diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md index e338a5a..7002ed6 100644 --- a/hub/CHANGELOG.md +++ b/hub/CHANGELOG.md @@ -1,5 +1,29 @@ # Felhom Hub — Changelog +## v0.60.0 — offsite continuity Part B: superseded-escrow retention (data-first) (2026-07-17) + +Closes the data-loss half of the reinstall-orphaned-repo incident: `SaveHostEscrow`'s destructive +`ON CONFLICT` overwrite meant a new escrow blob DESTROYED the old passphrase's only copy — so 18 +snapshots keyed under the old password became unrecoverable. Viktor's ruling (data protection first): +**retain superseded blobs** so the old passphrase stays customer-R-recoverable. Pairs with controller +v0.142.0 (Part A orphaned-repo guard). Green: `go build ./... && go vet ./... && go test ./...`. + +- **`host_escrow_superseded` (new table) + `SaveHostEscrow` rewrite.** On upload, if the current row + seals a DIFFERENT `restic_pw_sha256`, the old row is COPIED into the history table (in one tx) + BEFORE the current row is overwritten; a same-sha re-upload (idempotent re-ceremony) refreshes the + current row and creates NO supersede row. `SaveHostEscrow` now returns `superseded bool`. Retain + ALL (no pruning — the blobs are tiny + R-encrypted, custody unchanged); the hub still never + decrypts. **ACK/restore-serving read the CURRENT row (`GetHostEscrow`) — unchanged.** New + `CountSupersededEscrow` / `ListSupersededEscrow` (the latter seeds the future R-26 recovery flow). + `DeleteHost(deleteEscrow=true)` also drops the retained rows. +- **Surfaces.** Upload handler emits the hub-internal `escrow_superseded` audit event + logs the + retained count; the operator host-detail DR/Backup panel shows "N superseded escrow blob(s) + retained". Registered `offbox_repo_orphaned` / `offbox_repo_reset` (controller v0.142.0 pushes) in + `allowedEventTypes` + `customerMessages`. +- Red-proof `TestSaveHostEscrow_RetainsSuperseded` (pre-fix destructive overwrite → old blob gone → + FAIL; fixed → retained + retrievable; same-sha idempotent). +- **Deploy:** bump `manifests/hub.yaml` image tag to `0.60.0` and sync. + ## v0.59.0 — Direction-2a: agent-plane immediate-sync poke sender + ep0 felhom-poke surface (2026-07-16) Implements the AGENT-plane half of `documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md` diff --git a/hub/internal/api/escrow_test.go b/hub/internal/api/escrow_test.go index 966bda9..6884fca 100644 --- a/hub/internal/api/escrow_test.go +++ b/hub/internal/api/escrow_test.go @@ -155,7 +155,7 @@ func TestReportACK_EscrowStatus(t *testing.T) { } // escrow row with identity blob + hash → the ACK carries all three fields - if err := st.SaveHostEscrow("hv1", []byte("k-blob"), "fp", "zero_knowledge", "2026-07-09T20:00:00Z", "abc123"); err != nil { + if _, err := st.SaveHostEscrow("hv1", []byte("k-blob"), "fp", "zero_knowledge", "2026-07-09T20:00:00Z", "abc123"); err != nil { t.Fatal(err) } if err := st.SaveHostDRBundle("hv1", []byte("identity-blob"), "{}"); err != nil { diff --git a/hub/internal/api/handler.go b/hub/internal/api/handler.go index 7782fd8..e402007 100644 --- a/hub/internal/api/handler.go +++ b/hub/internal/api/handler.go @@ -1095,12 +1095,27 @@ func (h *Handler) handleHostEscrowPut(w http.ResponseWriter, r *http.Request, pa if createdAt == "" { createdAt = time.Now().UTC().Format(time.RFC3339) } - // Store the OPAQUE bytes. No decrypt path exists — the hub cannot open this. - if err := h.store.SaveHostEscrow(pathHostID, blob, req.KeyFingerprint, req.Posture, createdAt, req.ResticPwSHA256); err != nil { - h.logger.Printf("[ERROR] Failed to store escrow for host %s: %v", pathHostID, err) + // Store the OPAQUE bytes. No decrypt path exists — the hub cannot open this. Part B (v0.60.0): + // when this upload supersedes a DIFFERENT-passphrase old blob, the old one is RETAINED (not + // overwritten) so its recovery-code-recoverable history survives (Viktor's data-first ruling). + superseded, serr := h.store.SaveHostEscrow(pathHostID, blob, req.KeyFingerprint, req.Posture, createdAt, req.ResticPwSHA256) + if serr != nil { + h.logger.Printf("[ERROR] Failed to store escrow for host %s: %v", pathHostID, serr) http.Error(w, "Internal error", http.StatusInternalServerError) return } + if superseded { + n, _ := h.store.CountSupersededEscrow(pathHostID) + h.logger.Printf("[INFO] escrow for host %s superseded a different-passphrase blob — RETAINED (now %d superseded blob(s) held)", pathHostID, n) + // Hub-internal audit event (not gated by allowedEventTypes) — tied to the owning customer. + if host, herr := h.store.GetHost(pathHostID); herr == nil && host != nil && host.CustomerID != "" { + details, _ := json.Marshal(map[string]any{"host_id": pathHostID, "retained_count": n}) + if _, eerr := h.store.SaveEvent(host.CustomerID, "escrow_superseded", "info", + "A korábbi helyreállítási csomag megőrizve (új kulcs érkezett).", string(details), "hub"); eerr != nil { + h.logger.Printf("[WARN] escrow_superseded event save failed for %s: %v", pathHostID, eerr) + } + } + } // Slice 10D.1: optionally store the IDENTITY escrow blob + the non-secret DR directive alongside // the K-escrow (both opaque / non-secret — no usable secret hub-side). Additive: a slice-7 // upload without these is unchanged. @@ -1503,6 +1518,10 @@ var allowedEventTypes = map[string]bool{ // dynamic Hungarian message is customer-grade — deliberately NO customerMessages entry, which would // discard the numbers (templates.go:129 priority)). "offbox_enlarge_blocked": true, + // controller v0.142.0 — offsite-repo continuity: the remote repo is orphaned (reinstall shape) / + // was reset (move-aside + re-init). Customer-grade messages below. + "offbox_repo_orphaned": true, + "offbox_repo_reset": true, "storage_disconnected": true, "storage_reconnected": true, "disk_warning": true, diff --git a/hub/internal/notify/templates.go b/hub/internal/notify/templates.go index b69781b..dfd01e4 100644 --- a/hub/internal/notify/templates.go +++ b/hub/internal/notify/templates.go @@ -62,6 +62,9 @@ var customerMessages = map[string]string{ "backup_integrity_failed": "A mentés integritás ellenőrzés hibát talált!", "crossdrive_completed": "A másodlagos mentés sikeresen elkészült.", "crossdrive_failed": "A másodlagos mentés sikertelen!", + // Offsite-repo continuity (controller v0.142.0) + "offbox_repo_orphaned": "A távoli mentési tároló elárvult: a benne lévő mentések egy korábbi, már nem elérhető kulccsal készültek (jellemzően újratelepítés után). Új mentés a tároló visszaállításáig nem készül — nyisd meg a Távoli mentés oldalt.", + "offbox_repo_reset": "A távoli mentési tároló visszaállítva: a régi előzmény félretéve (nem törölve), és egy üres, új tároló jött létre a mostani kulccsal.", // Disk events (GUEST — the controller's own cgroup view) "disk_warning": "A lemezterület 90% felett van — kérjük, szabadíts fel helyet.", diff --git a/hub/internal/offsite/offsite_test.go b/hub/internal/offsite/offsite_test.go index 8316796..07dbb86 100644 --- a/hub/internal/offsite/offsite_test.go +++ b/hub/internal/offsite/offsite_test.go @@ -226,7 +226,7 @@ func TestReissue_InvalidatesEscrow(t *testing.T) { if err := st.UpsertHost(&store.Host{HostID: cust + "-01", CustomerID: cust, APIKey: "k"}); err != nil { t.Fatal(err) } - if err := st.SaveHostEscrow(cust+"-01", []byte("opaque-blob"), "SHA256:fp", "zero_knowledge", "2026-07-16T00:00:00Z", "OLDHASH"); err != nil { + if _, err := st.SaveHostEscrow(cust+"-01", []byte("opaque-blob"), "SHA256:fp", "zero_knowledge", "2026-07-16T00:00:00Z", "OLDHASH"); err != nil { t.Fatal(err) } // Before re-issue: current escrow — the hub serves the sealed hash and is NOT stale. @@ -256,7 +256,7 @@ func TestReissue_InvalidatesEscrow(t *testing.T) { } // A fresh ceremony (new blob sealing the new password) clears stale + serves the new hash. - if err := st.SaveHostEscrow(cust+"-01", []byte("opaque-blob-2"), "SHA256:fp", "zero_knowledge", "2026-07-16T01:00:00Z", "NEWHASH"); err != nil { + if _, err := st.SaveHostEscrow(cust+"-01", []byte("opaque-blob-2"), "SHA256:fp", "zero_knowledge", "2026-07-16T01:00:00Z", "NEWHASH"); err != nil { t.Fatal(err) } es, _ = st.GetEscrowStatusForCustomer(cust) diff --git a/hub/internal/store/escrow_superseded_test.go b/hub/internal/store/escrow_superseded_test.go new file mode 100644 index 0000000..a4e6ab0 --- /dev/null +++ b/hub/internal/store/escrow_superseded_test.go @@ -0,0 +1,58 @@ +package store + +import "testing" + +// Part B (v0.60.0) — the escrow retention red-proof (the 2026-07-17 incident class). A new escrow blob +// with a DIFFERENT sealed-passphrase sha must RETAIN the old blob (recoverable) instead of destroying +// it; a same-sha re-upload is idempotent (no supersede row). Pre-fix (destructive ON CONFLICT +// overwrite) the old blob is gone → the retrieval assertion FAILS. +func TestSaveHostEscrow_RetainsSuperseded(t *testing.T) { + st := newTestStore(t) + const h = "h1" + + // 1st upload (P_old) — nothing to supersede. + sup, err := st.SaveHostEscrow(h, []byte("blob-old"), "fp-old", "zk", "2026-07-09T00:00:00Z", "SHA_OLD") + if err != nil { + t.Fatal(err) + } + if sup { + t.Fatal("first upload must not supersede") + } + + // 2nd upload (P_new, DIFFERENT sha) — must supersede + retain the old. + sup, err = st.SaveHostEscrow(h, []byte("blob-new"), "fp-new", "zk", "2026-07-16T00:00:00Z", "SHA_NEW") + if err != nil { + t.Fatal(err) + } + if !sup { + t.Fatal("a different-passphrase upload must supersede (retain the old blob)") + } + // Current row is the NEW blob (ACK/restore-serving read this — unchanged behavior). + cur, _ := st.GetHostEscrow(h) + if cur == nil || string(cur.Blob) != "blob-new" || cur.ResticPwSHA256 != "SHA_NEW" { + t.Fatalf("current row not the new blob: %+v", cur) + } + // RED-PROOF: the OLD blob is RETAINED and retrievable. + old, err := st.ListSupersededEscrow(h) + if err != nil { + t.Fatal(err) + } + if len(old) != 1 || string(old[0].Blob) != "blob-old" || old[0].ResticPwSHA256 != "SHA_OLD" { + t.Fatalf("old blob NOT retained after overwrite (incident): %+v", old) + } + if n, _ := st.CountSupersededEscrow(h); n != 1 { + t.Fatalf("superseded count = %d, want 1", n) + } + + // 3rd upload, SAME sha as current — idempotent (re-ceremony of the same password): NO supersede row. + sup, err = st.SaveHostEscrow(h, []byte("blob-new-2"), "fp-new", "zk", "2026-07-16T01:00:00Z", "SHA_NEW") + if err != nil { + t.Fatal(err) + } + if sup { + t.Fatal("a same-sha re-upload must NOT supersede (idempotent)") + } + if n, _ := st.CountSupersededEscrow(h); n != 1 { + t.Fatalf("idempotent re-upload created a superseded row: count=%d", n) + } +} diff --git a/hub/internal/store/host_delete_test.go b/hub/internal/store/host_delete_test.go index 00446b2..76b5fcc 100644 --- a/hub/internal/store/host_delete_test.go +++ b/hub/internal/store/host_delete_test.go @@ -57,7 +57,7 @@ func seedHostWithArtifacts(t *testing.T, s *Store, hostID, customerID string) { "PK-"+hostID, "ip-"+hostID, hostID); err != nil { t.Fatal(err) } - if err := s.SaveHostEscrow(hostID, []byte("opaque-escrow"), "fp", "posture", "2026-07-01T00:00:00Z", ""); err != nil { + if _, err := s.SaveHostEscrow(hostID, []byte("opaque-escrow"), "fp", "posture", "2026-07-01T00:00:00Z", ""); err != nil { t.Fatal(err) } } diff --git a/hub/internal/store/store.go b/hub/internal/store/store.go index 0544435..73b369d 100644 --- a/hub/internal/store/store.go +++ b/hub/internal/store/store.go @@ -330,6 +330,25 @@ func (s *Store) migrate() error { updated_at DATETIME NOT NULL DEFAULT (datetime('now')) ); + -- host_escrow_superseded (v0.60.0, offsite-continuity): RETAINED old escrow blobs. Viktor's + -- ruling (data protection first): when a NEW escrow blob supersedes an old one whose sealed + -- restic-password sha DIFFERS, the old row is COPIED here BEFORE host_escrow is overwritten — + -- so the old passphrase stays customer-R-recoverable (turns the reinstall-orphan incident from + -- "history destroyed" into "history recoverable with the recovery code"). Append-only; the hub + -- never decrypts; NO pruning (the blobs are tiny + R-encrypted; custody unchanged). The ACK and + -- restore-serving read host_escrow (the CURRENT row) — never this table. + CREATE TABLE IF NOT EXISTS host_escrow_superseded ( + id INTEGER PRIMARY KEY AUTOINCREMENT, + host_id TEXT NOT NULL, + blob BLOB NOT NULL, + key_fingerprint TEXT NOT NULL DEFAULT '', + posture TEXT NOT NULL DEFAULT '', + created_at DATETIME NOT NULL, + restic_pw_sha256 TEXT NOT NULL DEFAULT '', + superseded_at DATETIME NOT NULL DEFAULT (datetime('now')) + ); + CREATE INDEX IF NOT EXISTS idx_host_escrow_superseded_host ON host_escrow_superseded(host_id); + -- signed_jobs (slice 10A): the per-host queue of OPAQUE operator-signed destructive-op -- blobs. The hub STORES + SERVES them; it never forges one (there is no signing key -- hub-side) and never executes them (execution + signature verification is slice 10B). @@ -1990,6 +2009,7 @@ func (s *Store) DeleteHost(hostID string, deleteEscrow bool) error { } if deleteEscrow { stmts = append(stmts, `DELETE FROM host_escrow WHERE host_id = ?`) + stmts = append(stmts, `DELETE FROM host_escrow_superseded WHERE host_id = ?`) // retained blobs go with the host } stmts = append(stmts, `DELETE FROM hosts WHERE host_id = ?`) for _, q := range stmts { @@ -2071,8 +2091,49 @@ type HostEscrow struct { // SaveHostEscrow stores (last-write-wins) the OPAQUE escrow blob for a host. The hub keeps the // bytes and NEVER decrypts them — there is no decrypt path. createdAt is the agent's timestamp. // resticPwSHA256 is "" when the ceremony sealed no staged password (stored as-is; never auto-confirms). -func (s *Store) SaveHostEscrow(hostID string, blob []byte, keyFingerprint, posture, createdAt, resticPwSHA256 string) error { - _, err := s.db.Exec(` +// SaveHostEscrow returns superseded=true when it RETAINED a different-passphrase old blob into +// host_escrow_superseded before overwriting the current row (Part B, v0.60.0). A same-sha re-upload +// (idempotent re-ceremony of the same password) refreshes the current row and does NOT create a +// superseded row. +func (s *Store) SaveHostEscrow(hostID string, blob []byte, keyFingerprint, posture, createdAt, resticPwSHA256 string) (superseded bool, err error) { + tx, err := s.db.Begin() + if err != nil { + return false, err + } + defer func() { + if err != nil { + tx.Rollback() + } + }() + + // Retain the current row iff it exists AND seals a DIFFERENT restic password (the incident: a + // recreated volume mints a new passphrase; the old must stay recoverable with its recovery code). + var ( + curBlob []byte + curFp, curPosture, curCreated, curSHA string + exists bool + ) + row := tx.QueryRow(`SELECT blob, key_fingerprint, posture, created_at, COALESCE(restic_pw_sha256,'') FROM host_escrow WHERE host_id = ?`, hostID) + switch scanErr := row.Scan(&curBlob, &curFp, &curPosture, &curCreated, &curSHA); scanErr { + case nil: + exists = true + case sql.ErrNoRows: + exists = false + default: + err = scanErr + return false, err + } + if exists && curSHA != resticPwSHA256 { + if _, err = tx.Exec(` + INSERT INTO host_escrow_superseded (host_id, blob, key_fingerprint, posture, created_at, restic_pw_sha256, superseded_at) + VALUES (?, ?, ?, ?, ?, ?, datetime('now'))`, + hostID, curBlob, curFp, curPosture, curCreated, curSHA); err != nil { + return false, err + } + superseded = true + } + + if _, err = tx.Exec(` INSERT INTO host_escrow (host_id, blob, key_fingerprint, posture, created_at, restic_pw_sha256, updated_at) VALUES (?, ?, ?, ?, ?, ?, datetime('now')) ON CONFLICT(host_id) DO UPDATE SET @@ -2083,9 +2144,40 @@ func (s *Store) SaveHostEscrow(hostID string, blob []byte, keyFingerprint, postu restic_pw_sha256 = excluded.restic_pw_sha256, stale_at = NULL, updated_at = datetime('now')`, - hostID, blob, keyFingerprint, posture, createdAt, resticPwSHA256, - ) - return err + hostID, blob, keyFingerprint, posture, createdAt, resticPwSHA256); err != nil { + return false, err + } + err = tx.Commit() + return superseded, err +} + +// CountSupersededEscrow returns how many retained (superseded) escrow blobs the hub holds for a host +// (the operator "N superseded escrow blobs retained" surface). 0 on no rows. +func (s *Store) CountSupersededEscrow(hostID string) (int, error) { + var n int + err := s.db.QueryRow(`SELECT COUNT(*) FROM host_escrow_superseded WHERE host_id = ?`, hostID).Scan(&n) + return n, err +} + +// ListSupersededEscrow returns the retained (superseded) escrow blobs for a host, newest-superseded +// first. Opaque bytes — the hub never decrypts. Seeds the future guided-recovery flow (R-26). +func (s *Store) ListSupersededEscrow(hostID string) ([]HostEscrow, error) { + rows, err := s.db.Query(` + SELECT host_id, blob, key_fingerprint, posture, created_at, restic_pw_sha256, superseded_at + FROM host_escrow_superseded WHERE host_id = ? ORDER BY id DESC`, hostID) + if err != nil { + return nil, err + } + defer rows.Close() + var out []HostEscrow + for rows.Next() { + var e HostEscrow + if err := rows.Scan(&e.HostID, &e.Blob, &e.KeyFingerprint, &e.Posture, &e.CreatedAt, &e.ResticPwSHA256, &e.UpdatedAt); err != nil { + return nil, err + } + out = append(out, e) + } + return out, rows.Err() } // MarkEscrowStale flags a host's escrow blob as stale (v0.57.0, 2.3) — called when the offsite repo diff --git a/hub/internal/web/hosts.go b/hub/internal/web/hosts.go index d33523e..2394dce 100644 --- a/hub/internal/web/hosts.go +++ b/hub/internal/web/hosts.go @@ -406,6 +406,9 @@ func (s *Server) hostDetailData(host *store.Host, r *http.Request) map[string]in "NeedsDRMigration": capabilitiesNeedDRMigration(capabilities), "DRPresent": drBundle != nil, "EscrowPresent": escrow != nil, + // v0.60.0 Part B: retained superseded escrow blobs (data-first — old passphrases stay + // R-recoverable). Operator-only surface. + "SupersededEscrowCount": func() int { n, _ := s.store.CountSupersededEscrow(host.HostID); return n }(), // v0.46.0 Diagnostics: pending log pulls + received/blocked bundles (72 h TTL). "LogBundles": s.hostLogBundleRows(host), "CSRFToken": s.getCSRFToken(r), diff --git a/hub/internal/web/hosts_delete_test.go b/hub/internal/web/hosts_delete_test.go index cc06de2..91b7fe9 100644 --- a/hub/internal/web/hosts_delete_test.go +++ b/hub/internal/web/hosts_delete_test.go @@ -64,7 +64,7 @@ func TestHostDelete_EscrowAckRequired(t *testing.T) { if err := st.UpsertHost(&store.Host{HostID: "esc-host", CustomerID: "c2", APIKey: "k"}); err != nil { t.Fatal(err) } - if err := st.SaveHostEscrow("esc-host", []byte("blob"), "fp", "p", "2026-07-01T00:00:00Z", ""); err != nil { + if _, err := st.SaveHostEscrow("esc-host", []byte("blob"), "fp", "p", "2026-07-01T00:00:00Z", ""); err != nil { t.Fatal(err) } @@ -110,7 +110,7 @@ func TestHostDelete_ImpactJSON(t *testing.T) { if err := st.UpsertHost(&store.Host{HostID: "imp-host", CustomerID: "c4", APIKey: "SECRET-KEY"}); err != nil { t.Fatal(err) } - if err := st.SaveHostEscrow("imp-host", []byte("blob"), "fp", "p", "2026-07-01T00:00:00Z", ""); err != nil { + if _, err := st.SaveHostEscrow("imp-host", []byte("blob"), "fp", "p", "2026-07-01T00:00:00Z", ""); err != nil { t.Fatal(err) } if err := st.UpsertGuestFromReport(&store.Guest{GuestID: store.GuestID("imp-host", 100), @@ -159,7 +159,7 @@ func TestHostDelete_HappyPath(t *testing.T) { if err := st.UpsertHost(&store.Host{HostID: "dr-drill", CustomerID: "c5", APIKey: "k"}); err != nil { t.Fatal(err) } - if err := st.SaveHostEscrow("dr-drill", []byte("blob"), "fp", "p", "2026-07-01T00:00:00Z", ""); err != nil { + if _, err := st.SaveHostEscrow("dr-drill", []byte("blob"), "fp", "p", "2026-07-01T00:00:00Z", ""); err != nil { t.Fatal(err) } rr := postHostDelete(t, s, "dr-drill", url.Values{ diff --git a/hub/internal/web/hosts_test.go b/hub/internal/web/hosts_test.go index c85f7bb..29bd77c 100644 --- a/hub/internal/web/hosts_test.go +++ b/hub/internal/web/hosts_test.go @@ -130,7 +130,7 @@ func TestHandleHostDetail(t *testing.T) { t.Fatal(err) } // DR + escrow present (escrow row must exist before the DR bundle UPDATE). - if err := st.SaveHostEscrow("demo-felhom-01", []byte("opaque-escrow"), "fp", "posture", "2026-06-01T00:00:00Z", ""); err != nil { + if _, err := st.SaveHostEscrow("demo-felhom-01", []byte("opaque-escrow"), "fp", "posture", "2026-06-01T00:00:00Z", ""); err != nil { t.Fatal(err) } if err := st.SaveHostDRBundle("demo-felhom-01", []byte("opaque-identity"), `{"v":1}`); err != nil { diff --git a/hub/internal/web/pbsdr_test.go b/hub/internal/web/pbsdr_test.go index 072080d..ef2105a 100644 --- a/hub/internal/web/pbsdr_test.go +++ b/hub/internal/web/pbsdr_test.go @@ -390,7 +390,7 @@ func TestPBSDR_F14AutoReissueOnAckedDeletion(t *testing.T) { if err := st.UpsertHost(&store.Host{HostID: "peti-00-dead", CustomerID: "peti", APIKey: "oldkey"}); err != nil { t.Fatal(err) } - if err := st.SaveHostEscrow("peti-00-dead", []byte("opaque"), "fp", "posture", "2026-07-01T00:00:00Z", ""); err != nil { + if _, err := st.SaveHostEscrow("peti-00-dead", []byte("opaque"), "fp", "posture", "2026-07-01T00:00:00Z", ""); err != nil { t.Fatal(err) } if err := st.DeleteHost("peti-00-dead", true); err != nil { diff --git a/hub/internal/web/templates/host_detail_body.html b/hub/internal/web/templates/host_detail_body.html index c0a66dc..c10e380 100644 --- a/hub/internal/web/templates/host_detail_body.html +++ b/hub/internal/web/templates/host_detail_body.html @@ -263,7 +263,7 @@
Key Escrow - {{if .EscrowPresent}}present{{else}}none{{end}} + {{if .EscrowPresent}}present{{else}}none{{end}}{{if gt .SupersededEscrowCount 0}} · {{.SupersededEscrowCount}} superseded escrow blob(s) retained{{end}}