# REPORT — the record, the second promise, the removal chain (2026-08-12)

Commits `f76cbf0` (Part 0), `2389544` (spec + bake evidence), `125aec1` (R-300), `890a474` (STATUS).
Controller: `68f3e12` (R-299). All gates green in both repos; **`--no-verify` used nowhere** — the
currency gate refused a push mid-session and stayed refused until the bake made it true.

## Part 0 — the record now says what is true

Re-read from the hub's own store, with a control (escrow query returns 1+1 for each demo box, 0+0 for
`drill-r50`). Confirmed: **3 hosts total, no peti row under any name**; 4 escrow rows hub-wide, all
demo; `host_deletions` id=1 `peti-felhom-86d37d` **2026-07-15 08:56:22**, `escrow_acked = 0`; last
report **2026-07-15 08:39:00 UTC**, controller 0.115.0, `offsite: {escrow_state: "pending",
snapshot_count: 0}`; local app-data repo empty; dashboard never claimed. The `PETI` row and `STATUS.md`
now state that the mitigation they named **does not exist** — and leave the parked/not-parked ruling
open, because that is the operator's and the fact does not need his opinion to be true.

**Contact since the deletion — answered without touching the machine.** No inbound row of any kind
after 2026-07-15 08:39; the only later rows are the hub's OWN alarms (`source = hub`: `node_stale`
09:09:32, `node_down` 09:39:32). No contact attempt, accepted or rejected, in the current hub pod's
logs (since 2026-08-09 17:26Z) — grep proven by **851 `demo-hp` hits against 0 for peti, 0
unauthorized**. **The window 2026-07-15 → 2026-08-09 cannot be answered from records**: a report from a
deleted host 401s and is not persisted, and those logs are gone.

## Part 1/2 — the second promise (controller v0.212.0)

`backups_remote.html` line 98 — the **always-visible** half — still ended *„…visszaállíthatók
lehetnek"*. Replaced; the two accurate halves kept.

**Why it survived, which is the useful part:** the spec called that line *"Accurate; keep"*, **and the
guard matched one INFLECTION** (`visszaállítható lehet`) that the plural does not contain. Guard
broadened to the stem `visszaállíthat`. Spec corrected in both places.

**Plant → convict → remove → pass:** planted the exact shipped plural → the stem guard **FAILED** and
quoted it back; the old singular guard **does not match that sentence at all** (`False`, shown as a
pure string fact, not a contaminated source grep); removed → 5/5 orphan-card tests pass.

Two instrument defects fixed on the way: the guard's failure message sliced rendered HTML at a **byte**
offset and cut Hungarian mid-character (now rune-safe); and a first pass at the bake's acceptance
markers returned a false `0` through shell quoting — re-run with `grep -F`, because a zero from a
broken instrument is not a measurement.

## Part 3 — the removal chain (R-300), CODE ONLY

Confirmed at source: uninstall removes the snippet and **restarts** (`:1075-1082`), leaving the unit
enabled; the byo preflight then refuses on `:53`.

**The prompt's framing needed one correction:** the installer does **not** install dnsmasq — the
**agent** does (`lanresolver.go:107`), conditionally, and `felhom-agent` is fenced this session. So
ownership is recorded at **preflight**, before anything is installed, which is the only moment it is a
fact — not a package mtime. At removal: Felhom's → stop+disable; the owner's → restart only; **no
record (every box in the field) → restart only, fail-safe, with the reason and the command logged.**
The refusal keeps its two routes and its promise, and gains the missing line naming our own leftover.

**NOT OBSERVED LIVE.** The `drill-r50` install→uninstall→install cycle was not run, so the wrong
outcome was never quoted and **no `installer-v1.27.0` tag is cut.**

## Golden 0.212.0 — baked, published, round-trip verified

`4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8`, 656 611 277 B, served bytes
re-downloaded and hashed identical. All six markers counted with `grep -F`. Token never on a command
line; leak grep 0, believable because a planted-token control grepped 1. Drill VM reverted to `virgin`.
Evidence: `documentation/tests/golden-0.212.0-2026-08-12/`.

## DROPPED — named plainly

- **The hub half of the naming (R-295)** — dropped first, exactly as the drop order allows. The four
  hub surfaces were NOT enumerated at `file:line`; that enumeration is still owed.
- **The stale-golden observation (R-297)** — dropped second. Nothing published, which is the safe state.
- **And one that was NOT droppable: R-300's live cycle.** The code shipped; the demonstration did not.
  Named here rather than shortened silently.

## Observations, not acted on

- **R-301** — the abandon countdown banner (`layout.html:143`) states the retired promise a third time
  and un-hedged. It is probably TRUE where it renders, and it renders on every page; a rebuilt box can
  have an active countdown while its store is orphaned. Not established: whether the two sentences name
  the same bytes. Left alone deliberately — this session was fenced to the orphan card.
- The orphan card now says "we cannot determine / it depends on the key / write to us" **twice** once a
  customer clicks through — reinforcement at the decision point rather than a contradiction, but worth
  an eye if the card is revisited.

## Deliberately out of scope

The CI runs that fail with no log; the twenty facts the machines report that nothing reads; the nine
grey claims; the storage page's separate empty-list cause (R-298); and proving a *retained* key can
actually open an old store — the one thing the retention fix has never been shown to do.