drill 0.243.0 complete: 0 interventions, the connect e-mail proven, NOT ready for a volunteer

The automatic connect e-mail is proven with a real mailbox: the host record was deleted at 12:22:59Z and the mail reached the customer at 12:23:00Z, one second later, with selfbind_link_sent (host delete) on the timeline. The requirement was two minutes. The hub refuses to delete an ONLINE host with no override, so the record had to fall stale first — that wait is part of the proof. Interventions: 0. Every P1 fix this drill set out to prove held on a fresh box. The verdict is still no, for a new reason: a one-drive box with no off-site tier keeps none of the household's own files in any backup, the page says otherwise, and the restore that should save them makes it worse (R-537, R-538). Teardown, three layers, stated. Customer tester-1 kept; RESET never used; nothing on the off-site server written or removed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-16 14:27:04 +02:00
parent ba33db3108
commit dfd854474e
6 changed files with 196 additions and 49 deletions
@@ -1,8 +1,8 @@
 # DRILL — prove the P1 fixes on a fresh box (2026-09-16)

-**Interventions: _pending_** (O1/O2 pre-declared, counted apart).
-**Ready for a volunteer: _pending_.**
-**The automatic connect e-mail: _pending_.**
+**Interventions: 0** (O1 the operator's self-bind press and O2 the PBS re-issue press were pre-declared and are counted apart).
+**Ready for a volunteer: NO — and the reason is new, not one of the old ones.** Every P1 fix this drill set out to prove did hold on a fresh box. But a one-drive box with no off-site tier — the state every fresh install starts in — keeps **none of the household's own files in any backup**, while the backup page says it does, and a restore then reports success and leaves the app listing photos it cannot open (R-537, R-538).
+**The automatic connect e-mail: PASSED.** The host record was deleted at 12:22:59Z and the mail „Kösd össze a Felhom dobozodat” reached `tester1@felhom.eu` at **12:23:00Z — one second later**, with `selfbind_link_sent … (host delete)` on the customer timeline. The requirement was two minutes.

 > Baselines at start (re-verified against live Gitea): controller `383a30b3c07b` v0.243.0 (`Unreleased`: the
 > „0 B" tile fix), agent `e98b857684f4` v0.131.0, felhom.eu `351296114c4d` hub v0.114.0, catalog `94bc5febaca2`.
@@ -61,3 +61,14 @@
 ## 12:58 CEST ("Operator email suppressed ... cooldown") and mailed again at 13:18 CEST - one hour after
 ## the 12:08 mail. So the one-hour operator cooldown both SUPPRESSES and RELEASES correctly, proven from
 ## the hub log and from the inbox independently.
+##
+## THE STALENESS ALARM, fired by the teardown itself (and it is TRUE - the box really is gone):
+##   the box's last report: 13:56:14 CEST (11:56:14Z); the machine destroyed ~13:57:30 CEST.
+##   14:22:00 CEST  host_stale  "tester-1-652049 ok -> stale"  -> OPERATOR EMAIL SENT, same second.
+##   That is 25m46s after the last report, i.e. the 30-minute staleness threshold measured from the
+##   LAST REPORT, not from the moment of death - exactly as the dead-man's-switch is designed.
+##   The hub's delete-impact endpoint flipped to {"status":"stale","deletable":true} in the same minute
+##   (12:21:27Z deletable=False -> 12:22:28Z deletable=True), which is what released the host delete.
+## NOTE on R-529 (the widened host_* cooldown bypass): this fired ONCE, so the 5-minute dedupe was still
+##   not exercised on this box - a second host_* within the hour would be needed, and the box was deleted
+##   instead. The bypass remains proven only by its red-proofed test and the 2026-09-15 node_* run.
@@ -4,3 +4,63 @@
  form fields: NONE
 ## waiting for the host record to fall stale (delete is refused while ONLINE, by design)
  2026-09-16T11:59:21Z status=ok deletable=False
+  2026-09-16T12:00:21Z status=ok deletable=False
+  2026-09-16T12:01:21Z status=ok deletable=False
+  2026-09-16T12:02:21Z status=ok deletable=False
+  2026-09-16T12:03:22Z status=ok deletable=False
+  2026-09-16T12:04:22Z status=ok deletable=False
+  2026-09-16T12:05:22Z status=ok deletable=False
+  2026-09-16T12:06:23Z status=ok deletable=False
+  2026-09-16T12:07:23Z status=ok deletable=False
+  2026-09-16T12:08:23Z status=ok deletable=False
+  2026-09-16T12:09:24Z status=ok deletable=False
+  2026-09-16T12:10:24Z status=ok deletable=False
+  2026-09-16T12:11:24Z status=ok deletable=False
+  2026-09-16T12:12:25Z status=ok deletable=False
+  2026-09-16T12:13:25Z status=ok deletable=False
+  2026-09-16T12:14:25Z status=ok deletable=False
+  2026-09-16T12:15:25Z status=ok deletable=False
+  2026-09-16T12:16:26Z status=ok deletable=False
+  2026-09-16T12:17:26Z status=ok deletable=False
+  2026-09-16T12:18:26Z status=ok deletable=False
+  2026-09-16T12:19:27Z status=ok deletable=False
+  2026-09-16T12:20:27Z status=ok deletable=False
+  2026-09-16T12:21:27Z status=ok deletable=False
+  2026-09-16T12:22:28Z status=stale deletable=True
+  DELETABLE at 2026-09-16T12:22:28Z
+## 2026-09-16T12:22:59Z DELETING the host record (customer tester-1 is KEPT; RESET never used)
+  pre-state: {"deletable":true,"escrow_present":false,"guests":1,"log_bundles":0,"pbs_secret_present":false,"recovery_present":true,"reports":10,"status":"stale","wg_peer_bound":true}
+  delete POST at 2026-09-16T12:22:59Z
+  http=303
+
+  host record after: 404  (404 = gone)
+  customer record after: 200  (200 = KEPT)
+  hub log right after the delete:
+    2026/09/16 14:22:00 [INFO] Host staleness: tester-1-652049 ok → stale (host_stale)
+    2026/09/16 14:22:00 [INFO] Operator email sent for tester-1/host_stale
+    2026/09/16 14:22:59 [INFO] host deleted: tester-1-652049 (escrow deleted: false)
+    2026/09/16 14:22:59 [INFO] self-bind link emailed to the registered address of tester-1
+    2026/09/16 14:22:59 [INFO] self-bind link (hash 029595d7…, valid 7 days) emailed to the registered address of tester-1
+    2026/09/16 14:22:59 [INFO] self-bind link auto-minted for tester-1 on host delete (the console banner's promised email now exists)
+  customer timeline, newest events after the host delete:
+    Sep 16 12:22 | info | selfbind_link_sent | Self-bind link e-mailed (host delete) | hub
+    Sep 16 12:22 | warning | host_stale | Host tester-1-652049: no report for 30m | hub
+    Sep 16 11:56 | info | controller_started | Controller elindult (0.243.0) | controller
+    Sep 16 11:39 | warning | backup_tier_skipped | Whole-guest backup tier felhom-pbs skipped: its storage does not exist on the host (never provisioned or removed). No app was stopped for it. | controller
+    Sep 16 11:37 | info | controller_restarted_by_agent | Host tester-1-652049 guest 9201: the agent restarted the controller (controller container exited on 2 consecutive sweeps) — restart #2 since the agent started | hub
+    Sep 16 11:34 | info | controller_started | Controller elindult (0.243.0) | controller
+  host list now: 0 occurrences of the deleted host id (0 = gone)
+## RESULT - the automatic connect e-mail after a host delete (R-509) - PASSED
+##  host delete POST     2026-09-16T12:22:59Z  -> 303, host record 404, customer record 200 (KEPT)
+##  hub log, same second: "host deleted: tester-1-652049 (escrow deleted: false)"
+##                        "self-bind link emailed to the registered address of tester-1"
+##                        "self-bind link (hash 029595d7..., valid 7 days) emailed ..."
+##                        "self-bind link auto-minted for tester-1 on host delete (the console banner's
+##                         promised email now exists)"
+##  MAILBOX, read independently: a NEW message at 2026-09-16T12:23:00Z - ONE SECOND after the delete -
+##    to tester1@felhom.eu, subject "[Felhom] Kosd ossze a Felhom dobozodat", body "Elkeszult a Felhom
+##    dobozod, es keszen all az osszekotesre ... https://hub.felhom.eu/bind/..."
+##    (The 09:59:56Z message in the same thread is the O1 operator-pressed one; this is a second, new one.)
+##  TIMELINE EVENT: "selfbind_link_sent | Self-bind link e-mailed (host delete) | hub" - the occasion is
+##    named, as required.
+##  Well inside the two-minute requirement: 1 second.