Day 3 2026-10-19: passphrase locks once the box uses its own key (D19; hub 0.161.0, controller 0.334.0 floor), every ep0 household gets a prune job (tenantsync v1.3.0), demo-hp address clean; register 163 -> 161 (closed 3, opened R-1167)

documentation/architecture/05-hub-architecture.md

@@ -242,6 +242,24 @@ while"). Re-issuing on the reuse path would give those powers to anyone holding
 switched off or silent. The cost of the loud shape is two operator acts per reinstall that kept its old record. Both
 event types are hub-origin only. `hub/internal/api/reenroll.go`, pinned by `hub/internal/api/r1154_reenroll_test.go`.
 
+**What the household's retrieval passphrase can get [DESIGN, 2026-10-19 — R-1159, operator decision D19 „box key
+first, then lock"; hub v0.161.0 + controller v0.334.0].** The passphrase is the household's install secret: a NEW box
+needs it (the installer's preflight, download login and enroll; the guest's first boot, `bootstrap.json` → `GET
+/config`, which is how the box gets its own hub key). Measured the same day, it also gave anyone who held it the box's
+keys for good, and through them every off-site key action (`audits/day-2026-10-19b/P2/`). **The rule:** the passphrase
+gives keys only until the box uses its own — `GET /config`, `GET /recovery` and the reuse path of `POST /host-enroll`
+answer **409 with no key** (and the operator gets `passphrase_keys_refused`) once a host record exists AND a controller
+report arrived since it was made AND that controller pulls its config with its own key (≥ 0.334.0, `GET /box-config`,
+`boxConfigMinController`). Open for a first install, the install in progress, a reinstall after the operator deleted
+the old host, and a box on an older controller (which still refreshes with the passphrase — the lock arms box by box
+as the floor moves). A reinstall over a live box therefore needs the operator's delete first, which R-1154 already
+made the rule. **Why this shape and not „before a host exists":** the install itself uses the passphrase AFTER enroll
+(`felhom-host-install.sh` step_agent_install → `/config`; the agent bakes it into `bootstrap.json`; the guest pulls with
+it), and so did every live box's config refresh — measured from the code before building, and put to the operator.
+`hub/internal/api/passphrase_scope.go`; pinned by `r1159_passphrase_scope_test.go`. Proven live on demo-hp
+(2026-10-19 14:30 UTC): before 0.334.0 → 200; after its first 0.334.0 report → 409, no key, the event raised; the box's
+own key → 200.
+
 **[FACT, 2026-10-19 — R-1158, hub v0.160.0] What the MINT path's off-site re-issue still does.** It resets the Storage
 Box sub-account password and stores the new one — a password only the hub itself uses (`offsitekeys.TargetFor`, the key
 registrar's login). No box receives it since v0.127.0 (`consume-password` answers 410; `ConsumeOneTimeSecret` has no

documentation/architecture/07-backup-architecture.md

@@ -492,8 +492,11 @@ data drives** — 916 GB on demo-felhom, 938 GB on demo-hp.
 > ISO weeks, so a flood inside a week replaces only that week's copy and the previous week's survives, however many runs
 > get through. Before the change, PBS's own dry run and an offline model of its selection both showed the new rule
 > removing nothing on either box (`audits/day-2026-10-19b/P1/`). DooPlex's copy of ep0 already prunes by time
-> (`prune-ep0-copy`, `keep-weekly 8`, decision 71). **A household namespace gets no prune job by itself:** `tester-1` and
-> `Tester-2` have none and keep every weekly copy (R-1165). **[DESIGN] The local tier keeps one copy per day (R-1149, operator decision D17,
+> (`prune-ep0-copy`, `keep-weekly 8`, decision 71). **[FACT] Every household namespace gets its prune job when it is made**
+> (R-1165, 2026-10-19): `felhom-tenantsync` v1.3.0 creates `prune-<id>` (keep-weekly 2, 03:30) with the namespace and
+> removes it with the household; the hub alarms on a namespace no job covers (`pbsdr_namespace_without_prune_job`,
+> from the 15-minute ep0 read). `tester-1` and `Tester-2` got theirs by hand on the operator's yes (13:35 UTC; the
+> dry run: tester-1's 2026-10-04 copy goes at the next run, nothing on Tester-2). **[DESIGN] The local tier keeps one copy per day (R-1149, operator decision D17,
 > 2026-10-19; agent 0.160.0):** `keep-daily=3` instead of keep-last 3 — the same at most three archives, but extra runs on
 > one day replace only that day's copy, so with the cap a day of flooding leaves the two earlier days' copies
 > (`TestBackupCap_R1149_LocalFloodKeepsOlderDays`). Measured at the first new-rule prune on demo-hp (retention 1: the

documentation/architecture/felhom-system-poster.facts.md

@@ -99,7 +99,7 @@ Footnote: "W = the household's backup window start, 02:30 by default. Tiers 1–
   - one namespace **per household** (whole-guest copies, each household's own key),
     with a NEUTRAL note under it (not a red gap box): "By design: each household holds the key to its own copies; the operator cannot open them without their recovery code." — *fix (c), 2026-10-09: this is a property of the design, not a gap, and a red box said the opposite of what it means.*
   - the **`operator`** namespace: two groups — **"hub database"** and **"DooPlex copy"** (code, password manager, secrets, signing keys).
-  Prune jobs on ep0: households keep one copy per week for 2 weeks (`keep-weekly 2`, R-1162, 2026-10-19 — a household without a job keeps all, R-1165); `operator` keeps 14 daily + 8 weekly.
+  Prune jobs on ep0: households keep one copy per week for 2 weeks (`keep-weekly 2`, R-1162, 2026-10-19; every new household's job is made with its namespace, R-1165); `operator` keeps 14 daily + 8 weekly.
   Mark ep0 with a small shield: "**Protected** — holds the only off-premises copy of real household data."
 - **Hetzner Storage Box** (grey): the shared box for the households' per-app restic copies (Tier 3), one sub-account per household, add-only keys.
 - **Mail service** (grey, "Resend"): every mail the hub sends — to the operator and to households.