# REPORT — cloudflared 2026.10.3 on every box (R-1300), 2026-10-26 evening, attended

> A sibling of `REPORT.md`: the night session (`TASK-night-burndown-and-tuesday-2026-10-26.md`) owns `REPORT.md`
> tonight.

## In plain words

1. **We run 3 cloudflared, one in each box's guest** (Tester 1, demo-hp, demo-felhom). None on DooPlex. Tester4 has no
   tunnel; Tester 2 has no box.
2. **The https-origin trap does not apply.** Each tunnel sends to `https://traefik` with „No TLS Verify" on, and traefik
   shows its own self-signed certificate — not an eMudhra one.
3. **0.345.1 is on every box: 4 of 4 reporting controllers** (the three above + Tester4); none left behind.
4. **Longest tunnel gap: about 11 seconds** (demo-hp). Tester 1 about 2 s, demo-felhom about 4 s.

Decisions: the operator said yes to the build-gate exception (build from a pushed tag) and to the global floor.

## Versions, digests, CI

| What | Value |
|---|---|
| controller tag `v0.345.1` | commit `f3204024` = v0.345.0 `6bfb784` + one commit; CI job 2393 success (attempt 1) |
| controller `main` | `a1c65b3d` (same bump + `build.sh` tag path); CI job 2392 success (attempt 1) |
| controller image `0.345.1` / `:latest` | `sha256:7cfdf7e1f835628de9c7d536e0a60c06bad5bbe19e8133765cc0a6bb732dbff6` |
| cloudflared | `cloudflare/cloudflared:2026.10.3`, index `sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39` |
| MinAgent | 0.158.1 (unchanged, declared with the floor) |
| global floor | 0.345.1 at 20:08:39Z (`303 floor_set`; read back from the running hub: „Effective floor: v0.345.1 — source: DB") |
| per-box floors | set 20:05:08Z (Tester 1), 20:06:04Z (demo-hp, demo-felhom); cleared 20:39:54Z |

Tests and gates: controller gates `--fast` green on both commits; `go test ./...` green on the tag commit; the new
reconcile test and the four build-gate cases red-proved. felhom.eu gates green on push. **Methods:** box state by
`docker ps`/`docker logs` in each guest; tunnel state by the hub's Hosts page and by a public name with no app
(`cfprobe.<domain>`: 404 = tunnel up, 530 = down), probed every 0.5–1 s from DooPlex.

## Register

Rows before **213**, after **214**, opened **2** (R-1300, R-1301), closed **1** (R-1300).

## Observations

- The N100 host's clock is 14 s slow; chrony fails at every boot — **FILED: R-1301** (and `lived-in/n100.md`).
- I put a test run and a commit in one command on the detached tag clone (standing rule 1). The commit was local; the
  test result was then read on its own (green) before anything was pushed — **NOT-A-FINDING: my slip, caught before
  push, recorded here.**
- `noTLSVerify` on every tunnel route (R-510) — **NOT-A-FINDING: a leg that never leaves the guest** (cloudflared and
  traefik alone on the /29 tunnel network); now written in `01` as a recorded exception, with the rule „never turn off
  a certificate check to make an update work".
- cloudflared 2026.10.4 (today, VULN-176088: metrics debug endpoints allowlist) — **NOT-A-FINDING: our metrics bind to
  the container's own loopback**; not taken because it is under a day old and the notice names 2026.10.3.
- 0.345.1 is built with 0.345.0's Go builder; `main` moved to Go 1.27.3 tonight (R-972) — **NOT-A-FINDING: R-972 owns
  it; the next release from `main` carries it.**
- Single-sample `000` answers at 20:13:37 (both Tester 1 probes at once) and 20:17:13 (demo-hp) — **NOT-A-FINDING: a
  client-side timeout, no 530; the hub and the boxes showed the tunnel up throughout.**
- `internal/stacks` tests took 450 s under the night session's load (each R-442 remove test 26 s) — **NOT-A-FINDING: CI
  green; slow only under load.**
- Tester4's agent reads `0.167.0-night1 floor held` on the Hosts page — the night session's agent; not touched.

## What changed in documents

- `architecture/01-topology-and-trust.md` „Tunnel placement": the version, the rule, the recorded exception.
- `architecture/11-os-updates.md` C8: the new pin.
- `STATUS.md`: one line (released; `main` and Sunday's golden carry it). The golden 0.344.0 still has 2026.9.3; a new
  box moves to the floor in its first minutes. No extra bake (operator did not ask).
- System poster: none of the three needed — no fact on the poster changed (cloudflared still runs in the guest).
- Controller: `build.sh` may push from the pushed tag `v<VERSION>` (operator's yes). Controller report:
  `felhom-controller/REPORT-cloudflared-0.345.1.md`.

## For the operator

- **Nothing to do.** If you want a second look: Cloudflare dashboard → Networking → Tunnels shows each connector's
  version (CC holds no Cloudflare token).

## Teardown

Machine: the image pulled on scratch guest 9202 for the version check was removed. Host: nothing. Hub: the three
per-box floors cleared; the global floor stays at 0.345.1 by design. Clones `felhom-controller-sec`,
`felhom-controller-mainsec` and `felhom.eu-cfsec` on DooPlex are my work copies (all pushed); removed at the end.