# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## RUNBOOK — offsite provisioning LIVE end-to-end (supervised) — 2026-07-09 — **PASS**

**Full record:** `documentation/audits/VALIDATION-offsite-provisioning-e2e-2026-07-09.md`.
**Shipped this run (felhom.eu):** manifest wiring `0a65f2b` (HETZNER_* env from Secret/storagebox),
**hub v0.38.1** `7c70c54` + bump `6d5b3c1` (LIVE: Synced/Healthy, `Offsite provisioning enabled
(pool_box=611714, location=fsn1)`). Pairs with controller v0.106.1 (that repo's REPORT).

The first live run of the SLICE 1+2 loop on `demo-felhom` against the new dedicated-project pool box:
hub UI save → sub-account provisioned (269008, `u629488-sub1`) → non-secret descriptor + one-time password →
controller config-refresh → apply-bridge (verify-pin, consume-once, pinned `ssh-copy-id`, offbox configured,
`EscrowState=pending`) → fork-4 run-gate refusal proven → escrow confirm (Option A — the repo password was
already escrowed under Viktor's R) → **first run: restic repo initialized, 2 apps, 2 snapshots on the new box,
key-only** (independently verified by SFTP-listing the repo with the bridge-installed key + pinned host key).

**Live bugs found + fixed mid-run:**
- **F1 (hub v0.38.1):** a re-click canceled `r.Context()` between `CreateSubaccount` and
  `SaveOneTimeSecret` → sub-account stranded with its password lost. `applyOffsite` now provisions on
  `context.WithoutCancel` + 3-min timeout. Test `TestApplyOffsite_ClientDisconnectMidProvision` + red-proof
  (raw-ctx shape reproduces the exact live error).
- **F3 (controller v0.106.1):** `ssh-copy-id -s` mktemp's under `~/.ssh`, absent from the container image —
  install died locally AFTER consuming the password (fail-safe held; password never transmitted).

**Open findings:** F2 fresh-subaccount DNS lag → first-save scan 502 (retry-with-backoff wanted);
F4 no hub password-reset path (recovery = delete sub-account + re-save); F5 no save spinner (the re-click
bait); F6 Hetzner box-level 423 action lock on concurrent saves (fail-closed, correct).

**Standing state:** demo offsite now targets the NEW box, `escrowed`, un-paused; the old-box offsite
(`u629193-sub1`) is a frozen archive until a NEW-box restore round-trip is verified.
**NEXT:** SLICE 3 (escrow auto-confirm), SLICE 4 (soft-quota), F2/F4/F5, Peti/pilot onboarding runbook.