# Teardown — OWED, not done (walk5, the fifth walk, 2026-08-07)

**Deliberately not performed in this session, per §10: the machine is the evidence until the verdict
is written.** The verdict is written (`journal.md`); the venue still stands so it can be re-read if
anything in this report is questioned. **Predecessor ledgers:** `teardown-finalwalk-2026-08-07.md`,
`teardown-2026-08-06.md`.

## The enumeration, matched on IDENTITY — never on size

Size is not a key here: on 2026-08-06 an item that measured exactly the expected size turned out to be
a working store.

| Layer | Item | Identified by |
|---|---|---|
| **machine** | `demo-hp` VM **325** `walk5-appliance` — 4 disks (efidisk + 200 G + 50 G + 50 G), **17 G actual** on `/mnt/nvme-1tb/images/325` | `qm config 325` → `name: walk5-appliance` |
| **hub** | customer **`walk5`**, host **`walk5-4bada5`** | `GET /configs/walk5/delete` preview + a FULL-SCHEMA census |
| **off-site** | Storage Box sub-account **285351**, user `u629488-sub4`, home naming the customer | Hetzner API, matched on the home directory |
| **off-site** | `ep0` PBS namespace **`walk5`** in datastore `felhom-offsite` | `ls /mnt/pbs-datastore/ns` — **the live store is `/mnt/pbs-datastore`; `/srv/pbs-felhom` is STALE and reading it gives a wrong answer in both directions** |
| **network** | WireGuard peer **10.77.0.5** | `wg_peers.host_id = walk5-4bada5`; verify removal on ep0's **live `wg show`**, not only in the hub DB |
| **DooPlex** | `~/.config/walk5/` — `dashboard_pw.txt`, `root_pw.txt`, `root_pw_rotated.txt`, `breakglass.json`, `retrieval_passphrase.txt`, `claim_code.txt` (all `0600`) | **`R_walk5.txt` is already `shred -u`'d, with a planted-copy control proving the sweep works** |
| **DooPlex** | the `walk5` block in `~/.ssh/config`, and the appliance's host key in `~/.ssh/known_hosts` | |

## `pvesm status` BEFORE (2026-08-07, venue standing)

```
c11-scratch    dir  active   983379700 KiB total   23680040 KiB used   909673048 KiB avail   2.41%
```

Take it again after; the delta should be ≈ 17 G. (`c11-scratch` and `felhom-backup` are two `dir`
entries over the **same** path `/mnt/nvme-1tb`, so they move together — do not read that as double
counting.)

## The gate that shapes the operation

**The cascade REFUSES to delete a live host** — there is no hub decommission endpoint; the word appears
only in the refusal. So VM 325 must be **stopped first** (guarded on `qm config 325` reading
`name: walk5-appliance` — `demo-hp` also carries a guest 9201, and the appliance carries its own) and
the hub allowed to age it past its `stale_threshold` (**30 m**, read from the deployed `hub-config`,
not assumed). Poll `GET /hosts/walk5-4bada5/delete-impact` for `deletable` — and **treat an empty
response as retry, not as success**.

Then `POST /configs/walk5/delete` with all six gates: `ack_hosts=1 ack_reset=1 ack_purge=1
confirm_id=walk5 expect_hosts=1`.

## What will NOT be gone, and must be checked rather than assumed — R-244

A full-schema census after the cascade will return rows, not zero. Four sources are **deliberate**
(`events`, `notification_log`, `host_deletions`, `customer_resets` — *"provenance/events are NEVER
wiped"*). The fifth is the open gap: **`app_log_issues`**, which the residue purge does not touch.

**Measured 2026-08-08 across the whole table:** 1309 rows, of which **71 reference a torn-down venue**
(`finalwalk`, `c11`, `rewalk`, `part4`) — **44 orphans** (safely deletable) and **27 shared with a live
customer** (`demo-felhom`, `peti-felhom`, …) which must be **de-referenced, never deleted**. **This
walk will add to that count.** Do not attempt a `DELETE … WHERE customer LIKE` — it would destroy a
live customer's issue history. R-244 carries the proposed shape.

**A per-table absence query is not a census.** The verification is a full-schema sweep, and that is
what found this.

## Positive controls the teardown must keep (each must SURVIVE)

- `qm list` still shows VM **300 `drill-r50`** — the protected drift fixture.
- Guest **9201 on `demo-hp` itself** still running (the host was never the target).
- Storage Box sub-accounts **`u629488-sub1/2/3`** (demo-felhom, peti-felhom, demo-hp) still present.
- `ep0` namespaces **`demo-felhom`** and **`demo-hp`** still present.
- WireGuard peers **10.77.0.2/.3/.4/.250** still on `wg0`.
- Hub rows for `demo-felhom`, `demo-hp`, `peti-felhom`, `david` untouched.

## One extra item this walk adds

**The `walk5` retrieval passphrase is compromised** — it reached a session transcript from the customer
page's `data-secret` attribute (**R-249**). It dies with this customer's deletion, which is the reason
the teardown should not be left indefinitely. No other walk5 secret left its `0600` file.