REPORT — the record, the second promise, the removal chain (2026-08-12)

Commits f76cbf0 (Part 0), 2389544 (spec + bake evidence), 125aec1 (R-300), 890a474 (STATUS). Controller: 68f3e12 (R-299). All gates green in both repos; --no-verify used nowhere — the currency gate refused a push mid-session and stayed refused until the bake made it true.

Part 0 — the record now says what is true

Re-read from the hub's own store, with a control (escrow query returns 1+1 for each demo box, 0+0 for drill-r50). Confirmed: 3 hosts total, no peti row under any name; 4 escrow rows hub-wide, all demo; host_deletions id=1 peti-felhom-86d37d 2026-07-15 08:56:22, escrow_acked = 0; last report 2026-07-15 08:39:00 UTC, controller 0.115.0, offsite: {escrow_state: "pending", snapshot_count: 0}; local app-data repo empty; dashboard never claimed. The PETI row and STATUS.md now state that the mitigation they named does not exist — and leave the parked/not-parked ruling open, because that is the operator's and the fact does not need his opinion to be true.

Contact since the deletion — answered without touching the machine. No inbound row of any kind after 2026-07-15 08:39; the only later rows are the hub's OWN alarms (source = hub: node_stale 09:09:32, node_down 09:39:32). No contact attempt, accepted or rejected, in the current hub pod's logs (since 2026-08-09 17:26Z) — grep proven by 851 demo-hp hits against 0 for peti, 0 unauthorized. The window 2026-07-15 → 2026-08-09 cannot be answered from records: a report from a deleted host 401s and is not persisted, and those logs are gone.

Part 1/2 — the second promise (controller v0.212.0)

backups_remote.html line 98 — the always-visible half — still ended „…visszaállíthatók lehetnek". Replaced; the two accurate halves kept.

Why it survived, which is the useful part: the spec called that line "Accurate; keep", and the guard matched one INFLECTION (visszaállítható lehet) that the plural does not contain. Guard broadened to the stem visszaállíthat. Spec corrected in both places.

Plant → convict → remove → pass: planted the exact shipped plural → the stem guard FAILED and quoted it back; the old singular guard does not match that sentence at all (False, shown as a pure string fact, not a contaminated source grep); removed → 5/5 orphan-card tests pass.

Two instrument defects fixed on the way: the guard's failure message sliced rendered HTML at a byte offset and cut Hungarian mid-character (now rune-safe); and a first pass at the bake's acceptance markers returned a false 0 through shell quoting — re-run with grep -F, because a zero from a broken instrument is not a measurement.

Part 3 — the removal chain (R-300), CODE ONLY

Confirmed at source: uninstall removes the snippet and restarts (:1075-1082), leaving the unit enabled; the byo preflight then refuses on :53.

The prompt's framing needed one correction: the installer does not install dnsmasq — the agent does (lanresolver.go:107), conditionally, and felhom-agent is fenced this session. So ownership is recorded at preflight, before anything is installed, which is the only moment it is a fact — not a package mtime. At removal: Felhom's → stop+disable; the owner's → restart only; no record (every box in the field) → restart only, fail-safe, with the reason and the command logged. The refusal keeps its two routes and its promise, and gains the missing line naming our own leftover.

NOT OBSERVED LIVE. The drill-r50 install→uninstall→install cycle was not run, so the wrong outcome was never quoted and no installer-v1.27.0 tag is cut.

Golden 0.212.0 — baked, published, round-trip verified

4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8, 656 611 277 B, served bytes re-downloaded and hashed identical. All six markers counted with grep -F. Token never on a command line; leak grep 0, believable because a planted-token control grepped 1. Drill VM reverted to virgin. Evidence: documentation/tests/golden-0.212.0-2026-08-12/.

DROPPED — named plainly

The hub half of the naming (R-295) — dropped first, exactly as the drop order allows. The four hub surfaces were NOT enumerated at file:line; that enumeration is still owed.
The stale-golden observation (R-297) — dropped second. Nothing published, which is the safe state.
And one that was NOT droppable: R-300's live cycle. The code shipped; the demonstration did not. Named here rather than shortened silently.

Observations, not acted on

R-301 — the abandon countdown banner (layout.html:143) states the retired promise a third time and un-hedged. It is probably TRUE where it renders, and it renders on every page; a rebuilt box can have an active countdown while its store is orphaned. Not established: whether the two sentences name the same bytes. Left alone deliberately — this session was fenced to the orphan card.
The orphan card now says "we cannot determine / it depends on the key / write to us" twice once a customer clicks through — reinforcement at the decision point rather than a contradiction, but worth an eye if the card is revisited.

Deliberately out of scope

The CI runs that fail with no log; the twenty facts the machines report that nothing reads; the nine grey claims; the storage page's separate empty-list cause (R-298); and proving a retained key can actually open an old store — the one thing the retention fix has never been shown to do.

5.6 KiB Raw Blame History