87 lines
5.6 KiB
Markdown
87 lines
5.6 KiB
Markdown
# REPORT — the record, the second promise, the removal chain (2026-08-12)
|
|
|
|
Commits `f76cbf0` (Part 0), `2389544` (spec + bake evidence), `125aec1` (R-300), `890a474` (STATUS).
|
|
Controller: `68f3e12` (R-299). All gates green in both repos; **`--no-verify` used nowhere** — the
|
|
currency gate refused a push mid-session and stayed refused until the bake made it true.
|
|
|
|
## Part 0 — the record now says what is true
|
|
|
|
Re-read from the hub's own store, with a control (escrow query returns 1+1 for each demo box, 0+0 for
|
|
`drill-r50`). Confirmed: **3 hosts total, no peti row under any name**; 4 escrow rows hub-wide, all
|
|
demo; `host_deletions` id=1 `peti-felhom-86d37d` **2026-07-15 08:56:22**, `escrow_acked = 0`; last
|
|
report **2026-07-15 08:39:00 UTC**, controller 0.115.0, `offsite: {escrow_state: "pending",
|
|
snapshot_count: 0}`; local app-data repo empty; dashboard never claimed. The `PETI` row and `STATUS.md`
|
|
now state that the mitigation they named **does not exist** — and leave the parked/not-parked ruling
|
|
open, because that is the operator's and the fact does not need his opinion to be true.
|
|
|
|
**Contact since the deletion — answered without touching the machine.** No inbound row of any kind
|
|
after 2026-07-15 08:39; the only later rows are the hub's OWN alarms (`source = hub`: `node_stale`
|
|
09:09:32, `node_down` 09:39:32). No contact attempt, accepted or rejected, in the current hub pod's
|
|
logs (since 2026-08-09 17:26Z) — grep proven by **851 `demo-hp` hits against 0 for peti, 0
|
|
unauthorized**. **The window 2026-07-15 → 2026-08-09 cannot be answered from records**: a report from a
|
|
deleted host 401s and is not persisted, and those logs are gone.
|
|
|
|
## Part 1/2 — the second promise (controller v0.212.0)
|
|
|
|
`backups_remote.html` line 98 — the **always-visible** half — still ended *„…visszaállíthatók
|
|
lehetnek"*. Replaced; the two accurate halves kept.
|
|
|
|
**Why it survived, which is the useful part:** the spec called that line *"Accurate; keep"*, **and the
|
|
guard matched one INFLECTION** (`visszaállítható lehet`) that the plural does not contain. Guard
|
|
broadened to the stem `visszaállíthat`. Spec corrected in both places.
|
|
|
|
**Plant → convict → remove → pass:** planted the exact shipped plural → the stem guard **FAILED** and
|
|
quoted it back; the old singular guard **does not match that sentence at all** (`False`, shown as a
|
|
pure string fact, not a contaminated source grep); removed → 5/5 orphan-card tests pass.
|
|
|
|
Two instrument defects fixed on the way: the guard's failure message sliced rendered HTML at a **byte**
|
|
offset and cut Hungarian mid-character (now rune-safe); and a first pass at the bake's acceptance
|
|
markers returned a false `0` through shell quoting — re-run with `grep -F`, because a zero from a
|
|
broken instrument is not a measurement.
|
|
|
|
## Part 3 — the removal chain (R-300), CODE ONLY
|
|
|
|
Confirmed at source: uninstall removes the snippet and **restarts** (`:1075-1082`), leaving the unit
|
|
enabled; the byo preflight then refuses on `:53`.
|
|
|
|
**The prompt's framing needed one correction:** the installer does **not** install dnsmasq — the
|
|
**agent** does (`lanresolver.go:107`), conditionally, and `felhom-agent` is fenced this session. So
|
|
ownership is recorded at **preflight**, before anything is installed, which is the only moment it is a
|
|
fact — not a package mtime. At removal: Felhom's → stop+disable; the owner's → restart only; **no
|
|
record (every box in the field) → restart only, fail-safe, with the reason and the command logged.**
|
|
The refusal keeps its two routes and its promise, and gains the missing line naming our own leftover.
|
|
|
|
**NOT OBSERVED LIVE.** The `drill-r50` install→uninstall→install cycle was not run, so the wrong
|
|
outcome was never quoted and **no `installer-v1.27.0` tag is cut.**
|
|
|
|
## Golden 0.212.0 — baked, published, round-trip verified
|
|
|
|
`4b0a7dacc503c38732ed0a44949398639248c7fbd90758a1e4a047c21a7a15d8`, 656 611 277 B, served bytes
|
|
re-downloaded and hashed identical. All six markers counted with `grep -F`. Token never on a command
|
|
line; leak grep 0, believable because a planted-token control grepped 1. Drill VM reverted to `virgin`.
|
|
Evidence: `documentation/tests/golden-0.212.0-2026-08-12/`.
|
|
|
|
## DROPPED — named plainly
|
|
|
|
- **The hub half of the naming (R-295)** — dropped first, exactly as the drop order allows. The four
|
|
hub surfaces were NOT enumerated at `file:line`; that enumeration is still owed.
|
|
- **The stale-golden observation (R-297)** — dropped second. Nothing published, which is the safe state.
|
|
- **And one that was NOT droppable: R-300's live cycle.** The code shipped; the demonstration did not.
|
|
Named here rather than shortened silently.
|
|
|
|
## Observations, not acted on
|
|
|
|
- **R-301** — the abandon countdown banner (`layout.html:143`) states the retired promise a third time
|
|
and un-hedged. It is probably TRUE where it renders, and it renders on every page; a rebuilt box can
|
|
have an active countdown while its store is orphaned. Not established: whether the two sentences name
|
|
the same bytes. Left alone deliberately — this session was fenced to the orphan card.
|
|
- The orphan card now says "we cannot determine / it depends on the key / write to us" **twice** once a
|
|
customer clicks through — reinforcement at the decision point rather than a contradiction, but worth
|
|
an eye if the card is revisited.
|
|
|
|
## Deliberately out of scope
|
|
|
|
The CI runs that fail with no log; the twenty facts the machines report that nothing reads; the nine
|
|
grey claims; the storage page's separate empty-list cause (R-298); and proving a *retained* key can
|
|
actually open an old store — the one thing the retention fix has never been shown to do.
|