doorstep teardown complete: host tester-1-8603a2 deleted, ep0 peer gone, customer kept; ep0 DR data retained for ruling

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT-doorstep-1271.md

@@ -82,9 +82,13 @@ Opened **R-502 … R-508** (7). Closed **R-497**. Fixed awaiting publish **R-496
 ## 8. Teardown
 
 Layers 1–2 done (VMs 331/332 destroyed; ≈12.8 GiB back on `nvme-scratch`; both ISOs and `/root/doorstep`
-gone; 9201/9202 untouched). Layer 3: appliance 27 discarded; host `tester-1-8603a2` delete pending its
+gone; 9201/9202 untouched). Layer 3: appliance 27 discarded (16:20Z); host `tester-1-8603a2` stale at 16:46:43Z (a true
-stale window (see the follow-up commit). **Customer `tester-1` KEPT.** Left on ep0 by the DR tier:
+`host_stale` operator mail), deleted 16:46:52Z (`host deleted: tester-1-8603a2 (escrow deleted: false)`;
-namespace `tester-1`, token `felhom@pbs!tester-1` — retained with the customer for the operator's ruling.
+host page 404, gone from `/hosts`); its ep0 WireGuard peer `10.77.0.5` removed at the 16:49:13Z push
+(0 left, control peer 1). **Customer `tester-1` KEPT** (page 200). **Left on ep0 by the DR tier, read-only
+check 16:51Z:** namespace `tester-1` exists with **2 directories inside — backup data from the test box**,
+plus token `felhom@pbs!tester-1`. Not removed: ep0 is protected, and the only product path (customer
+RESET) would also remove the tunnel. Retained for the operator's ruling.
 The hub's event stream and three operator mails are append-only and stay.
 
 ## 9. Observations

STATUS.md

@@ -28,8 +28,9 @@ have public hostnames? **If you do nothing:** a volunteer on a network like ours
 dashboard. (2) **Put the volunteer's e-mail on their customer record.** **If you do nothing:** they get no
 setup code. (3) **Say yes or no to publishing installer 1.27.1** — only after (1) is sorted, by the rule
 you set. **If you do nothing:** the old installer stays online, with the English admin line on screen.
-(4) **The test left a backup namespace for „Tester 1" on the off-site server**, created by its DR setting;
+(4) **The test left backup data for „Tester 1" on the off-site server**, written by its DR setting
-removing it would also remove the customer's tunnel. **If you do nothing:** it stays, empty.
+from the test box (now destroyed); removing it the product's way would also remove the customer's
+tunnel. **If you do nothing:** it stays and uses a little space on the off-site server.
 
 ---
 

documentation/audits/DOORSTEP-walk-1270-2026-09-14.md

@@ -98,8 +98,8 @@ Closed with this evidence: **R-497** (hub v0.113.0 live). Fixed, awaiting publis
 Layers 1–2 measured in `teardown-layers-1-2.txt` (VMs 331/332 destroyed; `nvme-scratch` used 23 528 192
 → 10 132 924 KiB; `local` 26 489 992 → 23 033 320 KiB; ISOs and `/root/doorstep` gone; 9201/9202 running;
 `local-lvm` 44.17 % unchanged). Layer 3 in `teardown-layer3-hub.txt`: appliance 27 discarded; host
-`tester-1-8603a2` deleted once stale (**customer `tester-1` is KEPT** — the operator's fixture; a RESET or
+`tester-1-8603a2` deleted at 16:46:52Z once stale; its ep0 peer gone at the 16:49:13Z push (**customer
-DELETE would remove its tunnel and zone). **Left on ep0 by design of the DR tier, named:** namespace
+`tester-1` is KEPT** — the operator's fixture; a RESET or DELETE would remove its tunnel and zone). **Left on
-`tester-1` and token `felhom@pbs!tester-1`, provisioned at enrolment; a host delete does not deprovision
+ep0 by the DR tier, measured read-only:** namespace `tester-1` with **2 directories of backup data** and
-tenancy — only the customer RESET does, which would also remove the tunnel. Disposition: retained with
+token `felhom@pbs!tester-1`; a host delete does not deprovision tenancy — only the customer RESET does,
-the customer, for the operator to rule.
+which would also remove the tunnel. Disposition: retained with the customer, for the operator to rule.

documentation/audits/evidence-doorstep-walk-1270-2026-09-14/teardown-layer3-hub.txt

@@ -6,3 +6,18 @@ HTTP/1.1 303 See Other
 Location: /hosts?flash=appliance_discarded
 332 MAC still on hosts page: 0
 host tester-1-8603a2 delete-impact: {"deletable":false,"escrow_present":false,"guests":1,"log_bundles":0,"pbs_secret_present":true,"recovery_present":true,"reports":3,"status":"ok","wg_peer_bound":true}
+=== host delete 2026-09-14T16:46:52Z
+impact: {"deletable":true,"escrow_present":false,"guests":1,"log_bundles":0,"pbs_secret_present":true,"recovery_present":true,"reports":3,"status":"stale","wg_peer_bound":true}
+ep0 peer 10.77.0.5 before: 1
+HTTP/1.1 303 See Other
+Location: /hosts
+host page: 404
+customer page tester-1 (must stay): 200
+tester-1 on /hosts: 0
+2026/09/14 18:46:43 [INFO] Host staleness: tester-1-8603a2 ok → stale (host_stale)
+2026/09/14 18:46:44 [INFO] Operator email sent for tester-1/host_stale
+2026/09/14 18:46:53 [INFO] host deleted: tester-1-8603a2 (escrow deleted: false)
+=== ep0 read-only 2026-09-14T16:51:13Z
+2026/09/14 18:49:13 [INFO] wgsync: pushed 4 peers to 167.233.158.164:22
+peer 10.77.0.5: 0  control 10.77.0.3: 1
+namespace dirs named tester-1: 1  snapshots inside: 2