Peti's box retired (operator ruling 2026-09-25): hub customer + Storage Box sub-account removed, ep0 held nothing; protected list = DooPlex + ep0; decision 34 (no leg resume, R-686 closed); R-688

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/runbooks/target-selection.md

@@ -6,11 +6,12 @@
 
 ## The rule
 
-> **Two machines are protected: `DooPlex` and Peti's box. Everything else is disposable.**
-> Operator decision **D-d**, 2026-08-02. DooPlex because it holds Gitea, the hub, the backups and the
-> registry — everything else rebuilds from it, and it rebuilds from nothing. Peti's box because there
-> is a real person behind it. **Every other box, both demo boxes included, may be broken or
-> reinstalled freely.**
+> **Two machines are protected: `DooPlex` and `ep0`. Everything else is disposable.**
+> Operator decision **D-d**, 2026-08-02, and the ep0 ruling of 2026-08-03. DooPlex because it holds
+> Gitea, the hub, the backups and the registry — everything else rebuilds from it, and it rebuilds from
+> nothing. ep0 for the reason below. **Every other box, both demo boxes included, may be broken or
+> reinstalled freely.** *(Peti's box was the second protected machine until it was RETIRED on
+> 2026-09-25 — operator ruling; `audits/RETIRE-peti-2026-09-25.md`.)*
 >
 > **This is a correction, not a relaxation.** The earlier posture was costing whole sessions to
 > caution and pushing drills onto DooPlex — the one machine that should never host them. If you are
@@ -70,7 +71,7 @@ in `documentation/backlog/OPEN-ITEMS.md`, never `--no-verify`.
 |---|---|---|
 | **0 — disposable. Reach here first.** | Exists to be broken; reinstalling is a routine afternoon, not an incident. **A drill that needs a victim uses one of these.** | `demo-hp` (t740), `demo-felhom` (N100) |
 | **1 — create and destroy freely** | Throwaway VMs, guests, scratch customers — **hosted on a Tier 0 machine** | drill VMs, scratch guests |
-| **2 — protected. Never a drill target.** | Losing it costs the recovery chain or a real relationship | **DooPlex**, **Peti's cluster**, **`ep0`** (operator ruling 2026-08-03) — and nothing else |
+| **2 — protected. Never a drill target.** | Losing it costs the recovery chain or a real relationship | **DooPlex**, **`ep0`** (operator ruling 2026-08-03) — and nothing else (Peti's cluster RETIRED 2026-09-25) |
 
 **DooPlex is Tier 2 because it *is* the recovery chain** — hub, Gitea, registry, PBS, k3s + Longhorn.
 Everything else rebuilds from it; it rebuilds from nothing. A bad moment in a DR drill there costs the
@@ -79,10 +80,14 @@ thing under test, the source of truth for it, and the backups, at once.
 **`ep0` is Tier 2 — PROTECTED. Operator ruling, 2026-08-03.** D-d named two protected machines and did
 not name ep0 either way, so this page carried the question in writing for two days and read it the
 narrow way meanwhile (not protected, but not wipeable). The ruling settles it and **extends D-d's
-protected list to three machines**: DooPlex, Peti's cluster, ep0.
+protected list to three machines**: DooPlex, Peti's cluster, ep0. **Since 2026-09-25 (Peti's box
+retired) it is two: DooPlex and ep0.**
 
-The reason it was never really in doubt: ep0 holds the **PBS-DR datastore and the restic copy of a
-real customer's data**, which is the only off-premises copy that exists. So *deleting datastores,
+The reason, as it stands on 2026-09-25: ep0 holds the **PBS-DR datastore with the demo boxes' (and
+tester-1's) whole-guest copies, the WireGuard hub every box's off-site path runs through, and the
+operator's out-of-band path**; the Hetzner Storage Boxes hold each box's restic copy. There is no paying
+customer yet, but ep0 is the only off-premises tier of the whole product, and a mistake there cannot be
+rebuilt from DooPlex. So *deleting datastores,
 prune jobs, tunnel config or nftables rules* was already forbidden by what it would destroy; the
 ruling makes the classification say so plainly instead of leaving each session to re-derive it.
 **Reads are fine** — including the ordinary off-site read a restore-test performs (R-86) — and it is
@@ -158,12 +163,12 @@ against.
   builds if `df -h /mnt/5_hdd /` shows either over 90 %. **Because it is the recovery chain and a live
   k3s node.**
 
-### `Peti's cluster` (`peti-felhom`) — **Tier 2**
+### `Peti's cluster` (`peti-felhom`) — **RETIRED 2026-09-25** (operator ruling)
 
-**Do not touch, at all.** A real external pilot with a real person behind it; its whole-guest backup
-still shares a device with its guest, so a drive failure is **offsite-only recovery**. Deliberately not
-migrated, parked until the tester reinstalls (`PETI` in `backlog/OPEN-ITEMS.md`). Currently DOWN, no
-enrolled host. No access route from DooPlex, and nothing here needs one.
+No longer protected and no longer a machine this project knows: the tester wiped his server and it will not
+return. Its hub customer, Storage Box sub-account (`u629488-sub2`, which never held a backup) and records were
+removed through the hub's own customer delete; ep0 held nothing of it. The audit trail stays (events, the
+deletion and reset tombstones). Record: `audits/RETIRE-peti-2026-09-25.md`.
 
 ### `ep0` (`felhom-hetzner`, `ep0.felhom.eu`) + the Hetzner Storage Boxes — **Tier 2, PROTECTED** (operator ruling 2026-08-03)
 
@@ -212,8 +217,9 @@ The fixture would have shown a controller nobody installs.
   from `backlog/OPEN-ITEMS.md`; **no direct access attempted or confirmed.** Tier 2 by what they hold.
 - **`felhotest`** (legacy, `ssh -p 33022 kisfenyo@router.abonet.hu`) — **`Connection refused`**
   2026-07-30; that was the only route tried. Untiered; assume nothing.
-- **Peti's cluster** hardware/storage layout — unverified. Tier 2 rests on the relationship, which
-  needs no verification.
+- **Peti's cluster** — RETIRED 2026-09-25 (operator ruling: the tester wiped his server; it will not
+  return). Its hub records, its Storage Box sub-account and folder are gone; ep0 never held anything of
+  it. `audits/RETIRE-peti-2026-09-25.md`.
 
 ## The gap this page closes