Evening 2026-10-18: fresh install proven (R-1148), OnlyOffice walk (R-1018), one-sign-in spike (R-1100 READY), Redis volumes (R-1117), CI rows, golden 0.331.0 baked; register 168 -> 168 (closed 6, opened R-1149..R-1154)

2026-10-18 23:12:21 +02:00
parent b9b56c47c0
commit e4f022a0d9
90 changed files with 1634 additions and 22 deletions
@@ -544,6 +544,12 @@ nicety.
  **loses Felhom's backup guarantees** — no PBS verify / monitoring on storage we can't reach. An
  honest signup-time tradeoff, not a hidden one.

+**When the new package reaches the hub (R-978, agent `main` 2026-10-18, unreleased):** a ceremony started again no
+longer replaces the hub's package when it starts. The package travels with the pending ceremony and is uploaded when its
+code is claimed, before the code is handed out (an upload failure is a 502 and the code stays claimable). An abandoned
+ceremony — TTL, a new start, a restart — leaves the first code opening the hub's package. Residual: the typed-back check
+is the browser's, so a code opened and not written down still replaces the package (R-1151).
+
 #### Custody across generations — what the hub retains when a blob is superseded (hub v0.60.0; **contract corrected hub v0.93.0, R-198**)

 A ceremony that seals a *different* passphrase does not destroy the blob it replaces: the hub copies