{
  "date": "2026-11-10",
  "cause": "A failed one-shot device authentication transitioned DESKTOP_LIST to CONFIG and had no authentication retry; the first underlying network/TLS/HTTP failure was not logged.",
  "changes": [
    "Stay on desktop selection for authentication failure",
    "Retry after completion with 2/4/8/16/30 second backoff",
    "Do not load local authorization or request tickets before authentication",
    "Log authentication HTTP status and network error code without credentials"
  ],
  "ctest_groups_passed": 4,
  "new_regression_scenarios": [
    "offline startup and recovery without restart",
    "HTTP 403 followed by authorization recovery",
    "slow authentication does not overlap",
    "synchronous invalid CA configuration stays on selection",
    "local POC mode still loads desktops"
  ],
  "deployed_kiosk_sha256": "9dba9c66092aa9ccf67477b305aaefe09f52eabb8c6b30dbbcbb1ce43dc7a6a6",
  "previous_kiosk_sha256": "2cca9d2d183c2f34f0f6172db207649decb2799414f9443043d175bbb19d33a1",
  "backup": "/home/armbian/vdi-terminal/backups/boot-device-auth-20261110/",
  "live_checks": {
    "device_auth": "ready",
    "authorized_desktops_http": 200,
    "authorized_desktops_count": 3,
    "session": "vdi-kiosk",
    "boot_id": "7ca3f9d2-9316-45cd-a490-7fc5c3db8ec4",
    "kernel_rebooted": false,
    "host_desktop_processes": false,
    "selection_screenshot": "selection-page.png"
  },
  "power_cycle_validation": "Not performed; recovery scenarios used isolated HTTPS test platform on the box."
}