ipk install on feed-less system zeroes nodogsplash (+ curl/socat/jq/libmicrohttpd) — postinst swallows the dead portal [fork#93 class, new forensics] #109

What

Installing the tollgate-wrt ipk on a system with no feed lists (no opkg update first) aborts the transaction mid-flight, and opkg's orphan-removal then zeroes runtime dependencies. Reproduced 2026-10-07 on the PRTA virtual lab (fresh OpenWrt 24.10.1 x86_64 VM, v0.6.0-rc1-local x86_64 ipk built by packaging/local-build-ipk.sh):

# after opkg install --force-overwrite /tmp/tollgate-wrt_v0.6.0-rc1-local_x86_64.ipk
wc -c /usr/bin/nodogsplash /etc/init.d/nodogsplash
        0 /usr/bin/nodogsplash
        0 /etc/init.d/nodogsplash

Also zeroed in the same event: /usr/bin/curl, /usr/bin/socat, /usr/bin/jq, and libmicrohttpd.so.12 (ndsctl then dies with Exec format error). opkg search can no longer map the zeroed files back to packages (bookkeeping lost) — repair-by-reinstall is whack-a-mole; the instance is a write-off.

Deploy log signature at install time:

Collected errors:
 * remove_obsolesced_files: unlinking /etc/uci-defaults/92-tollgate-admin-setup failed: No such file or directory.
Removing obsolete file /lib/apk/packages/tollgate-wrt.list.

Why it stays hidden

postinst ends with:

/etc/init.d/nodogsplash restart 2>/dev/null || true

— a zero-byte binary + empty init script restart is a silent no-op. The package installs "successfully"; the captive portal is dead; every downstream symptom looks like a product bug (this exact confusion cost PRTA hours: the deployed VM served :2121/:2051 fine with NO portal on :2050).

Relationship to #93

The preinst comment documents the class ("an aborted opkg transaction then orphan-removed runtime deps (nodogsplash et al.)"). This report adds: (a) the zero-byte forensic signature, (b) the feeds-absent trigger (Depends: nodogsplash unresolvable → forced transaction → orphan removal), (c) the multi-package blast radius, (d) the postinst swallow.

Suggested hardening (either closes the class)

1. postinst fail-loud: after the restart, verify [ -s /usr/bin/nodogsplash ] and ndsctl status — exit non-zero with a loud message instead of || true. A dead portal must never install "successfully".
2. Optionally preinst check: warn when /var/opkg-lists/ is empty (dependency resolution will be degraded).

PRTA runner already hardened on our side (opkg update before install + an NDS health gate that fails the run RED with the exact symptom).