REPORT — R-50 island-bridge SPIKE, empirical attempt 2 (t740): STILL BLOCKED (2026-07-25)

Overwritten per the standing rule. This session re-attempted the empirical half of SPIKE-island-bridge-2026-07-25.md on the t740 (per the operator's 2026-07-25 drill-host ruling). Docs-only; no code, no version bumps.

t740 access method

Discovery was read-only (no LAN scan): the SSH config's demo-hp entry (t740 = Tailscale 100.76.96.79 / LAN 192.168.0.87, host_id demo-hp-bb76ea) + the hub registry. The t740 has no baked SSH key, so access used the hub-vaulted G1 break-glass root credential — host_recovery/demo-hp-bb76ea (read from the hub SQLite via kubectl cp + sqlite3), sshpass -e (secret redacted, never printed). Connected: felhom-host, PVE 9.2.2.

P1 inventory — the finding: there is NO drill VM to probe

t740 (demo-hp): qm list → empty; /etc/pve/qemu-server/ → empty; standalone (no cluster); only its own LXC guest 9201 + the guest-9201 LVM volumes. No nested drill PVE VM.
Hub registry: only demo-hp-bb76ea (t740) + demo-felhom-8363b5 (N100) — no drill appliance (no 2f4b00/demo-vm/drill host).
felhom-pve: qm list empty (confirmed in attempt 1).
DooPlex: the historical drill appliance drill.qcow2 exists (/mnt/5_hdd/felhom.eu/drill/, 18G) but is powered off — a golden-bake VM (bake logs to 0.153.0, last Jul 18–20) whose nested guest is purged after each bake, so it has no island-bridge topology (agent + nested guest + bootstrap) to probe. DooPlex is the production k3s node and is loaded (~17G of 62G free).

Snapshot: N/A (no drill VM existed to snapshot).

Per-probe outcomes

P2–P7 (bridge create / NIC hot-add / island bind / pin / F1 replay / survival) — NOT RUN. The operator's ruling ("drill+build VMs on the HP from now on") is forward-looking and not yet realized: no probeable drill appliance exists on the t740, and the only artifact is a stale bake VM on the production node. Per the hard rule ("do not improvise on production"), felhom-pve, the t740 host networking, and guest 9201 were left UNTOUCHED. No config was changed anywhere → the rollback table is empty, and there is no island end-state to leave in place.

GO/NO-GO: PENDING (unchanged) — the design half still stands

The source-grounded half of the parent doc (address plan 169.254.253.1/30↔.2/30; the F1 two-place literal; the dnsmasq trap — LANResolverConfig.WithDefaults derives the DNS listen-addr from listen_addr, so the spec MUST set lan_resolver.host_ip = LAN IP; leaf-DER pin → no cert re-issue expected; provisioning inventory; cluster parity) is unchanged and ready. Only the empirical validation remains blocked.

Operator decision + docs

Operator chose (2026-07-25): they will provision a nested-PVE drill VM on the t740 (agent + a nested guest); this spike re-runs then. Commits (docs-only): the spike doc amended (attempt-2 section + verdict), ROADMAP R-50 note appended, documentation/operations/nodes.md gains a "designated drill+build VM host" subsection (t740 ruling + the not-yet-realized state + break-glass recipe), and the controller/agent CLAUDE.md env tables gain a demo-hp row/note. The build-PIPELINE relocation to the t740 is explicitly NOT ruled or implemented — only the VM-hosting ruling is recorded.

Observations

The t740 is a genuinely better drill host than DooPlex (dedicated demo node, ~30G RAM / ~49G free local-lvm, not the production k3s node) — the ruling is sound; it just needs the VM created.
The t740's agent is 0.93.0, behind demo-felhom's 0.95.0 — a publish-when-convenient gap (noted in nodes.md), unrelated to this spike.

3.7 KiB Raw Blame History Unescape Escape