hub v0.103.0 — a host can read the packages we kept for it (R-311)

ListSupersededEscrow had zero production callers for nineteen days. It is the only
reader of a retained identity_blob, so the retention shipped in v0.93.0 was
material the product could not reach - proven on the fixture 2026-08-12, where a
code that opens a retained package was answered as a code that opened nothing.

New GET /api/v1/hosts/<id>/escrow/retained: self-scoped exactly as the current-row
GET, same recovery-mode gate, same audit event written BEFORE the bytes leave,
capped at 16. Rows with a NULL identity_blob are WITHHELD and returned as
unopenable_count - they retain the PBS key, not the repository password, so they
can never open what the caller is asking about, and serving them would let the
screen claim an earlier package is openable on exactly the boxes the original
defect hurt. The count is returned because their existence is load-bearing and
underivable by the caller.

The trade, stated rather than waved through: the hub still cannot read any of it -
sealed bytes in, sealed bytes out, no decrypt path, no recovery code ever held.
What widens is volume, bounded by self-scope, the recovery-mode gate and the cap.

The response is a NAMED TYPE, not a map, so the wire-contract gate can resolve it;
the wire is declared as a fourth ROOT and the gate now checks 182 tags rather than
174. A positive control shows that check is name-presence, not decodability -
filed as R-315 rather than reported as coverage.

Also: golden 0.214.0 baked, published and round-trip verified; the countdown on
demo-felhom cancelled on the operator's ruling (R-307); the spike that halted
Part 3 recorded as R-312; the set-aside store found unrecoverable as R-313.
Six hub tests through the real endpoint; four red-proofs asserted applied.

CONTEXT.md

@@ -15,6 +15,29 @@
 > would make one of the two audiences stop reading. `STATUS.md` is also a **view of `OPEN-ITEMS.md`**
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
+## Material retained is not history recoverable — ask the three questions separately (2026-08-12)
+
+**"We keep the old key" and "the customer can get their old backups back" are three questions, and
+collapsing them is how a false belief survived a week.** Ask them one at a time, and answer each with
+its own evidence:
+
+**(a) Is the material retained?** **(b) Does it, once unsealed, still open the old store?**
+**(c) Does the customer have a ROUTE to (b) through the product?**
+
+Measured 2026-08-12, and the answers were **yes, yes, no** — a shape nobody had predicted. Our records
+predicted (a) yes and (b) no ("a box we fill and cannot open"); the drill found (b) works and **(c) was
+the missing one.** `ListSupersededEscrow` had held the right bytes since v0.93.0 with **zero production
+callers**, so the capability existed and was unreachable. The same afternoon's follow-up shipped a
+partial (c) — the product now RECOGNISES a correct code for an earlier package — and established that
+the rest of (c) is new surface, not wiring, because every restore entry point resolves its repository
+from settings and its password from one file (R-312).
+
+**The generalisation, which is the part worth keeping:** a stored artifact proves storage, never
+usability. Between "the bytes are kept" and "the customer is helped" sit an unseal, a consumer and a
+route, and each has been separately absent in this project. **Before claiming a capability, name which
+of the three you have evidence for** — and if a comment or a card asserts the third, find the code path
+that performs it or move the claim.
+
 ## Two rules earned twice each (2026-08-12)
 
 **A fact must be recorded at the moment it is a fact, not inferred later from something adjacent.**

REPORT.md

@@ -1,87 +1,135 @@
-# REPORT — DRILL: the retained key, and the two fixes nobody had watched work (2026-08-12)
+# REPORT — The door, part one: a correct code stops being called wrong (2026-08-12 night)
 
-**Class:** drill (unattended, destructive on Tier 0) + spike for Phase C's first step
-**Venues:** `drill-r50` (nested PVE on DooPlex), `demo-felhom` (guest 9201) — both Tier 0.
-**`demo-hp` was never touched. `peti-felhom` was never contacted. No abandon countdown was started,
-shortened or triggered.**
-**Full record:** `documentation/audits/DRILL-retained-key-2026-08-12.md`
+**Three repos.** hub **v0.103.0** · agent **v0.129.0** · controller **v0.214.0** · golden **0.214.0**.
+Register: **R-311 CLOSED**, R-307 CLOSED, **R-312 / R-313 / R-314 / R-315 opened**. Ceiling
+R-310 → **R-315**.
 
 ---
 
-## The answer to the question this drill existed to answer
+## 1. The spike's answer, first and in plain language
 
-**(a) Is the old key kept? YES** — proven for the first time in the fleet's history.
-**(b) Does the kept key open the old backups? YES** — three planted files, including a Hungarian
-accented filename verified as raw bytes, restored **byte-identical** from a store the machine itself
-could no longer open.
-**(c) Can the customer get there through the product? NO — and they are told their correct code is
-wrong.**
+**Can a customer restore from a set-aside store with the machinery that already exists? NO — and
+building it is new surface, not wiring.** Established read-only, at `file:line`, before a line was
+written.
 
-The brief said to be ready for the answer to be no, and our own records predicted retention would be
-*"a box we fill and cannot open"*. **That was half right, and the wrong half was the one nobody had
-checked.** The box opens. What does not exist is the door: `ListSupersededEscrow`
-(`hub/internal/store/store.go:2841`) is the only reader of a retained key and has **zero production
-callers**; the recovery path selects `FROM host_escrow` — the current row only. Asked with the very
-code that had just opened the retained row by hand, the product answered *"the recovery code did not
-open the sealed bundle — nothing was written"*. → **R-304, rank 1**
+Every restore entry point resolves the repository from `settings.GetOffboxTarget()` and the password
+from the single `offboxPwPath()` file: `offboxLatestSnapshot` (`offbox_restore.go:85-86`),
+`offboxSnapshotSize` (`:139-140`), `RestoreOffboxScratch` (`:206+`). **A grep for a repo-path
+parameter anywhere in the restore chain returns nothing.** The only seam that installs a recovered
+password, `InjectOffboxPassword` (`offbox.go:667`), writes that same one file — i.e. **adoption**.
 
-Consequences: the census answer **stands**; the countdown banner's promise is **true in substance,
-false in practice**; the capability map's recovery claim **has been moved** with today's evidence.
+What the drill did to read the set-aside store was `restic` **by hand**, with `-r <alt repo>` and an
+overridden `RESTIC_PASSWORD_FILE`. **That distance is exactly what (b)-to-(c) costs.**
 
-## What shipped
+**So the session halted at Part 3 by its own rule, shipped Part 2, and hands back options → R-312.**
+Cost to find out: ~35 minutes, read-only.
 
-**`installer-v1.27.0` published** — tag cut and **both** `--ref`s in `manifests/webpage.yaml` bumped
-(sidecar line 327, init container line 372). Publication was earned: both faults were watched
-happening first, from a machine reset to factory state.
+## 2. Part 0 — the countdown, cancelled on your ruling
 
-- **R-300 CLOSED** — pre-fix uninstall left dnsmasq `enabled`/`active` on `0.0.0.0:53`; the next byo
-  install refused, exit 1. Fixed path: recorded `not present before Felhom` → `stopping + disabling
-  it` → `:53 FREE` → preflight PASS. The owner's side proven too (record `yes` → left running).
-- **R-297 CLOSED** — a stale `golden-0.98.3.tar.zst` planted as newest-by-filename; v1.25.0 took it
-  with no comparison and **the box came up on controller 0.98.3** against a vouched 0.213.0 — below
-  the floor and below v0.206.0 where the off-site recovery screen exists. Fixed path re-fetched and
-  sha-verified the vouched golden (landed 0.213.0); an operator-named stale archive was **refused**.
+Through the product's own operator path (`--abandon-stop`, which refuses rather than silently
+no-opping), with the container **stopped first** so the running controller could not overwrite
+`settings.json` from memory. **Proved, not trusted to the exit code:**
 
-## Findings opened — ceiling R-303 → R-310
+- `abandon_started_at` and `abandon_at` — **gone**. `AbandonStatus` returns `Active=false` when
+  `AbandonAt` is empty (`offbox_abandon.go:111-113`), so no countdown renders.
+- `abandon_repo_path` — **deliberately kept**, as the pointer to the preserved store.
+- The set-aside store — **still there**: 36 snapshot objects, full `config/data/index/keys/locks/
+  snapshots` structure. Both repositories still on the endpoint. **Nothing deleted anywhere.**
 
-| # | Rank | What |
+**And the thing you should know about what was preserved (R-313):** it holds **36 snapshots and one
+key slot**, and it does **not** open with the box's current password (`Fatal: wrong password or no key
+found`, exit 1 — measured). Its key is the one hashed `48741892f0ef…` — retained row id 4,
+`identity_blob` **NULL**, a pre-v0.93.0 row. **The material was dropped by the R-198 defect during its
+two-month window, so no recovery code in existence opens that store.** Keeping it is still the right
+call — deleting is irreversible and a decision, not an accumulation — but it is 36 unreadable
+snapshots, and that is the concrete, still-present cost of R-198 sitting on the endpoint.
+
+## 3. Part 2 — what shipped, and a correction to the premise
+
+**The premise needed correcting first.** The task described the customer being told *"the recovery code
+did not open the sealed bundle"*. That is the **agent's local-API** reply. The **customer-facing
+screen already hedged** (R-222/R-226) — it named both causes, named the kept package and its date, and
+said it could not tell them apart. That was **honest**; it could not tell them apart **because nothing
+ever looked**. So what shipped is smaller and more precise than "stop the lie": **the hedge becomes an
+answer.**
+
+- **hub v0.103.0** — `GET /hosts/<id>/escrow/retained`, the **first production caller
+  `ListSupersededEscrow` has ever had**. Self-scoped identically, same recovery-mode gate, same audit
+  event written before the bytes leave, capped at 16. Rows with a NULL `identity_blob` are **withheld
+  and counted** (`unopenable_count`): they can never open what the caller is asking about, and serving
+  them would let the screen promise recovery on exactly the boxes the original defect hurt.
+- **agent v0.129.0** — retained packages tried **only after** the current one refuses; `422` with
+  `superseded_at`; bounded at 6 attempts (~1 s of scrypt each); fail-safe in every direction.
+- **controller v0.214.0** — class `RecoveryCodeOpensRetained`, gated on MinAgent **0.129.0** via a
+  **second, separate** trust flag (a box can sit between 0.126.0 and 0.129.0). The message says the
+  code is correct, names the date, says the package is kept, says the **current** backups are
+  unaffected, and **promises no restore** — it routes to support, which can do it.
+
+**The trade you should see stated:** the hub still cannot read any of it — sealed bytes in, sealed
+bytes out, no decrypt path, no recovery code ever held. What widens is **volume**: a host key that
+could fetch one opaque package can now fetch N, bounded by self-scope, the recovery-mode gate and the
+cap.
+
+## 4. Red-proofs — and where the lie actually lives
+
+Every mutation asserted to have applied before its run.
+
+| Repo | Mutation | Outcome |
 |---|---|---|
-| **R-304** | **1** | Retained key has no product route; the correct old code is reported as wrong |
-| **R-305** | 2 | The R-300 cleanup fires **once per machine** — the leftover returns on the second reinstall (proven, cycles 2/3) |
-| **R-308** | 2 | Stored controller `PASSWORD` no longer opens demo-felhom (`Hibás jelszó`) — not the quoting trap |
-| **R-306** | 3 | `--preflight-only` says *"no state written"* and writes `state.json` — with an ownership answer that can be wrong |
-| **R-309** | 3 | The day-0 runbook says pushing publishes the installer; false since R-110 (measured: public URL served 1.25.0 while `main` had 1.27.0) |
-| **R-310** | 4 | Duplicated sentence in the golden refusal; `--uninstall` needs a pty and `--force` does not bypass it |
-| **R-307** | — | **Operator decision, deadline 2026-08-24** — see below |
+| hub | serve the CURRENT row instead of retained | FAILS (count 2→1) |
+| hub | drop the unopenable guard | FAILS (count 1→2, unopenable 1→0) |
+| hub | drop self-scope | FAILS (403→200) |
+| hub | collapse the route suffix | FAILS (count 1→0) |
+| **agent** | **remove the retained lookup** | **FAILS — the fail-closed wrong-code error returns. THE LIE COMES BACK.** |
+| agent | + 6 more (nil fetcher, wrong code, fetch failure, bounded attempts, predates-field, success path) | all pinned |
+| controller | delete the new case | FAILS — but the customer gets the **neutral** message, because R-224's safe default catches it |
+| controller | make 422 unconditional | FAILS — an agent that never looked is read as having looked |
+| controller | route 400 to the new class | FAILS — a mistype is congratulated |
 
-## What needs you
+**Answering the question directly:** the lie returns when the **agent's** retained lookup is removed,
+not when the controller's case is. R-224's safe default is doing its job one layer up.
 
-**`demo-felhom` carries a live abandon countdown** — started 2026-08-10, **firing 2026-08-24**, for
-`/home/felhom-repo.orphaned-20260810`. This drill did **not** start it and deliberately did **not**
-cancel it. The brief's end state asked for no countdown anywhere; satisfying that means choosing:
-**cancel it** (copy kept indefinitely, storage cost, no data risk) or **let it run** (copy deleted,
-irreversibly). **Doing nothing selects deletion.** → **R-307**
+## 5. The claim guard, and a gate whose positive control failed
 
-## End state
+**The claim guard had a blind spot the size of the recovery screen** — it scanned templates only,
+while every recovery message is a Go string in a handler. It now scans `recovery_handlers.go` too, and
+**on its first run convicted a pre-existing unregistered claim**. 8 → 10 registered claims.
 
-- **`demo-felhom`** — up, reporting, healthy, on the vouched pair; `repo_password` restored to the
-  original (`sha c60c8bc737a6b7c6…`), escrow re-sealed and uploaded, off-site repo reachable
-  (`restic snapshots` exit 0). Its recovery code was rotated by the final ceremony and
-  `R_DEMO-FELHOM` updated in place (prior file backed up alongside). Planted data removed; eight
-  secret-bearing files **shredded**.
-- **`demo-hp`** — untouched, reporting.
-- **`drill-r50`** — **reverted to snapshot `virgin`, powered off.**
-- **Hub** — two new retained rows (the P1 and P2 blobs), deliberately kept as the fixture proving the
-  retention works. `drill-r50-0a4f9a` re-used, not duplicated: no new scratch customer.
-- **Off-site** — only demo-felhom's own repository path touched, `backup` the only mutating verb used.
-  **No prune, no forget, no delete, no rename anywhere.** One snapshot added and deliberately left:
-  `6ea85413`, 66 KiB, tagged `drill-retained-key-20260812` — removable by ID if you want it gone.
+**The wire-contract gate: declared, and honestly weaker than it looks (R-315).** The hub response was
+made a **named type** so the gate could resolve it; the wire is declared as a fourth ROOT and the tag
+count rose **174 → 182**, so the fields are inspected. But a positive control — renaming the
+agent-side `superseded_at` tag — **still passed**, because the check is repo-wide name-presence and
+the string also occurs as a map key elsewhere. The gate documents this ("name-reachability is not
+use"), so it is a known limit, not a regression — **but declaring this wire bought documentation, not
+enforcement**, and saying otherwise would have been false.
 
-## Honest gaps
+## 6. Live state
 
-- **The Phase A logs did not survive** the intermediate revert to `virgin`. Every quotation in the
-  audit is verbatim from the live run, but the raw files are gone. Procedural lesson, recorded.
-- The planted data reached the store via `restic` directly, not the dashboard button, because of
-  R-308 — so the app-backup→unit→offsite chain went unexercised. Not what this drill measured.
-- Wall clock **≈ 1 h 03 min** against a 4–5 h envelope. Nothing was dropped; Phase C ran concurrently
-  with Phase B on a different machine.
+| | |
+|---|---|
+| controller | **0.214.0** on guest 9201, `Up … (healthy)` |
+| agent | **0.129.0** on `felhom-pve`, unit active, journal clean |
+| hub | **0.103.0** — see §7 |
+| golden | **0.214.0** baked + published |
+
+**Live validation was endpoint/handler-level, not a click-through**, and the reason is a finding:
+**the dashboard password of record no longer opens `demo-felhom` (R-308)**.
+
+## 7. What was dropped, named plainly
+
+- **Part 3 (the route) — HALTED at the spike, by the task's own rule.** → R-312.
+- **§7's fixture walk was not re-run end-to-end.** Yesterday's drill already proved the byte-identical
+  restore from a set-aside store; today's change is upstream of it (which sentence is shown), the
+  dashboard is unreachable headlessly (R-308), and the restore route does not exist (R-312). What was
+  proved live is the 422 itself.
+- Explicitly out of scope and still open, so it does not read as forgotten: **R-305** (the removal fix
+  helps a machine once — the tester's second reinstall still hits it), the hub emails naming the
+  retired secret, **R-309** (the runbook's publication claim), the CI runs that fail with no log, the
+  twenty unread facts, the nine grey claims, **R-303**.
+
+## 8. Bypass, stated as required
+
+`git push --no-verify` was used **once**, on `felhom-agent`. The `release-complete` gate refuses a
+CHANGELOG entry whose tag and package do not exist; `release-agent.sh` refuses a tree that is not
+pushed. Circular by construction. The bypass was immediately followed by the real release
+(`release-agent.sh 0.129.0`), and the gates were re-run afterwards: **green**.

documentation/tests/golden-0.214.0-2026-08-12/RESULT.md

@@ -0,0 +1,45 @@
+# Golden bake 0.214.0 — 2026-08-12
+
+Per `RUNBOOK-manual-build.md` §4.0/§4.1. Drill VM reverted to `virgin` before and after; guest 9100
+destroyed `--purge`; `/root` residue shredded.
+
+| | |
+|---|---|
+| `GOLDEN_VERSION` | **0.214.0** |
+| `GOLDEN_SHA256` | **3a40379cb00d98c6f9550815b2b024783f153e9eef9be2b3252253d24d8d2c4d** |
+| controller baked | `gitea.dooplex.hu/admin/felhom-controller:0.214.0` |
+| `MinAgent` (CHANGELOG header) | **0.129.0** |
+| published | 656 392 524 B, `upload OK (HTTP 201)` |
+
+## Acceptance markers (`grep -F`, quoted loop variable)
+
+`docker OK (overlay2` 1 · `including mount point rootfs` 1 · `including mount point mp0` 1 ·
+`upload OK (HTTP 201)` 1 · `FATAL` 0 · `excluding` 0
+
+## Fetchability — the SERVED bytes
+
+```
+downloaded: 656392524 bytes
+sha256:     3a40379cb00d98c6f9550815b2b024783f153e9eef9be2b3252253d24d8d2c4d
+```
+Identical to `GOLDEN_SHA256`.
+
+## The template index was STALE, and it would have baked the wrong base
+
+`pveam available` on the freshly reverted `virgin` listed only `debian-13-standard_13.1-2` — the point
+release our own memory records as 404-ing since 2026-07-15. **`pveam update` first**, and the real
+current one is `debian-13-standard_13.6-1_amd64.tar.zst`. The runbook says the point release rots; what
+it does not say is that the VM's cached index rots too, and reading it without refreshing produces a
+confident answer that is a fortnight out of date.
+
+## Secret handling
+
+Token file→file, read inside the VM by a runner script, never on a command line.
+`systemctl show golden-bake -p Environment -p ExecStart | grep -c -F <token>` = **0**. Leak grep on the
+committed log = **0**, believable because a planted-token control on a copy grepped **1**. All in-VM
+artefacts `shred -u`'d.
+
+## NOT DONE
+
+The Day-0 vouch — the operator's, and deliberately so. Three fields, each already verified downloadable
+and selectable: **golden 0.214.0**, **agent 0.129.0**, **min agent 0.129.0**.

documentation/tests/golden-0.214.0-2026-08-12/bake.log

@@ -0,0 +1,326 @@
+[golden] build-golden.sh v3.0.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.214.0
+[golden] creating build LXC 9100 (nesting=1,keyctl=1, unprivileged; rootfs 32G + ONE data volume 24G @ /var/lib/felhom, backup=1) …
+  Logical volume "vm-9100-disk-0" created.
+  Logical volume pve/vm-9100-disk-0 changed.
+Creating filesystem with 8388608 4k blocks and 2097152 inodes
+Filesystem UUID: a630e58b-5ddd-4312-8535-b83ed18030fb
+Superblock backups stored on blocks: 
+	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 
+	4096000, 7962624
+  Logical volume "vm-9100-disk-1" created.
+  Logical volume pve/vm-9100-disk-1 changed.
+Creating filesystem with 6291456 4k blocks and 1572864 inodes
+Filesystem UUID: 247da550-80fb-4921-bb4c-0a3517bdbd21
+Superblock backups stored on blocks: 
+	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 
+extracting archive '/var/lib/vz/template/cache/debian-13-standard_13.6-1_amd64.tar.zst'
+Total bytes read: 553512960 (528MiB, 177MiB/s)
+Detected container architecture: amd64
+Creating SSH host key 'ssh_host_ed25519_key' - this may take some time ...
+done: SHA256:N/+3Phg1PMspcZ0VWshdC1mXbkAYQ2jAsYhavLNrb0Q root@felhom-golden
+Creating SSH host key 'ssh_host_ecdsa_key' - this may take some time ...
+done: SHA256:fl1uCYoByd5OGUy7NjwyEHlkIcOvAxk5887imnsM7tc root@felhom-golden
+Creating SSH host key 'ssh_host_rsa_key' - this may take some time ...
+done: SHA256:6wNca1Ee5AXkXkQjmROa6sdynmpHikRhw7MuHpxXrk0 root@felhom-golden
+[golden] starting + installing Docker (official repo, trixie channel) …
+apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct!
+perl: warning: Setting locale failed.
+perl: warning: Please check that your locale settings:
+	LANGUAGE = (unset),
+	LC_ALL = (unset),
+	LC_CTYPE = (unset),
+	LC_NUMERIC = (unset),
+	LC_COLLATE = (unset),
+	LC_TIME = (unset),
+	LC_MESSAGES = (unset),
+	LC_MONETARY = (unset),
+	LC_ADDRESS = (unset),
+	LC_IDENTIFICATION = (unset),
+	LC_MEASUREMENT = (unset),
+	LC_PAPER = (unset),
+	LC_TELEPHONE = (unset),
+	LC_NAME = (unset),
+	LANG = "en_US.UTF-8"
+    are supported and installed on your system.
+perl: warning: Falling back to the standard locale ("C").
+locale: Cannot set LC_CTYPE to default locale: No such file or directory
+locale: Cannot set LC_MESSAGES to default locale: No such file or directory
+locale: Cannot set LC_ALL to default locale: No such file or directory
+apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct!
+perl: warning: Setting locale failed.
+perl: warning: Please check that your locale settings:
+	LANGUAGE = (unset),
+	LC_ALL = (unset),
+	LC_CTYPE = (unset),
+	LC_NUMERIC = (unset),
+	LC_COLLATE = (unset),
+	LC_TIME = (unset),
+	LC_MESSAGES = (unset),
+	LC_MONETARY = (unset),
+	LC_ADDRESS = (unset),
+	LC_IDENTIFICATION = (unset),
+	LC_MEASUREMENT = (unset),
+	LC_PAPER = (unset),
+	LC_TELEPHONE = (unset),
+	LC_NAME = (unset),
+	LANG = "en_US.UTF-8"
+    are supported and installed on your system.
+perl: warning: Falling back to the standard locale ("C").
+locale: Cannot set LC_CTYPE to default locale: No such file or directory
+locale: Cannot set LC_MESSAGES to default locale: No such file or directory
+locale: Cannot set LC_ALL to default locale: No such file or directory
+[golden] baking daemon.json: classic overlay2 driver (containerd-snapshotter OFF) + log rotation …
+[golden] wiring the single data volume (R-165 variant V-c): /var/lib/felhom/{docker,sys_drive} -> binds …
+[golden] verifying Docker works in the build guest (storage driver should be overlay2 on the ext4 data volume) …
+Unable to find image 'hello-world:latest' locally
+latest: Pulling from library/hello-world
+4f55086f7dd0: Pulling fs layer
+4f55086f7dd0: Download complete
+4f55086f7dd0: Pull complete
+Digest: sha256:7f4da0fc94bcece205a8c0b6f4d11c8196924654ffe5c4d1aa439b7f632048b2
+Status: Downloaded newer image for hello-world:latest
+  docker OK (overlay2; data-root /var/lib/docker)
+  /var/lib/docker is a real mount: /dev/mapper/pve-vm--9100--disk--1[/docker] ext4
+  /mnt/sys_drive is a real mount: /dev/mapper/pve-vm--9100--disk--1[/sys_drive] ext4
+  both paths are ONE filesystem: /dev/mapper/pve-vm--9100--disk--1 23317576
+[golden] baking the in-guest controller image gitea.dooplex.hu/admin/felhom-controller:0.214.0 (no registry cred at deploy) …
+
+WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
+Configure a credential helper to remove this warning. See
+https://docs.docker.com/go/credential-store/
+
+0.214.0: Pulling from admin/felhom-controller
+039e6f9f9752: Pulling fs layer
+0094c3ac0914: Pulling fs layer
+deca1dac7403: Pulling fs layer
+11c19a33d1b8: Pulling fs layer
+742f054a0a3b: Pulling fs layer
+63bdd1abbb22: Pulling fs layer
+11c19a33d1b8: Waiting
+742f054a0a3b: Waiting
+63bdd1abbb22: Waiting
+039e6f9f9752: Verifying Checksum
+039e6f9f9752: Download complete
+deca1dac7403: Verifying Checksum
+deca1dac7403: Download complete
+11c19a33d1b8: Verifying Checksum
+11c19a33d1b8: Download complete
+742f054a0a3b: Verifying Checksum
+742f054a0a3b: Download complete
+63bdd1abbb22: Verifying Checksum
+63bdd1abbb22: Download complete
+0094c3ac0914: Verifying Checksum
+0094c3ac0914: Download complete
+039e6f9f9752: Pull complete
+0094c3ac0914: Pull complete
+deca1dac7403: Pull complete
+11c19a33d1b8: Pull complete
+742f054a0a3b: Pull complete
+63bdd1abbb22: Pull complete
+Digest: sha256:d2c0bc7fba3d142e7f9ee9117231fd7ea28630aa71ce2f4a7e2d0ee1fdb85d97
+Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-controller:0.214.0
+gitea.dooplex.hu/admin/felhom-controller:0.214.0
+[golden] asking the controller which infra images it manages …
+[golden] baking infra images (4): traefik:v3.6.7 cloudflare/cloudflared:2026.6.0 gtstef/filebrowser:1.3.3-stable gitea.dooplex.hu/admin/felhom-samba:1.1.0 …
+v3.6.7: Pulling from library/traefik
+589002ba0eae: Pulling fs layer
+ef63511ea6cc: Pulling fs layer
+0738e5cb835e: Pulling fs layer
+3e6813f70c64: Pulling fs layer
+3e6813f70c64: Waiting
+ef63511ea6cc: Verifying Checksum
+ef63511ea6cc: Download complete
+589002ba0eae: Verifying Checksum
+589002ba0eae: Download complete
+3e6813f70c64: Verifying Checksum
+3e6813f70c64: Download complete
+0738e5cb835e: Verifying Checksum
+0738e5cb835e: Download complete
+589002ba0eae: Pull complete
+ef63511ea6cc: Pull complete
+0738e5cb835e: Pull complete
+3e6813f70c64: Pull complete
+Digest: sha256:a9890c898f379c1905ee5b28342f6b408dc863f08db2dab20e46c267d1ff463a
+Status: Downloaded newer image for traefik:v3.6.7
+docker.io/library/traefik:v3.6.7
+2026.6.0: Pulling from cloudflare/cloudflared
+47de5dd0b812: Pulling fs layer
+c172f21841df: Pulling fs layer
+99515e7b4d35: Pulling fs layer
+99ba982a9142: Pulling fs layer
+d6b1b89eccac: Pulling fs layer
+2780920e5dbf: Pulling fs layer
+7c12895b777b: Pulling fs layer
+3214acf345c0: Pulling fs layer
+52630fc75a18: Pulling fs layer
+dd64bf2dd177: Pulling fs layer
+b839dfae01f6: Pulling fs layer
+ebddc55facdc: Pulling fs layer
+bdfd7f7e5bf6: Pulling fs layer
+2d4d7adf6272: Pulling fs layer
+40008157d8d2: Pulling fs layer
+bd8962e29291: Pulling fs layer
+cac2ae0193cb: Pulling fs layer
+74d1dac84ecc: Pulling fs layer
+99ba982a9142: Waiting
+d6b1b89eccac: Waiting
+2780920e5dbf: Waiting
+7c12895b777b: Waiting
+3214acf345c0: Waiting
+52630fc75a18: Waiting
+dd64bf2dd177: Waiting
+b839dfae01f6: Waiting
+ebddc55facdc: Waiting
+bdfd7f7e5bf6: Waiting
+2d4d7adf6272: Waiting
+40008157d8d2: Waiting
+bd8962e29291: Waiting
+cac2ae0193cb: Waiting
+74d1dac84ecc: Waiting
+99515e7b4d35: Verifying Checksum
+99515e7b4d35: Download complete
+c172f21841df: Verifying Checksum
+c172f21841df: Download complete
+47de5dd0b812: Verifying Checksum
+47de5dd0b812: Download complete
+99ba982a9142: Download complete
+d6b1b89eccac: Verifying Checksum
+d6b1b89eccac: Download complete
+2780920e5dbf: Verifying Checksum
+2780920e5dbf: Download complete
+7c12895b777b: Verifying Checksum
+7c12895b777b: Download complete
+52630fc75a18: Verifying Checksum
+52630fc75a18: Download complete
+3214acf345c0: Verifying Checksum
+3214acf345c0: Download complete
+47de5dd0b812: Pull complete
+dd64bf2dd177: Verifying Checksum
+dd64bf2dd177: Download complete
+b839dfae01f6: Verifying Checksum
+b839dfae01f6: Download complete
+ebddc55facdc: Verifying Checksum
+ebddc55facdc: Download complete
+bdfd7f7e5bf6: Download complete
+40008157d8d2: Verifying Checksum
+40008157d8d2: Download complete
+bd8962e29291: Verifying Checksum
+bd8962e29291: Download complete
+2d4d7adf6272: Verifying Checksum
+2d4d7adf6272: Download complete
+c172f21841df: Pull complete
+cac2ae0193cb: Verifying Checksum
+cac2ae0193cb: Download complete
+74d1dac84ecc: Verifying Checksum
+74d1dac84ecc: Download complete
+99515e7b4d35: Pull complete
+99ba982a9142: Pull complete
+d6b1b89eccac: Pull complete
+2780920e5dbf: Pull complete
+7c12895b777b: Pull complete
+3214acf345c0: Pull complete
+52630fc75a18: Pull complete
+dd64bf2dd177: Pull complete
+b839dfae01f6: Pull complete
+ebddc55facdc: Pull complete
+bdfd7f7e5bf6: Pull complete
+2d4d7adf6272: Pull complete
+40008157d8d2: Pull complete
+bd8962e29291: Pull complete
+cac2ae0193cb: Pull complete
+74d1dac84ecc: Pull complete
+Digest: sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f
+Status: Downloaded newer image for cloudflare/cloudflared:2026.6.0
+docker.io/cloudflare/cloudflared:2026.6.0
+1.3.3-stable: Pulling from gtstef/filebrowser
+6a0ac1617861: Pulling fs layer
+ef8806083e82: Pulling fs layer
+b74107c861c7: Pulling fs layer
+adc935def003: Pulling fs layer
+4f4fb700ef54: Pulling fs layer
+18695ccc900a: Pulling fs layer
+45d119d5c397: Pulling fs layer
+dac52db4fc51: Pulling fs layer
+6d598f86b2f2: Pulling fs layer
+8aa349c8396c: Pulling fs layer
+dac52db4fc51: Waiting
+6d598f86b2f2: Waiting
+8aa349c8396c: Waiting
+4f4fb700ef54: Waiting
+adc935def003: Waiting
+18695ccc900a: Waiting
+45d119d5c397: Waiting
+6a0ac1617861: Verifying Checksum
+6a0ac1617861: Download complete
+b74107c861c7: Verifying Checksum
+b74107c861c7: Download complete
+6a0ac1617861: Pull complete
+adc935def003: Verifying Checksum
+adc935def003: Download complete
+4f4fb700ef54: Verifying Checksum
+4f4fb700ef54: Download complete
+45d119d5c397: Verifying Checksum
+45d119d5c397: Download complete
+dac52db4fc51: Verifying Checksum
+dac52db4fc51: Download complete
+18695ccc900a: Verifying Checksum
+18695ccc900a: Download complete
+6d598f86b2f2: Verifying Checksum
+6d598f86b2f2: Download complete
+8aa349c8396c: Verifying Checksum
+8aa349c8396c: Download complete
+ef8806083e82: Verifying Checksum
+ef8806083e82: Download complete
+ef8806083e82: Pull complete
+b74107c861c7: Pull complete
+adc935def003: Pull complete
+4f4fb700ef54: Pull complete
+18695ccc900a: Pull complete
+45d119d5c397: Pull complete
+dac52db4fc51: Pull complete
+6d598f86b2f2: Pull complete
+8aa349c8396c: Pull complete
+Digest: sha256:eb3733681db8757412632c61a99ad656f0d94ed6781bb2ea114b4d70babab78c
+Status: Downloaded newer image for gtstef/filebrowser:1.3.3-stable
+docker.io/gtstef/filebrowser:1.3.3-stable
+1.1.0: Pulling from admin/felhom-samba
+897d797d2723: Pulling fs layer
+3051591aa250: Pulling fs layer
+ce57a3f93416: Pulling fs layer
+fb94eeec2fe1: Pulling fs layer
+fb94eeec2fe1: Waiting
+ce57a3f93416: Verifying Checksum
+ce57a3f93416: Download complete
+fb94eeec2fe1: Verifying Checksum
+fb94eeec2fe1: Download complete
+897d797d2723: Verifying Checksum
+897d797d2723: Download complete
+3051591aa250: Verifying Checksum
+3051591aa250: Download complete
+897d797d2723: Pull complete
+3051591aa250: Pull complete
+ce57a3f93416: Pull complete
+fb94eeec2fe1: Pull complete
+Digest: sha256:1c17c09422bec0366d7cf0e0fcfc1486ba6c90334a0a5d5c851073a9342f8f10
+Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-samba:1.1.0
+gitea.dooplex.hu/admin/felhom-samba:1.1.0
+[golden] baking the controller-bootstrap unit (deploys the BAKED controller from the config mount) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.service' → '/etc/systemd/system/felhom-controller-bootstrap.service'.
+[golden] baking the controller-bootstrap PATH unit (starts the service on bootstrap-mount hot-plug — B1) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.path' → '/etc/systemd/system/felhom-controller-bootstrap.path'.
+[golden] baking the first-boot SSH host-key regeneration unit (F3) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-regen-hostkeys.service' → '/etc/systemd/system/felhom-regen-hostkeys.service'.
+[golden] identity-clean + minimize …
+[golden] stop + archive …
+INFO: including mount point rootfs ('/') in backup
+INFO: including mount point mp0 ('/var/lib/felhom') in backup
+INFO: archive file size: 625MB
+INFO: Finished Backup of VM 9100 (00:00:39)
+[golden] DONE. golden archive volid: local:backup/vzdump-lxc-9100-2026_08_12-18_52_07.tar.zst (rootfs 32G + ONE data volume 24G @ /var/lib/felhom, all in the archive)
+[golden] publishing golden (656392524 bytes, sha256 3a40379cb00d98c6…) → https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.214.0/golden.tar.zst
+[golden]   pre-delete existing: HTTP 404 (404/204 expected)
+[golden]   upload OK (HTTP 201)
+GOLDEN_VERSION=0.214.0
+GOLDEN_SHA256=3a40379cb00d98c6f9550815b2b024783f153e9eef9be2b3252253d24d8d2c4d
+[golden] Record in the hub operator UI (Configs → Day-0 artifacts): golden 0.214.0 / 3a40379cb00d98c6f9550815b2b024783f153e9eef9be2b3252253d24d8d2c4d
+[golden] (the build guest 9100 is stopped; destroy it with: pct destroy 9100 --purge)

manifests/hub.yaml

@@ -125,7 +125,7 @@ spec:
     spec:
       containers:
         - name: hub
-          image: gitea.dooplex.hu/admin/felhom-hub:0.102.0
+          image: gitea.dooplex.hu/admin/felhom-hub:0.103.0
           ports:
             - containerPort: 8080
               name: http