hub v0.163.0: a rebuilt box gets the household's sealed package back (R-1176); one run per daily job on clock-change days (R-1183); a scoped abandonment purge (R-1182); the new-link page says the old box is still linked (R-1203)

hub/internal/web/selfbind_resend_test.go

@@ -41,8 +41,8 @@ func TestR719_AnExpiredLinkOffersAndSendsAFreshOne(t *testing.T) {
 	}
 }
 
-// No oracle, and no spam: an unknown token, a customer that already has a box, and a second press within
-// the hour all get the SAME page and NO mail.
+// No oracle, and no spam: an unknown token and a second press within the hour get the SAME page and NO mail; a
+// customer that already has a box gets no link (R-1203 below: its REAL link's holder is told why).
 func TestR719_ResendIsNoOracleAndRateLimited(t *testing.T) {
 	s, st := newTestServer(t)
 	m := &stubMailer{}
@@ -76,3 +76,39 @@ func TestR719_ResendIsNoOracleAndRateLimited(t *testing.T) {
 		t.Fatal("a customer with a box was mailed a bind link")
 	}
 }
+
+// R-1203 (rehearsal 2026-10-20 B7): the household's old box is still linked. The holder of the household's REAL used
+// link is told so in plain words (not „a mail comes in minutes"), the operator is told the host name once per hour,
+// and no link is mailed. An unknown token still gets the generic page.
+// COMPANION RED-PROOF: drop the GetHostByCustomer branch in handleBindResend → the page says „Kész." and no event.
+func TestR1203_AHouseholdWhoseOldBoxIsStillLinkedIsToldSo(t *testing.T) {
+	s, st := newTestServer(t)
+	m := &stubMailer{}
+	s.SetSelfBindMailer(m)
+	type ev struct{ cust, typ, sev, msg, details string }
+	var evs []ev
+	s.emit = func(c, typ, sev, msg, details, src string) { evs = append(evs, ev{c, typ, sev, msg, details}) }
+	seedForMint(t, st, "Tester4", "tester4@felhom.example")
+	if err := st.UpsertHost(&store.Host{HostID: "Tester4-816e21", CustomerID: "Tester4", APIKey: "hk"}); err != nil {
+		t.Fatal(err)
+	}
+	used := mintLink(t, st, "Tester4", -time.Hour)
+
+	body := resendPOST(s, used).Body.String()
+	if !strings.Contains(body, "A régi dobozod még össze van kötve") || strings.Contains(body, "percen belül új e-mailt") {
+		t.Fatalf("the page does not say the old box is still linked:\n%s", body)
+	}
+	if m.link != "" {
+		t.Fatal("a link was mailed while the old box is linked")
+	}
+	if len(evs) != 1 || evs[0].typ != "bind_old_host_linked" || evs[0].sev != "warning" || !strings.Contains(evs[0].msg, "Tester4-816e21") {
+		t.Fatalf("operator events = %+v, want one warning naming the host", evs)
+	}
+	_ = resendPOST(s, used) // a second press within the hour: same page, no second mail
+	if len(evs) != 1 {
+		t.Fatalf("operator events after a second press = %d, want 1", len(evs))
+	}
+	if unk := resendPOST(s, strings.Repeat("b", 64)).Body.String(); strings.Contains(unk, "A régi dobozod") {
+		t.Fatal("an unknown token learns that a box is linked")
+	}
+}