A second host, and the first thing that was not replicated

Everything in the provisioning script arrived on the new host, and three things that were not in it did not.

found by comparing the two hosts after provisioning:

  the ACME account key    the new host would have
                          registered a second account
                          and hit a rate limit
  the sealed logrotate
    state                 a rotated log with the same
                          name, both hosts, same
                          object store prefix
  a cron entry added in
    January for a
    one-off backfill      still there, still running,
                          on a backfill that finished
                          in February

none of these are configuration. all three are state.

A provisioning script describes configuration and a host accumulates state, and the difference is invisible until a second host exists. The one-off cron entry is the ordinary finding — a temporary job that outlived its purpose and would have been duplicated onto the new machine.