# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## N100 rehearsal S8 wrap — evidence, VALIDATION, map flips, ROADMAP, R-3 — 2026-07-18

**Class:** documentation/evidence run. **Repos touched:** `felhom.eu` only, docs only.
**No code changed anywhere** — every finding is recorded and ranked, none fixed (campaign discipline).

**Commit:** `aa9c08f` — *docs(rehearsal): N100 S8 wrap — VALIDATION, map flips, ROADMAP R-30..R-39,
R-3 draft* (pushed to `main`; parent `bbaa844`).

No CHANGELOG entry: `felhom.eu` keeps per-area changelogs (`hub/`, `scripts/`, `website/`) and this
run touched none of those areas.

### What the run proved

The complete final-product flow ran **end to end on real metal in one pass**: RESET → generic
pairing ISO v1.20.0 → **customer self-bind** → credential delivery → day-0 → managed-floor lift →
drive enrolment → escrow ceremony → offsite snapshots.

| Leg | Wall-clock |
|---|---|
| Blank-metal boot → registered as an unclaimed appliance | **< 1 s** |
| Bind → credential delivered | **26 s** |
| Bind → controller running the CURRENT version | **2 min 44 s** |
| Managed floor 0.143.0 → 0.145.0 (`initiated_by: auto-floor`) | **5 s**, unattended |
| Escrow ceremony → offsite runs enabled | **12 s** |
| Drive enrol (confirm → usable, incl. mkfs) | **30.3 s** |

**No post-bind leg stalled** — that is the immediacy row's real-onboarding proof.

---

## Phase A — evidence bundle (completed before the box was unplugged)

`180:~/n100-rehearsal/` — 984 KB, 10 files + `MANIFEST.md`:

| File | Evidences |
|---|---|
| `bootstrap-journal.txt` | first boot 16:17:14 UTC, PAIRING mode, unclaimed registration, the 30 s poll loop and its **52 systemd FAILED lines**, day-0 SUCCESS 16:32:32 |
| `host-state.txt` | `pct config 9201` (12288 MB), `pveversion -v`, `pvesm status` (**felhom-pbs 401/inactive**), `lsblk`, `blkid` |
| `guest-docker.txt` | 11 containers, controller 0.145.0 healthy, image pin |
| `controller-log-full.txt` / `controller-log.txt` | the whole controller life: auto-floor update, 16:55 config-refresh restart, escrow ceremony, orphan guard, both backup runs |
| `agent-journal.txt` | agent 0.90.0 start, WG registration, storage-wipe gate pending→confirmed, format + enrol, PBS apply, and the repeating PBS verify-loop permission error |
| `pbs-dr-state.txt` | the R-39 failure: storage.cfg stanza, `pvesm status`, credential metadata, direct token probe (401 everywhere), WG health, agent errors |
| `restic-and-pool.txt` | 2 snapshots / **48.717 MiB** attributed, pool `/home` listing + `du` showing **1.4 G + 3.0 M unattributed** |
| `hub-state.txt` | hosts row, both RESET ledger rows, the **unconsumed** PBS secret, self-bind token lifecycle, appliance registration, events timeline |
| `hub-events-timeline.txt` | the 15-row demo-felhom event stream from 15:50 |
| `timezones.txt` | the live-captured CEST/UTC split |

Secrets were read only to run probes and are recorded as lengths and metadata, never as values.

**Not collected:** the operator gauge screenshots (Viktor's set) and the **PBS DR tab**, which
remains uncaptured — and now matters more, because R-39 means it would have shown a fault. The hub
UI is password-gated, so CC cannot capture it.

---

## Phases B–E — what landed

- **Phase B** — `documentation/tests/VALIDATION-n100-rehearsal-2026-07-18.md`: run context, a
  **UTC-normalised** timeline (the host journal is CEST, everything else UTC — a 2 h trap), derived
  wall-clocks, per-ledger verdicts for S1–S8 plus ledgers 8 and 9, 12 findings, the not-exercised
  list, and the discrepancy table.
- **Phase C** — 10 capability-map rows annotated, each citing the Phase-B doc.
- **Phase D** — 5 items collapsed, 11 new ranked items, 1 pre-invite checklist.
- **Phase E** — Viktor's draft (which landed as `runbooks/RUNBOOK-onboarding-draft-v3.md`, not the
  filename the brief predicted) refined: all four `[REFINE]` slots filled, self-bind made the default
  bind path, the measured wall-clock table inlined, interim workarounds for R-31/R-36/R-39 added, and
  C6→C7 marked as the single unexecuted step. **Committed as DRAFT** — it graduates when C7 has
  evidence.

### Capability-map rows flipped

| Row | Change |
|---|---|
| Bare-metal Felhom ISO | PARTIAL → **PROVEN-LIVE** — F1 closed on physical hardware |
| Customer self-bind (slice 1) | IMPLEMENTED → **PROVEN-LIVE** — `customer_selfbind`, 0 failed attempts |
| Guest RAM resize (R-24) | IMPLEMENTED → **PROVEN-LIVE** — shrink **and** grow, live cgroup |
| Customer RESET | + two real firings, verified external teardown, orphan-guard interaction |
| Escrow ceremony | + first live customer-facing wizard firing |
| Immediacy | "real-onboarding proof pending" **cleared** |
| Publish train / floor | + box-side floor lift proven on a fresh install |
| Customer claim | + R-4 gmail half (Inbox under `p=quarantine`) |
| Offsite orphan guard | staged live leg **fired on its own** |
| **DR tier by default** | candidate PROVEN-LIVE upgrade **WITHDRAWN** (R-39) |

**Not flipped, as instructed:** customer-performs-restore (still MISSING), BYO, DLNA, multi-user.

### ROADMAP IDs assigned

| Rank | IDs |
|---|---|
| P2-HIGH | **R-39** PBS DR applied-but-dead · **R-30** liveness from the wait channel · **R-31** async offsite + status card · **R-32** RESET base-dir purge + orphan-card honesty + unattributed-bytes gauge · **R-33** bootstrap console quiet-poll |
| P2 | **R-34** backup data lifecycle · **R-35** config-apply session survival · **R-36** post-RESET re-enroll offsite prompt · **R-27c** console-passphrase bind |
| P3 | **R-37** post-RESET health card · **R-38** installer GRUB slice |

Collapsed: **R-1** (appliance half done; Peti half survives), **R-21** (physically closed), **R-24**,
**R-27** slice 1, **R-4** (gmail half). No existing item renumbered.

---

## Discrepancies found vs the brief (live evidence won in each case)

1. **"expect ~11675 MB" vs `pct config` 12288 MB.** Both correct at different times: F5 auto-sized to
   11675, then the customer shrank to 8192 (16:50:22) and grew to 12288 (17:02:17). Not a fault —
   it is what completes ledger 9.
2. **"2.6 GB pool vs ~0 attributed"** → measured **1.4 G + 3.0 M** unattributed vs **49 M**
   attributed, across **two** `.orphaned-*` directories, not one. The R-32 ruling is unaffected; the
   numbers are.
3. **"felhom-pbs entry present"** → present but **401 / inactive**. The brief treated the descriptor
   as done; it is provisioned but dead. → R-39.
4. **"RESET ×2 … second + third live firings"** → the ledger holds **exactly two rows, both
   tonight**, on **two different customers** (`demo-vm-felhom` 15:49:57, `demo-felhom` 16:08:51).
   Recorded as tonight's two firings rather than as ordinals.
5. **"keep R-29 if the number is free"** → **it is not free.** R-29 was committed earlier the same day
   (`2eccda4`) for the design-v2 gate rot — which *is* the brief's item 5. So the liveness item took
   **R-30**, and **no new ID was minted for the red-gate item**.
6. **Tip and filename:** the brief's tip `a03e142` is two commits behind `bbaa844`, and Viktor's R-3
   draft landed as `RUNBOOK-onboarding-draft-v3.md`, not `DRAFT-R3-onboarding-runbook.md`.
7. **R-39 has no counterpart in the brief at all** — it was found by probing the box, not by working
   the finding list. Its P2-HIGH rank is therefore **provisional pending Viktor**.

### The one finding worth reading twice

**R-39 — the DR tier can report `applied` and be dead simultaneously.** The descriptor
auto-provisioned and the agent converged `state=applied` at 16:45:53. But `pvesm status` returns
`401 Unauthorized`/`inactive`, and a direct probe with the stored credential 401s on **every**
endpoint including `/version` while the WG transport is healthy (handshake 9 s, 27.9 ms RTT) — so it
is authentication, not ACL scope. The hub minted a **second** token secret at 16:47:52, two minutes
*after* the agent applied the first, and its `consumed_at` is **still NULL**; the converged state
machine will not re-apply, and the agent's 15-minute verify loop **cannot read the credential to
notice**, because it reads directly as non-root a file it writes through a root sudo wrapper. A
silent DR failure surfaces first at a restore, which is the worst possible moment — hence the
withdrawn map upgrade and the interim `pvesm status` check now in R-3 step E1.

---

## Remaining to first invite

**freemail.hu test-send (Viktor, remote-doable) + C6 customer-restore evidence (remote-doable on the
reborn box from vacation — the dashboard is remote) + R-11 rulings (contact channel, agreement,
thresholds) + golden 0.145.x rebuild.**

R-39 is not on that line because it was discovered after the brief was written; if Viktor confirms
the P2-HIGH rank, it belongs there too — a first tester whose DR tier is silently dead is exactly the
scenario the alpha exists to avoid.

Viktor's polish/tweak notes arrive separately and are neither pre-empted nor invented here.