felhom.eu/REPORT-rehearsal-2026-10-20.md

# REPORT — Tester-2 rehearsal with a pretend household + an independent data-loss hunt (2026-10-20 → 21)

> Run 2026-10-20 09:30 UTC → 2026-10-21 ~09:50 UTC. Drafted before the night, finished in the morning. This repo's
> shared `REPORT.md` was not touched: a parallel session works in the same clone, and the repo rule says the second
> session writes `REPORT-<topic>.md` only (the brief asked for both; this line is why one was skipped).
> Evidence: `documentation/audits/rehearsal-2026-10-20/` (journal, A0–B10, screens) and
> `documentation/audits/dataloss-hunt-2026-10-20/` (C1–C3). Architecture read for the claims: `07-backup-architecture.md`,
> `10-localisation.md`, `00-capability-map.md` (A15).

## Five sentences

A pretend household installed a box from the public ISO, linked it, claimed it, put eight apps and about 2 GB of family
data on it, used it for a day, and every customer restore path brought its data back. The first night's backups, the
clock change, three days off and power cuts in the middle of installs and catch-ups all worked, and the morning data was
byte-identical to the evening's. But the 8 GB minimum box froze twice on its first afternoon and only a plug pull helped
(R-1192), and the household's warning mails went to the operator instead (R-1199). When the box died, the household could
not even start again without the operator, and after the operator's press the rebuilt box could not reach its off-site
history at all — proven live (R-1176, P1). Nothing was released; 29 new register rows carry the rest.

## The ten places a household gets stuck

`documentation/audits/rehearsal-2026-10-20/B10-stuck/README.md`. In short:

1. The box froze twice on the first afternoon (≈1 h and ≈35 min); only pulling the plug helped (R-1192, P1).
2. The bind page needs an owner passphrase the household does not have — 2 h 4 min waiting for the operator.
3. A power cut during a full off-site restore leaves the app on the backup's older data; the page only says „interrupted" (R-1195).
4. A pulled drive breaks the last uploads (0 bytes or gone) although each was confirmed (R-1196).
5. The family's warning mails went to the operator, not the family (R-1199).
6. „Ödön" and „Írisz" are refused as family names (W12).
7. A new drive needs a „mount name" nobody knows; the button silently does nothing (W13).
8. Sharing waits for ever for a password the page never asks for (W21).
9. Errors arrive as raw technical English (W22, W25).
10. After the box died, the household was promised a mail that never came, and after the operator's press the rebuilt box
    could not reach the family's off-site data (R-1203, R-1176). (Close behind: three apps' wrong „first steps", W17–W19.)

## Data-loss findings, ranked

| row | Sev | harm | reproduced | design / defect |
|---|---|---|---|---|
| R-1175 | P1 | shares on two drives sharing one second drive: every night one drive's share copy is pruned; the night a drive dies its copy is deleted | unit test on production code (`C3-D1-shares-tier2/`) | defect |
| R-1176 | P1 | a box rebuilt after „delete the old host" cannot reach its off-site history: no recovery code asked, a new key, the old history set aside on night one | hub store unit test (`C3-K1-…`) + **LIVE in B7** (2026-10-21) | defect |
| R-1191 | P1 | a `.fab` import makes a family-only app open to anyone | LIVE on scratch 9202 | defect (security) |
| R-1192 | P1 | the 8 GB box froze under first-day use; two plug pulls | LIVE on Tester4 (twice) | defect — cause not diagnosed (no shell on the box) |
| R-1177 | P2 | a failed local restore destroys the live data, keeps no copy | LIVE on 9202 | design question (D22 in STATUS) |
| R-1195 | P2 | a power cut mid full off-site restore: app on the backup's data, page says only „interrupted" | LIVE on Tester4 (B6 #2) | defect |
| R-1178 | P2 | second-drive „whole restore" can change files, refuse the DB, leave the app stopped and say „untouched" | unit test | defect |
| R-1180 | P2 | the nightly mirror (`rsync --delete`) can run during a restore from it | unit test | defect |
| R-1181 | P2 | a missing app folder deletes its second-drive copy in one night (the only copy for optional folders) | unit test | defect (D23 in STATUS) |
| R-1179 | P2 | a drive marked „away" can still be the second-drive target | code + unit test | defect |
| R-1182 | P2 | abandoning one set-aside off-site copy deletes every retained key package | code | defect |
| R-1199 | P2 | warning mails reach the operator, not the household | LIVE (two mailboxes) | defect |
| R-1204 | P2 | a box that ran once with its clock ahead loses its WireGuard tunnel to ep0 (PBS copies + operator door) until that date | LIVE (B6 #8, ep0 `wg show`) | defect |
| R-1203 | P2 | after a box death, the household is promised a link mail that never comes until the operator deletes the old host | LIVE (B7) | defect |
| R-1185 | P3 | a dump that fails its own check has already replaced the good one | unit test (docker stub) | defect (order) |
| R-1186 | P3 | the nightly off-site copy is skipped silently when another backup holds the flag | code | defect |
| R-1184 | P3 | a cut-off shares restore can be reported restored with files missing | code | defect |
| R-1196 | P3 | uploads confirmed just before a drive pull are 0 bytes or gone | LIVE (B6 #4) | defect |
| R-1183 | P3 | on 2026-10-25 every hub daily job runs twice (DB snapshot keep-2 pruned a day early) | replay of the hub's arithmetic | defect (D24 in STATUS) |
| R-1200 | P3 | an afternoon install gets no whole-box backup on night one | LIVE (B5) | design question |
| R-1202 | P3 | a box with its clock behind stops an app silently and only says „Hub nem elérhető" | LIVE (B6 #8) | defect |
| R-1187 … R-1190 | P3 | the unproven candidates of the four reviewers, grouped | code reading | mixed |

## Failure scenarios (B6)

| # | scenario | result | evidence |
|---|---|---|---|
| ★1 | power cut mid app install | PASS — clean rollback, honest event, reinstall in 15 s | `B6-failures/s1-…` |
| ★2 | power cut mid off-site restore | 6 s: safe; 14 s: app on the backup's data, page „interrupted" → R-1195 | `s2-…` |
| ★3 | data disk 100 % during backup | PASS — warned at 89 %, refused before writing, healed; SMB error unclear; system disk 97 % not run | `s3-…` |
| ★4 | data drive pulled, put back | apps stopped in 42/34 s, back by themselves; last uploads 0 B/missing → R-1196 | `s4-…` |
| ★5 | slow lossy line, first big off-site | run failed under 1 Mbit + 5 % loss, raw English; second press OK 3 m 38 s | `s5-…` |
| ★6 | off-site blocked | failed in 2.5 min, raw English; catch-up OK 2 m 37 s (shortened, not a night) | `s6-…` |
| ★7 | DST | PASS — the database copy ran once, at the second 02:30; W30 (no summer/winter mark in the repeated hour) | `s7-dst/` |
| ★8 | wrong clock at boot ±2 y | FINDINGS — −2 y became −6 months (the OS floor): „Hub nem elérhető" only, Paperless stopped silently (R-1202); +2 y: a whole-box archive dated 2028 (R-1189 a), then the ep0 tunnel dead (R-1204) | `s8-wrong-clock/` |
| ★9 | two actions at once | PASS — second action refused with a clear sentence | `s9-…` |
| ★10 | box off 3 days (+#15 restart in the catch-up) | PASS — ONE catch-up, a clear note to the household, the interrupted catch-up recovered | `s10-three-days-off/` |
| 11 | hard reset mid app update | NOT RUN — no update was offered to the box (nothing was released during the run) | — |
| 12 | DNS dead 1 h | PASS for data; operator told after ~37 min, household never | `s12-…` |
| 13 | second drive added later | not offered as the backup place → R-1198; safe removal OK; blank texts (W29) | `s13-…` |
| 14 | remove keeping data → reinstall „use kept data" | PASS — 47/47 documents, 47/47 originals | `s14-…` |
| 16 | English browser / English dashboard | follows the household's setting (by design); a few Hungarian strings → fixed W26 (unreleased) | `s16-…` |

## Restore paths (B8)

All seven customer paths PASS on the live box (`B8-restores/README.md`): A.1.1 Mealie unit 17 s; A.1.2 Nextcloud from
the second drive 3/3 sha256; A.1.3 Radicale verify copy 5 s; A.1.4 Nextcloud missing-only 3/3 sha256 (NFC/NFD: both
names come back on the share; Nextcloud itself folds NFD into NFC); A.1.5 BookStack full off-site 30 s; A.1.6 shares
2 files; A.1.7 `.fab` Mealie. Gaps: the messages do not say which point in time or how many files.

## Night chain and DST

**The first night (B5), no hands:** database copy 00:30Z PASS (3 m 27 s); second-drive copy 01:30Z PASS (8 apps + the
share, 58 s); off-site 02:15Z PASS (44 snapshots, 3 m 6 s, nothing deleted; the hub's own listing agrees: 44 files,
newest 02:18Z); whole-box backup NOT RUN — not due under the 24 h rule, because the install's own backup at 12:09Z
started the clock (R-1200, P3: the family's first day reaches a whole-box copy only on the second night). At 02:46Z
demo-hp's own kernel update rebooted the test host and shut the rehearsal VM down (harness, not a Tester4 defect; a BYO
host skips that step by design). Health 200 all night before that; memory steady. **The morning data snapshot is
identical to the evening one, byte for byte** (`B5-night/README.md`).

**DST (#7), live:** the box was started with its clock at 2026-10-25 02:20 CEST and left alone: no database copy at the first 02:30, one at the second (01:30:00Z, 1 m 55 s). The code replay agrees for the box; the hub runs every daily job twice on that day (R-1183, D24) and spring 2027 puts the 02:30 dump on the 03:30 copy (`B6-failures/dst-replay/`).

## Interventions (operator-only acts)

| # | when (UTC) | what | minutes the household waited |
|---|---|---|---|
| 1 | 09:57 → 12:00:57 | the owner passphrase handed over (by design, out of band) | 124 |
| 2 | asked 09:35, done 12:01–12:15 | off-site switched on for Tester4 | 0 (done before the household needed it) |
| 3 | asked 08:59, done ~09:11 (2026-10-21) | delete host Tester4-816e21 before the reinstall (B7) | ~12 (and 17 min of a dead end before it, R-1203) |

Not counted as interventions: the two plug pulls (14:11, 16:13) — a household can do that, and did.

## Versions

controller 0.336.0 (`7ca59e2`, floor), agent 0.161.0 (`4e1621c`), hub 0.162.0, golden 0.331.0, min_agent 0.158.1,
installer 1.35.0, ISO 1.29.0 (sha256 `dceacae5…4829`), catalog `c50adfc6` (65 templates). Nothing was released, deployed,
vouched, baked or published during the run. One text fix was committed, not released: controller `01c967e` (W26).

## Browser spike (A4)

Works: Chromium 155 + Playwright 1.52 in a throwaway LXC on demo-hp, phone and computer, HU and EN, in ~12 minutes.
121 screenshots. Limits: no real DNS/TLS for the household's address; not a human. `A4-browser/README.md`.

## Teardown

Machine: VM 9320, CT 9330 and the ISO removed from demo-hp by their own IDs; no drill firewall rules left; memory back
to the start. DooPlex: three watchers stopped by PID. Hub: **host Tester4-648b80 is left for the operator to delete**
(the customer Tester4 stays). ep0: one PBS snapshot `ns/Tester4/ct/9201/2026-10-20T12:17:26Z` and the WireGuard peer
10.77.0.6 remain; the Storage Box keeps the household's restic history — listed, nothing removed (`D-teardown/`).

## Secrets (names only)

All in `sec`, prefix `REHEARSAL_2026_10_20_`: `9202_PW`, `9202_RESETCODE`, `APP_BOOKSTACK`, `APP_RADICALE`,
`APP_VAULTADMIN`, `BIND_TOKEN`, `BOOKSTACK_TOKEN`, `DASH_PW`, `FAMILY_IRISZ`, `FAMILY_KATA`, `FAMILY_ODON`,
`INSTALL_ROOTPW`, `IRISZ_PW`, `KATA_PW`, `ODON_PW`, `OLD_BIND_TOKEN`, `PAIRING_CODE`, `PASSPHRASE`, `RECOVERY_CODE`,
`SETUP_CODE`, `SMB_PW`. Kept (the operator decides); none written anywhere else. Evidence scanned for their values:
0 hits.

## Register

Before 153 open rows; now 182. Opened by this run: 29 (R-1175 … R-1200, R-1202, R-1203, R-1204). Closed: R-1019 (a dated
check read on demo-felhom, read-only). One row (R-1201) came from a parallel session. Updated: R-1176 (proven live),
R-1189 (a half-live), R-895 (first verdict), R-435 (moved). Capability map: A15 still PARTIAL with new evidence; A12 and
A13 PROVEN-LIVE → PARTIAL (B7). `unproven.py --summary`: unchanged (35 of 55 not walked).

## Observations

FILED: everything in the tables above. NOT-A-FINDING: the dashboard ignores an English browser (by design: the
household's setting wins); Nextcloud folding NFD into NFC (upstream behaviour; both forms survive on the share); the
films' off-site size (CBR filler compresses; nothing missing); demo-hp's own kernel reboot at 02:46 (a harness effect: a
BYO host skips that step by design, `osupdate/leg.go:674`). FILED: everything in the tables above.

**Harness slips (mine), each recorded in the journal:** a screenshot step blanked a form before submit (15 min lost); the
two watcher logs froze at 20:24 when `git pull --autostash` replaced their files (recovered in full from the open files);
my first #10 start used a date the #7 records had made meaningless (restarted, recorded before any result). **Secrets:**
the nightly DooPlex sweep found three rehearsal secret values in my session record (the old and new bind tokens and a
setup code — I had read their mails in full and typed one into a `sec put`); in B7 a second bind link and setup code
entered the record the same way. All are one-time values, spent within minutes; nothing secret is in any committed file
(323 files scanned, 0 hits; pictures checked by eye; the B7 pairing code was blacked out).