hub v0.160.0: a live re-enroll mails the operator (R-1156); further refused backups counted, alarm once a day (R-1157); the reinstall's off-site re-issue says what it still does (R-1158)

hub/internal/api/handler.go

@@ -97,8 +97,12 @@ type Handler struct {
 
 	// offsiteReissuer (F3, v0.57.0) re-issues the customer's offsite credentials on clean-slate
 	// re-enrollment — main.go wires it to the web server's ReissueOffsiteForCustomer (same machinery
-	// as the manual "Re-issue offsite credentials" button, so escrow invalidation + events ride
-	// along). nil = no auto re-issue; a no-op when offsite isn't provisioned/enabled for the customer.
+	// as the manual "Re-issue offsite credentials" button). nil = no auto re-issue; a no-op when
+	// offsite isn't provisioned/enabled for the customer. WHAT IT STILL DOES (R-1158, 2026-10-19): it
+	// resets the Storage Box sub-account password that only the HUB uses (offsitekeys.TargetFor — the
+	// registrar's login); no box reads it since hub v0.127.0 (consume-password answers 410, every box
+	// reaches the store with its own registered key). Kept because it hands the hub a fresh, working
+	// login at every clean reinstall — which repairs a broken stored one — not because the box needs it.
 	offsiteReissuer func(ctx context.Context, customerID string) error
 
 	// intentHub (v0.58.0, Direction-2 immediate-sync) is the in-memory per-customer generation
@@ -1266,8 +1270,8 @@ func (h *Handler) handleHostEnroll(w http.ResponseWriter, r *http.Request) {
 	// above never re-issues; it tells the operator to delete). For a CLAIMED customer the fresh box has no
 	// password; auto-issue a reset code so the customer isn't stranded at the claim page hunting for
 	// the manual "request a new code" button (delivery rides the report ACK). No-op for an unclaimed
-	// customer (first provision). Also re-issue offsite credentials to the fresh box (F3) — the
-	// one-time offsite password only ever reached the OLD controller, so the fresh one has no target.
+	// customer (first provision). Also re-issue the off-site login (F3) — since hub v0.127.0 that is the
+	// HUB's own Storage Box login, not something the fresh box receives (R-1158; see offsiteReissuer).
 	h.reissueOnReenroll(cc)
 
 	w.Header().Set("Content-Type", "application/json")
@@ -1292,8 +1296,9 @@ func (h *Handler) reissueOnReenroll(cc *store.CustomerConfig) {
 			}
 		}
 	}
-	// F3 — offsite continuity: re-stage the one-time offsite password to the fresh controller (the
-	// one-time password only ever reached the OLD controller). ⚠ CORRECTED 2026-08-04 (R-196): this
+	// F3 — the off-site login: a fresh Storage Box sub-account password, stored for the HUB's registrar
+	// (R-1158: no box receives it since hub v0.127.0; the fresh box registers its own key with the
+	// controller API key). ⚠ CORRECTED 2026-08-04 (R-196): this
 	// used to claim "the re-issuer resets the restic repo password, which makes the OLD escrow blob
 	// stale". It does not and cannot — the re-issuer resets the PROVIDER account password; the
 	// repository password is generated on the box and never leaves it except sealed under R. The