felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

N100 rehearsal S8 wrap — evidence, VALIDATION, map flips, ROADMAP, R-3 — 2026-07-18

Class: documentation/evidence run. Repos touched: felhom.eu only, docs only. No code changed anywhere — every finding is recorded and ranked, none fixed (campaign discipline).

Commit: aa9c08f — docs(rehearsal): N100 S8 wrap — VALIDATION, map flips, ROADMAP R-30..R-39, R-3 draft (pushed to main; parent bbaa844).

No CHANGELOG entry: felhom.eu keeps per-area changelogs (hub/, scripts/, website/) and this run touched none of those areas.

What the run proved

The complete final-product flow ran end to end on real metal in one pass: RESET → generic pairing ISO v1.20.0 → customer self-bind → credential delivery → day-0 → managed-floor lift → drive enrolment → escrow ceremony → offsite snapshots.

Leg	Wall-clock
Blank-metal boot → registered as an unclaimed appliance	< 1 s
Bind → credential delivered	26 s
Bind → controller running the CURRENT version	2 min 44 s
Managed floor 0.143.0 → 0.145.0 (initiated_by: auto-floor)	5 s, unattended
Escrow ceremony → offsite runs enabled	12 s
Drive enrol (confirm → usable, incl. mkfs)	30.3 s

No post-bind leg stalled — that is the immediacy row's real-onboarding proof.

---

Phase A — evidence bundle (completed before the box was unplugged)

180:~/n100-rehearsal/ — 984 KB, 10 files + MANIFEST.md:

File	Evidences
bootstrap-journal.txt	first boot 16:17:14 UTC, PAIRING mode, unclaimed registration, the 30 s poll loop and its 52 systemd FAILED lines, day-0 SUCCESS 16:32:32
host-state.txt	pct config 9201 (12288 MB), pveversion -v, pvesm status (felhom-pbs 401/inactive), lsblk, blkid
guest-docker.txt	11 containers, controller 0.145.0 healthy, image pin
controller-log-full.txt / controller-log.txt	the whole controller life: auto-floor update, 16:55 config-refresh restart, escrow ceremony, orphan guard, both backup runs
agent-journal.txt	agent 0.90.0 start, WG registration, storage-wipe gate pending→confirmed, format + enrol, PBS apply, and the repeating PBS verify-loop permission error
pbs-dr-state.txt	the R-39 failure: storage.cfg stanza, pvesm status, credential metadata, direct token probe (401 everywhere), WG health, agent errors
restic-and-pool.txt	2 snapshots / 48.717 MiB attributed, pool /home listing + du showing 1.4 G + 3.0 M unattributed
hub-state.txt	hosts row, both RESET ledger rows, the unconsumed PBS secret, self-bind token lifecycle, appliance registration, events timeline
hub-events-timeline.txt	the 15-row demo-felhom event stream from 15:50
timezones.txt	the live-captured CEST/UTC split

Secrets were read only to run probes and are recorded as lengths and metadata, never as values.

Not collected: the operator gauge screenshots (Viktor's set) and the PBS DR tab, which remains uncaptured — and now matters more, because R-39 means it would have shown a fault. The hub UI is password-gated, so CC cannot capture it.

---

Phases B–E — what landed

• Phase B — documentation/tests/VALIDATION-n100-rehearsal-2026-07-18.md: run context, a UTC-normalised timeline (the host journal is CEST, everything else UTC — a 2 h trap), derived wall-clocks, per-ledger verdicts for S1–S8 plus ledgers 8 and 9, 12 findings, the not-exercised list, and the discrepancy table.
• Phase C — 10 capability-map rows annotated, each citing the Phase-B doc.
• Phase D — 5 items collapsed, 11 new ranked items, 1 pre-invite checklist.
• Phase E — Viktor's draft (which landed as runbooks/RUNBOOK-onboarding-draft-v3.md, not the filename the brief predicted) refined: all four [REFINE] slots filled, self-bind made the default bind path, the measured wall-clock table inlined, interim workarounds for R-31/R-36/R-39 added, and C6→C7 marked as the single unexecuted step. Committed as DRAFT — it graduates when C7 has evidence.

Capability-map rows flipped

Row	Change
Bare-metal Felhom ISO	PARTIAL → PROVEN-LIVE — F1 closed on physical hardware
Customer self-bind (slice 1)	IMPLEMENTED → PROVEN-LIVE — customer_selfbind, 0 failed attempts
Guest RAM resize (R-24)	IMPLEMENTED → PROVEN-LIVE — shrink and grow, live cgroup
Customer RESET	+ two real firings, verified external teardown, orphan-guard interaction
Escrow ceremony	+ first live customer-facing wizard firing
Immediacy	"real-onboarding proof pending" cleared
Publish train / floor	+ box-side floor lift proven on a fresh install
Customer claim	+ R-4 gmail half (Inbox under p=quarantine)
Offsite orphan guard	staged live leg fired on its own
DR tier by default	candidate PROVEN-LIVE upgrade WITHDRAWN (R-39)

Not flipped, as instructed: customer-performs-restore (still MISSING), BYO, DLNA, multi-user.

ROADMAP IDs assigned

Rank	IDs
P2-HIGH	R-39 PBS DR applied-but-dead · R-30 liveness from the wait channel · R-31 async offsite + status card · R-32 RESET base-dir purge + orphan-card honesty + unattributed-bytes gauge · R-33 bootstrap console quiet-poll
P2	R-34 backup data lifecycle · R-35 config-apply session survival · R-36 post-RESET re-enroll offsite prompt · R-27c console-passphrase bind
P3	R-37 post-RESET health card · R-38 installer GRUB slice

Collapsed: R-1 (appliance half done; Peti half survives), R-21 (physically closed), R-24, R-27 slice 1, R-4 (gmail half). No existing item renumbered.

---

Discrepancies found vs the brief (live evidence won in each case)

1. "expect ~11675 MB" vs pct config 12288 MB. Both correct at different times: F5 auto-sized to 11675, then the customer shrank to 8192 (16:50:22) and grew to 12288 (17:02:17). Not a fault — it is what completes ledger 9.
2. "2.6 GB pool vs ~0 attributed" → measured 1.4 G + 3.0 M unattributed vs 49 M attributed, across two .orphaned-* directories, not one. The R-32 ruling is unaffected; the numbers are.
3. "felhom-pbs entry present" → present but 401 / inactive. The brief treated the descriptor as done; it is provisioned but dead. → R-39.
4. "RESET ×2 … second + third live firings" → the ledger holds exactly two rows, both tonight, on two different customers (demo-vm-felhom 15:49:57, demo-felhom 16:08:51). Recorded as tonight's two firings rather than as ordinals.
5. "keep R-29 if the number is free" → it is not free. R-29 was committed earlier the same day (2eccda4) for the design-v2 gate rot — which is the brief's item 5. So the liveness item took R-30, and no new ID was minted for the red-gate item.
6. Tip and filename: the brief's tip a03e142 is two commits behind bbaa844, and Viktor's R-3 draft landed as RUNBOOK-onboarding-draft-v3.md, not DRAFT-R3-onboarding-runbook.md.
7. R-39 has no counterpart in the brief at all — it was found by probing the box, not by working the finding list. Its P2-HIGH rank is therefore provisional pending Viktor.

The one finding worth reading twice

R-39 — the DR tier can report applied and be dead simultaneously. The descriptor auto-provisioned and the agent converged state=applied at 16:45:53. But pvesm status returns 401 Unauthorized/inactive, and a direct probe with the stored credential 401s on every endpoint including /version while the WG transport is healthy (handshake 9 s, 27.9 ms RTT) — so it is authentication, not ACL scope. The hub minted a second token secret at 16:47:52, two minutes after the agent applied the first, and its consumed_at is still NULL; the converged state machine will not re-apply, and the agent's 15-minute verify loop cannot read the credential to notice, because it reads directly as non-root a file it writes through a root sudo wrapper. A silent DR failure surfaces first at a restore, which is the worst possible moment — hence the withdrawn map upgrade and the interim pvesm status check now in R-3 step E1.

---

Remaining to first invite

freemail.hu test-send (Viktor, remote-doable) + C6 customer-restore evidence (remote-doable on the reborn box from vacation — the dashboard is remote) + R-11 rulings (contact channel, agreement, thresholds) + golden 0.145.x rebuild.

R-39 is not on that line because it was discovered after the brief was written; if Viktor confirms the P2-HIGH rank, it belongs there too — a first tester whose DR tier is silently dead is exactly the scenario the alpha exists to avoid.

Viktor's polish/tweak notes arrive separately and are neither pre-empted nor invented here.