# REPORT — attended release run 2026-10-24: the hub's tokens locked, the hub out of the open backup, the iperf3 line test, the watch released

Brief: „the hub's tokens locked, the hub out of the open backup, an iperf3 line test via ep0, then the upload watch
released" (operator rulings 07:22 / 07:26, `CONTEXT.md`). Read first: `05` §16.2, `06` §4.5 / §5, `07`, `08` §9, the
spike `audits/SPIKE-upload-watch-2026-10-23.md`, the felhom-build-deploy skill. Evidence: `audits/line-test-2026-10-24/`.

## Five lines

1. **Hub tokens:** sealed in hub 0.168.0 and still working (demo-hp is served the same tunnel and API tokens it runs; the
   template fetch works; the next ep0 copy holds 0 of 8 token values). The live file keeps old bytes in free space — your
   call: accepted, written down, with the rule „copy hub.db only with VACUUM INTO".
2. **The hub is out of the open backup:** the hub volume reads `default: disabled`; the folder holds no copy of it (your
   two deletions worked; nothing else is left). Tonight's job is the last proof (dated check 2026-10-25).
3. **The line test:** demo-hp measured **94.4 Mbit/s** (Tester 1 94.3, demo-felhom 92.6) — the night backup said „at
   least 10".
4. **Live where:** hub 0.169.0 and controller 0.342.0 run on all three boxes (the global floor); agent 0.164.0 on all
   three (vouched); demo-felhom's qBittorrent is limited to 46 Mbit/s. Only these three boxes report to the hub.
5. **You still do:** nothing for this run. Two rows wait for a design (below).

## What I asked you, and what you said

- Deploy hub 0.168.0 → yes. Deploy hub 0.169.0 → yes. Global floor 0.342.0 → yes. Agent vouch → done.
- The live file's old bytes → accept and write down (my first estimate of „2 minutes" was wrong; the disk writes ~1.3
  MB/s, so a clean-up means an 8–20 minute hub stop).
- No host has the iperf3 program → the agent speaks iperf3 itself (nothing installed on hosts).

## Versions, digests, CI (by commit)

| Repo | Commit | What | CI |
|---|---|---|---|
| felhom.eu | `00031150` | hub 0.168.0 manifest + rulings | 2275 success |
| felhom.eu | `3363ffa8` | D40: the PVC label | 2276 success |
| felhom-agent | `f7e1dcb` | the line test | 2277 success |
| felhom-controller | `ed1011b` | the tested line in the watch | 2278 success |
| felhom.eu | `1a788f33` | docs, register, ep0 unit, hub `line_test` model | 2279 success |
| felhom-controller | `42cda07` | the start-line wording | 2283 success |
| felhom-agent | `08ca678` | CHANGELOG released, REPORT | (docs) |
| felhom.eu | `01bf4e83` | hub 0.169.0 manifest | (see the final push) |
| felhom-controller | `bddc477` | CHANGELOG released, REPORT | (docs) |

- **Hub 0.168.0** `sha256:3bfdecaa…` (from `5277d859`), deployed 05:39Z. **Hub 0.169.0** `sha256:fb9b2489…` (from
  `1a788f33`), deployed 07:51Z; 30-minute watch: only info events, 0 errors.
- **Agent 0.164.0**: binary `1b803d8b70f8afbe1546f6989f35b6b0e29c9ed63f6acb3843d3c04ef0d24b2b`, bundle
  `1d7b54d39d0c1aff682ba0c0a7f91aea0f9407a10d2f5a8bbfdc858d32c13341`, tag `v0.164.0`; signed `agent_update` to the three
  boxes, self-check 76/76; vouched (hub page + `Artifact manifest set` line).
- **Controller 0.342.0** `sha256:d002d3b7…` (from `42cda07`); rc.2 on 9202; per-box floors → healthy on all three, box
  checks and https-only green; global floor 08:29:19Z, MinAgent 0.158.1, read back on the hub log and page.
- **ep0:** `felhom-iperf3.service` (iperf3 3.18-2+deb13u2, already installed since 2026-07-03), one nftables line;
  no answer on the internet (`:22` as the control), an answer in the tunnel. CVEs: four fixed in this build; two open
  „minor" server DoS issues bounded by tunnel-only, TCP-only and systemd caps (`scripts/ep0-iperf3/README.md`).

## Rows

**Before 194, after 191; opened 2 (R-1249, R-1250), closed 5 (R-975, R-1244, R-1245, R-1246, R-1247).** R-1243 →
VERIFY (dated check 2026-10-25); R-1241 keeps only the homelab half.

## Observations

- The start-up VACUUM after a legacy seal cannot finish on the Longhorn disk; its comment said 2.8 s — FILED: R-1249.
- A qBittorrent that seeds all day keeps the uplink busy, so that box is never tested and gets no limit — FILED: R-1250.
- The live hub file's old token bytes — NOT-A-FINDING: accepted by the operator 2026-10-24 (`05` §16.2), every copy that
  leaves is clean.
- Two pre-deploy hub snapshots in `/data/snapshots` held plain tokens — NOT-A-FINDING: they roll off (one already pruned
  at 06:06Z; the other at the 12:00Z snapshot); same volume, same reader as above.
- The cross-repo wire gate refused the agent's new `line_test` field until the hub modelled it — fixed in the session
  (hub 0.169.0 `sysfacts.LineTest`, the System page cell).
- My first ArgoCD sync used a wrong commit id — NOT-A-FINDING: it failed to fetch and changed nothing; redone.
- 9202 has no agent local API, so its controller cannot read a line test — NOT-A-FINDING: by design (scratch guest);
  the qBittorrent proof moved to demo-felhom, where the product path runs.
- demo-hp's first watch minute could not resolve `plex` — NOT-A-FINDING: the known start-up race (2026-10-23).
- The family's line on demo-felhom's qBittorrent page was not seen live — NOT-A-FINDING: the household's password is not
  CC's; the render is pinned by a test, and the text with the live value is in the evidence.
- Old rc controller images (other sessions) sit on 9202 — NOT-A-FINDING: a scratch guest; mine (rc.2) is removed.
- The hub's database is 530 MB, mostly report history (`host_reports` 305 MB, `reports` 128 MB) — NOT-A-FINDING here:
  it is why a VACUUM is slow, recorded in R-1249.

## Teardown, three layers

- **Machine:** 9202 — the throwaway qBittorrent removed through the product (0 containers, 0 volumes), back on the
  0.342.0 release, my rc.2 image removed. demo-hp's host — the probe binary deleted, nothing running.
- **Host / DooPlex:** the database copies I restored for the checks shredded; the 9202 password copy, the signed job
  envelopes and the release clone shredded / removed. ep0 — the one planned change stays (`felhom-iperf3`); the backup
  of the firewall file is `/etc/nftables.conf.bak-20261024-iperf3`.
- **Hub:** the three per-box floors cleared; the global floor 0.342.0 stays (the release).

## Instruction files, poster

No instruction file edited. System poster: a text-only change (ep0 also runs the tunnel-only line-test server) — the
facts file and the matching poster text edited in the same commit.