admin a6acb0f762 Hub v0.149.0: clamp a future deliberate-off time; hold a customer only when all its hosts are off (R-998) ...

Security review of 50e47e29: requested_at is the box's clock — a future value is cut to the hub's
now; CustomerDeliberatelyOff now needs every host of the customer held (one machine of two no
longer silences the other), and fails closed on a read error or no host. Both red-proofed.

2026-10-13 19:52:12 +02:00

..

testdata

hub v0.111.0: notice a deletion within a day (R-431); correct R-429; re-scope R-95

2026-09-01 14:25:24 +02:00

box_reachability_test.go

hub v0.106.0: report loss of visibility into the off-site stores (R-339)

2026-08-18 19:27:33 +02:00

controller_supervisor_test.go

hub v0.117.0: the status follows the configured threshold; slow crash loop and interrupted restore events

2026-09-17 10:20:32 +02:00

controller_supervisor.go

hub v0.117.0: the status follows the configured threshold; slow crash loop and interrupted restore events

2026-09-17 10:20:32 +02:00

deadline_anchor_test.go

hub v0.77.0 — R-85 Part 2: a restore-test result becomes a SIGNAL

2026-07-26 21:08:02 +02:00

deadline_test.go

hub v0.76.0 — R-82 Slice C: tier-aware backup thresholds

2026-07-26 16:58:38 +02:00

deadline_tiers_test.go

hub v0.76.0 — R-82 Slice C: tier-aware backup thresholds

2026-07-26 16:58:38 +02:00

deadline_tiers.go

hub v0.76.0 — R-82 Slice C: tier-aware backup thresholds

2026-07-26 16:58:38 +02:00

deadline_unbound_test.go

R-195: a customer with no machine ever bound does not alarm (hub v0.92.0) + R-193/R-192 spike

2026-08-04 11:04:39 +02:00

deadline.go

Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998)

2026-10-13 19:47:02 +02:00

deliberate_off_test.go

Hub v0.149.0: clamp a future deliberate-off time; hold a customer only when all its hosts are off (R-998)

2026-10-13 19:52:12 +02:00

golden_vouch_test.go

hub v0.147.0 (code): the operator's answers S4, S6, S10, S29, S30, S32, S33

2026-10-12 14:54:14 +02:00

golden_vouch.go

hub v0.147.0 (code): the operator's answers S4, S6, S10, S29, S30, S32, S33

2026-10-12 14:54:14 +02:00

host_capability_test.go

hub: F2 — alert on host already degraded/stale at (re)start (seed only healthy) v0.21.0

2026-06-29 21:46:25 +02:00

host_capability.go

hub: F2 — alert on host already degraded/stale at (re)start (seed only healthy) v0.21.0

2026-06-29 21:46:25 +02:00

host_disk_test.go

hub v0.24.0: dispatcher routes critical severity (+ nil-prefs crash guard)

2026-06-30 14:18:45 +02:00

host_disk.go

hub v0.24.0: dispatcher routes critical severity (+ nil-prefs crash guard)

2026-06-30 14:18:45 +02:00

host_leaf_test.go

hub: HostLeafChecker — proactive agent re-key detection (host_leaf_changed) v0.22.0

2026-06-29 23:15:22 +02:00

host_leaf.go

hub: HostLeafChecker — proactive agent re-key detection (host_leaf_changed) v0.22.0

2026-06-29 23:15:22 +02:00

host_mgmtplane_test.go

fix(hub): mgmt_plane_healed alerts on the FIRST auto-heal (TASK G1) — v0.34.1

2026-07-05 19:12:50 +02:00

host_mgmtplane.go

fix(hub): mgmt_plane_healed alerts on the FIRST auto-heal (TASK G1) — v0.34.1

2026-07-05 19:12:50 +02:00

host_oob_operatorkey_test.go

hub v0.99.0 — the hub can see whether the operator can get in (R-260); G-1 gate closes, R-247 closes

2026-08-08 08:47:02 +02:00

host_oob_test.go

hub v0.99.0 — the hub can see whether the operator can get in (R-260); G-1 gate closes, R-247 closes

2026-08-08 08:47:02 +02:00

host_oob.go

hub v0.99.0 — the hub can see whether the operator can get in (R-260); G-1 gate closes, R-247 closes

2026-08-08 08:47:02 +02:00

host_staleness_test.go

hub: F2 — alert on host already degraded/stale at (re)start (seed only healthy) v0.21.0

2026-06-29 21:46:25 +02:00

host_staleness.go

Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998)

2026-10-13 19:47:02 +02:00

offsite_box_test.go

hub v0.106.0: report loss of visibility into the off-site stores (R-339)

2026-08-18 19:27:33 +02:00

offsite_box.go

hub v0.106.0: report loss of visibility into the off-site stores (R-339)

2026-08-18 19:27:33 +02:00

offsite_declared_test.go

R-204 item 4 (hub half): the hub answers a rebuilt box's request (hub v0.96.0)

2026-08-05 10:48:18 +02:00

offsite_delivery_honesty_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

offsite_delivery_test.go

hub v0.72.0 — R-70 + R-71c: offsite delivery-state detector, card, stuck event, R-39(a)-guarded self-heal restage

2026-07-23 12:59:04 +02:00

offsite_delivery.go

R-204 item 4 (hub half): the hub answers a rebuilt box's request (hub v0.96.0)

2026-08-05 10:48:18 +02:00

offsite_escrow_pending_test.go

R-243: offsite_escrow_pending — an operator alarm when off-site is on and the escrow never done (7 days); 09 decisions 177-179; 07 R-899 note

2026-10-08 08:00:08 +02:00

offsite_escrow_pending.go

R-243: offsite_escrow_pending — an operator alarm when off-site is on and the escrow never done (7 days); 09 decisions 177-179; 07 R-899 note

2026-10-08 08:00:08 +02:00

offsite_neverran_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

offsite_r100_test.go

R-100: offsite staleness counts from the last SUCCESS (hub v0.80.0)

2026-07-28 13:17:04 +02:00

offsite_r431_test.go

hub: one lost off-site snapshot outside a clean-up window is an error (R-435, D7)

2026-10-08 15:17:05 +02:00

offsite_r434_test.go

hub v0.111.1: the alarm stops promising a rescue that does not exist, and the arc is closed for beta

2026-09-01 18:34:52 +02:00

offsite_test.go

hub v0.41.0: OffsiteChecker (fill 90/95 + staleness >48h) + operator freeze lever (SLICE 4)

2026-07-09 23:57:12 +02:00

offsite.go

Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998)

2026-10-13 19:47:02 +02:00

pbsdr_box_test.go

hub v0.106.0: report loss of visibility into the off-site stores (R-339)

2026-08-18 19:27:33 +02:00

pbsdr_box.go

hub v0.106.0: report loss of visibility into the off-site stores (R-339)

2026-08-18 19:27:33 +02:00

r435_pinned_drop_test.go

hub R-435: each clean-up window explains one fall only; a window stuck open past its deadline explains nothing (security review)

2026-10-08 15:17:05 +02:00

r672_thinpool_test.go

hub v0.124.0: a thin pool is critical at 90% (data or metadata), one alarm per pool per 6 h (R-672)

2026-09-24 16:26:17 +02:00

r723_new_box_test.go

hub v0.126.0: fresh connect link from the old one (R-719); day-one mails (R-723); bind-page wording (R-725); volunteer guide current (R-722); ep0 cleanup and release evidence

2026-09-30 10:35:18 +02:00

r872_down_box_test.go

burn-down night watches: R-872 05:00 run worked as designed but silently (Tester 2 34.8 h old) — early returns now log why, check re-dated 2026-10-07; R-887: 2 lost jobs, both re-run green; session report

2026-10-06 05:05:42 +02:00

restoretest_test.go

hub v0.91.1 — observation may only WIDEN a tier's window, never tighten it (R-86)

2026-08-03 15:16:59 +02:00

restoretest.go

Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998)

2026-10-13 19:47:02 +02:00

staleness_disabled_test.go

hub v0.105.0: the third name, a machine told to be quiet, and a guard for the hub's own words

2026-08-13 15:50:32 +02:00

staleness.go

Hub v0.149.0: a box the household switched off is not an outage for 14 days (R-998)

2026-10-13 19:47:02 +02:00

storage_fill_test.go

hub v0.25.0: per-storage worst-fill alerting (StorageFillChecker)

2026-06-30 19:01:20 +02:00

storage_fill.go

hub v0.124.0: a thin pool is critical at 90% (data or metadata), one alarm per pool per 6 h (R-672)

2026-09-24 16:26:17 +02:00