R-267 CLOSED (26.2s -> 0.24s warm); R-268 filed: I printed a live token into a transcript

R-267 closed by hub v0.101.0. Measured after the 60s memo: cold 13.4s, warm 0.24-0.33s. The operator
sees a quarter-second except at most once a minute.

R-268 filed against myself. Setting up R-221's live drill, a one-liner meant to list bootstrap.json's
KEYS printed the local_api object whole, including its token, for guest 9201. Reported rather than
quietly rotated, because a secret reaching a transcript is a finding whatever its blast radius.

Exposure assessed rather than assumed, and it is small: the token opens only the agent's per-guest
local API on the island bridge between that host and that one guest, self-scoped to guest 9201, not
routable from the LAN or internet, on a Tier-0 disposable box with no customer data. Using it already
requires code execution there, at which point an attacker has more than the token.

Rotation exists (TokenStore.Mint, last-write-wins per VMID) but must also rewrite the guest's
bootstrap.json or the controller loses agent access — an operator-timed act, not a background one.
The general fix is upstream: reading secret-bearing JSON should go through a helper that prints keys
and never values, the discipline the golden bake already uses for the Gitea token.

R-221 also recorded as PROVEN ON HARDWARE in STATUS.

STATUS.md

@@ -27,16 +27,13 @@ in 72 seconds. The two rough edges that walk found are also gone. *(R-201, R-252
 
 - **Nothing new is broken.** The *check* against a fourth secret-in-a-page covers 4 pages of 27, and
   the cheap one covering all of them is blind to the shape that shipped. *(R-255)*
-- **The machine's own screen keeps telling an already-paired box to pair itself** — 25 minutes after it
-  was paired, on a screen that promises it refreshes itself. *(R-214, R-235)*
-- **A backup that covered nothing still calls itself „Sikeres".** The state is honest; the word is not.
-  *(R-240)*
-- **A machine waiting for its recovery code can stop backing up off-site without alarming us** —
-  after a *rebuild* we ARE told; the gap is reaching that state with no working tier. *(R-243)*
+- **An already-paired box is still told to pair itself**, 25 minutes on. *(R-214, R-235)*
+- **A backup that covered nothing still calls itself „Sikeres".** *(R-240)*
+- **A machine waiting for its recovery code can stop backing up off-site without alarming us.** *(R-243)*
 - **The card offering to reopen set-aside backups promises more than we can deliver.** *(R-202)*
 - **Deleting a customer leaves rows behind** while reporting a clean teardown — no secrets, but it
   accumulates. *(R-244)*
-- **Putting restored files back where they belong is still a manual step.** *(R-213)*
+- **Putting restored files back where they belong is still manual.** *(R-213)*
 
 ## Fixed today — four things the machine knew and did not say
 
@@ -59,6 +56,10 @@ All one family: something the box already knows, thrown away or drawn as its opp
 **Not fixed, and said rather than glossed:** that failed disk reading still reaches us as "0 of
 0 GB". It is the quiet direction — it can only miss a true alarm, never raise a false one. *(R-266)*
 
+**And R-221 is now proven on hardware, not just in tests** — on a demo machine we removed the one
+line, watched the setup screen refuse, waited one minute, and watched it go green by itself with
+nothing restarted. Every other line of that file came back identical.
+
 ## What we're working on
 
 - **Widening the check** so a fourth secret-in-a-page is caught by a machine. *(R-255)* · **Deciding
@@ -84,18 +85,22 @@ the machine all this is built on, not what a customer receives. Mixing them in i
 being readable.*
 
 - **DooPlex's own backup keeps every copy inside the same box, and is silent when it fails.** *(R-232)*
-- **193 old images exist only on this machine**, ~27 GB against 199 GB free — clutter, not space. *(R-210)*
+- **193 old images exist only on this machine**, ~27 GB — clutter, not space. *(R-210)*
 - **The hub password needs rotating** — a diagnostic printed it into a session log; nothing suggests
   anyone else saw it. *(R-132)*
-- **One thing to read after DooPlex next restarts** — the second-SSD move has never survived a reboot;
-  it writes PASS/FAIL to `/var/log/felhom-store-postboot-check.log`. On PASS, 34 GB comes back. *(R-209a)*
+- **After DooPlex next restarts**, read `/var/log/felhom-store-postboot-check.log` — the second-SSD
+  move has never survived a reboot; on PASS, 34 GB comes back. *(R-209a)*
 - **Backup scripts on DooPlex are unversioned host state** *(R-231)*, and the instruction-file
   follow-ups each need a decision rather than an edit *(R-229, R-230)*.
-- **The Configuration page: 26 s → about 10 s, and not finished.** It was never hashing anything —
-  the hashes are already stored and just read. It was making 42 calls one after another. What is
-  left is a single slow Gitea lookup per dropdown; making it instant means holding a short-lived
-  copy, which trades freshness for speed and is your call. **Numbers were taken on a busy box and
-  swing 3×** — worth a re-check when it is idle. *(R-267)*
+- **The Configuration page is fixed: 26 s → a quarter of a second.** It was never hashing anything —
+  the hashes are already stored and simply read. It was making 42 calls one after another. Now they
+  overlap, the connections are kept, and the answer is held for a minute, so you see ~0.25 s except
+  at most once a minute (13 s on that one load). *(R-267 — closed.)*
+- **I printed a live access token into a session log** while setting up today's drill, and I am
+  telling you rather than quietly rotating it. It only opens the agent's private channel to one
+  demo guest, on a wire that exists solely between that host and that guest — not reachable from
+  your network or the internet, on a disposable machine with no customer data. Rotating it also
+  means updating the guest, so it is a deliberate act, not a background one. *(R-268)*
 - **Our build-check alarm has one gap left.** A run that hangs is now cut off after five minutes and
   the mail says how long it took — but **whether the alarm fires at all when the machinery kills a
   run outright is still unverified**, and we have not claimed otherwise. *(R-265)*