rehearsal 2026-10-20: final report, STATUS (morning list, D24), capability map A12/A13 → PARTIAL (B7), stuck point 10

REPORT-rehearsal-2026-10-20.md

@@ -1,13 +1,21 @@
 # REPORT — Tester-2 rehearsal with a pretend household + an independent data-loss hunt (2026-10-20 → 21)
 
-> DRAFT written 2026-10-20 ~21:30 UTC, before the night. Sections marked **PENDING** are filled in the morning.
+> Run 2026-10-20 09:30 UTC → 2026-10-21 ~09:50 UTC. Drafted before the night, finished in the morning. This repo's
+> shared `REPORT.md` was not touched: a parallel session works in the same clone, and the repo rule says the second
+> session writes `REPORT-<topic>.md` only (the brief asked for both; this line is why one was skipped).
 > Evidence: `documentation/audits/rehearsal-2026-10-20/` (journal, A0–B10, screens) and
 > `documentation/audits/dataloss-hunt-2026-10-20/` (C1–C3). Architecture read for the claims: `07-backup-architecture.md`,
 > `10-localisation.md`, `00-capability-map.md` (A15).
 
 ## Five sentences
 
-PENDING (morning).
+A pretend household installed a box from the public ISO, linked it, claimed it, put eight apps and about 2 GB of family
+data on it, used it for a day, and every customer restore path brought its data back. The first night's backups, the
+clock change, three days off and power cuts in the middle of installs and catch-ups all worked, and the morning data was
+byte-identical to the evening's. But the 8 GB minimum box froze twice on its first afternoon and only a plug pull helped
+(R-1192), and the household's warning mails went to the operator instead (R-1199). When the box died, the household could
+not even start again without the operator, and after the operator's press the rebuilt box could not reach its off-site
+history at all — proven live (R-1176, P1). Nothing was released; 29 new register rows carry the rest.
 
 ## The ten places a household gets stuck
 
@@ -22,14 +30,15 @@ PENDING (morning).
 7. A new drive needs a „mount name" nobody knows; the button silently does nothing (W13).
 8. Sharing waits for ever for a password the page never asks for (W21).
 9. Errors arrive as raw technical English (W22, W25).
-10. Three apps' „first steps" are wrong for this household (wrong address, wrong user name, wrong sign-up state; W17–W19).
+10. After the box died, the household was promised a mail that never came, and after the operator's press the rebuilt box
+    could not reach the family's off-site data (R-1203, R-1176). (Close behind: three apps' wrong „first steps", W17–W19.)
 
 ## Data-loss findings, ranked
 
 | row | Sev | harm | reproduced | design / defect |
 |---|---|---|---|---|
 | R-1175 | P1 | shares on two drives sharing one second drive: every night one drive's share copy is pruned; the night a drive dies its copy is deleted | unit test on production code (`C3-D1-shares-tier2/`) | defect |
-| R-1176 | P1 | a box rebuilt after „delete the old host" cannot reach its off-site history: no recovery code asked, a new key, the old history set aside on night one | hub store unit test (`C3-K1-…`); controller half read in code; live test in B7 — PENDING | defect |
+| R-1176 | P1 | a box rebuilt after „delete the old host" cannot reach its off-site history: no recovery code asked, a new key, the old history set aside on night one | hub store unit test (`C3-K1-…`) + **LIVE in B7** (2026-10-21) | defect |
 | R-1191 | P1 | a `.fab` import makes a family-only app open to anyone | LIVE on scratch 9202 | defect (security) |
 | R-1192 | P1 | the 8 GB box froze under first-day use; two plug pulls | LIVE on Tester4 (twice) | defect — cause not diagnosed (no shell on the box) |
 | R-1177 | P2 | a failed local restore destroys the live data, keeps no copy | LIVE on 9202 | design question (D22 in STATUS) |
@@ -40,11 +49,15 @@ PENDING (morning).
 | R-1179 | P2 | a drive marked „away" can still be the second-drive target | code + unit test | defect |
 | R-1182 | P2 | abandoning one set-aside off-site copy deletes every retained key package | code | defect |
 | R-1199 | P2 | warning mails reach the operator, not the household | LIVE (two mailboxes) | defect |
+| R-1204 | P2 | a box that ran once with its clock ahead loses its WireGuard tunnel to ep0 (PBS copies + operator door) until that date | LIVE (B6 #8, ep0 `wg show`) | defect |
+| R-1203 | P2 | after a box death, the household is promised a link mail that never comes until the operator deletes the old host | LIVE (B7) | defect |
 | R-1185 | P3 | a dump that fails its own check has already replaced the good one | unit test (docker stub) | defect (order) |
 | R-1186 | P3 | the nightly off-site copy is skipped silently when another backup holds the flag | code | defect |
 | R-1184 | P3 | a cut-off shares restore can be reported restored with files missing | code | defect |
 | R-1196 | P3 | uploads confirmed just before a drive pull are 0 bytes or gone | LIVE (B6 #4) | defect |
-| R-1183 | P3 | on 2026-10-25 every hub daily job runs twice (DB snapshot keep-2 pruned a day early) | replay of the hub's arithmetic | defect |
+| R-1183 | P3 | on 2026-10-25 every hub daily job runs twice (DB snapshot keep-2 pruned a day early) | replay of the hub's arithmetic | defect (D24 in STATUS) |
+| R-1200 | P3 | an afternoon install gets no whole-box backup on night one | LIVE (B5) | design question |
+| R-1202 | P3 | a box with its clock behind stops an app silently and only says „Hub nem elérhető" | LIVE (B6 #8) | defect |
 | R-1187 … R-1190 | P3 | the unproven candidates of the four reviewers, grouped | code reading | mixed |
 
 ## Failure scenarios (B6)
@@ -57,11 +70,11 @@ PENDING (morning).
 | ★4 | data drive pulled, put back | apps stopped in 42/34 s, back by themselves; last uploads 0 B/missing → R-1196 | `s4-…` |
 | ★5 | slow lossy line, first big off-site | run failed under 1 Mbit + 5 % loss, raw English; second press OK 3 m 38 s | `s5-…` |
 | ★6 | off-site blocked | failed in 2.5 min, raw English; catch-up OK 2 m 37 s (shortened, not a night) | `s6-…` |
-| ★7 | DST | PENDING (morning) | |
-| ★8 | wrong clock at boot ±2 y | PENDING (morning) | |
+| ★7 | DST | PASS — the database copy ran once, at the second 02:30; W30 (no summer/winter mark in the repeated hour) | `s7-dst/` |
+| ★8 | wrong clock at boot ±2 y | FINDINGS — −2 y became −6 months (the OS floor): „Hub nem elérhető" only, Paperless stopped silently (R-1202); +2 y: a whole-box archive dated 2028 (R-1189 a), then the ep0 tunnel dead (R-1204) | `s8-wrong-clock/` |
 | ★9 | two actions at once | PASS — second action refused with a clear sentence | `s9-…` |
-| ★10 | box off 3 days (+#15 restart in the catch-up) | PENDING (morning) | |
-| 11 | hard reset mid app update | PENDING — expected NOT RUN: no update is offered (nothing released during the run) | |
+| ★10 | box off 3 days (+#15 restart in the catch-up) | PASS — ONE catch-up, a clear note to the household, the interrupted catch-up recovered | `s10-three-days-off/` |
+| 11 | hard reset mid app update | NOT RUN — no update was offered to the box (nothing was released during the run) | — |
 | 12 | DNS dead 1 h | PASS for data; operator told after ~37 min, household never | `s12-…` |
 | 13 | second drive added later | not offered as the backup place → R-1198; safe removal OK; blank texts (W29) | `s13-…` |
 | 14 | remove keeping data → reinstall „use kept data" | PASS — 47/47 documents, 47/47 originals | `s14-…` |
@@ -84,10 +97,7 @@ demo-hp's own kernel update rebooted the test host and shut the rehearsal VM dow
 host skips that step by design). Health 200 all night before that; memory steady. **The morning data snapshot is
 identical to the evening one, byte for byte** (`B5-night/README.md`).
 
-**DST (#7):** PENDING — running on the box now. So far: at the first 02:30 (summer time) the database copy did NOT run,
-as the code replay said. Code replay: the controller runs each daily job once on 2026-10-25 (a 02:xx job at the second,
-CET occurrence); the hub runs every daily job twice (R-1183); spring 2027 puts the 02:30 dump on the 03:30 second-drive
-copy (`B6-failures/dst-replay/`).
+**DST (#7), live:** the box was started with its clock at 2026-10-25 02:20 CEST and left alone: no database copy at the first 02:30, one at the second (01:30:00Z, 1 m 55 s). The code replay agrees for the box; the hub runs every daily job twice on that day (R-1183, D24) and spring 2027 puts the 02:30 dump on the 03:30 copy (`B6-failures/dst-replay/`).
 
 ## Interventions (operator-only acts)
 
@@ -95,7 +105,7 @@ copy (`B6-failures/dst-replay/`).
 |---|---|---|---|
 | 1 | 09:57 → 12:00:57 | the owner passphrase handed over (by design, out of band) | 124 |
 | 2 | asked 09:35, done 12:01–12:15 | off-site switched on for Tester4 | 0 (done before the household needed it) |
-| 3 | PENDING | delete host Tester4-816e21 before the reinstall (B7) | PENDING |
+| 3 | asked 08:59, done ~09:11 (2026-10-21) | delete host Tester4-816e21 before the reinstall (B7) | ~12 (and 17 min of a dead end before it, R-1203) |
 
 Not counted as interventions: the two plug pulls (14:11, 16:13) — a household can do that, and did.
 
@@ -112,7 +122,10 @@ Works: Chromium 155 + Playwright 1.52 in a throwaway LXC on demo-hp, phone and c
 
 ## Teardown
 
-PENDING (Part D).
+Machine: VM 9320, CT 9330 and the ISO removed from demo-hp by their own IDs; no drill firewall rules left; memory back
+to the start. DooPlex: three watchers stopped by PID. Hub: **host Tester4-648b80 is left for the operator to delete**
+(the customer Tester4 stays). ep0: one PBS snapshot `ns/Tester4/ct/9201/2026-10-20T12:17:26Z` and the WireGuard peer
+10.77.0.6 remain; the Storage Box keeps the household's restic history — listed, nothing removed (`D-teardown/`).
 
 ## Secrets (names only)
 
@@ -124,10 +137,22 @@ All in `sec`, prefix `REHEARSAL_2026_10_20_`: `9202_PW`, `9202_RESETCODE`, `APP_
 
 ## Register
 
-Before 153 open rows; now 178 — opened R-1175 … R-1199 (25), closed 0. PENDING final count.
+Before 153 open rows; now 182. Opened by this run: 29 (R-1175 … R-1200, R-1202, R-1203, R-1204). Closed: R-1019 (a dated
+check read on demo-felhom, read-only). One row (R-1201) came from a parallel session. Updated: R-1176 (proven live),
+R-1189 (a half-live), R-895 (first verdict), R-435 (moved). Capability map: A15 still PARTIAL with new evidence; A12 and
+A13 PROVEN-LIVE → PARTIAL (B7). `unproven.py --summary`: unchanged (35 of 55 not walked).
 
 ## Observations
 
 FILED: everything in the tables above. NOT-A-FINDING: the dashboard ignores an English browser (by design: the
 household's setting wins); Nextcloud folding NFD into NFC (upstream behaviour; both forms survive on the share); the
-films' off-site size (CBR filler compresses; nothing missing); PENDING more.
+films' off-site size (CBR filler compresses; nothing missing); demo-hp's own kernel reboot at 02:46 (a harness effect: a
+BYO host skips that step by design, `osupdate/leg.go:674`). FILED: everything in the tables above.
+
+**Harness slips (mine), each recorded in the journal:** a screenshot step blanked a form before submit (15 min lost); the
+two watcher logs froze at 20:24 when `git pull --autostash` replaced their files (recovered in full from the open files);
+my first #10 start used a date the #7 records had made meaningless (restarted, recorded before any result). **Secrets:**
+the nightly DooPlex sweep found three rehearsal secret values in my session record (the old and new bind tokens and a
+setup code — I had read their mails in full and typed one into a `sec put`); in B7 a second bind link and setup code
+entered the record the same way. All are one-time values, spent within minutes; nothing secret is in any committed file
+(323 files scanned, 0 hits; pictures checked by eye; the B7 pairing code was blacked out).

STATUS.md

@@ -2,7 +2,7 @@
 
 **Ready for the first real tester (Tester 2)? Yes.** Tester 2 (a laptop) is off; nothing was sent to it.
 
-**Updated 2026-10-20 (day).** Hub 0.162.0, agent 0.161.0 (you vouched it) and installer 1.35.0 are live, and a failed off-site restore now puts the app back exactly as it was (your D20 = A; controller 0.336.0 is the floor). This page is one screen again: older news moved to the history file (`documentation/backlog/STATUS-HISTORY.md`), and nothing was deleted. A long rehearsal on a fresh box runs today and tonight.
+**Updated 2026-10-21 (morning).** The 24-hour rehearsal with a pretend household finished: the first night, the clock change, a 3-day power-off and every restore path worked, but the 8 GB box froze twice on day one and, after a box death, the household could not get its off-site data back (R-1176, proven live). Report: `REPORT-rehearsal-2026-10-20.md`; ten stuck points, 29 new rows, nothing released.
 
 ## What works
 - A box installs from nothing with the public installer, links to the hub, and moves to the floor by itself (map A1, A3, A4).
@@ -15,7 +15,7 @@
 - The hub mails alarms and recoveries, and keeps one whole-box copy per week on ep0; CC uses its own limited token, not your password (map F1, F11, G15).
 
 ## What is broken
-- **P1 (the data-loss hunt, 2026-10-20 — still running):** shared folders on two drives lose their second copy every night, and a dead drive's copy is deleted the same night (R-1175); a box rebuilt after „delete the old host" cannot reach the household's off-site history (R-1176); importing an app bundle makes a family-only app public (R-1191); on the 8 GB minimum box the family's first afternoon froze the box for an hour, twice; the household was told nothing (R-1192, R-1193).
+- **P1 (rehearsal + data-loss hunt, 2026-10-20/21):** shared folders on two drives lose their second copy every night (R-1175); after a box death the household cannot reach its off-site history — proven live on 2026-10-21 (R-1176); importing an app bundle makes a family-only app public (R-1191); the 8 GB box froze twice on its first afternoon (R-1192, R-1193).
 - **P1:** about 12 homelab logins still use a password that was public, and the public Gitea repo is not decided (R-925, yours).
 - Two root-level weaknesses wait on your decisions D3 and D4 (R-985, R-982).
 - Tester 2 is off since 2026-10-04: old emergency password, no off-site check, no bootstrap (R-1139, R-1104, R-862).
@@ -32,6 +32,7 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te
 
 | # | Row | Question | Pick (why) | The other option costs | If you do nothing | Blocked |
 |---|---|---|---|---|---|---|
+| D24 | R-1183 | On Sunday 25 Oct (clocks go back) the hub runs every daily job twice. Fix it before Sunday with a hub deploy you attend? | **Yes, Friday** (a small change; the box side was proven right live today) | Leave it: the alarm check runs twice and the hub keeps one day less of its database copies, once | the double run happens on Sunday; nothing is lost on the boxes | — |
 | D23 | R-1181 | A missing app folder deletes its second-drive copy within one night. Keep the old copy until the household lets it go? | **Yes, keep it** (a deleted folder is the reason a backup exists; audiobooks, comics and ROMs have no other copy) | Keep as now: a deleted folder is gone from every local copy by the next morning | an accidental folder delete is unrecoverable after one night | — |
 | D22 | R-1177 | A LOCAL restore that fails destroys the live data and keeps no copy. Give it the off-site restore's „put back exactly" (your D20)? | **Yes** (proven live today: a failed restore left the app dead and the newest data gone) | No: a failed local restore can lose the household's newest data | the main restore button can lose data when a backup copy is damaged | — |
 | D21 | R-49 | Immich's off-site copy: leave out only the AI model files now (B), or also the raw database folder and Immich's own backups (A)? | **B now** (−62 %, no new risk); A's other parts after their proof | A: −92 %, but it needs a restore path we have never run | every Immich box sends about 12 times its real data off-site each night | — |
@@ -54,9 +55,9 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te
 6. BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. Since 2026-10-14.
 7. Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). Since 2026-10-12.
 
-**Morning list, 2026-10-20 (from the night session, part 2).** Item 1 (vouch agent 0.161.0) is done. Item 2 is D21 above.
-- MeTube's downloaded videos are now out of the second-drive copy, like the torrent and usenet downloads. If you want them kept, say so. If not: nothing to do.
-- The update test for more apps needs your word: start the test bench (guest 9401 on demo-hp) and let CC commit to the drill catalog (R-462). Five apps wait for a tested step. If not: they stay on their tested version, which is safe.
+**Morning list, 2026-10-21 (rehearsal).** No decision was taken by CC.
+- Delete host **Tester4-648b80** on the Hosts page (the rebuilt test box, now gone; if not: stale/down alarm mails). Keep or remove the 24 `REHEARSAL_2026_10_20_*` secrets in sec (7 are spent one-time values).
+- From 2026-10-20: MeTube downloads are out of the second-drive copy (say if you want them kept); the update test for five apps waits for your word to start bench 9401 (R-462).
 
 **The rest**
 - Pull the failed disk Z6A07P2G out of DooPlex (R-934); it is still in. If not: its alarms return on 11 November. Since 2026-10-12.

documentation/architecture/00-capability-map.md

@@ -85,8 +85,8 @@
 | <a id="a9"></a>[A9](capability-map-detail/A.md#a9) | One name per secret on every surface — „Beállító kód" (the setup code) and „Tulajdonosi jelmondat" (the owner passphrase) — and the re-enrol mail points at a page a rebuilt box shows | controller v0.211.0, hub v0.104.0 + v0.105.0 (R-295, R-323) | **IMPLEMENTED** | written BUILT: source-read; no customer has typed the passphrase | R-295; R-323 |
 | <a id="a10"></a>[A10](capability-map-detail/A.md#a10) | The offsite repository password can be RECOVERED from the sealed escrow with the customer's recovery code | hub v0.94.0, agent v0.125.0, controller v0.195.0 | **PROVEN-LIVE** | demo-felhom, real endpoints | `audits/DRILL-r201-offsite-recovery-2026-08-04.md` (2026-08-04); `audits/RECON-offsite-dr-chain-2026-08-04.md` (2026-08-04) |
 | <a id="a11"></a>[A11](capability-map-detail/A.md#a11) | DR tier by default: PBS + WireGuard base infra on every install, hub-controlled activation | installer v1.15, agent v0.86, hub v0.51 | **PROVEN-LIVE** | demo/drill fleet only | `audits/DRILL-day0-take2-2026-07-12.md` (2026-07-12) |
-| <a id="a12"></a>[A12](capability-map-detail/A.md#a12) | A customer's file survives a machine rebuild and comes back — the whole off-site story, end to end | hub v0.94.0, agent v0.125.0, controller v0.197.0 | **PROVEN-LIVE** | the success path; the failure path is not claimed (R-379, R-380) | `audits/DRILL-r201-night-run-2026-08-04.md` (2026-08-04); `audits/DRILL-r356-hot-only-restore-2026-08-22/` (2026-08-22); `audits/DRILL-r356b-driveless-db-restore-2026-08-22/` (2026-08-22) |
-| <a id="a13"></a>[A13](capability-map-detail/A.md#a13) | The customer's own UNAIDED recovery journey, end to end | controller v0.206.0, hub v0.98.0, agent v0.127.0 | **PROVEN-LIVE** | fifth walk, scoped — read what it does not claim | `tests/walk5-r201-2026-08-07/journal.md` (2026-08-07); `audits/CAMPAIGN-11-recovery-journey-2026-08-05.md` (2026-08-05) |
+| <a id="a12"></a>[A12](capability-map-detail/A.md#a12) | A customer's file survives a machine rebuild and comes back — the whole off-site story, end to end | hub v0.94.0, agent v0.125.0, controller v0.197.0 | **PARTIAL** | 2026-10-21: FAILS on the current versions — after a box death and the operator's delete, the rebuilt box offers only a NEW recovery code and cannot read the off-site store (R-1176); before: the success path; the failure path is not claimed (R-379, R-380) | `audits/rehearsal-2026-10-20/B7-died/README.md` (2026-10-21); `audits/DRILL-r201-night-run-2026-08-04.md` (2026-08-04); `audits/DRILL-r356-hot-only-restore-2026-08-22/` (2026-08-22); `audits/DRILL-r356b-driveless-db-restore-2026-08-22/` (2026-08-22) |
+| <a id="a13"></a>[A13](capability-map-detail/A.md#a13) | The customer's own UNAIDED recovery journey, end to end | controller v0.206.0, hub v0.98.0, agent v0.127.0 | **PARTIAL** | 2026-10-21: FAILS on the current versions — the unaided journey stops at the rebuilt dashboard (R-1176, R-1203); before: fifth walk, scoped — read what it does not claim | `audits/rehearsal-2026-10-20/B7-died/README.md` (2026-10-21); `tests/walk5-r201-2026-08-07/journal.md` (2026-08-07); `audits/CAMPAIGN-11-recovery-journey-2026-08-05.md` (2026-08-05) |
 | <a id="a14"></a>[A14](capability-map-detail/A.md#a14) | A random night of household actions while random things go wrong — twelve rounds, unattended | controller v0.245.0, agent v0.131.0, hub v0.116.0, golden 0.245.0, ISO 1.28.0 | **PROVEN-LIVE** | nested box, twelve chaos rounds | `audits/DRILL-chaos-night-2026-09-17.md` (2026-09-17) |
 | <a id="a15"></a>[A15](capability-map-detail/A.md#a15) | A stranger's FIRST HOUR on a fresh install — download → install → claim → two apps → use → backup → remove → restore, plus a power cut and a mistyped code | controller v0.336.0, agent v0.161.0, hub v0.162.0, golden 0.331.0, installer 1.35.0, ISO 1.29.0 | **PARTIAL** | 2026-10-20: download → install → bind → claim → 8 apps → use → backup → remove → every restore path → power cut → mistyped codes all worked; the 8 GB box FROZE twice in the first afternoon and only a plug pull brought it back (R-1192), and the owner passphrase needed the operator | `audits/rehearsal-2026-10-20/journal.md` (2026-10-20); `audits/DRILL-fresh-install-0242-2026-09-14.md` (2026-09-14); `audits/DRILL-new-household-2026-09-30.md` (2026-09-30) |
 | <a id="a16"></a>[A16](capability-map-detail/A.md#a16) | Off-site app-data capture covers the paths an app declares MANDATORY — on BOTH drive layouts | controller v0.197.0 | **PROVEN-LIVE** | both drive layouts | `audits/DRILL-r201-offsite-recovery-2026-08-04.md` (2026-08-04) |

documentation/audits/rehearsal-2026-10-20/B10-stuck/README.md

@@ -14,8 +14,8 @@ Each point names what the family SAW, what it would do next, and the record (reg
 | 7 | new drive (storage init) | a required „Csatlakoztatási név * /mnt/…" field, empty; the button silently did nothing | press again; give up | the 200 GB disk unused until someone helps | W13 |
 | 8 | sharing („Megosztás") | „A megosztási szolgáltatás előkészítése folyamatban…" for ever — it waits for a share password the page never asks for | wait; ask for help | no shared folder until found | W21 |
 | 9 | errors in English | a failed restore, a failed off-site run, a failed install all show raw technical English („offbox backup immich: exit status 1…", „starting stack rallly: exit code 1…") | cannot tell what broke or what to do | a call to support each time | W22, W25, s1/s6/s5 READMEs |
-| 10 | wrong „Első lépések" | Mealie's steps name the wrong address (mealie.… while the app is at recipes.…); Paperless says log in as „admin" while the family chose its own name; Vaultwarden says sign-up is closed while the family opened it | follow the steps, fail, think the app is broken | minutes per app; trust lost | W17–W19 |
+| 10 | after the box died (B7) | the old link page: „new mail in a few minutes" — no mail until the operator deleted the old host; then the rebuilt box offered only a NEW recovery code and could not read the off-site store | wait; phone Felhom; start over with an empty box | the family's data out of reach, though it still exists | R-1203 (P2), R-1176 (P1) |
 
-Close behind (not in the ten): the download link that does not look like a link (W2); the second disk never offered as
+Close behind (not in the ten): three apps' wrong „first steps" (W17–W19); the download link that does not look like a link (W2); the second disk never offered as
 the backup place (R-1198); Jellyfin refused for memory with no help choosing what to remove (W20); the recovery-code
 page full of operator words (W10); Actual Budget wholly in English (W23).

documentation/backlog/STATUS-HISTORY.md

@@ -5,6 +5,10 @@ Moved here byte for byte on 2026-10-14 (night session), newest first, so that `S
 
 **Updated 2026-10-13 (night): demo-hp, demo-felhom and Tester 1 run agent 0.155.0; demo-felhom runs controller 0.310.0, the other two 0.309.0 until the floor is raised. The open-items list is at 127. Reports: `REPORT-poweroff.md`, `REPORT-plugmeter.md`, `REPORT-usenet-2026-10-12.md`, `REPORT-newapps-2026-10-12.md`, `REPORT-disk-evening-2026-10-12.md`, `REPORT-answers-2026-10-12.md`, `REPORT-m3-2026-10-11.md`, `REPORT-redesign-2026-10-10.md`, `REPORT-testers-2026-10-10.md`, `REPORT-register-shrink-2026-10-10.md`, `REPORT-new-apps-2026-10-10.md`, `REPORT-release-2026-10-10.md`, `REPORT-break-the-circle-2026-10-09.md`, `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
 
+## Moved from STATUS on 2026-10-21
+
+**Updated 2026-10-20 (day).** Hub 0.162.0, agent 0.161.0 (you vouched it) and installer 1.35.0 are live, and a failed off-site restore now puts the app back exactly as it was (your D20 = A; controller 0.336.0 is the floor). This page is one screen again: older news moved to the history file (`documentation/backlog/STATUS-HISTORY.md`), and nothing was deleted. A long rehearsal on a fresh box runs today and tonight.
+
 ## Moved from STATUS on 2026-10-20
 
 `STATUS.md` was rebuilt from the register on 2026-10-20 (107 lines and 31,695 bytes before; one screen after). Nothing