felhom.eu/REPORT-instruction-closeout-2026-08-06.md

REPORT — instruction arc close-out, 2026-08-06

Six items. Closes R-229(b) and R-230(b); part-actions R-230(a). Full accounting: documentation/audits/LEDGER-instruction-closeout-2026-08-06.md.

Second session in this repo, so this is a REPORT-<topic>.md; the shared REPORT.md was not touched.

1. Baselines and commits

Reconfirmed live, all clean and synced: felhom.eu 92a076c239b9, felhom-controller 66d80efb9f20, felhom-agent 5b2666e3a2ae, app-catalog 459766cb1639.

Push	Repo	What
aa74294	felhom-agent	core + 4 rule files
15fa527	felhom.eu	checks 6-content and 7
f49b1f3	felhom.eu	symlink + check 5 two shapes
5ca5082	felhom.eu	t740, registers, ledger, S-37

2. felhom-agent/CLAUDE.md

175 → 99 effective lines (207 → 103 raw; 14,093 → 6,267 B). Measured 175, not the spec's 173 — part 2's CI correction added two. Four new paths:-scoped rule files, all ≤46 effective, beside the existing health-checks.md.

Glob overlap, stated not silently resolved: health-checks.md already covered internal/{storage,localapi,guesthook}/**, which storage.md and localapi.md now also cover. Both load; neither supersedes. Each new file says so in its own text.

3. Hook evidence — fresh sessions, both directions

Agent rules (claude -p, timestamps from the log):

2026-08-06T09:46:15Z  path_glob_match  .../rules/proxmox.md   trigger=client.go
2026-08-06T09:46:23Z  path_glob_match  .../rules/backup.md    trigger=doc.go

Negative control — reading go.mod, which matches no rule glob: no rule fired at all. And each positive fired only its own rule.

Symlink — all three fresh sessions logged session_start Project /mnt/5_hdd/felhom.eu/git/CLAUDE.md (Claude Code reports the link path, not the resolved one). Because a logged path proves discovery and not delivery, a fourth fresh session with no tools at all was asked for standing rule 1 and returned it verbatim: "Never combine a test run and a commit in one command…". The content reaches the model. The link stays.

4. Memory — three false statements, and a corrected premise

Backup: /mnt/5_hdd/felhom.eu/backups/claude-memory-20260806-112853 (158 files). 158 before, 158 after. Nothing deleted. Only three lines edited.

The premise was wrong and the error was mine. Part 2 reported "3 expired statements"; re-run with the cause printed, all three matched an ISO date inside a markdown link target — a filename — while the one real expired claim was written ~08-02, carried no ISO date, and was never matched.

The three genuinely false statements, each falsified by evidence:

Line	Was	Falsified by
17	R-193 decision open	row reads **CLOSED 2026-08-05 — controller v0.200.0**
34	demo boxes REMOTE till ~08-02	ssh felhom-pve answers, holding 192.168.0.162/24 on vmbr0
68	OPEN R-25b	**SHIPPED hub v0.69.0 (2026-07-21)**

Line 34 kept its durable half — ssh felhom-pve still resolves to the tailnet address.

5. Gate: check 6 content WARNings + check 7

First run over the real index: 32 version literals, 4 host addresses, 0 expired, 0 stale citations. The 32 and the 4 are deliberately left for the loop to work on.

Check 7 finds nothing across the four repos right now — 19 citations, 0 failures — because part 2 already fixed the four stale sentences. The red-proof, not the zero, is what shows it works:

CLAUDE.md:90: claims R-168 is still open, but the register says it is closed. …
      report when you use it.** Both facts are why CI is still owed (`OPEN-ITEMS.md` R-168).

Restored; gate green again. Suite 39 → 68 assertions, 0 failures.

Two bugs found by the check's own red-proofs, both of which would have shipped. The state marker is not self-closing (**SHIPPED — …**), so the first parser read R-168, its own founding case, as OPEN; and the CLOSED exemption was line-wide, so "shipped" in a title pardoned OPEN R-25b. The second was found only because the red-proof failed to go red.

Deviation from the task's literal wording, stated: check 7 triggers on an openness claim, not on every citation of a non-open item. The literal rule fires on ~30 legitimate provenance citations ((R-161), R-117 spike §6.3); a gate that noisy gets switched off, which is R-29's own lesson. The spec's required pass case (R-168, CLOSED 2026-08-02) is tested and green.

6. Symlink

Live root file → relative symlink; backup workspace-CLAUDE.md.bak-20260806-113952. Check 5 asserts per shape: link → resolves to the versioned copy (dangling case red-proofed, since a dangling link loads nothing); two files → byte-identity as before. Installer links by default, migrates an existing regular file after backing it up and says so if it differed, and keeps --copy.

7. t740 — measured, then corrected

target-selection.md said the off-site tier is the N100's and "(demo-hp has none)". Measured:

demo-hp# LC_ALL=C pvesm list felhom-pbs
  felhom-pbs:backup/ct/9201/2026-07-28T19:19:45Z  pbs-ct  6264034048  9201
  felhom-pbs:backup/ct/9201/2026-08-04T19:24:16Z  pbs-ct  4637840512  9201
ep0:/mnt/pbs-datastore/ns/  →  c11  demo-felhom  demo-hp  rewalk

Two snapshots in demo-hp's own namespace, newest two days old. The claim is false — and it was true when written, going stale when F10 resolved 2026-07-23 (first snapshot 2026-07-28). Corrected with the measurement kept beside it. It mattered because the sentence was the stated reason for steering backup-disturbing tests at the other box.

8. context7 — nothing written

No Node.js exists on DooPlex: npx, node, npm all absent from PATH, no package installed, no runtime directory. The manifest is {"command": "npx", "args": ["-y", "@upstash/context7-mcp"]}, so ENOENT is literal.

The fix is one package install away, but that is not this task's call: DooPlex is Tier 2 and is the recovery chain, and adding a language runtime to it deserves its own review. Measured surface, so the recommendation is evidence-based: 1 direct third-party dependency in the agent, 3 in the hub, 6 in the controller — ~8 distinct, small, stable packages. Per §6, nothing was written.

9. Registers

R-229(b) CLOSED · R-230(b) CLOSED · R-230(a) part-actioned, bulk-correction ruling still owed and still yours · R-230(c) (spec-as-failing-test pilot) untouched · R-231 untouched. S-37 added to CONTEXT.md.

10. Observations — not acted on

1. R-129 has a second dated observation. A key authenticated to demo-hp non-interactively today, 2026-08-06 — that is how §7's evidence was gathered. The row is still right to be open.
2. ~/.ssh/config carries the same expired vacation claim the index did ("at the VACATION site until ~2026-08-02"). Host state, outside every repo and outside scope — the same statement in a third place.
3. The hub operator UI did not answer over its ClusterIP this session (hung, 2-min timeout); the off-site evidence came from the boxes instead. The memory note describing that access path may need re-checking.
4. MEMORY.md's header still says "felhom-controller Project Memory" though it indexes all four repos. Left for the R-230(a) ruling.
5. register_state is a reusable register parser now. Anything else needing "is R-nnn open" should call it — its two parsing traps are not obvious and were both found the hard way.