REPORT — 2026-10-26 afternoon: R-1295 fixed at the cause, R-1294 read, R-1285 / R-1292, R-1291 designed, releases

Plain words first.

R-1295 cause: PBS's proxy keeps permissions in a 5-second cache, and a new access key's grant does not clear it. When other boxes are talking to ep0 at that moment, the new key is refused for a few seconds, and the old script gave up after one quick retry. Fixed at the cause on ep0 (the script now waits up to 15 s) and in the hub (retries, and a failure now mails you — yes). Live: a fresh Tester4 install set up its whole-box off-site copy.
Tester 2's reinstall is safe from this failure: the fix is on ep0 and in the hub, and if anything still fails you get a mail that says what to do.
R-1294: demo-hp's clean-up plan is honest (old copies only, every app keeps its copies), but it can never get back under the safety cap by itself. Your pick D54: a one-time window with a raised cap (my pick).
R-1292 fixed and released; R-1285 fixed, not released (its live proof needs a box coming from 0.164.0).
Released: hub 0.172.0, controller 0.345.0 (every live box), felhom-tenantsync v1.4.0 on ep0. Not released: agent.

Safest readings taken alone (said first): R-1292's live test ran on Tester 1, not 9202 (9202 has no tested line, so the rule never acts there); R-1285 has no live test today (a box coming from 0.164.0 needs a signed downgrade chain); the fresh-install proof ran after the hub rc deploy, both on your yes.

Each fix, before → after

R-1295 (hub v0.172.0 + tenantsync v1.4.0): a new access key refused by the PBS cache → rolled back, no off-site copy, only a log line → the script waits up to 15 s (the admin key too); the hub retries 3×, 7 s apart; a final failure mails you („… could not be set up — save the customer config to retry"). Measured 11/30 → 0/30 under load; red-proved.
R-1292 (controller v0.345.0): with alternative speed on, the 50 % rule changed the alternative limit or gave up → it sets only the normal limit. Live on Tester 1; red-proved.
R-1285 (agent b1bc63d, not released): the old agent installed the bundle, so the new policy pass waited a release → the new agent runs it once after its update commits. Tested in the real order; red-proved.
R-1294 (read only): no change; D54.
R-1291 (design only): 08 §10; D53.

Versions, CI by commit

What	Version / digest	Commit → CI
hub	0.172.0, `sha256:7c8d129a…` (rc.1 `f6cb8f57…` for the proof)	`722013da` 2362 ✓, `232f42d2` 2366 ✓; manifests `ee38dee2` 2364 ✓
ep0	felhom-tenantsync v1.4.0, sha256 `751b3c26…` (v1.3.0 kept beside it)	`722013da`
controller	0.345.0, `sha256:2dc2c0a5…` (rc.1 `1378e4e2…`)	`2619191` 2365 ✓, `6bfb784` 2368 ✓
agent	— (not released)	`b1bc63d` 2363 ✓

Global floor 0.345.0 at 13:27:04Z (MinAgent 0.158.1), read back from the hub DB with its WAL and the hub log; the per-box floors cleared. Every live box reports 0.345.0.

Rows

Before 212, after 212; opened 2 (R-1296 the hub drops ep0's refusal reason; R-1297 CI speed — your „both"), closed 2 (R-1295, R-1292). R-1285 VERIFY; R-1294 and R-1291 wait for D54 / D53.

Observations

FILED: R-1296 — PBS's real refusal reason never reaches the hub log (found only by reading ep0's journal).
FILED: R-1297 — felhom.eu CI ~13 min, one runner; ruled „both".
NOT-A-FINDING: the backup_tier_skipped 6 min after the fresh install — before the box applied its descriptor; the hub held the mail by design (box enrolled < 1 h); 15 min later the box took its key and made its first copy.
NOT-A-FINDING: 9202's FileBrowser WARN on the move from 0.343.0 (twice now) — healed in 3 s, log only, every live box is past that move.
NOT-A-FINDING: R-1292 run 1 „FAIL" — my probe's quoting broke its reads (kept as evidence); run 2 with a fail-fast instrument check passed.
My mistake, fixed: removing Tester 1's test record the first time raced a path unit that restarted the controller; the second time I stopped the path unit first.

Teardown

Machines: VM 9373 (the R-1295 fresh install) and LXC 9374 (the throwaway PBS) destroyed with their disks; Tester 1's two throwaway qBittorrents removed through the product, its rule record removed (it had none before), helper files gone; 9202 back on 0.343.0 exactly as found (FileBrowser on traefik-public, no felhom-files network, the rc image deleted — 9202 is not bound to the hub, so no floor moves it). Nothing of mine runs on demo-hp into Tuesday 10:00.
Product uninstall of VM 9373: not run — tried root SSH with the original password (refused: day-0 replaced it with the vaulted one) and DooPlex's key (never installed); the vault read is yours. The VM was destroyed instead.
Hub: delete host Tester4-b5ec39 (STATUS). Its first whole-guest copy stays in Tester4's ep0 namespace (a host delete keeps the tenancy, by design).
ep0: only the script swap you approved; v1.3.0 kept as /usr/local/bin/felhom-tenantsync.v1.3.0.
Secrets: evidence scanned (the sec values + the bind token and pairing code): 0 hits.

5.2 KiB Raw Blame History Unescape Escape