hub v0.104.0: the guest network gets a reader (R-319), and the hub half of the naming (R-295)

Four paper debts and one fact given a reader. Hub-only — nothing to bake.

A4 — the entry about "the tester's machine" named a risk correctly and labelled it
in a way that invited deleting it. Established from the hub's own store: `peti-felhom`
is a REAL machine (482 reports, 2026-02-27 → 2026-07-15, a named person's own box) and
the 3.6 GB with no key and no backup is real. `david` → `tester-1` is a DIFFERENT record
with no host, no escrow and no report, ever — deleted 07:55:49 and re-created 07:56:47
this morning. The prompt's premise conflated the two; the register now says which is which.

A1 — R-312/R-313/R-303 recorded as DECIDED with their re-open triggers, and moved out
of STATUS's "Waiting on you", which is now empty.

A3 — day0-install §C.1 said pushing the installer publishes it. It has not since
R-110. Corrected, with the two manifest pins named and an outside-verification command;
the one copy that repeated it (a dated audit, true when written) carries a superseded note.

A5 — standing rule 5: evidence comes off the machine at the end of the phase that
produced it, before any revert. Earned twice in three days on the same box at the same
point (R-320). Four homes, plus what to do when it is already gone.

R-295 hub half — „Beállító kód" everywhere; „Visszaállító kód" retired. New `reenroll`
mail kind so the mail names the page a REBUILT box actually shows („A szerver
beállítása"), not the „Elfelejtett jelszó" page it has no login screen to reach.
Naming only; the acceptance pin proves the secret is untouched.

R-319 — the hub models `guest_net` after 23 days of receiving and discarding it. The
signal is `heals_last_hour`, not `state`: a guest the watchdog keeps repairing reads
healthy between repairs. `heal_succeeded` decoded too (R-260's lesson). Unknown is never
drawn as healthy — three absences, three sentences. No alarm, deliberately.
Three red-proofs, mutations asserted applied. Wire-gate checked tags 182 → 190.

B1 — the operator's 2026-08-12 dispositions were NOT in the register; they are now.
Third allowlist kind for the five ruled "no reader wanted"; `reporting_disabled`
reclassified redundant. 8 read · 5 deliberately unread · 1 redundant · 6 still owed.

Also filed: R-321 (a deliberately-silent box still alarms stale/down — the checker is
age-only, and decoding the flag would not have fixed it), R-322 (the claim guard has
never scanned the hub; a hand scan returns zero, so it is a scope gap, not a defect).

hub/internal/notify/templates.go

@@ -69,7 +69,7 @@ Message:  %s`, customerID, eventType, severity, now, message)
 // customerMessages maps event_type → Hungarian customer message.
 var customerMessages = map[string]string{
 	// Customer-claim arc (v0.50.0)
-	"claim_lockout": "Túl sok hibás beállító/visszaállító kód próbálkozás történt — a beállító oldal 15 percre zárolva lett. Ha nem te próbálkoztál, jelezd az üzemeltetőnek.",
+	"claim_lockout": "Túl sok hibás beállító kód próbálkozás történt — a beállító oldal 15 percre zárolva lett. Ha nem te próbálkoztál, jelezd az üzemeltetőnek.",
 	// Backup events
 	"backup_completed":        "A biztonsági mentés sikeresen elkészült.",
 	"backup_failed":           "A biztonsági mentés sikertelen! Kérjük, ellenőrizd a rendszert.",
@@ -207,18 +207,38 @@ Felhom.eu monitoring`
 // ──────────────────────────────────────────────────────────────────────
 
 // FormatClaimEmail returns (subject, textBody) for a claim-arc email. kind is one of
-// "claim" | "reset" | "claimed" (claim.EmailKind values). The code appears ONLY in the
+// "claim" | "reset" | "reenroll" | "claimed" (claim.EmailKind values). The code appears ONLY in the
 // returned body — callers must never log it.
+//
+// R-295, HUB HALF (2026-08-13). ONE NAME PER SECRET, and it is „Beállító kód".
+//
+// The three-word code that gives a person control of the DASHBOARD is „Beállító kód" everywhere —
+// in this mail, on the operator button, and on the box's own page, which has said so since the
+// controller half shipped on 2026-08-10. The TEN-word code that opens the sealed backups is
+// „Helyreállítási kód" and is a different secret entirely. **„Visszaállító kód" is retired**: it was
+// a near-homograph of „Helyreállítási kód", the collision cost a real code, and the hub was the last
+// place it survived — this half was dropped twice before it was finished.
+//
+// The rule the three branches below follow: ONE SECRET IN TWO SITUATIONS KEEPS ITS NAME, AND THE
+// SENTENCE AROUND IT CHANGES. „reset" and „reenroll" carry the identical secret under the identical
+// name; they differ only in which page the customer will actually be looking at.
+//
+// THIS IS NAMING, NOT FUNCTION. No acceptance logic moved: the code is minted, hashed, rotated,
+// capped and consumed exactly as before, and a reset code is still accepted on the setup page.
+// Pinned by TestFormatClaimEmail_OneNamePerSecret and, on the box side, by the controller's
+// claim_code_naming_test.go.
 func FormatClaimEmail(kind, customerID, domain, code string) (string, string) {
 	dashboardURL := "https://felhom." + domain
 	switch kind {
 	case "reset":
-		subject := "[Felhom] Jelszó-visszaállítási kód"
+		// The box HAS a password: the customer asked for a reset from the login screen, so the
+		// „Elfelejtett jelszó" link IS on their screen and naming it is correct here.
+		subject := "[Felhom] Beállító kód a jelszavad visszaállításához"
 		body := fmt.Sprintf(`Kedves Ügyfél!
 
 Jelszó-visszaállítást kértél a Felhom vezérlőpultodhoz.
 
-Visszaállító kód: %s
+Beállító kód: %s
 
 A kód 72 óráig érvényes, és egyszer használható fel. Add meg a vezérlőpult
 "Elfelejtett jelszó" oldalán, majd válassz új jelszót:
@@ -227,6 +247,32 @@ A kód 72 óráig érvényes, és egyszer használható fel. Add meg a vezérlő
 
 Ha nem te kérted, hagyd figyelmen kívül — a jelenlegi jelszavad változatlan.
 
+Üdvözlettel,
+Felhom.eu`, code, dashboardURL)
+		return subject, body
+	case "reenroll":
+		// The box was rebuilt and has NO password, so it shows „A szerver beállítása" and serves no
+		// login page — there is no „Elfelejtett jelszó" link to send anyone to. Same secret, same
+		// name, the page the machine is actually showing.
+		//
+		// It deliberately says NOTHING about the apps or the backups. A clean-slate reinstall is
+		// exactly the situation in which such a reassurance could be false, and this project has
+		// spent four register rows removing promises it could not see were still true.
+		subject := "[Felhom] Új beállító kód — újratelepült a szervered"
+		body := fmt.Sprintf(`Kedves Ügyfél!
+
+A Felhom szervered újratelepült, ezért a vezérlőpultod belépését újra be kell
+állítani. A korábbi jelszavad már nem érvényes.
+
+Beállító kód: %s
+
+A kód 72 óráig érvényes, és egyszer használható fel. Nyisd meg a vezérlőpultot —
+"A szerver beállítása" oldal fogad —, add meg a kódot, majd válassz új jelszót:
+
+%s
+
+Ha nem te telepítetted újra a szervered, vedd fel a kapcsolatot az üzemeltetővel.
+
 Üdvözlettel,
 Felhom.eu`, code, dashboardURL)
 		return subject, body