hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

Four paper debts and one fact given a reader. Hub-only — nothing to bake.

A4 — the entry about "the tester's machine" named a risk correctly and labelled it
in a way that invited deleting it. Established from the hub's own store: `peti-felhom`
is a REAL machine (482 reports, 2026-02-27 → 2026-07-15, a named person's own box) and
the 3.6 GB with no key and no backup is real. `david` → `tester-1` is a DIFFERENT record
with no host, no escrow and no report, ever — deleted 07:55:49 and re-created 07:56:47
this morning. The prompt's premise conflated the two; the register now says which is which.

A1 — R-312/R-313/R-303 recorded as DECIDED with their re-open triggers, and moved out
of STATUS's "Waiting on you", which is now empty.

A3 — day0-install §C.1 said pushing the installer publishes it. It has not since
R-110. Corrected, with the two manifest pins named and an outside-verification command;
the one copy that repeated it (a dated audit, true when written) carries a superseded note.

A5 — standing rule 5: evidence comes off the machine at the end of the phase that
produced it, before any revert. Earned twice in three days on the same box at the same
point (R-320). Four homes, plus what to do when it is already gone.

R-295 hub half — „Beállító kód" everywhere; „Visszaállító kód" retired. New `reenroll`
mail kind so the mail names the page a REBUILT box actually shows („A szerver
beállítása"), not the „Elfelejtett jelszó" page it has no login screen to reach.
Naming only; the acceptance pin proves the secret is untouched.

R-319 — the hub models `guest_net` after 23 days of receiving and discarding it. The
signal is `heals_last_hour`, not `state`: a guest the watchdog keeps repairing reads
healthy between repairs. `heal_succeeded` decoded too (R-260's lesson). Unknown is never
drawn as healthy — three absences, three sentences. No alarm, deliberately.
Three red-proofs, mutations asserted applied. Wire-gate checked tags 182 → 190.

B1 — the operator's 2026-08-12 dispositions were NOT in the register; they are now.
Third allowlist kind for the five ruled "no reader wanted"; `reporting_disabled`
reclassified redundant. 8 read · 5 deliberately unread · 1 redundant · 6 still owed.

Also filed: R-321 (a deliberately-silent box still alarms stale/down — the checker is
age-only, and decoding the flag would not have fixed it), R-322 (the claim guard has
never scanned the hub; a hand scan returns zero, so it is a scope gap, not a defect).

hub/internal/claim/engine.go

@@ -29,8 +29,21 @@ type EmailKind string
 
 const (
 	EmailClaim   EmailKind = "claim"   // first setup: "Elindult a Felhom szervered"
-	EmailReset   EmailKind = "reset"   // forgotten password
+	EmailReset   EmailKind = "reset"   // forgotten password — the box HAS a password
 	EmailClaimed EmailKind = "claimed" // confirmation after a successful claim (carries no code)
+	// EmailReenroll — the box was wiped and re-enrolled, so the fresh controller has NO password
+	// while the hub-side claim is still set (ReissueForReenroll).
+	//
+	// R-295 (hub half, 2026-08-13): THIS EXISTS BECAUSE THE MAIL MUST NAME THE PAGE THE MACHINE IS
+	// ACTUALLY SHOWING. Both situations deliver the same secret and it keeps the same name — the
+	// three-word „Beállító kód" — but they do NOT show the same screen, and only the hub can tell
+	// them apart, because it is the hub that chose which call site fired. A rebuilt box renders
+	// „A szerver beállítása" (controller `web/claim.go:279`: `reset := s.authEnabled()`, and a fresh
+	// controller has no password), and it serves no login page — so it has no „Elfelejtett jelszó"
+	// link at all. Sending a re-enrolled customer to that page names a route that is not on their
+	// screen. Splitting the KIND rather than the NAME is what the ruling asks for: one secret in two
+	// situations keeps its name, and the sentence around it changes.
+	EmailReenroll EmailKind = "reenroll"
 )
 
 // Mailer delivers a claim-arc email. The code is passed through and MUST NOT be persisted or
@@ -178,7 +191,8 @@ func (e *Engine) ReissueForReenroll(cc *store.CustomerConfig) (gen int, reissued
 	if cs == nil || !cs.Claimed() {
 		return 0, false, nil // unclaimed → first-provision path; nothing to re-issue
 	}
-	gen, err = e.rotateAndSend(cc, EmailReset)
+	// EmailReenroll, not EmailReset: same secret, same name, different screen — see the constant.
+	gen, err = e.rotateAndSend(cc, EmailReenroll)
 	if err != nil {
 		return gen, true, err // reissued=true so the caller records the attempt even on email failure
 	}