Decisions 50 (apps off-site by default, R-720) and 51 (ep0 drill archives; restore test on own archives, R-727) recorded; Tester-2 read-only checklist

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-30 09:49:41 +02:00
parent cdf974d186
commit 4951fc2283
8 changed files with 87 additions and 0 deletions
@@ -191,6 +191,10 @@ the same way.

 ## 8. Storage & backup

+> **2026-09-30 (operator, `09` §3 decisions 50–51):** a new box's apps are in the off-site copy by default (07 §6);
+> the whole-guest restore test takes only the box's OWN archives — an earlier box's archive left in the customer's
+> ep0 namespace is never this box's proof, and the three drill archives found there are removed.
+
 **Tiers** (escalating failure scope):

 | Layer | Mechanism | Survives | Note |
@@ -297,6 +297,13 @@ fresh box the same day: five photos put into Nextcloud, deleted, restored from t
 and none of them opened (`audits/DRILL-prove-fixes-0243-2026-09-16.md`, R-537/R-538). Implemented in
 hub v0.116.0 (`handleConfigNewForm`). **What this ruling does NOT change: what any tier captures.**

+**[RULING 2026-09-30, operator — `09` §3 decision 50] …and every app on such a box is IN the off-site copy by
+default.** The 2026-09-16 ruling turned the tier on per customer; a per-app switch that started OFF left a new
+household's apps out of it (measured on a fresh box, `audits/DRILL-new-household-2026-09-30.md`, R-720). A newly
+installed app on a box whose customer has off-site is switched on at install. Over the customer's quota the page names
+the largest apps and the household chooses; **the box never deletes off-site history to make room without that
+choice.** Apps installed before the release are offered one press, never switched by the release itself.
+

 **The app update's safety precondition accepts ANY tier** (operator ruling 2026-09-13, controller
 v0.239.0, R-475): the first fresh copy in the order Tier 2, Tier 1, Tier 3; with none, it backs up
@@ -548,6 +548,19 @@ R-636's louder repeated alarm.
    is case-insensitive (termix's router ignores case). Final trick run: 113 tries on 11 apps, 0 got in.
    Same day, operator: CC changes the admin passwords of demo-hp's installed bookstack and calibre-web and stores them
    in the operator's credentials file (not in any repo).
+50. **Every newly installed app goes off-site by itself when the customer has off-site** — *operator ruling 2026-09-30
+    (R-720, option A).* It restores the intent of the 2026-09-16 ruling (`07` §6: Tier 3 ON for every new customer),
+    which a per-app switch starting OFF had undone. If the apps will not fit the customer's quota, the page says so,
+    names the largest, and the household chooses which stay off-site. Apps already installed are not switched by a
+    release (the 2026-09-29 Part 0 rule); the backups page offers one press to switch them all on.
+    **The box never deletes off-site history to make room without the household's choice.** *(Outcome: filled in by
+    the 2026-09-30 fixes session.)*
+51. **ep0: the three whole-guest archives of deleted drill boxes in `tester-1`'s namespace are removed, and only
+    those** — *operator ruling 2026-09-30 (R-727).* With before/after controls on every other namespace. The restore
+    test is fixed to take only the current box's own archives, so an archive of an earlier box in the same namespace
+    can never be tested again. *(Outcome: filled in by the 2026-09-30 fixes session.)*
+    Same day, operator: the first real tester gets a NEW customer record (`Tester-2`, domain `sajatfelhom.hu`), not
+    `tester-1`; and CC rewrites the volunteer guide as measured (R-722).

 ---

@@ -0,0 +1,17 @@
+# Tester-2 — read-only readiness check, 2026-09-30 07:47 UTC
+
+Nothing on Tester-2, Cloudflare, ep0 or the Storage Box was changed. Sources: the hub's customer page, the hub log,
+public DNS (`dns.txt`), Cloudflare GET calls with the API token stored on the record (`cloudflare-dns.txt`), ep0
+listing (`ep0-storagebox.txt`).
+
+| # | item | state | where to fix |
+|---|---|---|---|
+| 1 | Tunnel token pasted | **done** — names tunnel `3ce0eccd-…-43c093aa8822` (Peti's original tunnel, reused) | — |
+| 2 | DNS of `sajatfelhom.hu` | **done** — exactly ONE record: `*.sajatfelhom.hu` CNAME → that same tunnel, proxied (created 2026-02-27). No leftover pointing elsewhere. Today every name answers **530** = no connector, which is right with no box | — |
+| 3 | The tunnel's published route (`*.sajatfelhom.hu` → `https://traefik`, **No TLS Verify** ticked) | **UNKNOWN** — the API token on the record may read DNS only; the tunnel read answered `Authentication error` (stopped there) | Cloudflare → Zero Trust → Networks → Tunnels → this tunnel → Published application routes. Without the route the dashboard answers 503; without No TLS Verify, 502 (R-505, R-510) |
+| 4 | Off-site | **done** — ON, shared, 100 GB; new sub-account id 322460 (username `u629488-sub2` reused; Peti's sub-account 269130 was emptied and deleted 2026-09-25) | — |
+| 5 | DR tier (ep0) | **done** — ON; ep0 holds nothing for Tester-2 yet (made when the box connects) and nothing of Peti's | — |
+| 6 | The connect e-mail | **sent 07:36 UTC — TWICE** (the customer was created twice in the same second; two different links). Both valid until **2026-10-07 07:36 UTC** | If your friend installs after that: hub → Tester-2 → „Send self-bind link" (Part D makes this automatic) |
+| 7 | E-mail language | **English** — the connect mail, the bind page, the setup-code mail and the box itself start in English | Hub → Tester-2 → Edit → „Customer e-mail language", if your friend should get Hungarian |
+| 8 | Owner passphrase | yours to hand over (5 words, on the customer page) | in person or by phone |
+| 9 | Customer id `Tester-2` has a capital letter | **never walked before** with a capital; no known break | — (note only) |
@@ -0,0 +1,8 @@
+## 2026-09-30T07:47:44Z Cloudflare DNS records of sajatfelhom.hu (GET only, with the API token stored on Tester-2's record)
+Tester-2's tunnel token names tunnel id: 3ce0eccd-03f0-424a-90b9-43c093aa8822
+success True count 1 []
+  CNAME *.sajatfelhom.hu 3ce0eccd-03f0-424a-90b9-43c093aa8822.cfargotunnel.com proxied=True created 2026-02-27   <- THIS customer tunnel
+## tunnel 3ce0eccd-03f0-424a-90b9-43c093aa8822 (GET only)
+tunnel: False ['Authentication error'] name None status None deleted_at None connections 0 config_src None
+config: False ['Authentication error']
+  top originRequest None
@@ -0,0 +1,16 @@
+## 2026-09-30T07:47:11Z public DNS for sajatfelhom.hu (@1.1.1.1), read only
+NS: martha.ns.cloudflare.com. tony.ns.cloudflare.com. 
+sajatfelhom.hu A:  CNAME: 
+felhom.sajatfelhom.hu A: 172.67.162.57 104.21.90.232  CNAME: 
+www.sajatfelhom.hu A: 172.67.162.57 104.21.90.232  CNAME: 
+wiki.sajatfelhom.hu A: 172.67.162.57 104.21.90.232  CNAME: 
+paste.sajatfelhom.hu A: 172.67.162.57 104.21.90.232  CNAME: 
+photos.sajatfelhom.hu A: 104.21.90.232 172.67.162.57  CNAME: 
+nextcloud.sajatfelhom.hu A: 172.67.162.57 104.21.90.232  CNAME: 
+files.sajatfelhom.hu A: 104.21.90.232 172.67.162.57  CNAME: 
+jellyfin.sajatfelhom.hu A: 172.67.162.57 104.21.90.232  CNAME: 
+zzqx-nonexistent.sajatfelhom.hu A: 104.21.90.232 172.67.162.57  CNAME: 
+GET https://felhom.sajatfelhom.hu/ → 530 
+GET https://wiki.sajatfelhom.hu/ → 530 
+GET https://zzqx-nonexistent.sajatfelhom.hu/ → 530 
+edge cert: X509v3 Subject Alternative Name:      DNS:*.sajatfelhom.hu, DNS:sajatfelhom.hu 
@@ -0,0 +1,16 @@
+## 2026-09-30T07:48:15Z ep0 namespaces (read-only)
+demo-felhom
+demo-hp
+tester-1
+/mnt/pbs-datastore/ns/demo-felhom/:
+ct
+
+/mnt/pbs-datastore/ns/demo-hp/:
+ct
+
+/mnt/pbs-datastore/ns/tester-1/:
+ct
+felhom@pbs!demo-felhom
+felhom@pbs!demo-hp
+felhom@pbs!tester-1
+## Storage Box sub-accounts (GET only)