# REPORT — 2026-09-30: the fixes before the first real tester

Architecture read first: `07` §6 (the 2026-09-16 ruling), `03` (the restore test's selection), `05` (self-bind),
`04` §3.1 (signed delivery), `09` §3 decisions 45–49; rows R-719 … R-727, R-95, R-240, R-494, R-600, R-688.
Releases: **controller v0.283.0 + v0.283.1**, **agent v0.138.0**, **hub v0.126.0**. Evidence:
`documentation/audits/evidence-fixes-first-tester-2026-09-30/` (part0, partA, partC, partD, partE, release).

## Tester-2 — read-only checklist (nothing on Tester-2, Cloudflare, ep0 or the Storage Box was changed)

| # | item | state | where to fix |
|---|---|---|---|
| 1 | Tunnel token pasted | **done** — tunnel `3ce0eccd…` (Peti's original, reused) | — |
| 2 | DNS of `sajatfelhom.hu` | **done** — ONE record `*.sajatfelhom.hu` → that same tunnel; no leftover pointing elsewhere; today 530 (no connector, right with no box) | — |
| 3 | The tunnel's route `*.sajatfelhom.hu` → `https://traefik`, No TLS Verify | **UNKNOWN** — the record's Cloudflare key reads DNS only (`Authentication error` on the tunnel; stopped there) | Cloudflare → Zero Trust → Networks → Tunnels → this tunnel → Published application routes |
| 4 | Off-site | **done** — shared 100 GB, new sub-account 322460 (username `sub2` reused; Peti's was emptied and deleted 2026-09-25) | — |
| 5 | DR tier (ep0) | **done** — ON; nothing of Tester-2 or Peti on ep0 yet (made at the first connection) | — |
| 6 | The connect e-mail | **sent twice at 07:36 UTC** (the customer was created twice, R-728) — **only one of the two links works**; valid until 2026-10-07 07:36 UTC | Tell your friend: if one link says „expired", use the other; or press „Send self-bind link" once just before the install |
| 7 | E-mail language | **English** — mail, bind page and the box start in English | Hub → Tester-2 → Edit, if Hungarian is wanted |
| 8 | Owner passphrase | yours to hand over | in person / by phone |
| 9 | Customer id `Tester-2` has a capital letter | never walked before; no known break | note only |

## The Parts

| Part | state | note |
|---|---|---|
| 0 Tester-2 read-only | **done** | checklist above; items 3 and 6 need you |
| A1 measure the over-quota path | **done** | it deletes nothing extra: refuses new pushes, runs only the ruled retention; now pinned |
| A2 apps off-site by default + one press for older apps | **done** | controller v0.283.0; live on 9202 |
| A3 size warning | **done** | page card; unit + parity proven (a household NAS target has no quota to test live) |
| B guide + slips | **done / narrowed** | six stale lines rewritten (the sixth found on the way: auto-reboot); R-724/R-725 partly, the rest narrowed |
| C1 ep0 cleanup | **done** | three archives removed; every other namespace byte-identical |
| C2 agent v0.138.0 | **done** | signed delivery to both demo boxes (340 s); due-check normal on both |
| D fresh link for a returning customer | **changed** | the brief's trigger cannot be built (a registering box is unclaimed); built „Új linket kérek" on the expired/used page |
| E Stop holds | **done, after a live failure** | v0.283.0 was wrong in production (adapter); v0.283.1 fixed and proven live |
| F day-one mails | **done** | unit + red-proof; live proof at Tester-2's first hour |

## Claims in the brief that turned out wrong, named

- **"The over-quota path prunes history"** — **wrong.** Over the quota the box refuses new pushes and runs the SAME
  retention as every night; with no new snapshots nothing extra ages out. No P1.
- **"Peti's Cloudflare records for `sajatfelhom.hu` may still be there"** — **there is exactly one record, and it
  points at the tunnel Tester-2 now carries** (Peti's tunnel, reused). Nothing stale to remove.
- **"A PBS archive carries its box's key fingerprint or host id"** — **half right:** the key fingerprint yes (PVE
  content `encrypted`), a host id no (the comment is only „felhom local-api", the owner is the customer's token).
- **"The hub sends no link at registration"** — **right, and it cannot:** the registration carries nothing of a
  customer. The fix was changed to a button on the old link's page.
- **"Stop is lost at the backup's resume only"** — **wrong:** also at the nightly volume dump, the update leg and the
  startup crash recovery; all four fixed.
- **Mine, from 2026-09-30:** "the ✗ names the wrong tier" — misread; the local-tier heading was the NEXT section.

## Red-proofs (each seen failing on its assertion, then restored)

RP31 new app not ON · RP32 earlier OFF overridden · RP33 hook not wired · RP34 over-quota forget differs · RP35 exact
quota "does not fit" · RP36 quiesce restarts a stopped app · RP37 dump restarts it · RP38 update leg presses it ·
RP39 (agent) an earlier box's archive picked · RP40 new box "recovered" · RP41 first-hour skip mailed · RP42 no fresh
link · RP43 the production adapter does not answer · RP44 crash recovery restarts it. Outputs:
`evidence-fixes-first-tester-2026-09-30/` and the scratchpad `rp/` copies.

## Slips of mine, said

- The first hub/evidence commit went out after my secret-scan script crashed (it looked for last night's shredded
  files). Scanned right after: 5 125 files, 7 secrets, **0 hits**, control 1. Nothing leaked.
- v0.283.0 shipped the Stop fix un-wired in production; the live test caught it; v0.283.1 is the second controller
  release this session (the one-release rule bent, reason in its CHANGELOG).

## Rows

Closed **R-719, R-720, R-721, R-722, R-727**. Fixed pending live proof **R-723**. Narrowed **R-724, R-725**. Opened
**R-728** (customer created twice), **R-729** (no way to remove an off-site target). **Register 359 → 361 rows.**
R-726 (a returning customer's orphaned repository) stays open — a NEW record does not meet it.

## Teardown

- **9202:** controller left on 0.283.1 (scratch; the floor does not reach it); the throwaway NAS target switched off
  through the form and then removed from `settings.json` with the controller stopped (R-729: no product path);
  `glance` removed with its data; paperless-ngx running; the off-site switches back OFF.
- **Demo boxes:** controller 0.283.1 by the floor, agent 0.138.0 by signed jobs — nothing else.
- **ep0:** only the three archives of decision 51. **Hub:** floor 0.283.1 (MinAgent 0.131.0 declared); hub 0.126.0.
- **Tester-2 / Cloudflare:** read only. DooPlex: pushes, builds, the hub deploy, signing.