R-1138: two dated credentials copies shredded; an undated third found, waits for the operator

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

STATUS.md

@@ -60,7 +60,7 @@
 | D10 | R-1125 | **DECIDED 2026-10-17: A** — the 23 memory requests now match real use (catalog `1af6ea7`); the install refusal and page say what to do (controller 0.327.0). An 8 GB box no longer installs the whole household set. | done | — | — | — |
 | D11 | R-1126 | **DECIDED 2026-10-17: A** — FileBrowser is published only after its default password is checked; it never answers on the default (controller 0.327.1). The tunnel still runs before the claim, by design (`01` §5). | done | — | — | — |
 | D12 | R-1129 | **CLOSED 2026-10-17: not a defect** — CC misread the CI log; the failure mail always worked. A forced test mail went to admin@felhom.eu at 10:48:54 UTC (CC saw it arrive). Your key change did no harm. | done | — | — | — |
-| D17 | R-1138 | Two old plain copies of the deleted credentials file are still in `~/.config/` (`.bak-20261001-calibre`, `.bak-20261016-tester1`). Delete them? Everything in them is in CC's store, except one older value each (an old hub token, an old Tester 1 password). | **Delete** | Keep: two plain copies of 17–19 secrets stay on DooPlex | they stay | — |
+| D17 | R-1138 | The two dated copies of the old credentials file are deleted. A third, undated one remains: `~/.config/credentials.bak` (all in CC's store, except an older hub token). Delete it too? | **Delete** | Keep: one plain copy of 17 secrets stays on DooPlex | it stays | — |
 | D9 | R-1062 | The N100's USB drive is also its whole-box backup drive. Split it in two anyway? | **No — keep one drive**; the lived-in box keeps its nightly whole-box backup | Split: the box loses its local whole-box backup (or add a second drive first) | it stays one drive; multi-drive tests stay on Tester 1 | — |
 
 ## Waiting on you — do

documentation/backlog/OPEN-ITEMS.md

@@ -235,7 +235,7 @@ stopping line that lies.
 | **R-1118** | Security & access | P3 | **CC's secrets moved off the plain `~/.config/credentials` into an encrypted store with a broker and guards; what is left is retiring the old file.** BUILT 2026-10-17 (store B, operator ruling 11:28): private repo `admin/cc-secrets` (`ARCHITECTURE.md`, the design verbatim in `docs/`), `sec` (no get), PreToolUse refusals + PostToolUse masking for Bash and Read in `~/.claude/settings.json` (every CC session on DooPlex), nightly transcript sweep with mail. 55 tests, 18 red-proofs, 36-row child-session proof in both launch modes, fresh-session proof (`audits/cc-creds-build-2026-10-17/`). 25 names in the store (23 imported, `RESEND_API` from CC's environment, a self-test value). `12-agent-tooling.md` §5 points at it. | NARROWED — built; the old file's retirement is R-1134 | the week with no reader (R-1134) | `sec doctor` stays all OK; R-1134 | CC |
 | **R-1121** | Security & access | P3 | **`~/rotated-secrets-2026-10-09.txt` still exists on DooPlex** — 632 bytes, modified 2026-10-09 13:08 +0200, mode 600 (SPIKE Q6: `test -e` + `stat` only, not opened). Left by the R-925 rotation work. If any value in it is still valid, it is one more plaintext secrets file in the home folder, readable by every CC session. | WAITING-ON-OPERATOR | what the file holds — only the operator knows | Operator: confirm every value in it is revoked, then `shred -u` it; or move the live ones into the R-1118 store | operator |
 | **R-1133** | Security & access | P3 | **`~/.git-credentials` on DooPlex holds Gitea tokens in clear text** — three entries (`kisfenyo`, `Kisfenyo`, `admin`); the `admin` token has `write:repository` (and misc, package, issue, notification). Any `cat` of it prints them; the new PreToolUse guard refuses reads of that path (`read-secret-file`), but git itself must keep reading it. Out of the 2026-10-17 build's scope by its brief. **Same class:** `~/.docker/config.json` holds two saved registry logins (Docker Hub, `gitea.dooplex.hu`) as base64 — R-1130; the guard does not list that path yet. | OPEN | — | Decide: move git to a credential helper that reads from `sec`, or accept the file (0600) with the guard | operator → CC |
-| **R-1138** | Security & access | P3 | **Two old plain copies of the deleted credentials file remain: `~/.config/credentials.bak-20261001-calibre` (17 keys) and `~/.config/credentials.bak-20261016-tester1` (19 keys)**, both 0600. Compared 2026-10-17 in memory (names only, `audits/cc-creds-build-2026-10-17/old-backups-compare.txt`): every key equals the store except one OLDER value each — `HUB_TOKEN` in the 10-01 copy, `TESTER1_PASSWORD` in the 10-16 copy (both since changed). Found when the operator's go deleted the main file (R-1134); not deleted, because the go named „the file". | WAITING-ON-OPERATOR | the operator's word | Operator: „delete them" → `shred -u` both; or keep | operator |
+| **R-1138** | Security & access | P3 | **One old plain copy of the deleted credentials file remains: `~/.config/credentials.bak`** (17 keys, 0600, modified 2026-10-16 09:15). The two dated copies (`.bak-20261001-calibre`, `.bak-20261016-tester1`) were shredded 2026-10-17 on the operator's „delete them"; a wider search then found this undated one. Compared in memory (names only): every key equals the store except an older `HUB_TOKEN`. | WAITING-ON-OPERATOR | the operator's word for this third file | Operator: „delete it too" → `shred -u` | operator |
 
 ## Box system & updates — 12 rows (P2 1, P3 7, P4 4)