admin
ca543b8f69
gates / gates (push) Successful in 15s
Eight claims re-checked against the drill and the v0.218.0 fixes; three moved, all downward.
backup.offsite walked -> partial. "18 snapshots, daily, unbroken" was true on
2026-08-09 and false by 2026-08-21: the next snapshot after that date
was put there by hand, twelve days later. The rebuild lost the target
and the per-app switches came back off, so a run reported "backup OK:
0 app(s) backed up".
fail.wiped-reinstalled.data walked -> partial. A real reinstall orphans BOTH off-premises tiers:
restic silently for 12 days (R-193), and the PBS archives from before
the reinstall cannot be opened by the rebuilt box at all (R-366).
backup.fill-warning walked -> partial. The warning fires correctly, but the watcher runs
once a day, so a filesystem that fills at 03:31 goes unannounced for
~24 h. Watched silent while a volume sat at 99%.
Five re-checked and held: backup.tier1 and recover.byte-identical carry the R-355/R-354 story and
their fixes; backup.restore-proof stays grey for a sharper reason (orphaned archives, not an
untested tier); backup.sikeres gains two fresh instances; fail.customer-self-restore records that
R-356 now blocks 40 of 53 apps regardless of who is driving.
render_stands.py: the header's commit shas were hardcoded, so the page cited the August 9th commits
while the YAML said otherwise - the stale-build-product failure the renderer exists to prevent. They
are parsed now. The count beside them said "15 status(es) moved in that pass" when 15 was every
recorded move ever; it now separates the two numbers.
check_stands passes, and was itself proven able to convict first: a claim marked `missing` flipped to
`walked` in a scratch copy fired rule 5 by name (use.dlna), and the real file still passes.
768 lines
34 KiB
YAML
768 lines
34 KiB
YAML
# where-felhom-stands.yaml — the data behind documentation/architecture/where-felhom-stands.html
|
|
#
|
|
# THIS IS A VIEW, NEVER A SOURCE. Every entry cites the capability-map row, register row or
|
|
# evidence document it derives from; an entry with no source is a defect, not a claim.
|
|
# A status may not be RAISED here — if the evidence supports a stronger status than the
|
|
# capability map records, the MAP changes first and this file follows it.
|
|
# Regenerate the page after any status move: python3 scripts/render_stands.py
|
|
#
|
|
# YAML rather than JSON, deliberately: statuses move one line at a time and a YAML diff shows
|
|
# which claim moved. A JSON re-dump reflows and shows the whole file.
|
|
#
|
|
# verdict vocabulary: confirmed | downgraded | upgraded | contested | needs-hardware
|
|
# depth: source-read (opened live source or evidence) | register+map (checked against the
|
|
# register and capability map only) | needs-hardware (cannot be settled off-box)
|
|
verified_on: 2026-08-22
|
|
verified_against:
|
|
felhom-agent: 40d857b527
|
|
felhom-controller: 2da259af38
|
|
hub: 877fcd2a38
|
|
claims:
|
|
- id: install.iso-selfregister
|
|
band: journey
|
|
stage: 1
|
|
title: "A blank machine installs itself from our own boot image and registers itself as unclaimed — proven on two different boards"
|
|
status: walked
|
|
note: "Two boards: N100 2026-07-18, HP t740 2026-07-21."
|
|
sources:
|
|
- capability-map: "Bare-metal Felhom ISO (blank hardware → zero-touch auto-install → first-boot host-install)"
|
|
- evidence: "tests/VALIDATION-n100-rehearsal-2026-07-18.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: install.installer-by-tag
|
|
band: journey
|
|
stage: 1
|
|
title: "The installer is published rather than pushed: rolling it back is one act"
|
|
status: built
|
|
note: "Gate 6 of hostinstall_gates asserts the manifest names an installer-v tag; ran green tonight."
|
|
sources:
|
|
- capability-map: "The installer is PUBLISHED, not pushed"
|
|
- register: "R-110"
|
|
changed:
|
|
from: walked
|
|
reason: "gate 6 asserts the manifest names an installer tag, but no walk of a rollback is on file"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: downgraded
|
|
depth: source-read
|
|
- id: install.byo
|
|
band: journey
|
|
stage: 1
|
|
title: "Installing onto hardware the customer already owns — the path exists, the first real one has not happened"
|
|
status: partial
|
|
note: "UPGRADED: a real --mode byo install completed on demo-hp 2026-08-09 (Day-0 provision SUCCESS, 3m49s). Still not a customer's own hardware, so not 'walked' — but 'has not happened' is now false."
|
|
sources:
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: upgraded
|
|
depth: source-read
|
|
- id: install.nic-selfheal
|
|
band: journey
|
|
stage: 1
|
|
title: "A machine that ends up on the wrong network port explains itself on screen and finds its way back — proven in a virtual drill, never on metal"
|
|
status: partial
|
|
note: "Map says the same: PROVEN-LIVE (nested drill — nested != metal)."
|
|
sources:
|
|
- capability-map: "Box survives a wrong-NIC install"
|
|
- evidence: "audits/SPIKE-firstboot-nic-sweep-2026-07-22.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: install.reinstall-refuses
|
|
band: journey
|
|
stage: 1
|
|
title: "Reinstalling a machine we previously installed refuses, because our own removal leaves a name service holding the port our own installer checks"
|
|
status: partial
|
|
note: "Warning card. Confirmed live 2026-08-09; dnsmasq restarted by --uninstall seizes :53."
|
|
sources:
|
|
- register: "R-272"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: claim.one-time-code
|
|
band: journey
|
|
stage: 2
|
|
title: "An emailed one-time code; the customer sets their own password and the operator never sees it"
|
|
status: walked
|
|
note: "Exercised live 2026-08-09: reset code accepted at /claim, 302 + session."
|
|
sources:
|
|
- capability-map: "Customer claim: one-time emailed code → customer sets own password"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: claim.selfbind
|
|
band: journey
|
|
stage: 2
|
|
title: "The customer can bind their own machine from a link, with no operator present — done once, for real"
|
|
status: walked
|
|
note: "attempts=0, locked=0, source customer_selfbind, 2026-07-18."
|
|
sources:
|
|
- capability-map: "Customer binds their own appliance (self-service)"
|
|
- evidence: "tests/VALIDATION-n100-rehearsal-2026-07-18.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: claim.never-by-non-operator
|
|
band: journey
|
|
stage: 2
|
|
title: "It has never been done by a person who is not the operator"
|
|
status: partial
|
|
note: "Map records MISSING (as evidence). Still true after 2026-08-09."
|
|
sources:
|
|
- capability-map: "A customer (not the operator) performs a restore via UI alone"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: claim.code-naming
|
|
band: journey
|
|
stage: 2
|
|
title: "The same word is used for two different secrets across three surfaces; the email points at a page a rebuilt machine does not show"
|
|
status: partial
|
|
note: "Warning card. Cost a real code on 2026-08-09."
|
|
sources:
|
|
- register: "R-282"
|
|
- register: "R-283"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: use.catalog
|
|
band: journey
|
|
stage: 3
|
|
title: "Apps installed from a catalog of about 52, with a memory guard and health-aware progress"
|
|
status: walked
|
|
note: "53 templates listed on the rebuilt box 2026-08-09; deploy driven live."
|
|
sources:
|
|
- capability-map: "Deploy an app from the catalog (env config, memory guard, health-aware progress)"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: use.lifecycle
|
|
band: journey
|
|
stage: 3
|
|
title: "Start, stop, restart, update, logs, remove — and the parts that must not be stopped cannot be"
|
|
status: built
|
|
sources:
|
|
- capability-map: "App lifecycle: start/stop/restart/update/logs/remove/redeploy"
|
|
- register: "R-108"
|
|
changed:
|
|
from: walked
|
|
reason: "no walk document cited by the map row or anywhere else"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: downgraded
|
|
depth: register+map
|
|
- id: use.tunnel
|
|
band: journey
|
|
stage: 3
|
|
title: "Reachable from anywhere through a tunnel, per-app addresses"
|
|
status: walked
|
|
note: "Verified tonight: the rebuilt box answered on its public URL from outside."
|
|
sources:
|
|
- capability-map: "Remote access via Cloudflare Tunnel + Traefik (per-app subdomains)"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: use.lan-fallback
|
|
band: journey
|
|
stage: 3
|
|
title: "Reachable on the home network when the internet is down"
|
|
status: built
|
|
note: "Only an observation on a running box with WAN pulled could settle it. Boxes are off."
|
|
sources:
|
|
- capability-map: "LAN access when internet is down (lan_resolver)"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: needs-hardware
|
|
depth: needs-hardware
|
|
- id: use.files
|
|
band: journey
|
|
stage: 3
|
|
title: "Phone photos, documents with text recognition, files from Windows Explorer or a Mac"
|
|
status: walked
|
|
sources:
|
|
- capability-map: "Files from Windows Explorer / Mac Finder (SMB server)"
|
|
- evidence: "audits/SPIKE-lan-discovery-2026-07-18.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: use.launcher
|
|
band: journey
|
|
stage: 3
|
|
title: "A one-tap launcher, and a read-only guest link for visitors"
|
|
status: built
|
|
sources:
|
|
- capability-map: "Indítópult (app launcher) — one-tap grid of the household's openable apps"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: use.dlna
|
|
band: journey
|
|
stage: 3
|
|
title: "Media to a TV"
|
|
status: missing
|
|
note: "Map: MISSING."
|
|
sources:
|
|
- capability-map: "Media to TV via DLNA"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: use.multiuser
|
|
band: journey
|
|
stage: 3
|
|
title: "Separate accounts per household member"
|
|
status: missing
|
|
note: "Map: MISSING."
|
|
sources:
|
|
- capability-map: "Multiple household users / per-person accounts"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: drives.enrol
|
|
band: journey
|
|
stage: 4
|
|
title: "A new drive is found, offered, formatted, mounted and enrolled — including on awkward older boot layouts"
|
|
status: walked
|
|
note: "Applies to a NEW drive. Re-attaching an existing one after a reinstall is R-280 and fails."
|
|
sources:
|
|
- capability-map: "Drive wizard: scan/format/mount/enroll, incl. legacy-boot LVM-root hosts"
|
|
- register: "R-220"
|
|
- evidence: "audits/SPIKE-raw-drive-enroll-2026-06-15.md"
|
|
changed:
|
|
from: built
|
|
also_moved: 2026-08-09 walked -> built
|
|
reason_superseded: "the 2026-08-09 walk exercised RE-attach (which failed, R-280); first-enrolment of a NEW drive has no walk on file"
|
|
reason: "receipt found 2026-08-10: a live throwaway drive on felhom-pve walked scan -> format -> mount -> PVE dir storage -> one-click Regisztralas, with the resulting storage.cfg entry and systemd mount unit recorded. The map already read PROVEN-LIVE; the dataset was behind it. Scope unchanged: this is a NEW drive. Re-attaching an existing one after a reinstall is R-280 and still fails."
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: upgraded
|
|
depth: source-read
|
|
- id: drives.migrate
|
|
band: journey
|
|
stage: 4
|
|
title: "Moving data between drives, crash-safe; removing a drive safely; unplug detected"
|
|
status: built
|
|
sources:
|
|
- capability-map: "Data migration between drives (all / per-app), crash-safe"
|
|
changed:
|
|
from: walked
|
|
reason: "no walk document cited"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: downgraded
|
|
depth: register+map
|
|
- id: drives.nas
|
|
band: journey
|
|
stage: 4
|
|
title: "A network drive can be browsed and hold bulk media, but may not hold an app's data — enforced"
|
|
status: walked
|
|
note: "RefuseAsAppNamespace is the fail-closed predicate."
|
|
sources:
|
|
- capability-map: "Network storage (NAS) is browse + bulk-media only"
|
|
- register: "R-108"
|
|
- evidence: "audits/R108-network-app-namespace-2026-07-30.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: drives.reattach-wall
|
|
band: journey
|
|
stage: 4
|
|
title: "After a reinstall the data drive cannot be re-attached through any dashboard route"
|
|
status: partial
|
|
note: "Warning card. /api/disks/candidates returns empty; the restore page promises two clicks."
|
|
sources:
|
|
- register: "R-280"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: backup.tier1
|
|
band: journey
|
|
stage: 5
|
|
title: "App data on the machine, nightly database dumps, a copy on a second drive"
|
|
status: walked
|
|
note: "True for every app but one, and that one was found on 2026-08-21: paperless-ngx's 72-table PostgreSQL was dumped nightly and written into a folder named after an app that does not exist, so it never entered the recovery unit, the second-drive copy or the off-site copy. Fixed and proven live 2026-08-22 (R-355) — the dump is now in the app's own unit and in the off-site snapshot for the first time. A catalogue-wide sweep, itself proven able to convict a planted case, says 1 of 53 was affected."
|
|
sources:
|
|
- capability-map: "Tier-2 secondary-drive copy: class-driven legs"
|
|
- register: "R-355"
|
|
- evidence: "audits/CAMPAIGN-8-backup-restore-2026-07-27.md"
|
|
- evidence: "audits/DRILL-backup-truth-2026-08-21/evidence/phase4-paperless/FINDING.txt"
|
|
changed:
|
|
from: built
|
|
also_moved: 2026-08-09 walked -> built
|
|
reason_superseded: "no walk document cited"
|
|
reason: "receipt found 2026-08-10: an adversarial, destructive, unattended overnight campaign across both boxes and ep0, with A2 (one quiesce, two tiers) proven end to end. Map already read PROVEN-LIVE."
|
|
verified:
|
|
date: 2026-08-22
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: backup.whole-machine
|
|
band: journey
|
|
stage: 5
|
|
title: "A whole-machine archive that lands off the guest's own disk — a single-drive machine is recorded as degraded rather than pretending"
|
|
status: built
|
|
sources:
|
|
- capability-map: "Whole-guest backup lands OFF the guest's own physical device"
|
|
- register: "R-165"
|
|
changed:
|
|
from: walked
|
|
reason: "no walk document cited"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: downgraded
|
|
depth: register+map
|
|
- id: backup.offsite
|
|
band: journey
|
|
stage: 5
|
|
title: "An encrypted off-site copy, sealed with a key the operator cannot read"
|
|
status: partial
|
|
note: "The COPY is real and the key is still unreadable to us — what failed is DAILY and UNBROKEN. The 2026-08-09 note said '18 snapshots, daily, unbroken'; the next snapshot after 2026-08-09 08:30 was 2026-08-21 22:17, put there by hand during the drill. Twelve days, no alarm. Two causes in series: the 2026-08-21 rebuild lost the off-box target (R-193's shape), and after the self-heal restored it EVERY per-app switch was still off, so the first run logged 'backup OK: 0 app(s) backed up, 14s'."
|
|
sources:
|
|
- capability-map: "Offsite (restic → Hetzner Storage Box)"
|
|
- register: "R-199"
|
|
- register: "R-193"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
|
changed:
|
|
from: walked
|
|
reason: "the claim is about a CONTINUING daily copy; a 12-day silent gap was found on 2026-08-21 and nothing reported it"
|
|
verified:
|
|
date: 2026-08-22
|
|
verdict: downgraded
|
|
depth: source-read
|
|
- id: backup.restore-proof
|
|
band: journey
|
|
stage: 5
|
|
title: "The backups prove themselves: a restore is actually performed, unattended, on every tier, on both machines"
|
|
status: built
|
|
note: "STILL GREY, and for a sharper reason than in August. The scheduler runs and the check works — it failed again on 2026-08-21, unprompted, and named the cause exactly: after the reinstall the box presents a different PBS key than its own older archives were sealed with, so those archives cannot be opened at all (R-366). A tier whose archives are orphaned is a different alarm from a tier whose test failed, and only the second is being said."
|
|
sources:
|
|
- capability-map: "Restore-proof is UNATTENDED — the scheduler covers EVERY tier"
|
|
- register: "R-86"
|
|
- register: "R-366"
|
|
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
|
changed:
|
|
from: walked
|
|
reason: "no walk document cited, and the last recorded restore-test on demo-hp FAILED (2026-08-05)"
|
|
decay: "PROOF-DECAY RULE FIRED (first time it has). A receipt EXISTS - architecture/_recovery-inventory-2026-07-28.md carries live journal lines for scheduled restore-tests on both boxes and both tiers - but it is superseded by later observation: demo-hp logged restore_test_failed on 2026-08-05, and the box has since been wiped and reinstalled (2026-08-09). The claim is about a CONTINUING scheduled behaviour, so a 2026-07-28 observation cannot carry it. Stays grey until a scheduled restore-test is seen passing on the rebuilt box. THE CAPABILITY MAP STILL READS PROVEN-LIVE (2026-08-03) AND IS NOW THE THING OUT OF STEP."
|
|
worse_2026_08_22: "It failed AGAIN, unprompted, on 2026-08-21 21:59 - and the cause is worse than 'untested'. Hub event 3016: the PBS archive of 2026-08-18 could not be restored because the manifest's key does not match the key the rebuilt box now presents. The archives that predate the 2026-08-21 reinstall are UNREADABLE to the machine that made them (R-366). Credit where due: the mechanism caught it and named the key mismatch precisely. The gap is that it is reported as 'a restore test failed' rather than 'your older whole-machine backups cannot be opened on this box'."
|
|
verified:
|
|
date: 2026-08-22
|
|
verdict: downgraded
|
|
depth: needs-hardware
|
|
- id: backup.fill-warning
|
|
band: journey
|
|
stage: 5
|
|
title: "The customer is warned before a drive fills, per drive, in their own language"
|
|
status: partial
|
|
note: "The warning is real and was SEEN firing on 2026-08-21 with the right Hungarian copy, naming the drive and the free space. What 'BEFORE' cannot survive is the cadence: the watcher runs once a day at 03:30 plus once at startup (R-363), so a filesystem that fills at 03:31 goes unannounced for ~24 h. Watched live: the 69 GB volume carrying all 40-class app data was filled to 99% and the watcher said nothing, while the backup reserve was already refusing an app per run and telling the hub about it."
|
|
sources:
|
|
- capability-map: "The customer is warned BEFORE a filesystem fills"
|
|
- register: "R-167"
|
|
- register: "R-363"
|
|
- evidence: "audits/SPIKE-r165-mp1-merge-2026-08-02.md"
|
|
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
|
changed:
|
|
from: walked
|
|
reason: "a daily check cannot carry the word BEFORE; observed silent for the whole window a filesystem sat at 99%"
|
|
verified:
|
|
date: 2026-08-22
|
|
verdict: downgraded
|
|
depth: source-read
|
|
- id: backup.sikeres
|
|
band: journey
|
|
stage: 5
|
|
title: "A backup that covered nothing still calls itself successful"
|
|
status: partial
|
|
note: "Warning card — and the drill found two more of it, both live. (1) An off-site run with no app selected logs 'backup OK: 0 app(s) backed up'; the card does say 'nincs kijelölt alkalmazás' beside the green tick, so this one is honest if you read past the tick. (2) A restore that placed nothing reported success: '0 fájl visszaállítva', ok=true. The second is the one that matters and it is R-353, still open. The volume half of it is fixed (R-354): the message now names what came back."
|
|
sources:
|
|
- register: "R-240"
|
|
- register: "R-353"
|
|
- register: "R-354"
|
|
- evidence: "audits/DRILL-backup-truth-2026-08-21/evidence/phase3-experiment/messages-verbatim.txt"
|
|
verified:
|
|
date: 2026-08-22
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: fault.selfheal
|
|
band: journey
|
|
stage: 6
|
|
title: "The machine watches itself and repairs some faults without telling anyone it had to"
|
|
status: built
|
|
note: "R-264 records that the self-heal counters reach the hub and are decoded nowhere."
|
|
sources:
|
|
- capability-map: "Box survives an unattended app or guest-network failure"
|
|
- register: "R-264"
|
|
changed:
|
|
from: walked
|
|
reason: "no walk document cited"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: downgraded
|
|
depth: source-read
|
|
- id: fault.operator-email
|
|
band: journey
|
|
stage: 6
|
|
title: "Failures reach the operator by email, one mail per run, every failing app named"
|
|
status: built
|
|
note: "CONFIRMED against source: backup_run_failures digest is allowlisted (api/handler.go:1837), operator-only (dispatcher.go:423), templated (templates.go:48); recovery_unit_capture_failed is record-only (dispatcher.go:376). NOTE: R-182's register row still describes the PRE-FIX behaviour — see R-289."
|
|
sources:
|
|
- capability-map: "A failed per-app Tier-1 backup reaches the OPERATOR — EVERY failing app, in ONE mail per run"
|
|
- register: "R-182"
|
|
changed:
|
|
from: walked
|
|
reason: "the digest is wired and source-verified, but no run of it has been observed delivering"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: downgraded
|
|
depth: source-read
|
|
- id: fault.customer-email
|
|
band: journey
|
|
stage: 6
|
|
title: "Failures reach the customer"
|
|
status: built
|
|
note: "The customer leg is built; today's log shows customer-channel rows skipped as operator_only."
|
|
sources:
|
|
- capability-map: "App crashes → customer notified (one event per transition, no flapping spam)"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: fault.already-paired
|
|
band: journey
|
|
stage: 6
|
|
title: "An already-paired box is still told to pair itself"
|
|
status: partial
|
|
note: "Warning card."
|
|
sources:
|
|
- register: "R-214"
|
|
- register: "R-235"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: recover.screen
|
|
band: journey
|
|
stage: 7
|
|
title: "A rebuilt machine shows a full-page recovery screen without anyone looking for it, and says plainly that nobody can replace a lost recovery code"
|
|
status: walked
|
|
note: "Seen unsought on the rebuilt demo-hp 2026-08-09, seal date matching host_escrow.created_at."
|
|
sources:
|
|
- register: "R-193"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: recover.byte-identical
|
|
band: journey
|
|
stage: 7
|
|
title: "The customer's code opens the sealed package and the data returns byte for byte — including accented Hungarian filenames, verified as raw bytes"
|
|
status: walked
|
|
note: "Still true, and re-proven 2026-08-22 (5/5 byte-identical, both accented names as raw bytes) — but the SCOPE is narrower than the sentence sounds and was silently narrower still until v0.218.0. The drill found the off-site restore had NO named-volume leg at all: the archive sat in the unit, the snapshot and the checking folder and was never replayed, under a success message (R-354, fixed and proven 2026-08-22). AND 40 of the 53 catalogue apps STILL cannot run this route at all — it refuses first, saying a running app is not installed (R-356, open). So: proven for an app that declares a data drive; unproven and currently unreachable for the class whose entire dataset is a named volume."
|
|
sources:
|
|
- register: "R-201"
|
|
- register: "R-354"
|
|
- register: "R-356"
|
|
- evidence: "tests/walk5-r201-2026-08-07/journal.md"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
|
verified:
|
|
date: 2026-08-22
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: recover.no-shell
|
|
band: journey
|
|
stage: 7
|
|
title: "Walked end to end with no command line inside the machine (2026-08-07)"
|
|
status: walked
|
|
note: "CONTESTED-RESOLVED: not a contradiction. The walk proves the ROUTE needs no guest shell; the map's MISSING row is about a NON-OPERATOR doing it, which has still never happened. Two questions, one word 'customer'."
|
|
sources:
|
|
- register: "R-201"
|
|
- evidence: "tests/walk5-r201-2026-08-07/journal.md"
|
|
- capability-map: "A customer (not the operator) performs a restore via UI alone"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: contested
|
|
depth: source-read
|
|
- id: recover.putback
|
|
band: journey
|
|
stage: 7
|
|
title: "Putting restored files back where they belong is still manual"
|
|
status: partial
|
|
note: "Warning card. Confirmed 2026-08-09: the restore lands in a verification folder and says so."
|
|
sources:
|
|
- register: "R-213"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: recover.tripwire
|
|
band: journey
|
|
stage: 7
|
|
title: "The tripwire that says someone is opening this customer's backups does fire"
|
|
status: walked
|
|
note: "CONFIRMED tonight from the hub store: escrow_blob_served 2026-08-09 10:19:41Z = 12:19 CEST in the operator's mailbox. R-281's original claim of silence is WITHDRAWN."
|
|
sources:
|
|
- register: "R-281"
|
|
- register: "R-285"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: fail.disk-failing
|
|
band: failures
|
|
title: "A disk starts failing — healthy path only; a genuinely failing disk has never been seen"
|
|
status: partial
|
|
note: "Only a failing disk on a running box could settle it."
|
|
sources:
|
|
- capability-map: "Lemez-egészség felügyelet: per-disk SMART kártya"
|
|
- evidence: "audits/SPIKE-smart-coverage-2026-07-25.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: needs-hardware
|
|
depth: needs-hardware
|
|
- id: fail.backup-drive-unplugged
|
|
band: failures
|
|
title: "The backup drive is unplugged"
|
|
status: walked
|
|
sources:
|
|
- capability-map: "An ABSENT backup-target drive raises its OWN alarm"
|
|
- evidence: "audits/R116-v0116-2026-07-30.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: fail.drive-filling
|
|
band: failures
|
|
title: "A drive is filling up"
|
|
status: built
|
|
sources:
|
|
- register: "R-167"
|
|
changed:
|
|
from: walked
|
|
reason: "no walk document cited"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: downgraded
|
|
depth: register+map
|
|
- id: fail.app-crash
|
|
band: failures
|
|
title: "An app crashes — the email leg has never been confirmed end to end"
|
|
status: built
|
|
note: "Consistent with fault.operator-email: the digest is wired but its delivery is unobserved."
|
|
sources:
|
|
- capability-map: "App crashes → customer notified (one event per transition, no flapping spam)"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: fail.power-cut
|
|
band: failures
|
|
title: "Power cut mid-backup"
|
|
status: walked
|
|
sources:
|
|
- evidence: "audits/AUDIT-power-outage-recovery-2026-07-22.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: fail.guest-destroyed
|
|
band: failures
|
|
title: "The guest is destroyed"
|
|
status: walked
|
|
sources:
|
|
- register: "R-201"
|
|
- evidence: "audits/DRILL-r201-night-run-2026-08-04.md"
|
|
- evidence: "audits/DRILL-r201-night-run-2026-08-04.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: fail.wiped-reinstalled.data
|
|
band: failures
|
|
title: "The whole machine is wiped and reinstalled — the data comes back"
|
|
status: partial
|
|
note: "The 2026-08-09 rehearsal really did return 4/4 byte-identical, and that stands. What the next real reinstall showed (2026-08-21, demo-hp) is that the rebuild ORPHANS BOTH OFF-PREMISES TIERS at once, quietly: the restic target was lost and needed a self-heal plus a per-app re-enable before any copy resumed (R-193), and the PBS archives from before the reinstall cannot be opened by the rebuilt box at all, because it now presents a different key (R-366). The data came back in the rehearsal because the rehearsal restored it immediately; a machine left alone after a reinstall is not protected in the meantime and nothing says so."
|
|
sources:
|
|
- register: "R-193"
|
|
- register: "R-366"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
|
changed:
|
|
from: walked
|
|
reason: "a real reinstall on 2026-08-21 left both off-premises tiers broken - one silently for 12 days, the other unreadable - so 'the data comes back' holds only if someone restores it at once"
|
|
verified:
|
|
date: 2026-08-22
|
|
verdict: downgraded
|
|
depth: source-read
|
|
- id: fail.wiped-reinstalled.journey
|
|
band: failures
|
|
title: "The whole machine is wiped and reinstalled — the journey needs a terminal twice"
|
|
status: partial
|
|
note: "CONTESTED-RESOLVED against the map: the map's PROVEN-LIVE row is scoped to a controller-data-volume REBUILD (2026-08-04), not a whole-host reinstall. The map has no row for the host case, so there was no contradiction — only a gap."
|
|
sources:
|
|
- register: "R-273"
|
|
- register: "R-280"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: fail.stolen-machine
|
|
band: failures
|
|
title: "The machine is stolen, and someone opens the backups — the operator is told"
|
|
status: walked
|
|
note: "Confirmed 2026-08-09 from the store and the mailbox."
|
|
sources:
|
|
- register: "R-281"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: fail.forgot-password
|
|
band: failures
|
|
title: "The customer forgets their dashboard password"
|
|
status: walked
|
|
note: "Exercised 2026-08-09 via the reset code."
|
|
sources:
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: fail.lost-recovery-code
|
|
band: failures
|
|
title: "The customer loses their recovery code — by design, the data is unrecoverable"
|
|
status: walked
|
|
note: "The recovery screen states it in Hungarian."
|
|
sources:
|
|
- capability-map: "Escrow ceremony: customer-facing wizard, one-shot R claim, operator zero-knowledge"
|
|
- register: "R-198"
|
|
- evidence: "audits/REHEARSAL-byo-reinstall-2026-08-09.md"
|
|
changed:
|
|
from: built
|
|
also_moved: 2026-08-09 walked -> built
|
|
reason_superseded: "a by-design refusal; no walk document cited"
|
|
reason: "receipt found 2026-08-10, and then proven the hard way: the recovery screen states in Hungarian that nobody can replace a lost code, and on 2026-08-10 demo-felhom's pre-fix key was confirmed unrecoverable by construction (identity_blob NULL; the restic password lives only in that bundle). The by-design refusal is real."
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: upgraded
|
|
depth: source-read
|
|
- id: fail.moves-house
|
|
band: failures
|
|
title: "The machine moves house / new network"
|
|
status: walked
|
|
sources:
|
|
- capability-map: "Box survives a site/network change (relocation, different subnet, DHCP re-lease)"
|
|
- evidence: "audits/AUDIT-vacation-remote-ops-2026-07-20.md"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: fail.internet-down
|
|
band: failures
|
|
title: "The internet goes down — built, never walked"
|
|
status: built
|
|
note: "Needs a running box with WAN pulled."
|
|
sources:
|
|
- capability-map: "LAN access when internet is down (lan_resolver)"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: needs-hardware
|
|
depth: needs-hardware
|
|
- id: fail.hub-down
|
|
band: failures
|
|
title: "The hub is down"
|
|
status: built
|
|
sources:
|
|
- capability-map: "Config/state change round-trips in seconds (hub↔box immediacy"
|
|
changed:
|
|
from: walked
|
|
reason: "no walk document cited"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: downgraded
|
|
depth: register+map
|
|
- id: fail.broken-release
|
|
band: failures
|
|
title: "We ship a broken release — the guard is missing"
|
|
status: missing
|
|
note: "Proven the hard way on 2026-08-09: a vouched agent version had no git tag and every install died at 5/8. Both guards still owed."
|
|
sources:
|
|
- register: "R-273"
|
|
- register: "R-287"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: fail.stale-image
|
|
band: failures
|
|
title: "A fresh install picks up an old image"
|
|
status: partial
|
|
note: "Narrowed 2026-08-09: the resume path fetched the vouched golden; a fresh install still takes the newest LOCAL archive with no manifest comparison."
|
|
sources:
|
|
- register: "R-274"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: fail.offsite-account-deleted
|
|
band: failures
|
|
title: "The off-site provider account is deleted"
|
|
status: partial
|
|
note: "The credential that holds the customer's documents can still delete."
|
|
sources:
|
|
- register: "R-95"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: register+map
|
|
- id: fail.expected-downtime
|
|
band: failures
|
|
title: "The machine is switched off for an afternoon — no notion of expected downtime"
|
|
status: missing
|
|
note: "Confirmed 2026-08-09: eight operator mails for deliberate, attended work."
|
|
sources:
|
|
- register: "R-285"
|
|
verified:
|
|
date: 2026-08-09
|
|
verdict: confirmed
|
|
depth: source-read
|
|
- id: fail.customer-self-restore
|
|
band: failures
|
|
title: "A customer restores their own data with no help"
|
|
status: partial
|
|
note: "CONTESTED-RESOLVED: the map's MISSING is about a NON-OPERATOR performing it; the walks prove the route, not the person. Neither record was wrong. SINCE 2026-08-21 there is a second, harder blocker and it is not about the person at all: for the 40 of 53 apps that declare no data drive the off-site restore REFUSES before it starts, telling the customer a running app 'nincs telepítve' and to reinstall it to the same place — which those apps give them no way to choose (R-356). Those are exactly the apps whose whole dataset is a named volume. Until that is fixed, most customers cannot self-restore off-site even in principle."
|
|
sources:
|
|
- capability-map: "A customer (not the operator) performs a restore via UI alone"
|
|
- register: "R-201"
|
|
- register: "R-356"
|
|
- evidence: "audits/REPORT-DRILL-backup-truth-2026-08-21.md"
|
|
verified:
|
|
date: 2026-08-22
|
|
verdict: contested
|
|
depth: source-read
|