# REPORT — the „turn the machine off" button: spike on the N100, then built and proven (2026-10-13)

Architecture: `documentation/architecture/14-host-power-off.md` (new), `03-host-agent.md` §6, `13-threat-model.md`,
`05` staleness. Evidence: `documentation/audits/poweroff-2026-10-13/README.md` (Part A, Part B, HP). Times UTC.

## 1. Watts and the restart

| Item | Value |
|---|---|
| N100 at rest | 8.5 W mean, 7.2 W median |
| N100 at work (Immich, 200 photos) | 20.7 W mean, 24.0 W busiest minute, 25.2 W max |
| N100 off | 0.0 W (below the plug's 0.1 W step), 2 h 56 min |
| N100 plug off/on | did **not** start (BIOS not read — no monitor) |
| N100 power button | Part A: dashboard 200 in 42 s. Part B: dashboard 200 within 50 s |
| HP t740 off, plug on | 0–3.2 W |
| HP after a power cut | did not start (BIOS „After Power Loss" Off) → operator set „Previous State" → starts by itself, controller healthy 2 min 38 s after power returned |

## 2. The hub during the hand test (Part A, before the build)

| Item | Result |
|---|---|
| 18 min after power-off | hosts page ONLINE, „Last Report 18 min ago"; no event, no mail |
| Code reading | without the build: `host_stale` at 45 min, `host_down` at 90 min, and the 05:00 `expected_backup_missed` pair — as Tester 2 gets every day |

## 3. The button

| Who | What they see |
|---|---|
| Household | Beállítások → Rendszer → „A gép kikapcsolása". They type KIKAPCSOLÁS (EN: TURN OFF). Text: to start it again, press the machine's power button. The plug trick is not mentioned. Refusals in plain words: too soon after start, already done this boot, backup, update, drive work, another machine running |
| Old restart button | now „A Felhom újraindítása" / „Restart Felhom" (R-999); reboot is POST only |
| Hub | event `host_deliberate_off` at once; host page „Power: Kikapcsolva a háztartás által … riasztás szünetel eddig: +14 days"; badge KIKAPCSOLVA once the report is stale (45 min — R-1002); no stale/down/backup/offsite/restore-test/OS alarm for 14 days; OS ring-0 stall is still raised on purpose |
| Hub, machine back | `host_deliberate_off_ended` (info) with the first report; staleness back to ok; no `*_recovered`, no crash mail |
| Live proof | press 18:52:34 → 202 → 0.0 W 18:53:07 → 2 h 56 min quiet (mailbox checked; positive control: the HP crash mails arrived) → button 21:48:43 → clean boot → hub cleared 21:49:22 |

## 4. Versions and what waits on the operator

| Part | Version | Where |
|---|---|---|
| Agent | v0.155.0 + config bundle | all three boxes by signed job; sudo checked live on each |
| Hub | v0.149.0 | live (ArgoCD, hub Deployment only) |
| Controller | v0.310.0, MinAgent 0.155.0 | N100 guest 9201 only, by hand |

| Waiting on the operator | If nothing is done |
|---|---|
| Golden bake (weekly) | the waiver covers it until 2026-10-20 |
| Vouch agent 0.155.0 + bundle | a fresh install gets 0.154.0, without the power-off lines |
| Floor 0.310.0 with `min_agent` 0.155.0 | demo-hp and Tester 1 keep 0.309.0: no button there |
| N100 BIOS „After Power Loss" | unknown; a deliberately-off N100 stays off after a power cut (looks like „last state") |
| HP BIOS: „Bypass F1 on configuration changes" → Enable | a changed BIOS can stop the HP at an F1 prompt after a cut |

## 5. Claims in the spec that were wrong

| Claim | What is true |
|---|---|
| „guestpower.go guards a reboot during a vzdump" | only the watchdog path does; the new route takes the heavy-operation gate itself |
| „the plug can be switched; the spike runs without the operator" | the N100 does not start on plug power; the operator pressed the button twice |
| A0 „never cut a running machine" as written | needed a measured standby value first (`standby_w`) and a 20 s reading window; the first live `off` refused on 16 s |

Decisions taken in the session (doc 14): refuse while another guest or VM runs; `os_ring0_stalled` not held; the
unaccented KIKAPCSOLAS accepted; the golden waiver renewed to 2026-10-20 to let the hub deploy pass its gate.

## 6. Commits, register, STATUS

| Repo | Commits |
|---|---|
| felhom.eu | `6a1f715a`, `b4dcf4b3`, `750b55e9`, `50e47e29`, `a6acb0f7`, `35e546a9`, `e8c8fc30`, `81e64c6f`, `0544ae0d`, `95d293b9`, and this one |
| felhom-agent | `3403c87`, `f38b03c`, `c6d9435`, `bdf25f0`, `68a2130`, `10ca63a`, `e7d4ecd` |
| felhom-controller | `201f936`, `e24430c`, `acbbf4b` |

Register: **125 before, 127 after.** Opened R-998, R-999, R-1000, R-1001, R-1002 (5). Closed R-998, R-999 (2).
R-997 was closed by another session in between (−1).

Fixed without a row: an escrow-ceremony data race (agent); `plugswitch` read window (bench tool); my wrong
`os_ring0_stalled` sentence in the hub CHANGELOG and doc 14.

Teardown: machine — the N100 and the HP run as before, Immich removed in Part A; host — no change left on either host
apart from the released agent and bundle; hub — the hold was set and cleared by the product. The bench meters are
stopped. Home Assistant on demo-hp stays (Task 1, on purpose).

System poster: no fact in `felhom-system-poster.facts.md` changed.