Tester 2's RESET checked read only: every leg ok, the first live R-32 purge (folder held no repository; sub-account gone), ep0 namespace+copy+prune job+token gone, no other customer touched (Storage Box 303/62/43 and ep0 2/2/2/1/27 before = after); hand-over: tell the friend go; A20 third firing; R-32 result + dated check for Tester4

documentation/architecture/capability-map-detail/A.md

@@ -407,6 +407,15 @@ the ten places a household gets stuck are in `audits/rehearsal-2026-10-20/B10-st
 
 **Evidence (as written):** **`tests/VALIDATION-n100-rehearsal-2026-07-18.md` — two live firings, both host-delete-first, on two different customers** (`demo-vm-felhom` 15:49:57, `demo-felhom` 16:08:51): every leg `ok` (`claim`, `db_purge`, `descriptor`, `hetzner`, `pbs`), escrow acked separately, each completing in 8–9 s (`hub-state.txt` `customer_resets`). The **Hetzner sub-account destruction is now verified against the live pool box** — and produced the run's sharpest lesson: **a sub-account is an access-control object, not a data object.** Deleting it left its `/home` intact, so re-enabling offsite recreated an account over the previous lifecycle's ciphertext under a key this same RESET had destroyed — which is why the orphan guard fired at 16:58:14 (**a finding by S7's own criterion**) and why RESET now needs a base-dir purge → **R-32**. Prior: hub v0.61.0 REPORT; **ep0 live drill 2026-07-17** (throwaway `drill-reset-01` with a real backup: deprovision `deleted:true` destroyed the namespace + backup group + token, idempotent re-run `deleted:false`, all 3 real tenants + shared user survived); red-proofs (ack-gate, partial-failure resumability) + orchestration/store/offsite/render tests
 
+**Third live firing — 2026-10-22, a real customer (Tester-2), the first with the R-32 purge-first off-site leg (hub
+0.165.0):** host delete 12:54:47 UTC, RESET 12:55:56–12:56:04, every leg `ok`. The off-site leg logged in with the
+sub-account's own password, found no repository (the box never ran an off-site backup — so the removal of a folder
+WITH data is still not seen live), re-listed and deleted the sub-account; ep0's namespace with its one whole-box copy
+(2026-10-04), its prune job and its token are gone; the customer, address, domain, language, tier choice and quota
+stayed. **No other customer touched:** the three live boxes' repositories re-listed with their own keys equal the hub's
+05:10 listing (303 / 62 / 43); every other ep0 namespace equals today's 03:30 prune keep-list (2 / 2 / 2 / 1; operator
+27). Evidence `audits/tester2-reset-2026-10-22/`.
+
 **Gap / roadmap (as written):** External teardown FIRST, DB purge LAST, every leg idempotent; refuses while any host row exists; separate escrow-custody ack; clears claim (fresh code next onboarding); keeps the offsite tier CHOICE, drops provisioned fields. **Live-clicked 2026-07-18** (twice, by Viktor) — this supersedes the earlier "not live-clicked / Hetzner delete unit-tested only" note. **R-25b CLOSED (hub v0.69.0, 2026-07-21):** the Danger-zone DELETE is now the guided full-teardown cascade that runs this very sequence as its middle leg — see the row below
 
 ---