# OVERSEER-STATUS

## 2026-07-20 — M-B4 rung-1 (LAN Gitea) safe prep, pre-live-fire
- Backup: `.backups/gitea-rung-2026-07-20.credrot.age` (age-sealed, 2 entries of `gitea/` prefix); **verified decrypts**; restore key custodied in gopass `incredigo/backups/gitea-rung-2026-07-20` (no plaintext on disk). Store confirmed intact.
- Selectors (read-only, via Tailscale `100.117.177.50:3030`; LAN IP dead): login `#user_name` ✅ `#password` ✅ submit **fixed** `.ui.primary.button` ✅ (seed `[type=submit]` MISSED — corrected in sites.go). Change page 303→/user/login ✅ confirms `LoginBeforeChange`.
- Unconfirmed (auth-gated, defer to live-fire; self-heal covers): change-form `#old_password`/`#password`/`#retype`/submit; login SuccessText.
- Zero Gitea writes; no submit performed. **Blocked on Andre:** (1) push local commits `1db4134`+`e11d2f0`(+uncommitted sites.go selector fix); (2) explicit go for the live rotation.

## 2026-07-21 — M-B4 LIVE-FIRE DONE: first REAL browser password rotation (LIVE-REAL)
- **Rotated** the self-owned Gitea login password (`trill-technician` @ `100.117.177.50:3030`, gopass `gitea/login-creds`) end-to-end via `lab/rung4-gitea-browser` (MODE=live): backup gate 3 gitea entries sealed+verified → pre-change login(OLD) → change-form submit → **site confirmed** → new stored to gopass → verified by browser re-login **and** independent API re-auth (HTTP 200). Old password now dead (confirmed). Metadata lines (username/url/notes) restored on the entry.
- **Engine fixes from the live-fire (all tested green, 11 pass, -race clean):** (1) `sites.go` submit selectors drop `[type=submit]` (Gitea buttons have only the default DOM property, no attribute) — login `.ui.primary.button`, change `form[action$='/user/settings/account'] button`; (2) `RodDriver.Click` waits for post-submit navigation to settle before reading success text (remote round-trip vs instant in-process test); (3) new `RodDriver.Insecure` = `--ignore-certificate-errors` for the self-signed/Tailscale host.
- **Proof-as-data:** `GiteaSite.Proof` promoted UNPROVEN → **ProofLiveReal**; docs (`BROWSER-ROTATION.md` §9, `BROWSERROT-PLAN.md`) updated. Safety held throughout: the two prior failed attempts (submit selector miss) left the password UNCHANGED (API 200 confirmed) — fail-safe worked. Seal passphrase custodied in gopass `incredigo/backups/gitea-rung4-browser-2026-07-20`. **Not yet committed/pushed.**