morning 2026-10-22: ISO 1.30.0 published (W1, W7; gate + proof installs on both entries); download pages point at it; rows 184 -> 178 (closed R-1192, R-1177, R-1178, R-1180, R-1195, R-1199, R-1210; opened R-1216 the host-swap check too strict); STATUS, CONTEXT, report

2026-10-22 10:51:24 +02:00
parent 115f15c89e
commit a92837410a
26 changed files with 316 additions and 39 deletions
@@ -26,6 +26,18 @@

 ---

+## 2026-10-22 morning — the releases (full text of the rows: `git show 115f15c8:documentation/backlog/OPEN-ITEMS.md`)
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-1210** | **Three first-hour words from the rehearsal wait for a publish:** (P3) | CLOSED 2026-10-22 — W2 published (website `6b391a63`: „Letöltés (1,6 GB)" / „Download (1.6 GB)"); W1 + W7 shipped in ISO **1.30.0**, published after its gate and two proof installs (W1 seen on the boot screen; W7 by test — the bound banner needs a bind); both download pages point at 1.30.0. Full row text: `git show 115f15c8:documentation/backlog/OPEN-ITEMS.md`. | `documentation/tests/iso-release-1.30.0-2026-10-22/` |
+| **R-1192** | **On the minimum machine (8 GB), the household's first afternoon froze the box for about an hour: the dashboard and every app stopped answering, and only pulling the plug brought it back.** (P1) | CLOSED 2026-10-22 — agent **v0.162.0** released (operator yes) and delivered to demo-hp, Tester 1, demo-felhom: each logged `guest-swap: raised` and `pct config` reads swap = memory (25898/25898, 12288/12288, 4096/4096). Night soak on a fresh 8 GB box: 11 h, no freeze. The vouch is the operator's. Follow-ups: R-1207 (no host swap), R-1214 (tier2 pressure), R-1216 (the host-swap check too strict). | `audits/morning-2026-10-22/release/04-agent-delivery.txt`, `audits/night-2026-10-21/P1-soak/` |
+| **R-1177** | **A local restore that fails destroys the household's live data and keeps no copy of it: the app is left broken.** (P2) | CLOSED 2026-10-22 — shipped in controller **v0.338.0** (released on the operator's yes; on Tester 1, demo-hp and demo-felhom through the floor, then the global floor 0.338.0). Proven the night before on 9202: a damaged backup kept the newest row and the app ran. | `audits/night-2026-10-21/P3-*`, `audits/morning-2026-10-22/release/` |
+| **R-1178** | **The second drive's „Teljes visszaállítás" can change files, then refuse the database half, leave the app STOPPED, and tell the household „the app and its data are untouched".** (P2) | CLOSED 2026-10-22 — shipped in controller **v0.338.0** (`UnitRestoreOptions.CheckOnly`: a refusal moves nothing); test-proven. | controller CHANGELOG v0.338.0 |
+| **R-1180** | **The nightly second-drive mirror (`rsync --delete`) can run DURING a restore from that same mirror and delete files not yet copied back.** (P2) | CLOSED 2026-10-22 — shipped in controller **v0.338.0** (the night's mirror skips an app while its restore runs); test-proven. | controller CHANGELOG v0.338.0 |
+| **R-1195** | **A power cut in the middle of a full off-site restore can leave the app running on the BACKUP's data while the page says only „the restore was interrupted, start it again" — the household's newer data is gone and nothing says so.** (P2) | CLOSED 2026-10-22 — shipped in controller **v0.338.0**; proven on 9202 the night before (a controller killed mid-restore → put back at the next start, the record says so in Hungarian). | `audits/night-2026-10-21/P3-*` |
+| **R-1199** | **The household's notification page shows disk-warning, drive-disconnected and backup-failed mails switched ON, but on the rehearsal day only the OPERATOR got them — the household's mailbox received one alarm (a failed off-site run) out of nine.** (P2) | CLOSED 2026-10-22 — the hub mailed the household by a list saved 2026-10-18, before the box existed; the box never pushed its own because it pushes only a saved choice. Fixed in controller `ba22f9b` (a box with no saved choice pushes the default list its page shows, no address), shipped in **v0.338.0**. *Decided by CC unattended 2026-10-21 — operator may reverse* (the box's page is the source, `08`). `TestR1199_*` red-proved. | `REPORT-night-2026-10-21.md` §6, `audits/night-2026-10-21/P5-checks/` |
+
 ## 2026-10-21 night — the CI time limit of the decoy suite (full text of the row: `git show f576d7f7:documentation/backlog/OPEN-ITEMS.md`)

 | Row | What | Closed | Evidence |
@@ -7,6 +7,8 @@ Moved here byte for byte on 2026-10-14 (night session), newest first, so that `S

 ## Moved from STATUS on 2026-10-22

+**Updated 2026-10-22 (morning, after the night run).** A failed or cut restore now puts the data back and starts the app (proven on the scratch box); clearer first-hour texts; a host short of swap is reported. Built and tested, nothing released.
+
 **Updated 2026-10-21 (evening).** A rebuilt box now gets the household's off-site backups back (hub 0.163.0, proven live: 3 031 files byte-identical), and shared folders, imported apps and away drives keep their copies and locks (controller 0.337.0, the floor). The 8 GB freeze is explained — the guest's swap was capped at 512 MB — and the agent fix is ready but not released. Report: `REPORT-fixes-2026-10-21.md`.

 ## Moved from STATUS on 2026-10-21
@@ -327,4 +327,4 @@ release report. A criterion with no recorded observation is a criterion that was
 **The ONE home for a release's record is `documentation/tests/iso-release-<version>-<date>/`** (R-588,
 2026-10-05) — one directory per published ISO, so „was the gate run for this image?" is answered by looking,
 not by a full-text search for a checksum. A record made elsewhere (inside an audit) gets a directory here
-whose `README.md` points at it. Today: 1.27.0, 1.27.1, 1.28.0 (pointer), 1.29.0.
+whose `README.md` points at it. Today: 1.27.0, 1.27.1, 1.28.0 (pointer), 1.29.0, 1.30.0.
@@ -0,0 +1,67 @@
+# ISO release 1.30.0 — PUBLISHED 2026-10-22 (W1 boot text, W7 the bound banner clears the screen)
+
+| | |
+|---|---|
+| file | `felhom-installer-1.30.0-pve9.2-1.iso` |
+| sha256 | `590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1` |
+| size | 1 705 324 544 bytes |
+| base | Proxmox VE 9.2-1 (`4e88fe41…c2c6c`) |
+| source | felhom.eu `115f15c8` (clean and pushed; the build's own clean-tree gate) — W1/W7 from `2fa5b8f3`, the version bump `6d5a7f1b` |
+| published | `https://iso.felhom.eu/felhom-installer-1.30.0-pve9.2-1.iso` (+ `.sha256`, `.manifest.txt`) |
+| rollback | `felhom-installer-1.29.0-pve9.2-1.iso` (sha `dceacae5…`) stays online (HTTP 200 after the publish); rolling back is one edit on the two download pages |
+| decided by | the operator's yes, 2026-10-22 morning („Publish items — Yes, all") |
+
+**What changed (felhom.eu R-1210, the rehearsal's first-hour words):**
+- **W1** — the graphical entry's boot line is in the te-form: „A Felhom telepítése indul — válaszd ki a lemezt a
+  telepítőben..." (was „válassza ki"). Seen on the screen: `w1-boot-text.png`.
+- **W7** — when the box is linked, the bound banner first clears the screen AND its scroll-back
+  (`\033[3J\033[H\033[2J`), so the spent pairing code is not left readable. Pinned by
+  `scripts/iso/test/test_bound_banner_clears.py` (with a decoy); **not seen live** — the bound banner shows only after a
+  bind, and the proof installs were not bound (no customer was made for them).
+
+## The criteria, each with its observed value (run on the exact file that was uploaded)
+
+`static-gate.txt` holds the raw output of every static check below.
+
+| | verdict | observed |
+|---|---|---|
+| G1 no `answer.toml` | **PASS** | root-level `answer.toml` / `auto-installer-mode.toml` → 0 |
+| G2 no root password | **PASS** | `root-password`, `$6$`, `$y$`, `$2[aby]$` across every added path + the extracted package → 0; the build said `root-pw: NONE`, no `.rootpw.txt` in the publish source |
+| G3 no SSH key | **PASS** | `root-ssh-keys`, `ssh-rsa`, `ssh-ed25519`, `ssh-dss` → 0 |
+| G4 no customer identity | **PASS** | two hits, both variables: `Bearer $token` (line 534) and a `*FELHOM_RETRIEVAL_PASSPHRASE=*` pattern test (line 553) |
+| G5 enumeration | **PASS** | added vs stock: `/boot/grub/felhomtheme/` (2 files) and `/proxmox/packages/felhom-bootstrap_1.30.0_all.deb`; removed: `/boot/grub/pvetheme/` — the same set as 1.29.0. PEM headers, `token=`/`password=`/`passphrase=`/`api_key=` with ≥ 12-char values → 0 |
+| G6 boot menu | **PASS** | 2 menuentries, `timeout=15`, `timeout_style=menu`, `default=0`; `proxdebug`/`Rescue Boot`/`memtest`/`fwsetup` → 0 |
+| G7 package | **PASS** | one `felhom-bootstrap 1.30.0`, no `Depends`; `dpkg-query` on both installs: `install ok installed` |
+| G8 postinst | **PASS** | `systemctl start/daemon-reload/restart` → 1 and `set -e` → 1 are both the postinst's own header COMMENTS (lines 10–11, „NO `set -e`", „NO systemctl start") — no command; no curl/wget/apt/nc/ping; last line `exit 0`. Unchanged since 1.29.0 (`eb1ae370`) |
+| G9 payload = repo HEAD | **PASS** | `felhom-bootstrap.sh` `8dbb173d…36adfb` and the unit `cf2e4678…a69af3` — extracted = repo, `cmp` IDENTICAL; the installed copy on both boxes has the same sha |
+| G10 committed | **PASS** | the build's clean-tree gate (HEAD = origin/main, no untracked file); the manifest names the commit |
+| G11 checksum + round trip | **PASS** | downloaded from `iso.felhom.eu`: 1 705 324 544 B, sha256 `590d7b9b…74d5cc1` = the built file = the published `.sha256` (both side files HTTP 200) |
+| G12 bucket private | **NOT RE-READ** | nothing in this release touches the bucket; the token is object-scoped and cannot read the bucket's setting |
+| G13 directories | **PASS** | `./etc/felhom/`, `./usr/local/sbin/`, `./lib/systemd/system/` in the package |
+| G14 a person chooses the disk | **PASS** | `filter.` in the added text → 0; observed on BOTH entries: graphical `Target Harddisk /dev/sda (32.00GiB, QEMU HARDDISK)` with a selector (`gfx-disk.png`), text `Target harddisk: < /dev/sda (QEMU HARDDISK) (32.00 GiB) >` (`tui-disk.png`); both summaries show the disk before erasing |
+| G15 console after first boot AND one reboot | **PASS** | both installs, both boots: `grep -c 8006 /etc/issue` → **0**; `Felhom otthoni szerver` → 1; `Felhom home server` → 1; `pvebanner.service` → **masked** (`checks-*.txt`); the text install's screen after the reboot is pixel-identical to the first boot |
+| G16 Hungarian first, secrets once | **PASS** | `python3 scripts/iso_bootstrap_gate.py` → 73 harness checks green, its decoy convicted; `jelszavad` 0, `Tulajdonosi jelmondat` 1, `Owner passphrase` 1, negative control `zzqx-not-there` 0 |
+
+**The runbook's G16 command was stale** and is corrected in the same session: it mounted `scripts/iso` as `/work`, where
+`golden/` and `postinst` do not sit, so 10 checks failed on a correct tree (the same 10 failed on the commit before W7).
+`scripts/iso_bootstrap_gate.py` stages the inputs and is now the named command.
+
+## The proof installs — BOTH menu entries, on the built file (sha checked on demo-hp before boot)
+
+Nested VMs on demo-hp, 4 GiB RAM, 32 GB disk on `nvme-scratch`, the Hungarian keyboard kept, destroyed afterwards.
+
+| | entry | VM | result |
+|---|---|---|---|
+| 1 | `Felhom telepítés / Install Felhom` (graphical) | 9341 | installed, first boot + one reboot: package installed, unit `enabled` and fired on both boots, a pairing code in `/etc/felhom/appliance-pairing-code`, all G15 checks |
+| 2 | `Felhom telepítés (szöveges mód) / text` | 9342 | the same, all pass |
+
+The installer gave each 4 GB machine a 3.8 GB host swap (`SwapTotal` 4 005 884 kB) — the installer's swap = RAM rule
+the swap fix relies on (felhom.eu R-1192, R-1207). Pairing codes are blanked in the committed screendumps.
+
+## Teardown
+
+- **Machine:** VMs 9341 and 9342 destroyed (`qm destroy --purge`, names checked first); no disk directory left on
+  `nvme-scratch`. The ISO stays in demo-hp's `local:iso` beside 1.27.1–1.29.0, for the next proof.
+- **Hub:** the two unclaimed appliance registrations the proof installs made (**ids 47 and 48**, `registered`) are
+  the OPERATOR's to discard (Hosts page → Discard) — no token can do it (`05` §17.3).
+- **Off-site:** nothing (an unbound appliance provisions nothing).
@@ -0,0 +1,17 @@
+host: proofgfx  boot: 2026-10-22 10:39:27
+G7 dpkg: felhom-bootstrap 1.30.0 install ok installed
+unit enabled: enabled  active: activating
+unit fired (journal lines this boot): 8; first: Oct 22 10:39:51 proofgfx felhom-bootstrap.sh[1072]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with th
+pairing code file non-empty: yes
+G15 8006 in /etc/issue: 0  'Felhom otthoni szerver': 1  'Felhom home server': 1  pvebanner: masked
+host swap: 4005884 kB  RAM: 4008428 kB
+felhom-bootstrap.sh sha256: 8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb
+--- after one reboot
+host: proofgfx  boot: 2026-10-22 10:41:41
+G7 dpkg: felhom-bootstrap 1.30.0 install ok installed
+unit enabled: enabled  active: activating
+unit fired (journal lines this boot): 6; first: Oct 22 10:41:53 proofgfx felhom-bootstrap.sh[1008]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with th
+pairing code file non-empty: yes
+G15 8006 in /etc/issue: 0  'Felhom otthoni szerver': 1  'Felhom home server': 1  pvebanner: masked
+host swap: 4005884 kB  RAM: 4008428 kB
+felhom-bootstrap.sh sha256: 8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb
@@ -0,0 +1,17 @@
+host: prooftui  boot: 2026-10-22 10:41:41
+G7 dpkg: felhom-bootstrap 1.30.0 install ok installed
+unit enabled: enabled  active: activating
+unit fired (journal lines this boot): 8; first: Oct 22 10:42:00 prooftui felhom-bootstrap.sh[1050]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with th
+pairing code file non-empty: yes
+G15 8006 in /etc/issue: 0  'Felhom otthoni szerver': 1  'Felhom home server': 1  pvebanner: masked
+host swap: 4005884 kB  RAM: 4008424 kB
+felhom-bootstrap.sh sha256: 8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb
+--- after one reboot
+host: prooftui  boot: 2026-10-22 10:43:54
+G7 dpkg: felhom-bootstrap 1.30.0 install ok installed
+unit enabled: enabled  active: activating
+unit fired (journal lines this boot): 3; first: Oct 22 10:44:06 prooftui felhom-bootstrap.sh[1018]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with th
+pairing code file non-empty: yes
+G15 8006 in /etc/issue: 0  'Felhom otthoni szerver': 1  'Felhom home server': 1  pvebanner: masked
+host swap: 4005884 kB  RAM: 4008420 kB
+felhom-bootstrap.sh sha256: 8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb
@@ -0,0 +1,26 @@
+Felhom bare-metal ISO build manifest (R-21 slice A+B+C)
+built              : 2026-10-22T10:24:15+02:00
+iso-version-tag    : iso-v1.30.0   (the git tag this image's source carries, when tagged — NOT installer-v*, the host-install script's line)
+pve-version        : 9.2-1
+source-iso         : proxmox-ve_9.2-1.iso
+source-iso-sha256  : 4e88fe416df9b527624a175f24c9aa07c714d3332afb1ee3dbf3879573ef2c6c
+assistant-version  : proxmox-installer-common v9.2.8
+profile            : none (a release image bakes no disk selection)
+fqdn               : (none — interactive install)
+mode               : release (PUBLIC image — NO answer.toml, NO baked credential, interactive disk selection)
+loader             : shim (stock MS-signed chain; Secure Boot OK on compliant firmware)
+grub-mkimage       : unknown
+boot-menu          : FELHOM release menu — TWO INTERACTIVE entries ('Felhom telepítés' graphical = default, 'Felhom telepítés (szöveges mód)' = Terminal UI), timeout 15s
+menu-entries       : 2 (graphical default + Terminal UI; timeout 15s)
+menu-removed       : debug variants, Rescue Boot, memtest86+, UEFI Firmware Settings
+automated-entry    : NOT PRESENT — no auto-installer-mode.toml, so the stock grub.cfg does
+                     not emit it. Disk selection is INTERACTIVE by construction.
+host-install-url   : https://felhom.eu/scripts/felhom-host-install.sh (default)
+secret-bearing     : no   (PUBLIC image — carries NO credential of any kind)
+root-password      : NONE — not baked. The installer prompts the person installing (release gate G2).
+answer-file        : NONE — no answer.toml, no auto-installer-mode.toml (release gate G1)
+felhom-package     : felhom-bootstrap_1.30.0_all.deb sha256=fb224e733e312f992492109f9c29e455bba3471ade254c26494e2dee639fb910
+repo-commit        : 115f15c89e82b6002235a2c132cf30570a3cedfd   (clean tree, = origin/main at build time — the clean-tree gate, R-730)
+output             : felhom-installer-1.30.0-pve9.2-1.iso
+output-sha256      : 590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1
+output-size-bytes  : 1705324544
@@ -0,0 +1 @@
+590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1  felhom-installer-1.30.0-pve9.2-1.iso
@@ -0,0 +1,62 @@
+== G1 answer.toml/auto-installer-mode.toml at root (want 0)
+0
+== G5 paths added vs stock:
+'/boot/grub/felhomtheme'
+'/boot/grub/felhomtheme/background.png'
+'/boot/grub/felhomtheme/theme.txt'
+'/proxmox/packages/felhom-bootstrap_1.30.0_all.deb'
+== G5 paths removed vs stock:
+'/boot/grub/pvetheme'
+'/boot/grub/pvetheme/logo.png'
+'/boot/grub/pvetheme/theme.txt'
+deb: <extract>/x/proxmox/packages/felhom-bootstrap_1.30.0_all.deb
+== G2 root-password / crypt hash (want 0)
+0
+== G3 ssh keys (want 0)
+0
+== G4 identity with a value (lines, want only empty decls / variables)
+<extract>/debx/usr/local/sbin/felhom-bootstrap.sh:534:            -H "Authorization: Bearer $token" "$HUB_URL/api/v1/appliance/poll" 2>/dev/null)
+<extract>/debx/usr/local/sbin/felhom-bootstrap.sh:553:            if [[ -z "$envtext" || "$envtext" != *FELHOM_RETRIEVAL_PASSPHRASE=* ]]; then
+== G5 secret patterns (PEM, token=, password=, passphrase=, api_key=)
+(end)
+== G6 menuentries / settings / banned
+2
+set timeout_style=menu
+set timeout=15
+set default=0
+menuentry 'Felhom telepítés / Install Felhom' --class felhom --class os {
+menuentry 'Felhom telepítés (szöveges mód) / text' --class felhom --class os {
+0
+== W1 boot text (te-form 'valaszd' want>=1, formal 'valassza' want 0) — ASCII fragments with controls
+1
+0
+1
+== G7 package
+1
+ Package: felhom-bootstrap
+ Version: 1.30.0
+== G8 postinst
+1
+0
+1
+exit 0
+== G9 payload = repo HEAD
+8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb <extract>/debx/usr/local/sbin/felhom-bootstrap.sh
+8dbb173df22067fdbb5129afed990486fc8bbc96009095f573deee066836adfb /repo/scripts/iso/felhom-bootstrap.sh
+cf2e4678e9ef5ab8439f7fc8522e4a61b031222243eea8916ea0efa6dca69af3 <extract>/debx/lib/systemd/system/felhom-bootstrap.service
+cf2e4678e9ef5ab8439f7fc8522e4a61b031222243eea8916ea0efa6dca69af3 /repo/scripts/iso/felhom-bootstrap.service
+script IDENTICAL
+unit IDENTICAL
+== W7 clear in the shipped bound banner (ASCII fragment)
+98:    # W7 (rehearsal 2026-10-20): clear the screen AND its scroll-back first — the spent pairing code stayed readable
+100:    { printf '\033[3J\033[H\033[2J'
+296:        # judged on the lease's OWN addressing/routing, so clear vmbr0 first; the restore path (and
+312:        pkill -x dhclient 2>/dev/null   # F-P4: clear the failed/killed client before the next candidate
+== G13 dirs
+./etc/felhom/
+./lib/systemd/system/
+./usr/local/sbin/
+== G14 filter. in added text files (want 0)
+0
+== G16 secret names in the shipped script
+jelszavad=0 Tulajdonosi jelmondat=1 Owner passphrase=1 NEGATIVE-control zzqx-not-there=0
				`@@ -0,0 +1 @@`
				`590d7b9b3ccbc7644536a1971a44deb2d1bf7136f69eae2b4dc42961e74d5cc1 felhom-installer-1.30.0-pve9.2-1.iso`