wg-felhom.conf removed)
+    - self-update artifacts: guarded wrapper, A/B slots (.prev/.new.*), rollback unit, start-limit drop-in
+    - break-glass watchdog + OOB artifacts (where present); guest-hook snippet; dnsmasq snippets; the mkfs, pbs-apply,
+      backup-target-apply, os-apply and priv-apply wrappers; the crash guard; the config-bundle record
+    - pveum: the Felhom roles/user/token/scoped ACL; the emptied felhom pool
+    - the install state file
+  KEPT (lives on deliberately — remove/rotate these out-of-band if the customer is leaving):
+    - the enrolled drives + ALL data under /mnt/felhom-drives — unmounted only, NEVER wiped;
+      the drives are physically removable now.
+    - the PBS backups + this customer's namespace on the PBS side — delete there if wanted
+    - the hub host/customer record + report history (operator UI / DB)
+    - this host's WireGuard PEER on the hub and the off-site endpoint (its /32 and public key) — the
+      tunnel is down from this side; delete the peer in the hub (operator) if the customer is leaving
+    - the escrow blob in the hub, if one exists (operator UI)
+
+[OK] UNINSTALL complete — removed: guest 9201, the felhom-agent (unit/sudoers/binary/state/config+baks/user + selfupdate-artifacts/shared-parent/mkfs-wrapper/pbs-apply-wrapper/hook-snippet/dnsmasq-snippets), the pveum role/user/token/ACL, the felhom pool, and /var/lib/felhom-install/state.json.
+[INFO]   golden vzdump: left in place (--remove-golden to remove).
+[INFO]   NOTE: the 'sudo' package was left INSTALLED (a system package, never ours to remove). dnsmasq is removed only when the install-time record says Felhom installed it; a resolver that pre-dated Felhom is never touched. The host record still exists in the hub — remove it there if desired.
+UNINSTALL_RC=0
+Connection to 192.168.0.151 closed.

documentation/audits/release-2026-10-26/global-floor-watch.txt

@@ -0,0 +1,4 @@
+# global floor 0.343.0 set 17:53:42Z; watch until 18:23:58Z
+17:54:00Z BYO Tester4 guest: gitea.dooplex.hu/admin/felhom-controller:0.343.0 Up 8 seconds (healthy)
+== hub events/alarms 17:53Z..now:
+2026/10/25 18:52:55 [INFO] osupdates: alarm check done in 2.069s, 0 alarm(s) sent []

documentation/audits/release-2026-10-26/t1-restores-0.343.0/_t1probe/record.json

@@ -0,0 +1,46 @@
+{
+ "app": "tandoor",
+ "install": true,
+ "seed": true,
+ "backup": {
+  "code": "200",
+  "seconds": 56,
+  "status": "{\"db_dump\": {\"count\": 3, \"duration\": \"52.311590442s\", \"last_run\": \"2026-10-25T17:24:29.737958922Z\", \"success\": true}, \"enabled\": true, \"running\": false}"
+ },
+ "unit_restore": {
+  "points": 1,
+  "location": [
+   "location: /backups/restore?flash=flash.restore.started"
+  ],
+  "seconds": 101,
+  "status": "{\"running\": false, \"op\": \"restore\", \"stack\": \"tandoor\", \"started_at\": \"2026-10-25T17:24:33.058022807Z\", \"last\": {\"op\": \"restore\", \"stack\": \"tandoor\", \"ok\": true, \"message\": \"A(z) tandoor: 3 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult.\", \"finished_at\": \"2026-10-25T17:26:13.100134046Z\"}, \"last_recent\": true}",
+  "state": "running"
+ },
+ "unit_restore_item": true,
+ "unit_restore_release": {
+  "line": "2026/10/25 17:29:15 [INFO] [backup] tandoor: ran stably for 3m0s after its unit restore — the restore copy is released (R-1270)",
+  "undo_left": ""
+ },
+ "reinstall": true,
+ "set_aside_line": "2026/10/25 17:31:55 [INFO] [backup] tandoor: the recovery unit of an earlier install (795457b5d5a73a21; the install ids differ) is SET ASIDE whole → /mnt/sys_drive/felhom-data/backups/set-aside/tandoor/20261025T173155Z; this install (c150b1bb5020980f) gets its own unit from its first backup (D47)",
+ "restore_page_offers": true,
+ "kept_restore": {
+  "seconds": 100,
+  "status": "{\"running\": false, \"op\": \"restore\", \"stack\": \"tandoor\", \"started_at\": \"2026-10-25T17:32:39.488361815Z\", \"last\": {\"op\": \"restore\", \"stack\": \"tandoor\", \"ok\": true, \"message\": \"A(z) tandoor: 3 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult.\", \"finished_at\": \"2026-10-25T17:34:18.635463152Z\"}, \"last_recent\": true}"
+ },
+ "kept_restore_item": true,
+ "kept_restore_release": {
+  "line": "2026/10/25 17:37:20 [INFO] [backup] tandoor: ran stably for 3m0s after its unit restore — the restore copy is released (R-1270)",
+  "undo_left": ""
+ },
+ "controller_lines": "2026/10/25 17:24:33 [WARN] [web] Restore requested (async): stack=tandoor, snapshot=helyi from 172.18.0.3:46404\n2026/10/25 17:24:33 [INFO] [backup] Restore tandoor: database password(s) [DB_PASSWORD] come from the backup, [] stay as installed (older than the data) — values not logged (R-1106)\n2026/10/25 17:24:33 [INFO] [backup] Restoring tandoor from recovery unit /mnt/sys_drive/felhom-data/backups/primary/tandoor: images=2, secrets recovered=2/2, data_keys=0\n2026/10/25 17:24:38 [INFO] [offbox] tandoor: the live volumes are copied before the restore (3 copied, 0 new from the snapshot) in 2.712s — /mnt/sys_drive/felhom-data/backups/restore-undo/tandoor/20261025T172435Z (R-893)\n2026/10/25 17:24:38 [INFO] [backup] tandoor: the restore copy is recorded — a power cut from here on puts the app back on start (R-1195)\n2026/10/25 17:24:38 [INFO] [backup] Restoring Docker volume tandoor_tandoor_media for tandoor\n2026/10/25 17:24:38 [INFO] [backup] Restoring Docker volume tandoor_tandoor_postgres_data for tandoor\n2026/10/25 17:24:40 [INFO] [backup] Restoring Docker volume tandoor_tandoor_static for tandoor\n2026/10/25 17:24:42 [INFO] [backup] Restored 3 Docker volume(s) for tandoor\n2026/10/25 17:24:43 [INFO] [backup] Restore tandoor: replaying DB dump into tandoor-postgres (postgres)\n2026/10/25 17:24:46 [INFO] [backup] Restore tandoor: replayed 1 DB dump(s)\n2026/10/25 17:26:13 [INFO] [backup] Restore-from-unit completed: tandoor — 3 volume(s) of 3 listed, 1 database(s) of 1 listed\n2026/10/25 17:26:13 [INFO] [web] Restore completed (async): stack=tandoor in 1m40.039853575s (volumes 3/3, dbs 1/1)\n2026/10/25 17:29:15 [INFO] [backup] tandoor: ran stably for 3m0s after its unit restore — the restore copy is released (R-1270)\n2026/10/25 17:29:56 [INFO] [stacks] image retention (remove of tandoor): pass over 24 image(s) of [ghcr.io/tandoorrecipes/recipes postgres] — 2 candidate(s), 2 deleted, the rest kept\n2026/10/25 17:31:55 [INFO] [settings] kept copy recorded: kind=unit source=\"tandoor\" reason=earlier_install path=/mnt/sys_drive/felhom-data/backups/set-aside/tandoor/20261025T173155Z\n2026/10/25 17:31:55 [INFO] [backup] copy KEPT (earlier_install): unit \"tandoor\" at /mnt/sys_drive/felhom-data/backups/set-aside/tandoor/20261025T173155Z\n2026/10/25 17:31:55 [INFO] [backup] tandoor: the recovery unit of an earlier install (795457b5d5a73a21; the install ids differ) is SET ASIDE whole → /mnt/sys_drive/felhom-data/backups/set-aside/tandoor/20261025T173155Z; this install (c150b1bb5020980f) gets its own unit from its first backup (D47)\n2026/10/25 17:31:55 [INFO] Event pushed: backup_run_failures (error) [hu-only] — App \"tandoor\": its backup belonged to an earlier install (795457b5d5a73a21; this install c150b1bb5020980f), so it was SET ASIDE whole at /mnt/sys_drive/felhom-data/backups/set-aside/tandoor/20261025T173155Z (D47) and \n2026/10/25 17:32:39 [WARN] [web] Restore of tandoor from a set-aside unit requested (async): /mnt/sys_drive/felhom-data/backups/set-aside/tandoor/20261025T173155Z from 172.18.0.3:49058\n2026/10/25 17:32:39 [INFO] [backup] restore tandoor from the set-aside unit /mnt/sys_drive/felhom-data/backups/set-aside/tandoor/20261025T173155Z (an earlier install, D47)\n2026/10/25 17:32:39 [INFO] [backup] Restore tandoor: database password(s) [DB_PASSWORD] come from the backup, [] stay as installed (older than the data) — values not logged (R-1106)\n2026/10/25 17:32:39 [INFO] [backup] Restoring tandoor from recovery unit /mnt/sys_drive/felhom-data/backups/set-aside/tandoor/20261025T173155Z: images=2, secrets recovered=2/2, data_keys=0\n2026/10/25 17:32:48 [INFO] [offbox] tandoor: the live volumes are copied before the restore (3 copied, 0 new from the snapshot) in 4.781s — /mnt/sys_drive/felhom-data/backups/restore-undo/tandoor/20261025T173243Z (R-893)\n2026/10/25 17:32:48 [INFO] [backup] tandoor: the restore copy is recorded — a power cut from here on puts the app back on start (R-1195)\n2026/10/25 17:32:48 [INFO] [backup] Restoring Docker volume tandoor_tandoor_media for tandoor\n2026/10/25 17:32:48 [INFO] [backup] Restoring Docker volume tandoor_tandoor_postgres_data for tandoor\n2026/10/25 17:32:50 [INFO] [backup] Restoring Docker volume tandoor_tandoor_static for tandoor\n2026/10/25 17:32:53 [INFO] [backup] Restored 3 Docker volume(s) for tandoor\n2026/10/25 17:32:53 [INFO] [stacks] tandoor: the restored data belongs to install 795457b5d5a73a21 (was c150b1bb5020980f) — its backups follow it (D47)\n2026/10/25 17:32:53 [INFO] [backup] Restore tandoor: replaying DB dump into tandoor-postgres (postgres)\n2026/10/25 17:32:57 [INFO] [backup] Restore tandoor: replayed 1 DB dump(s)\n2026/10/25 17:34:18 [INFO] [backup] Restore-from-unit completed: tandoor — 3 volume(s) of 3 listed, 1 database(s) of 1 listed\n2026/10/25 17:36:54 [INFO] [settings] kept copy recorded: kind=unit source=\"tandoor\" reason=earlier_install path=/mnt/sys_drive/felhom-data/backupLine truncated
+ "after_remove": {
+  "containers": "",
+  "volumes": "",
+  "appyaml": "",
+  "appdata": "",
+  "kept": "",
+  "subdomain": "404"
+ },
+ "set_aside_after_remove": "ls: cannot access '/mnt/*/felhom-data/backups/set-aside/tandoor': No such file or directory"
+}

documentation/audits/release-2026-10-26/t1-restores-0.343.0/_t1probe/walk.log

@@ -0,0 +1,21 @@
+17:20:37Z   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+17:23:17Z   [1] deployed, controller state=running, pinned={'tandoor': 'ghcr.io/tandoorrecipes/recipes:2.6.15', 'tandoor-postgres': 'postgres:17-alpine'}
+17:23:18Z     gate: recipes is gated — passed as the household (cookie set)
+17:23:32Z     tandoor: createsuperuser :: Running django-vite in production mode (no HMR) Superuser created successfully.
+17:23:37Z     tandoor: seeded superuser drill4e7162
+17:23:37Z   [4] Mentés most -> 200 {'ok': True, 'message': 'Mentés elindítva'}
+17:24:33Z   [6] POST /backup/restore -> HTTP/2 302  ['location: /backups/restore?flash=flash.restore.started']
+17:26:13Z   [1] unit restore: {"running": false, "op": "restore", "stack": "tandoor", "started_at": "2026-10-25T17:24:33.058022807Z", "last": {"op": "restore", "stack": "tandoor", "ok": true, "message": "A(z) tandoor: 3 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult.", "finished_at": "2026-10-25T17:26:13.1001
+17:26:43Z     tandoor: readback of the seeded account found=True
+17:26:43Z   [1] item after the unit restore: True
+17:29:19Z   [1] released: 2026/10/25 17:29:15 [INFO] [backup] tandoor: ran stably for 3m0s after its unit restore — the restore copy is released (R-1270) | undo folder now: gone
+17:29:54Z   [5] stop 200, remove KEEPING data -> 200 {'ok': True, 'data': {'removed': 'tandoor', 'volumes_removed': ['tandoor_tandoor_media', 'tandoor_tandoor_postgres_data', 'tandoor_tandoor_static'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [],
+17:29:59Z   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+17:32:15Z   [1] deployed, controller state=running, pinned={'tandoor': 'ghcr.io/tandoorrecipes/recipes:2.6.15', 'tandoor-postgres': 'postgres:17-alpine'}
+17:32:30Z   [2] set aside: 2026/10/25 17:31:55 [INFO] [backup] tandoor: the recovery unit of an earlier install (795457b5d5a73a21; the install ids differ) is SET ASIDE whole → /mnt/sys_drive/felhom-data/backups/set-aside/tandoor/20261025T173155Z; this install (c150b1bb5020980f) gets its
+17:32:39Z   [2] POST /backup/kept/restore -> HTTP/2 302  ['location: /backups/restore?flash=flash.restore.started']
+17:34:19Z   [2] kept restore: {"running": false, "op": "restore", "stack": "tandoor", "started_at": "2026-10-25T17:32:39.488361815Z", "last": {"op": "restore", "stack": "tandoor", "ok": true, "message": "A(z) tandoor: 3 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult.", "finished_at": "2026-10-25T17:34:18.6354
+17:34:49Z     tandoor: readback of the seeded account found=True
+17:34:49Z   [2] item after the kept-data restore: True
+17:37:25Z   [2] released: 2026/10/25 17:37:20 [INFO] [backup] tandoor: ran stably for 3m0s after its unit restore — the restore copy is released (R-1270) | undo folder now: gone
+17:38:04Z   [7] stop 200, remove with data -> 200 {'ok': True, 'data': {'removed': 'tandoor', 'volumes_removed': ['tandoor_tandoor_media', 'tandoor_tandoor_postgres_data', 'tandoor_tandoor_static'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [],

documentation/audits/release-2026-10-26/t1-restores-0.343.0/run.txt

@@ -0,0 +1,21 @@
+17:20:37Z   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+17:23:17Z   [1] deployed, controller state=running, pinned={'tandoor': 'ghcr.io/tandoorrecipes/recipes:2.6.15', 'tandoor-postgres': 'postgres:17-alpine'}
+17:23:18Z     gate: recipes is gated — passed as the household (cookie set)
+17:23:32Z     tandoor: createsuperuser :: Running django-vite in production mode (no HMR) Superuser created successfully.
+17:23:37Z     tandoor: seeded superuser drill4e7162
+17:23:37Z   [4] Mentés most -> 200 {'ok': True, 'message': 'Mentés elindítva'}
+17:24:33Z   [6] POST /backup/restore -> HTTP/2 302  ['location: /backups/restore?flash=flash.restore.started']
+17:26:13Z   [1] unit restore: {"running": false, "op": "restore", "stack": "tandoor", "started_at": "2026-10-25T17:24:33.058022807Z", "last": {"op": "restore", "stack": "tandoor", "ok": true, "message": "A(z) tandoor: 3 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult.", "finished_at": "2026-10-25T17:26:13.1001
+17:26:43Z     tandoor: readback of the seeded account found=True
+17:26:43Z   [1] item after the unit restore: True
+17:29:19Z   [1] released: 2026/10/25 17:29:15 [INFO] [backup] tandoor: ran stably for 3m0s after its unit restore — the restore copy is released (R-1270) | undo folder now: gone
+17:29:54Z   [5] stop 200, remove KEEPING data -> 200 {'ok': True, 'data': {'removed': 'tandoor', 'volumes_removed': ['tandoor_tandoor_media', 'tandoor_tandoor_postgres_data', 'tandoor_tandoor_static'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [],
+17:29:59Z   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
+17:32:15Z   [1] deployed, controller state=running, pinned={'tandoor': 'ghcr.io/tandoorrecipes/recipes:2.6.15', 'tandoor-postgres': 'postgres:17-alpine'}
+17:32:30Z   [2] set aside: 2026/10/25 17:31:55 [INFO] [backup] tandoor: the recovery unit of an earlier install (795457b5d5a73a21; the install ids differ) is SET ASIDE whole → /mnt/sys_drive/felhom-data/backups/set-aside/tandoor/20261025T173155Z; this install (c150b1bb5020980f) gets its
+17:32:39Z   [2] POST /backup/kept/restore -> HTTP/2 302  ['location: /backups/restore?flash=flash.restore.started']
+17:34:19Z   [2] kept restore: {"running": false, "op": "restore", "stack": "tandoor", "started_at": "2026-10-25T17:32:39.488361815Z", "last": {"op": "restore", "stack": "tandoor", "ok": true, "message": "A(z) tandoor: 3 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult.", "finished_at": "2026-10-25T17:34:18.6354
+17:34:49Z     tandoor: readback of the seeded account found=True
+17:34:49Z   [2] item after the kept-data restore: True
+17:37:25Z   [2] released: 2026/10/25 17:37:20 [INFO] [backup] tandoor: ran stably for 3m0s after its unit restore — the restore copy is released (R-1270) | undo folder now: gone
+17:38:04Z   [7] stop 200, remove with data -> 200 {'ok': True, 'data': {'removed': 'tandoor', 'volumes_removed': ['tandoor_tandoor_media', 'tandoor_tandoor_postgres_data', 'tandoor_tandoor_static'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [],