CAMPAIGN-11: hygiene, what-did-not-run, venue end state, and the session report

The recovery codes are shredded with the plant->find->shred->fail-to-find control the brief asks for, and THE CONTROL PAID FOR ITSELF ON ITS FIRST RUN: it found the Phase 0 code in ~/.config/credentials as R_CAMPAIGN_11 — a copy this session did not create and would never have looked for. Without it, a 'codes shredded' claim would have been false. That key was removed from the shared file with a verified diff (every other line identical, nine keys intact) and HUB_PW re-tested at hub:200. Consequence stated plainly rather than left to be discovered: /home/felhom-repo.orphaned-20260805 (12 535 KB, the three Phase 0 sentinels) is now permanently unopenable — which is what the set-aside screen promises, and teardown removes it anyway. Venue left WORKING and said so: ONLINE, 4 containers healthy, backup target not degraded, off-site on 2 snapshots. Two things a future session needs: the raw /mnt/{adatok,mentes} mounts are deliberately left unmounted (R-220's workaround), and the appliance root credential was shredded — re-fetch it from the hub. REPORT-campaign11-phase24.md rather than REPORT.md, per the repo's parallel-session rule. No product code changed. No version bumped.
2026-08-06 04:32:56 +02:00
parent df6081e60b
commit 9c1d05d360
3 changed files with 248 additions and 2 deletions
@@ -554,8 +554,17 @@ accumulated before; the Phase 0 census found **none** outstanding, and c11 must

 ## 12. Hygiene

- **The recovery codes** live in `~/.config/campaign11/` on DooPlex, `0600`, and are reported in §13
-  of the session report with their shred and its positive control.
+- **The recovery codes are SHREDDED**, with the plant→find→shred→fail-to-find control the brief asks
+  for. **The control paid for itself on its first run**: it found the Phase 0 code in
+  `~/.config/credentials` as **`R_CAMPAIGN_11`** — a copy this session did not create and would never
+  have looked for, which would have made a "codes shredded" claim **false**. That key was removed from
+  the shared file carefully (backup → exact-match removal → `diff` proving every other line identical →
+  `HUB_PW` re-verified at `hub:200` → backup shredded). Everything else was `shred -u`'d on both hosts
+  and the absence re-swept; only the planted controls remained, and they were shredded too.
+  **⚠ Consequence, stated plainly: `/home/felhom-repo.orphaned-20260805` (12 535 KB, the three Phase 0
+  sentinels) is now permanently unopenable.** That is what the set-aside screen promises will happen,
+  teardown removes the repository anyway, and R-222 means no read path existed for it regardless — but
+  the door is now shut for good.
 - **No secret is written into any committed file.** Every hash quoted here is a sha256 prefix; the
  codes' contents appear nowhere.
 - **`git add -A` was never used** — every commit staged explicit paths, and `git status --porcelain`
@@ -567,3 +576,34 @@ accumulated before; the Phase 0 census found **none** outstanding, and c11 must
  rule 1.
 - **No version was bumped** in any repo.

+
+---
+
+## 13. What did not run, and why
+
+| | why |
+|---|---|
+| **F10 as specified** | **Not injectable.** Three attempts, each with a control: the app, then the controller's monitor, then the run itself recreate the mandatory directory within ~1 s. The state does not exist on a deployed app of this kind. **Harness, not product** |
+| **F9's literal precondition** | A box that never had off-site backups needs a **rebuild**, which the brief forbids before Phase 4. The assertion that failed in Phase 1 (the page not consulting its predicate) was tested instead, and passes |
+| **§4.2's positive half** | Needs shape (a) — hub blob present, key placed, **no target**. The venue has a target, so the box correctly does not declare. Also needs a rebuild |
+| **`STALE → DOWN` escalation** | F11 was ended once `stale` and `recovered` had both fired, because Phase 4 needed the venue back. The >1 h arm is untested |
+| **The whole-guest tier's due-ness** | **Not resolvable with existing instruments** — routine local-api calls and the hub's deadline monitor are both invisible at INFO. Recorded as an open question, not scored |
+| **The retained package's read path** | Does not exist (R-199's inventory is unbuilt). R-222 was re-confirmed live rather than re-tested |
+| **A re-walk of the journey** | **Deliberately out of scope.** These faults are not a re-walk, and the capability map's recovery row stays **FAIL** until one passes |
+| **Any fix** | Brief rule 1 — file and continue. **No product code was changed and no version bumped** |
+
+---
+
+## 14. Venue state at the end — **WORKING**
+
+| | |
+|---|---|
+| Hub | `c11-36d660` **ONLINE**, agent `0.125.0`, 1/1 guests, reporting on schedule (last seen 04:29:54) |
+| Containers | `calibre-web` · `filebrowser` · `felhom-controller:0.201.0` · `traefik` — all healthy |
+| Drives | both enrolled; backup target `{"degraded":false,"label":"mentes","target":"felhom-backup"}` |
+| Off-site | **2 snapshots**, `last_status: ok`, `last_success 2026-08-06T02:15:24Z`, 51 206 B, `escrow_state: escrowed` |
+| Set aside | `/home/felhom-repo.orphaned-20260805` — 12 535 KB, intact, and now **permanently unopenable** (§12) |
+| Left in place | the raw `/mnt/adatok` and `/mnt/mentes` mounts remain **unmounted** — R-220's workaround, without which no app can be deployed on a rebuilt box. The stable `/mnt/felhom-drives/*` mounts are what everything uses |
+| Access | the appliance's vaulted root credential was **shredded with the codes**, so a future session must re-fetch it from the hub (`POST /hosts/c11-36d660/reveal-recovery-credential`) — the designed path |
+
+**Nothing is left broken, and nothing is left running that should not be.**