felhom.eu/REPORT-window-button-sec-rm-2026-10-27.md

REPORT — 2026-10-27 evening: the clean-up window button (R-1299) and sec rm

Plain words first

1. The button is live on the hub: customer page → Backup & DR tab → „Off-site clean-up window". You granted a window on Tester 1 and cancelled it again; nothing was removed.
2. sec rm NAME works (cc-secrets 0.3.0): one name per call, saved in git, undo by git revert.
3. 46 store entries removed on your yes (names in documentation/audits/r1299-window-button-2026-10-27/sec-rm.txt): the two D55 token copies, 20 of the 10-20 rehearsal box, 14 of the night/fixes test boxes, 3 of the rig and the release BYO box, 5 of the 10-24 sweep box, R_C11_REWALK, R_PART4. The store went from 92 to 46.
4. You still do: nothing from this run. (Today's three do-items are done: agent 0.167.0 vouched, the D55 token revoked, Tester4-b5dbbd deleted.)

A defect of my own, found by your click and fixed: hub 0.174.0 logged each grant but stored NO event row (my code called only the dispatcher, which writes no row, and my test checked the call, not the row). Hub 0.174.1 stores the row; the test now reads the stored rows and fails on 0.174.0's shape. 0.174.1 also moved the card to Backup & DR, where you looked for it first.

Versions, digests, CI

	Version	Digest	From	CI
hub	0.174.0	sha256:4f9ee04a9ff7c108a37a411be3c3de521b6acccb431c9e550c3567f7211e2e94	d85198b8	2433 ✓
hub	0.174.1	sha256:bb43f88acd59b8b20914381932eb2d9f779d44c190c34d3349eed91d37ce71fb	de57c090 (manifest 714ee236)	2437 ✓
cc-secrets	0.3.0	—	dc82cf9	no CI in that repo; local suite 72 OK, red-proofs 28/28
agent pin	day0_agent 0.167.0	—	3055bc5	(end-of-run check)

Live: 0.174.0 at 19:25 CET, 0.174.1 at 20:26 CET; both Synced/Healthy, 0 restarts, hub-only ArgoCD sync, built from a clean clone (the shared clone held another session's uncommitted installer edit). 30-minute watch after 0.174.1 (to 21:13 CET): 0 warning-or-worse events, 0 WARN/ERROR lines, 10 box reports in the last 20 minutes, 0 restarts, no new alarm mail.

Tests

Hub TestR1299_* (five): the page per branch (and in the Backup & DR tab), a grant through the form stores one grant with its limit and one stored row, refusals store nothing (above the count, not a number, no confirm, no CSRF), the ceiling when no count is known (260 passes, 501 refused), cancel. Red-proofs: seven mutations, all caught (redproof-0174.0.txt, redproof-0174.1.txt). The tests were written after the code in Part 1 — so each was then seen failing by a mutation; Part 2's sec rm tests were written first and seen failing before the code existed.

Rows

Before 224 open → after 224. Closed: R-1299. Opened: R-1326 (the hub's start-up, 31–36 s, eats half its liveness margin of ~65 s). Updated: R-1237 (its dead names are gone from the store; the sweep no longer watches those values; the transcripts are unchanged).

Observations

• FILED R-1326 — hub start-up vs the liveness probe.
• FIXED in-session — the window event wrote no row (0.174.0 → 0.174.1).
• FIXED in-session — the card's place (Backup & DR).
• NOT-A-FINDING: CC cannot press the button — its token has no offsite:write and CC holds no hub password, by design (09 §3 decision 251); the live click was the operator's.
• NOT-A-FINDING: the sec doctor sweep line still lists the removed names — it reports the LAST night's sweep (03:40 UTC), before the removal.