# REPORT — 2026-10-26 afternoon: R-1295 fixed at the cause, R-1294 read, R-1285 / R-1292, R-1291 designed, releases

**Plain words first.**
1. **R-1295 cause:** PBS's proxy keeps permissions in a 5-second cache, and a new access key's grant does not clear it.
   When other boxes are talking to ep0 at that moment, the new key is refused for a few seconds, and the old script
   gave up after one quick retry. **Fixed at the cause on ep0** (the script now waits up to 15 s) **and in the hub**
   (retries, and **a failure now mails you** — yes). Live: a fresh Tester4 install set up its whole-box off-site copy.
2. **Tester 2's reinstall is safe** from this failure: the fix is on ep0 and in the hub, and if anything still fails you
   get a mail that says what to do.
3. **R-1294:** demo-hp's clean-up plan is **honest** (old copies only, every app keeps its copies), but it can never get
   back under the safety cap by itself. **Your pick D54:** a one-time window with a raised cap (my pick).
4. **R-1292 fixed and released; R-1285 fixed, not released** (its live proof needs a box coming from 0.164.0).
5. **Released:** hub 0.172.0, controller 0.345.0 (every live box), felhom-tenantsync v1.4.0 on ep0. Not released: agent.

Safest readings taken alone (said first): R-1292's live test ran on Tester 1, not 9202 (9202 has no tested line, so the
rule never acts there); R-1285 has no live test today (a box coming from 0.164.0 needs a signed downgrade chain); the
fresh-install proof ran after the hub rc deploy, both on your yes.

## Each fix, before → after

- **R-1295 (hub v0.172.0 + tenantsync v1.4.0):** a new access key refused by the PBS cache → rolled back, no off-site copy,
  only a log line → the script waits up to 15 s (the admin key too); the hub retries 3×, 7 s apart; a final failure mails
  you („… could not be set up — save the customer config to retry"). Measured 11/30 → 0/30 under load; red-proved.
- **R-1292 (controller v0.345.0):** with alternative speed on, the 50 % rule changed the alternative limit or gave up →
  it sets only the normal limit. Live on Tester 1; red-proved.
- **R-1285 (agent `b1bc63d`, not released):** the old agent installed the bundle, so the new policy pass waited a release
  → the new agent runs it once after its update commits. Tested in the real order; red-proved.
- **R-1294 (read only):** no change; D54.
- **R-1291 (design only):** `08` §10; D53.

## Versions, CI by commit

| What | Version / digest | Commit → CI |
|---|---|---|
| hub | 0.172.0, `sha256:7c8d129a…` (rc.1 `f6cb8f57…` for the proof) | `722013da` 2362 ✓, `232f42d2` 2366 ✓; manifests `ee38dee2` 2364 ✓ |
| ep0 | felhom-tenantsync v1.4.0, sha256 `751b3c26…` (v1.3.0 kept beside it) | `722013da` |
| controller | 0.345.0, `sha256:2dc2c0a5…` (rc.1 `1378e4e2…`) | `2619191` 2365 ✓, `6bfb784` 2368 ✓ |
| agent | — (not released) | `b1bc63d` 2363 ✓ |

Global floor 0.345.0 at 13:27:04Z (MinAgent 0.158.1), read back from the hub DB with its WAL and the hub log; the
per-box floors cleared. Every live box reports 0.345.0.

## Rows

Before **212**, after **212**; opened **2** (R-1296 the hub drops ep0's refusal reason; R-1297 CI speed — your „both"),
closed **2** (R-1295, R-1292). R-1285 VERIFY; R-1294 and R-1291 wait for D54 / D53.

## Observations

- FILED: R-1296 — PBS's real refusal reason never reaches the hub log (found only by reading ep0's journal).
- FILED: R-1297 — felhom.eu CI ~13 min, one runner; ruled „both".
- NOT-A-FINDING: the `backup_tier_skipped` 6 min after the fresh install — before the box applied its descriptor; the hub
  held the mail by design (box enrolled < 1 h); 15 min later the box took its key and made its first copy.
- NOT-A-FINDING: 9202's FileBrowser WARN on the move from 0.343.0 (twice now) — healed in 3 s, log only, every live box is
  past that move.
- NOT-A-FINDING: R-1292 run 1 „FAIL" — my probe's quoting broke its reads (kept as evidence); run 2 with a fail-fast
  instrument check passed.
- My mistake, fixed: removing Tester 1's test record the first time raced a path unit that restarted the controller; the
  second time I stopped the path unit first.

## Teardown

- **Machines:** VM 9373 (the R-1295 fresh install) and LXC 9374 (the throwaway PBS) destroyed with their disks; Tester 1's
  two throwaway qBittorrents removed through the product, its rule record removed (it had none before), helper files
  gone; 9202 back on 0.343.0 exactly as found (FileBrowser on `traefik-public`, no `felhom-files` network, the rc image
  deleted — 9202 is not bound to the hub, so no floor moves it). Nothing of mine runs on demo-hp into Tuesday 10:00.
- **Product uninstall of VM 9373: not run** — tried root SSH with the original password (refused: day-0 replaced it with
  the vaulted one) and DooPlex's key (never installed); the vault read is yours. The VM was destroyed instead.
- **Hub:** delete host `Tester4-b5ec39` (STATUS). Its first whole-guest copy stays in Tester4's ep0 namespace (a host
  delete keeps the tenancy, by design).
- **ep0:** only the script swap you approved; v1.3.0 kept as `/usr/local/bin/felhom-tenantsync.v1.3.0`.
- **Secrets:** evidence scanned (the sec values + the bind token and pairing code): 0 hits.