# REPORT — instruction arc close-out, 2026-08-06

Six items. Closes **R-229(b)** and **R-230(b)**; part-actions **R-230(a)**.
Full accounting: `documentation/audits/LEDGER-instruction-closeout-2026-08-06.md`.

> Second session in this repo, so this is a `REPORT-<topic>.md`; the shared `REPORT.md` was not
> touched.

## 1. Baselines and commits

Reconfirmed live, all clean and synced: `felhom.eu` `92a076c239b9`, `felhom-controller`
`66d80efb9f20`, `felhom-agent` `5b2666e3a2ae`, `app-catalog` `459766cb1639`.

| Push | Repo | What |
|---|---|---|
| `aa74294` | felhom-agent | core + 4 rule files |
| `15fa527` | felhom.eu | checks 6-content and 7 |
| `f49b1f3` | felhom.eu | symlink + check 5 two shapes |
| `5ca5082` | felhom.eu | t740, registers, ledger, S-37 |

## 2. `felhom-agent/CLAUDE.md`

**175 → 99 effective lines** (207 → 103 raw; 14,093 → 6,267 B). Measured 175, not the spec's 173 —
part 2's CI correction added two. Four new `paths:`-scoped rule files, all ≤46 effective, beside the
existing `health-checks.md`.

**Glob overlap, stated not silently resolved:** `health-checks.md` already covered
`internal/{storage,localapi,guesthook}/**`, which `storage.md` and `localapi.md` now also cover. Both
load; neither supersedes. Each new file says so in its own text.

## 3. Hook evidence — fresh sessions, both directions

Agent rules (`claude -p`, timestamps from the log):

```
2026-08-06T09:46:15Z  path_glob_match  .../rules/proxmox.md   trigger=client.go
2026-08-06T09:46:23Z  path_glob_match  .../rules/backup.md    trigger=doc.go
```

Negative control — reading `go.mod`, which matches no rule glob: **no rule fired at all**. And each
positive fired *only* its own rule.

Symlink — all three fresh sessions logged
`session_start  Project  /mnt/5_hdd/felhom.eu/git/CLAUDE.md` (Claude Code reports the **link** path,
not the resolved one). Because a logged path proves discovery and not delivery, a fourth fresh
session **with no tools at all** was asked for standing rule 1 and returned it verbatim:
*"Never combine a test run and a commit in one command…"*. **The content reaches the model. The link
stays.**

## 4. Memory — three false statements, and a corrected premise

Backup: `/mnt/5_hdd/felhom.eu/backups/claude-memory-20260806-112853` (158 files). **158 before, 158
after. Nothing deleted. Only three lines edited.**

**The premise was wrong and the error was mine.** Part 2 reported "3 expired statements"; re-run with
the cause printed, **all three matched an ISO date inside a markdown link target — a filename** —
while the one real expired claim was written `~08-02`, carried no ISO date, and was never matched.

The three genuinely false statements, each falsified by evidence:

| Line | Was | Falsified by |
|---|---|---|
| 17 | `R-193 decision open` | row reads `**CLOSED 2026-08-05 — controller v0.200.0**` |
| 34 | `demo boxes REMOTE till ~08-02` | `ssh felhom-pve` answers, holding `192.168.0.162/24` on `vmbr0` |
| 68 | `OPEN R-25b` | `**SHIPPED hub v0.69.0 (2026-07-21)**` |

Line 34 kept its durable half — `ssh felhom-pve` still resolves to the **tailnet** address.

## 5. Gate: check 6 content WARNings + check 7

First run over the real index: **32 version literals, 4 host addresses, 0 expired, 0 stale
citations**. The 32 and the 4 are **deliberately left** for the loop to work on.

**Check 7 finds nothing across the four repos right now** — 19 citations, 0 failures — because part 2
already fixed the four stale sentences. The red-proof, not the zero, is what shows it works:

```
CLAUDE.md:90: claims R-168 is still open, but the register says it is closed. …
      report when you use it.** Both facts are why CI is still owed (`OPEN-ITEMS.md` R-168).
```

Restored; gate green again. **Suite 39 → 68 assertions, 0 failures.**

**Two bugs found by the check's own red-proofs, both of which would have shipped.** The state marker
is not self-closing (`**SHIPPED — …**`), so the first parser read **R-168, its own founding case, as
OPEN**; and the CLOSED exemption was line-wide, so "shipped" in a title pardoned `OPEN R-25b`. The
second was found *only* because the red-proof failed to go red.

**Deviation from the task's literal wording, stated:** check 7 triggers on an **openness claim**, not
on every citation of a non-open item. The literal rule fires on ~30 legitimate provenance citations
(`(R-161)`, `R-117 spike §6.3`); a gate that noisy gets switched off, which is R-29's own lesson. The
spec's required pass case (`R-168, CLOSED 2026-08-02`) is tested and green.

## 6. Symlink

Live root file → relative symlink; backup `workspace-CLAUDE.md.bak-20260806-113952`. Check 5 asserts
per shape: link → resolves to the versioned copy (dangling case red-proofed, since a dangling link
loads **nothing**); two files → byte-identity as before. Installer links by default, **migrates** an
existing regular file after backing it up and says so if it differed, and keeps `--copy`.

## 7. t740 — measured, then corrected

`target-selection.md` said the off-site tier is the N100's and **"(demo-hp has none)"**. Measured:

```
demo-hp# LC_ALL=C pvesm list felhom-pbs
  felhom-pbs:backup/ct/9201/2026-07-28T19:19:45Z  pbs-ct  6264034048  9201
  felhom-pbs:backup/ct/9201/2026-08-04T19:24:16Z  pbs-ct  4637840512  9201
ep0:/mnt/pbs-datastore/ns/  →  c11  demo-felhom  demo-hp  rewalk
```

Two snapshots in demo-hp's **own namespace**, newest two days old. **The claim is false — and it was
true when written**, going stale when F10 resolved 2026-07-23 (first snapshot 2026-07-28). Corrected
with the measurement kept beside it. It mattered because the sentence was the stated reason for
steering backup-disturbing tests at the other box.

## 8. context7 — nothing written

**No Node.js exists on DooPlex**: `npx`, `node`, `npm` all absent from `PATH`, no package installed,
no runtime directory. The manifest is `{"command": "npx", "args": ["-y", "@upstash/context7-mcp"]}`,
so `ENOENT` is literal.

The fix is one package install away, **but that is not this task's call**: DooPlex is Tier 2 and *is*
the recovery chain, and adding a language runtime to it deserves its own review. Measured surface, so
the recommendation is evidence-based: **1 direct third-party dependency in the agent, 3 in the hub, 6
in the controller** — ~8 distinct, small, stable packages. Per §6, nothing was written.

## 9. Registers

**R-229(b) CLOSED** · **R-230(b) CLOSED** · **R-230(a)** part-actioned, **bulk-correction ruling
still owed and still yours** · **R-230(c)** (spec-as-failing-test pilot) untouched · **R-231**
untouched. **S-37** added to `CONTEXT.md`.

## 10. Observations — not acted on

1. **R-129 has a second dated observation.** A key authenticated to demo-hp non-interactively today,
   2026-08-06 — that is how §7's evidence was gathered. The row is still right to be open.
2. **`~/.ssh/config` carries the same expired vacation claim** the index did ("at the VACATION site
   until ~2026-08-02"). Host state, outside every repo and outside scope — the same statement in a
   third place.
3. **The hub operator UI did not answer over its ClusterIP** this session (hung, 2-min timeout); the
   off-site evidence came from the boxes instead. The memory note describing that access path may
   need re-checking.
4. **`MEMORY.md`'s header still says "felhom-controller Project Memory"** though it indexes all four
   repos. Left for the R-230(a) ruling.
5. **`register_state` is a reusable register parser now.** Anything else needing "is R-nnn open"
   should call it — its two parsing traps are not obvious and were both found the hard way.