admin 6f8aa46cf7 R-31: a second off-site Save while the first still provisions is refused, not raced ...

Both saves used to list no sub-account and create one (a dedicated box is a
second bill). Per-customer in-memory claim; the second gets 409 and nothing
is saved or created. The async save + status card stays open.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-06 21:04:54 +02:00

..

static

…

templates

R-444: hub half — the System page shows each box's last disk trim

2026-10-06 11:29:17 +02:00

appliances_test.go

…

appliances.go

…

apps_render_test.go

…

apps.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

artifact_choices_test.go

hub v0.101.0 — memoise the artifact dropdown for 60s (R-267, operator ruling)

2026-08-08 20:08:51 +02:00

artifact_installability_test.go

hub v0.102.0 — refuse to vouch a version that cannot be installed (R-273)

2026-08-09 19:13:45 +02:00

artifacts_form_render_test.go

hub v0.68.1 — fix the Configuration layout broken by the wrapper-sha field

2026-07-21 10:34:34 +02:00

backup_card.go

R-331 (hub half): the Backup card reads offsite, not the dead backup fields (v0.109.0)

2026-08-30 18:39:15 +02:00

bind_language_test.go

hub v0.126.0: fresh connect link from the old one (R-719); day-one mails (R-723); bind-page wording (R-725); volunteer guide current (R-722); ep0 cleanup and release evidence

2026-09-30 10:35:18 +02:00

change_password_test.go

…

claim_ui_test.go

hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

2026-08-13 10:50:12 +02:00

configs_debug_test.go

…

configs_delivery_render_test.go

hub v0.72.0 — R-70 + R-71c: offsite delivery-state detector, card, stuck event, R-39(a)-guarded self-heal restage

2026-07-23 12:59:04 +02:00

configs_offsite_test.go

…

configs.go

R-31: a second off-site Save while the first still provisions is refused, not raced

2026-10-06 21:04:54 +02:00

controller.yaml.default

…

customer_delete_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

customer_delete.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

customer_edit_tab_test.go

feat(hub): v0.69.0 — customer DELETE is the guided full-teardown cascade (R-25b)

2026-07-21 19:31:48 +02:00

customer_ghost_delete_render_test.go

hub v0.70.1: the ghost customer's Delete button must exist (Danger-zone render gate split)

2026-07-22 09:23:37 +02:00

customer_reset_render_test.go

…

customer_reset_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

customer_reset.go

feat(hub): v0.70.0 — a deleted customer actually disappears (residue leg + ghost cleanup)

2026-07-21 20:28:06 +02:00

customer_state_banners_test.go

hub v0.67.0 — auto-minted self-bind link, post-RESET staleness, unprovisioned-offsite warning

2026-07-18 21:45:11 +02:00

customer_tabs_test.go

…

declared_floor_test.go

hub v0.112.0: a floor carries a declared MinAgent past the golden (R-472)

2026-09-13 16:47:11 +02:00

dr_recipe.go

…

drtier_test.go

…

embed.go

…

escrow_demote_wording_test.go

…

floor_ui_test.go

hub v0.82.0 (R-120): the vouch path REFUSES a golden the fleet has already outrun

2026-07-30 10:42:43 +02:00

funcmap_test.go

…

hosts_delete_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

hosts_guestnet_test.go

hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

2026-08-13 10:50:12 +02:00

hosts_network_test.go

hub v0.85.0 — Network card: a host's addresses are visible at last

2026-07-31 08:49:44 +02:00

hosts_recovery_reveal_test.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

hosts_test.go

hub v0.93.0: the retention keeps the key it was built to keep (R-198) + three honesty fixes (R-197, R-192, R-196)

2026-08-04 12:56:58 +02:00

hosts.go

R-276 (hub half): host delete asks for the WireGuard peer-list push at once

2026-10-05 21:45:04 +02:00

logbundle.go

…

logtail.go

…

offsite_box_render_test.go

…

offsite_box.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

offsite_default_test.go

hub v0.116.0: every new customer starts WITH the off-site copy (operator ruling)

2026-09-16 16:56:01 +02:00

offsite_test.go

…

offsite.go

…

os_updates.go

hub v0.132.0: the System page (versions + OS updates with the ring/switch/approve buttons, R-852), the Hosts Proxmox/kernel column, the operator-approved Docker engine release (2 healthy ring-0 nights), the crash-guard events (R-851); evidence audits/os-docker-crash-2026-10-04

2026-10-04 16:16:02 +02:00

passphrase_handover_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

pbsdr_box_render_test.go

…

pbsdr_box.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

pbsdr_generation_test.go

hub: R-39 core — stamp a secret GENERATION into the pbs_dr descriptor

2026-07-21 09:52:04 +02:00

pbsdr_poke_test.go

…

pbsdr_test.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

pbsdr.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

r133_reveal_wrongkey_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r135_csrf_test.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

r136_host_cookie_test.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

r276_host_delete_wg_test.go

R-276 (hub half): host delete asks for the WireGuard peer-list push at once

2026-10-05 21:45:04 +02:00

r277_r92_bytes_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r283_box_claim_test.go

R-283: customer page shows the box's own claim state beside the hub's, and warns on a mismatch

2026-10-05 21:45:04 +02:00

r292_artifact_flash_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r331_backup_card_test.go

R-331 (hub half): the Backup card reads offsite, not the dead backup fields (v0.109.0)

2026-08-30 18:39:15 +02:00

r349_agent_binary_test.go

R-349 (hub half): host page shows agent-binary drift from the reported agent_sha256

2026-10-05 21:45:04 +02:00

r508_no_email_banner_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r544_r599_host_delete_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r604_floor_held_back_test.go

hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

2026-10-05 11:12:56 +02:00

r725_bind_expired_copy_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

r728_create_once_test.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

refresh_cachebust_test.go

…

render_test.go

hub: delete the host-install version label (R-94) + invert hostinstall gate 1

2026-08-02 15:16:01 +02:00

rollup_test.go

hub v0.117.0: the status follows the configured threshold; slow crash loop and interrupted restore events

2026-09-17 10:20:32 +02:00

rollup.go

hub v0.117.0: the status follows the configured threshold; slow crash loop and interrupted restore events

2026-09-17 10:20:32 +02:00

selfbind_automint_test.go

hub v0.67.0 — auto-minted self-bind link, post-RESET staleness, unprovisioned-offsite warning

2026-07-18 21:45:11 +02:00

selfbind_mint.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

selfbind_naming_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

selfbind_resend_test.go

hub v0.126.0: fresh connect link from the old one (R-719); day-one mails (R-723); bind-page wording (R-725); volunteer guide current (R-722); ep0 cleanup and release evidence

2026-09-30 10:35:18 +02:00

selfbind_test.go

hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

2026-09-18 16:20:11 +02:00

selfbind_waiting_test.go

hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

2026-09-15 10:05:41 +02:00

selfbind.go

hub v0.137.0 source + burn-down round 2 in felhom.eu: R-277 R-581 R-600 R-544 R-855 R-134 R-92 R-292 R-599 R-725 R-728 (hub), R-819 R-857 R-555 R-364 R-587 (gates/tools), R-571 R-129 R-124-runbook (docs); 28 rows closed incl. catalog + agent v0.147.0 rows, R-350 merged into R-132, R-888 opened, R-887 mechanism (249 -> 222)

2026-10-05 19:43:37 +02:00

server.go

R-136: operator session cookie renamed to __Host-hub_session (always Secure, Path=/, no Domain)

2026-10-05 21:45:04 +02:00

system_bundle_test.go

hub v0.133.0 (R-859 test approvals end with the test; R-840 bundle on the System page, manifest, alarm); installer 1.31.0 (root files from the config bundle); bundle bootstrap script; golden 0.293.0 evidence; rulings 96–99; drill-r50 removed (evidence)

2026-10-04 20:18:37 +02:00

system_test.go

hub v0.140.0: a failed operator mail is retried (1, 5, 15 min); a Docker set needs a passing memory-kill check on every ring-0 box (decision 157)

2026-10-06 19:14:00 +02:00

system_trim_test.go

R-444: hub half — the System page shows each box's last disk trim

2026-10-06 11:29:17 +02:00

system.go

R-444: hub half — the System page shows each box's last disk trim

2026-10-06 11:29:17 +02:00

templatefetcher.go

…

version.go

…

wrapper_drift_test.go

hub v0.68.0 — auth_failed self-heal, consumed_at honesty gauge, wrapper drift (R-39 + R-50b(a))

2026-07-21 10:01:35 +02:00