Tester 2: a new install, not an upgrade (operator ruling 2026-10-22 14:11) — hand-over list rewritten (host delete then RESET, what each removes, the friend's page in Hungarian); R-862, R-1139 close at the reinstall; R-32's first live purge noted; STATUS, CONTEXT

documentation/pilot/TESTER2-handover.md

@@ -1,61 +1,129 @@
-# Tester 2 — the hand-over list (written 2026-10-22)
+# Tester 2 — the hand-over list: a NEW INSTALL (rewritten 2026-10-22, operator ruling 14:11)
 
-Tester 2's laptop (`Tester-2-be8404`, customer `Tester-2`) has been off since 2026-10-04. It was installed with **our
-installer** (operator answer, 2026-10-22), so it has host swap and the swap fix will work on it. When it reports
-again it runs old software: agent 0.142.0, controller 0.292.0. This page says what happens then, in order.
+**The ruling:** Tester 2's friend reinstalls the laptop from the public download (installer 1.30.0 or newer) when he
+puts the new drive in, with the drive in before the install. The old box's data is not needed („he barely used the
+laptop, no useful data on it"). So nothing is upgraded and nothing is restored. (The earlier upgrade list is in git:
+`git log -- documentation/pilot/TESTER2-handover.md`.)
 
-## 1. The operator, when the laptop is on — in this order
+## What the hub holds for Tester 2 today (read only, 2026-10-22)
+
+- Host `Tester-2-be8404`, agent 0.142.0, last report **2026-10-04 18:05 UTC** (offline since). A 16 GB machine, guest
+  9201 with 12 GB.
+- **No sealed key package** (`host_escrow`: none; retained packages: none). The hub mailed `offsite_escrow_pending` on
+  10-11 and 10-18: the box never deposited its off-site key.
+- **Off-site was set up**: tier `shared` (the Storage Box), its descriptor provisioned on 2026-10-04 (`offsite_key_installed`
+  16:16 UTC). Whether the repository holds any snapshot is not known from the hub; without a key package it can never
+  be opened by anyone.
+- **PBS whole-box tier (ep0)**: namespace provisioned (its secret used 2026-10-04 16:28 UTC); the box reported **one
+  whole-box copy**, 2026-10-04 16:31 UTC; its prune job `prune-Tester-2` was added by hand on 2026-10-19.
+- DR recipe (2026-10-04), claim (claimed 2026-10-04 16:30 UTC), mail list (written at the claim, never saved by the
+  household — `household_saved` false).
+- **The customer's mail language is English** (`language = en`). The box's first screen, the link mail and the
+  set-up mail follow it. If the friend reads Hungarian, change it on the customer page before step 1.
+
+## Host delete or customer RESET? — for a fresh start with nothing to keep
+
+A new install for the same customer needs the old host gone first (D19): the passphrase works only while the customer
+has no host, and an install over a kept host skips the claim and off-site re-issues (R-1154). Both paths begin with the
+host delete; RESET is a second press after it (RESET refuses while any host exists).
+
+**Host delete alone** (Hosts → `Tester-2-be8404` → Delete; allowed because the box is offline; no key-package tick is
+needed — there is none):
+- removes the host record, its keys and its WireGuard peer; records the deletion; mails the friend a new link;
+- **keeps** the off-site descriptor and whatever the Storage Box repository holds, the ep0 namespace with the
+  2026-10-04 whole-box copy and its prune job, the DR recipe, the claim;
+- the new box gets new off-site credentials and mints a **new** off-site key; with no package to carry, it never asks
+  for an old recovery code. If the old repository holds snapshots, the new box sets them aside on its first night and
+  they stay on the Storage Box, unreadable, until the abandonment clean-up (R-1182) removes them. The ep0 copy stays
+  until its prune job ages it out.
+
+**Customer RESET** (Configs → `Tester-2` → Reset, after the host delete; type the customer id; no key-package tick —
+there is none). From the code (`hub/internal/web/customer_reset.go`, `store/customer_reset.go`) and A20:
+- **destroys on the Storage Box:** Tester-2's off-site folder — the repository and any set-aside copy — through its own
+  sub-account login, then the sub-account (the Hetzner leg — only because off-site is on). This purge is hub 0.142.0's
+  (R-32) and **has never run live**: Tester 2's RESET is its first. If the purge fails, the sub-account is kept and the
+  leg reads `failed` — press Reset again; CC reads the journal after;
+- **destroys on ep0:** the `Tester-2` PBS namespace **with the 2026-10-04 whole-box copy**, its token and its prune job
+  (`felhom-tenantsync` deprovision);
+- **destroys on the hub:** the claim (a fresh setup code at the next install), the provisioned off-site descriptor (the tier stays
+  „on" but unprovisioned until the operator presses Save on the customer page — section 3), the DR recipe, the one-time secret, log bundles; pending operator actions are
+  cancelled;
+- **keeps:** the customer, its address, domain, language, Cloudflare settings, the off-site tier CHOICE and its mail
+  list; every event (the audit trail);
+- at the end it mails the friend a new link itself.
+
+**Recommendation: host delete, then RESET.** „Fresh start, nothing to keep" is exactly what RESET is for: the new box
+starts with an empty Storage Box path and an empty ep0 namespace, instead of carrying a set-aside history nobody can
+open and a stale whole-box copy. **RESET deletes data on ep0 and on the Storage Box — that is the operator's press,
+never CC's** (both are Tier 2). It is proven live twice (A20, 2026-07-18), each leg idempotent: a failed leg is
+re-run from the top, and nothing on the hub is purged until both external legs are ok.
+
+## 1. The operator, before the friend starts
 
 | # | What | Where | Done when |
 |---|---|---|---|
-| 1 | **Tell CC „Tester 2 is on".** CC signs the agent update to the vouched **0.162.0** (one signed `agent_update` job, the same as for the three test boxes on 2026-10-22). | this chat | CC reports `update committed` within about 15 minutes |
-| 2 | **Read the host swap.** No new `host_swap_short` alarm for Tester 2 within 15 minutes of the update means the swap is fine. Our installer gives about the machine's RAM, at most 8 GB. CC also reads the two numbers from the host report. | Hub → Hosts → `Tester-2-be8404`, and the operator mailbox | no alarm; CC confirms the numbers |
-| 3 | **The bootstrap step (R-862)** — once, by hand, because this box is older than the config bundle. Connect your WireGuard operator tunnel; `ssh -p 8822 felhom-op@10.77.0.5`; Hub → Hosts → `Tester-2-be8404` → Console access → **Reveal**; `su -` with it; then the three commands in `runbooks/config-bundle.md` („A box from before agent v0.143.0"). | your tunnel | the script ends with `DONE. This box can now take signed config bundles.` Then tell CC „bootstrap done" — CC sends the bundles and reads them back |
-| 4 | **The emergency root password (R-1139)** — in the same root shell: `bash felhom-host-install.sh --rotate-recovery-only` (`runbooks/break-glass.md`). It sets a new random console password and stores it in the hub. | the same root shell | it prints `root@pam password set + vaulted to the hub`; tell CC — CC proves the new one logs in and the old one is refused |
-| 5 | **One off-site check (R-862).** You believed on 2026-10-07 that Tester 2 never set up the off-site backup. Look: Hub → Customers → `Tester-2` → Off-site. If it is not set up, decide with the tester whether to set it up now. | the hub | you tell CC what you saw |
-| 6 | **Tell CC „Tester 2 hand-over done".** | this chat | CC runs section 3 |
+| 1 | (If the friend reads Hungarian) set the mail language to Magyar | Configs → `Tester-2` | the page shows Magyar |
+| 2 | **Delete the old host.** Tick the box-off confirmation if the page asks; type the host id | Hosts → `Tester-2-be8404` → Delete | the host is gone from the Hosts page. A `409` means the hub still sees the box online — it is not (last report 2026-10-04), so a 409 here is worth telling CC |
+| 3 | **RESET the customer.** Read the preview: host count 0, off-site on (shared), no key-package line | Configs → `Tester-2` → Reset → type `Tester-2` | every leg reads `ok` (hetzner, pbs, claim, descriptor, db_purge); a failed leg: press Reset again (it resumes) |
+| 4 | Check the Cloudflare tunnel still routes `*.<his domain>` (R-494) — RESET does not touch it | Cloudflare | the tunnel exists; its token is on the customer page |
+| 5 | Give the friend the 5-word **owner passphrase** in person or by message (never by the link mail) and the page in section 2. Tell him „go". | — | — |
 
-The controller needs nothing from you: once the agent is 0.162.0, the hub's floor moves the controller to the current
-release at the next report (the floor waits for an agent ≥ 0.158.1).
+## 2. The friend — one page, Hungarian (send it as it is)
 
-**What happens if you do nothing:** the box keeps agent 0.142.0 and controller 0.292.0 (the floor holds it there),
-without the swap fix — a big upload can freeze it for minutes — and with the old emergency password.
-
-## 2. For the tester (Hungarian, one page — send it as it is)
-
-> **Szia! A Felhom dobozod újra bekapcsolható.**
+> **Szia! Így telepítsd újra a Felhom dobozodat.** Kb. egy óra. A gépen minden adat törlődik — a régi rendszerre nincs
+> szükség.
 >
-> **Mi változott október 4. óta?**
-> 1. A doboz nagy feltöltéskor (például sok fénykép egyszerre) nem akad meg többé percekre.
-> 2. Ha egy visszaállítás félbeszakad (hiba vagy áramszünet miatt), az adataid visszakerülnek oda, ahol előtte voltak.
-> 3. Áramszünet után a doboz magától rendbe teszi magát, és az alkalmazások újraindulnak.
-> 4. Az értesítéseid listáját a doboz megőrzi; a levelek és a képernyők szövegei érthetőbbek lettek.
-> 5. A doboz minden címe csak biztonságos (https) kapcsolaton érhető el.
+> **Előtte:** építsd be az új meghajtót. Kell egy legalább 4 GB-os USB-kulcs, hálózati kábel a routerhez, a Felhomtól
+> kapott **Tulajdonosi jelmondat** (5 szó) és az e-mail fiókod.
 >
-> **Mit próbálj ki az első órában?**
-> - Nyisd meg a doboz kezdőlapját, és nézd meg, hogy minden alkalmazásod fut-e.
-> - Tölts fel néhány fényképet vagy dokumentumot abba az alkalmazásba, amit a legtöbbet használsz.
-> - Nézd meg a Beállítások → Értesítések oldalt: azok a levelek vannak-e bekapcsolva, amelyeket kérni szeretnél.
-> - Nyomd meg a „Mentés most" gombot a Mentések oldalon, és várd meg, amíg kész lesz.
+> 1. **Letöltés:** nyisd meg a https://felhom.eu/letoltes oldalt, és nyomd meg a **„Letöltés (1,6 GB)"** gombot.
+> 2. **Ellenőrzés:** az oldal kiírja a fájl ellenőrző összegét (SHA-256), és azt is, hogyan számold ki a gépeden.
+>    A két érték legyen pontosan ugyanaz. Ha nem az, ne telepítsd — szólj.
+> 3. **USB-kulcs:** írd ki a fájlt a kulcsra balenaEtcherrel (vagy Windows-on Rufusszal, „DD" módban).
+> 4. **Telepítés:** indítsd a gépet a kulcsról. A képernyők angolul vannak — ez rendben van.
+>    - Felhom logó, két sor: **„Felhom telepítés"**. Utána: **I agree**.
+>    - **Target harddisk — ez a legfontosabb lépés.** A telepítő felsorolja a lemezeket méretükkel. Válaszd azt, amelyre
+>      a rendszer kerüljön (a gép belső rendszerlemeze). **Az új meghajtót ne válaszd** — azt a doboz később, a
+>      Tárhely oldalon kapja meg. Ha nem tudod, melyik melyik, állj meg és szólj.
+>    - Country / Timezone / Keyboard: hagyd így. Root password: adj meg bármilyen legalább 8 karakteres jelszót kétszer
+>      (a Felhom később lecseréli). Administrator email: a saját címed. Hostname: `felhom.<a-te-domained>`.
+>    - Summary: a jobbra nyíllal lépj az **Install** gombra, és nyomd meg. A gép a végén magától újraindul — a másolás
+>      alatt húzd ki az USB-kulcsot.
+> 5. **Párosító kód:** a doboz képernyőjén 2–4 perc múlva megjelenik: „Párosító kód: XXX-XXX". Írd fel.
+> 6. **Összekötés:** nyisd meg a **„Kösd össze a Felhom dobozodat"** e-mailt (ha kettő jött, a frissebbet), kattints a
+>    hivatkozásra, és add meg a Párosító kódot és a Tulajdonosi jelmondatot.
+> 7. **Vezérlőpult jelszó:** kb. 3 perc múlva jön a **beállító kódos** e-mail. Kattints a benne lévő címre, add meg a
+>    Beállító kódot (3 szó), és válassz legalább 12 karakteres jelszót. Ez a vezérlőpult jelszava.
+> 8. **Helyreállítási kód:** a vezérlőpult kéri, hogy hozd létre. Írd le **papírra**, és tartsd a gépen kívül. Amíg
+>    nincs meg, a távoli mentés nem indul el.
+> 9. **Első két alkalmazás:** Alkalmazások → például **BookStack** és **PrivateBin** → Telepítés. Ha valamelyik
+>    jelszót kér, nyomd meg a „Generálás" gombot.
 >
-> **Ha valami nem működik:** írd le röviden, mit csináltál, mit vártál, és mi történt helyette. Ha tudsz, küldj
-> képernyőképet is. Küldd el a Felhom üzemeltetőjének azon a címen, ahol eddig is levelezettetek.
+> **Ha valami nem működik:** írd le röviden, mit csináltál, mit vártál, és mi történt helyette, és ha tudsz, küldj
+> képernyőképet. Küldd el a Felhom üzemeltetőjének azon a címen, ahol eddig is levelezettetek.
 >
-> **Amit ne csinálj:**
-> - Visszaállítás közben ne húzd ki a dobozt a konnektorból, és ne kapcsold ki.
-> - A helyreállítási kódodat tartsd papíron, a dobozon kívül. A dobozon vagy a laptopon ne tárold.
+> **Amit ne csinálj:** visszaállítás közben ne húzd ki a gépet a konnektorból, és ne kapcsold ki. A helyreállítási
+> kódot ne a gépen vagy a laptopon tárold.
 
-## 3. What CC checks after the hand-over
+## 3. The operator, after the install
 
-1. **A read-only box walk of Tester 2's box:** `scripts/https_only_check.py` with Tester 2 in it (R-1104); the
-   containers, unhealthy and restarting counts, and the controller's error lines (the 2026-10-22 release shape); the
-   agent's capability self-check (`ok=N total=N`) and the config bundle read back (R-862).
-2. **The next night chain:** the database dump, the second-drive copy (if the tester has added a drive), the off-site
-   copy (if set up), the integrity check — each ran, read from the box's log the next morning.
-3. **The hub alarms:** for 24 hours after it is back, every alarm Tester 2 raises, and whether the household's mail
-   list is the one the household saved (the hub keeps it; the box adopts it — R-1199).
-4. **Tester 2's mail list:** its hub row was written at the claim and never saved by the household
-   (`household_saved` = false), so the box will push its default list once and keep it. If the tester had chosen a
-   different list on 2026-10-04, ask them to save it again on the box.
+- **Off-site, if the friend wants it:** Configs → `Tester-2` → Edit → **Save** (off-site stays ticked). After the RESET
+  the tier is on but unprovisioned — the page says so — and the hub provisions a fresh Storage Box account only on
+  Save (about 25 s; do not click twice). Then the box's off-site starts once the friend has made the recovery code.
+  If he does not want it: untick off-site, Save. Nothing else.
 
-Rows: R-862, R-1139, R-1104, R-1207, R-1199.
+## 4. CC, after (tell CC „Tester 2 installed")
+
+1. **A read-only box walk:** `scripts/https_only_check.py` with Tester 2 in it (R-1104); containers, unhealthy and
+   restarting counts; the controller's error lines; the agent's capability self-check and the config bundle (a fresh
+   install has both).
+2. **The host swap (D28):** from the host report — our installer gives this 16 GB machine 8 GB; the new rule says
+   short only below 90 % of min(the guest's swap, 8 GB). No `host_swap_short` expected.
+3. **The first night chain, the next morning:** database dump, second-drive copy (if the new drive was set up as the
+   backup target), off-site copy (if switched on), the whole-box copy to ep0 (CC confirms the new host's PBS namespace
+   was made again after the RESET), the integrity check — each ran.
+4. **The hub alarms for 24 hours** after the install, read from the hub.
+5. **The mail list:** the hub's row was never saved by a household, so the new box pushes its default list once and
+   keeps it; the hub and the box page must agree.
+
+Rows: R-862 and R-1139 close when Tester 2 is reinstalled; R-1104 is checked by step 4.1.