felhom-host-install.sh 1.35.0 (not published): the hub's live-box 409 is worded in EN and HU at the preflight, host-enroll and the controller.yaml fetch, with harness cases (R-1167)

scripts/hostinstall-mode-harness.sh

@@ -288,6 +288,63 @@ else
     verdict FAIL "GL6-ANON empty-cred anonymous-fetch fallback (warn-not-die + conditional auth)"
 fi
 
+# R-1167 (1.35.0): the hub's 409 (a LIVE box — since hub 0.161.0 the passphrase gives no keys) is worded, never
+# „unexpected 409". Static: every passphrase call (preflight, host-enroll, the controller.yaml fetch) maps 409 to
+# die_live_box. Behaviour: the REAL resolve_git_creds + die_live_box, extracted from the script, against a local fake
+# hub — 409 → exit nonzero with the delete-first sentence in EN and HU; 200 → the git user is read (no regression).
+# Red-proof (2026-10-19): with the 409 arm removed from resolve_git_creds the behaviour case FAILs („hub status 409").
+r1167_static=true
+for want in '409) die_live_box "the config preflight' '409) die_live_box "host-enroll' '409) die_live_box "the controller.yaml fetch'; do
+    grep -qF "$want" "$SCRIPT" || { r1167_static=false; r1167_why="missing: $want"; }
+done
+if $r1167_static; then
+    verdict PASS "R-1167 every passphrase call maps 409 to die_live_box"
+else
+    verdict FAIL "R-1167 every passphrase call maps 409 to die_live_box" "$r1167_why"
+fi
+r1167_fns="$WORK/r1167-fns.sh"
+{
+    echo 'log_error() { echo "ERROR: $*"; }; log_warn() { echo "WARN: $*"; }'
+    sed -n '/^die() /p; /^die_live_box() {/,/^}/p; /^resolve_git_creds() {/,/^}/p' "$SCRIPT"
+} > "$r1167_fns"
+cat > "$WORK/r1167-hub.py" <<'PY'
+import http.server, sys, threading
+code = int(sys.argv[1])
+class H(http.server.BaseHTTPRequestHandler):
+    def do_GET(self):
+        body = b"git:\n  username: felhom-ci\n  token: \"\"\n" if code == 200 else b"Conflict: this customer already has a live box\n"
+        self.send_response(code); self.send_header("Content-Length", str(len(body))); self.end_headers(); self.wfile.write(body)
+    def log_message(self, *a): pass
+srv = http.server.HTTPServer(("127.0.0.1", 0), H)
+print(srv.server_address[1], flush=True)
+srv.serve_forever()
+PY
+r1167_run() { # <hub status> → $out/$rc of resolve_git_creds against the fake hub
+    local port pid
+    python3 "$WORK/r1167-hub.py" "$1" > "$WORK/r1167-port" 2>/dev/null & pid=$!
+    for _ in 1 2 3 4 5 6 7 8 9 10; do port=$(head -1 "$WORK/r1167-port" 2>/dev/null); [[ -n "$port" ]] && break; sleep 0.2; done
+    set +e
+    out=$(HUB_URL="http://127.0.0.1:$port" CUSTOMER_ID=t PASSPHRASE=x bash -c ". '$r1167_fns'; resolve_git_creds; echo \"GIT_USER=\$GIT_USER\"" 2>&1)
+    rc=$?
+    set -e
+    kill "$pid" 2>/dev/null || true; wait "$pid" 2>/dev/null || true
+    [[ -n "$port" ]]
+}
+if ! grep -q '^resolve_git_creds() {' "$r1167_fns" || ! grep -q '^die_live_box() {' "$r1167_fns"; then
+    verdict FAIL "R-1167 live-box 409 is worded (EN + HU)" "could not extract resolve_git_creds/die_live_box from the script"
+elif ! r1167_run 409; then
+    verdict SKIP "R-1167 live-box 409 is worded (EN + HU)" "the local fake hub did not start"
+elif [[ $rc -ne 0 && "$out" == *"The operator deletes the old host on the hub first"* && "$out" == *"HU: a hub 409-cel"* && "$out" != *"hub status 409"* ]]; then
+    verdict PASS "R-1167 live-box 409 is worded (EN + HU)"
+else
+    verdict FAIL "R-1167 live-box 409 is worded (EN + HU)" "rc=$rc; got: $(echo "$out" | tr '\n' ' ' | cut -c1-200)"
+fi
+if r1167_run 200 && [[ $rc -eq 0 && "$out" == *"GIT_USER=felhom-ci"* ]]; then
+    verdict PASS "R-1167 a 200 still reads the git credential"
+else
+    verdict FAIL "R-1167 a 200 still reads the git credential" "rc=$rc; got: $(echo "$out" | tr '\n' ' ' | cut -c1-200)"
+fi
+
 # GL6-F4 (v1.11.3): the producer steps token/enroll/grows must run UNCONDITIONALLY (not behind
 # `should_skip … ||`) so --resume repopulates the in-memory outputs later steps consume; and the
 # resume block must re-derive GOLDEN_VOLID from the local archive when golden already completed.