REPORT: record corrected, second promise closed, removal chain code-only

REPORT.md

@@ -1,49 +1,86 @@
-# REPORT — installer golden gate + golden 0.211.0 bake (2026-08-10)
+# REPORT — the record, the second promise, the removal chain (2026-08-12)
 
-Commits `eb60087` (R-297 installer) and `999b0a3` (bake evidence). CI run **299** → `success`.
-All eight `repo_gates.py` gates OK, including `golden-currency`, which this run took from RED to GREEN.
-**`--no-verify` was not used at any point** — the currency gate refused an earlier push and that
-refusal was respected until the bake made it true.
+Commits `f76cbf0` (Part 0), `2389544` (spec + bake evidence), `125aec1` (R-300), `890a474` (STATUS).
+Controller: `68f3e12` (R-299). All gates green in both repos; **`--no-verify` used nowhere** — the
+currency gate refused a push mid-session and stayed refused until the bake made it true.
 
-## R-297 — an install takes the golden you approved
+## Part 0 — the record now says what is true
 
-`felhom-host-install.sh` v1.26.0. Step 7 short-circuited on ANY local archive: no version compare,
-no digest, no warning, so the manifest's sha256 — which vouches from a different trust root than the
-code host — was consulted only on the fetch path. Discovery is `sort | tail -1`: correct by recency,
-never by verification.
+Re-read from the hub's own store, with a control (escrow query returns 1+1 for each demo box, 0+0 for
+`drill-r50`). Confirmed: **3 hosts total, no peti row under any name**; 4 escrow rows hub-wide, all
+demo; `host_deletions` id=1 `peti-felhom-86d37d` **2026-07-15 08:56:22**, `escrow_acked = 0`; last
+report **2026-07-15 08:39:00 UTC**, controller 0.115.0, `offsite: {escrow_state: "pending",
+snapshot_count: 0}`; local app-data repo empty; dashboard never claimed. The `PETI` row and `STATUS.md`
+now state that the mitigation they named **does not exist** — and leave the parked/not-parked ruling
+open, because that is the operator's and the fact does not need his opinion to be true.
 
-`golden_local_matches_manifest()` compares digest first (a match means it IS the vouched artifact),
-then the controller tag baked at `/etc/felhom-controller-image`. Auto-discovered mismatch → ignore
-and fetch the vouched one; operator-named (`--golden`) mismatch → REFUSE, never silently substitute;
-unreadable manifest → refuse rather than pass.
+**Contact since the deletion — answered without touching the machine.** No inbound row of any kind
+after 2026-07-15 08:39; the only later rows are the hub's OWN alarms (`source = hub`: `node_stale`
+09:09:32, `node_down` 09:39:32). No contact attempt, accepted or rejected, in the current hub pod's
+logs (since 2026-08-09 17:26Z) — grep proven by **851 `demo-hp` hits against 0 for peti, 0
+unauthorized**. **The window 2026-07-15 → 2026-08-09 cannot be answered from records**: a report from a
+deleted host 401s and is not persisted, and those logs are gone.
 
-**Measured on real hardware:** three goldens sit on `demo-hp` carrying controller **0.153.0** and
-**0.210.0**, and nothing compared either to the vouched version before use.
+## Part 1/2 — the second promise (controller v0.212.0)
 
-**NOT PUBLISHED.** The task asked that a fresh install be watched taking a stale local golden on
-`drill-r50` BEFORE the fix. That was not done, so `installer-v1.26.0` is deliberately not cut and
-`webpage.yaml` is untouched — pushing to `main` publishes nothing (R-110). Publishing an unobserved
-change to the one artifact that runs as root on a virgin box is the failure this project keeps
-writing rules about.
+`backups_remote.html` line 98 — the **always-visible** half — still ended *„…visszaállíthatók
+lehetnek"*. Replaced; the two accurate halves kept.
 
-## Golden 0.211.0 — baked, published, round-trip verified
+**Why it survived, which is the useful part:** the spec called that line *"Accurate; keep"*, **and the
+guard matched one INFLECTION** (`visszaállítható lehet`) that the plural does not contain. Guard
+broadened to the stem `visszaállíthat`. Spec corrected in both places.
 
-Full evidence: `documentation/tests/golden-0.211.0-2026-08-10/` (`bake.log` + `RESULT.md`).
+**Plant → convict → remove → pass:** planted the exact shipped plural → the stem guard **FAILED** and
+quoted it back; the old singular guard **does not match that sentence at all** (`False`, shown as a
+pure string fact, not a contaminated source grep); removed → 5/5 orphan-card tests pass.
 
-- `GOLDEN_SHA256=8593516889eb93fe1691410d7306be8cb87ee835b8d2378740eb34022272f849`
-- Served bytes re-downloaded and hashed → identical. 656 141 689 B.
-- All six acceptance markers counted (two initially returned a false `0` through broken shell
-  quoting and were re-run with `grep -F` — a 0 from a broken instrument is not a measurement).
-- Token never on a command line; leak grep on the committed log = 0, and that 0 was made believable
-  by first proving the grep finds a planted token.
-- Drill VM reverted to `virgin` before and after; build guest destroyed `--purge`; `/root` residue empty.
+Two instrument defects fixed on the way: the guard's failure message sliced rendered HTML at a **byte**
+offset and cut Hungarian mid-character (now rune-safe); and a first pass at the bake's acceptance
+markers returned a false `0` through shell quoting — re-run with `grep -F`, because a zero from a
+broken instrument is not a measurement.
 
-## Registers
+## Part 3 — the removal chain (R-300), CODE ONLY
 
-R-295 (PARTIAL — hub half open), R-296, R-297, R-298 filed. Ceiling moved R-294 → **R-298**.
+Confirmed at source: uninstall removes the snippet and **restarts** (`:1075-1082`), leaving the unit
+enabled; the byo preflight then refuses on `:53`.
 
-## NOT DONE
+**The prompt's framing needed one correction:** the installer does **not** install dnsmasq — the
+**agent** does (`lanresolver.go:107`), conditionally, and `felhom-agent` is fenced this session. So
+ownership is recorded at **preflight**, before anything is installed, which is the only moment it is a
+fact — not a package mtime. At removal: Felhom's → stop+disable; the owner's → restart only; **no
+record (every box in the field) → restart only, fail-safe, with the reason and the command logged.**
+The refusal keeps its two routes and its promise, and gains the missing line naming our own leftover.
 
-- **The Day-0 vouch** — the operator's, deliberately not made here.
-- **Part 2** (uninstall leaves `dnsmasq` bound to :53) — dropped first, per the task's drop order.
-- **Part 4a** (hub half of the code naming, and its emails) — dropped second, filed as R-295 PARTIAL.
+**NOT OBSERVED LIVE.** The `drill-r50` install→uninstall→install cycle was not run, so the wrong
+outcome was never quoted and **no `installer-v1.27.0` tag is cut.**
+
+## Golden 0.212.0 — baked, published, round-trip verified
+
+`4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8`, 656 611 277 B, served bytes
+re-downloaded and hashed identical. All six markers counted with `grep -F`. Token never on a command
+line; leak grep 0, believable because a planted-token control grepped 1. Drill VM reverted to `virgin`.
+Evidence: `documentation/tests/golden-0.212.0-2026-08-12/`.
+
+## DROPPED — named plainly
+
+- **The hub half of the naming (R-295)** — dropped first, exactly as the drop order allows. The four
+  hub surfaces were NOT enumerated at `file:line`; that enumeration is still owed.
+- **The stale-golden observation (R-297)** — dropped second. Nothing published, which is the safe state.
+- **And one that was NOT droppable: R-300's live cycle.** The code shipped; the demonstration did not.
+  Named here rather than shortened silently.
+
+## Observations, not acted on
+
+- **R-301** — the abandon countdown banner (`layout.html:143`) states the retired promise a third time
+  and un-hedged. It is probably TRUE where it renders, and it renders on every page; a rebuilt box can
+  have an active countdown while its store is orphaned. Not established: whether the two sentences name
+  the same bytes. Left alone deliberately — this session was fenced to the orphan card.
+- The orphan card now says "we cannot determine / it depends on the key / write to us" **twice** once a
+  customer clicks through — reinforcement at the decision point rather than a contradiction, but worth
+  an eye if the card is revisited.
+
+## Deliberately out of scope
+
+The CI runs that fail with no log; the twenty facts the machines report that nothing reads; the nine
+grey claims; the storage page's separate empty-list cause (R-298); and proving a *retained* key can
+actually open an old store — the one thing the retention fix has never been shown to do.