# Tester 2 — the hand-over list: a NEW INSTALL (rewritten 2026-10-22, operator ruling 14:11)

**The ruling:** Tester 2's friend reinstalls the laptop from the public download (installer 1.30.0 or newer) when he
puts the new drive in, with the drive in before the install. The old box's data is not needed („he barely used the
laptop, no useful data on it"). So nothing is upgraded and nothing is restored. (The earlier upgrade list is in git:
`git log -- documentation/pilot/TESTER2-handover.md`.)

## What the hub held for Tester 2 before the RESET (read only, 2026-10-22 morning)

- Host `Tester-2-be8404`, agent 0.142.0, last report **2026-10-04 18:05 UTC** (offline since). A 16 GB machine, guest
  9201 with 12 GB.
- **No sealed key package** (`host_escrow`: none; retained packages: none). The hub mailed `offsite_escrow_pending` on
  10-11 and 10-18: the box never deposited its off-site key.
- **Off-site was set up**: tier `shared` (the Storage Box), its descriptor provisioned on 2026-10-04 (`offsite_key_installed`
  16:16 UTC). Whether the repository holds any snapshot is not known from the hub; without a key package it can never
  be opened by anyone.
- **PBS whole-box tier (ep0)**: namespace provisioned (its secret used 2026-10-04 16:28 UTC); the box reported **one
  whole-box copy**, 2026-10-04 16:31 UTC; its prune job `prune-Tester-2` was added by hand on 2026-10-19.
- DR recipe (2026-10-04), claim (claimed 2026-10-04 16:30 UTC), mail list (written at the claim, never saved by the
  household — `household_saved` false).
- **The customer's mail language is English** (`language = en`). The box's first screen, the link mail and the
  set-up mail follow it. If the friend reads Hungarian, change it on the customer page before step 1.

## Host delete or customer RESET? — for a fresh start with nothing to keep

A new install for the same customer needs the old host gone first (D19): the passphrase works only while the customer
has no host, and an install over a kept host skips the claim and off-site re-issues (R-1154). Both paths begin with the
host delete; RESET is a second press after it (RESET refuses while any host exists).

**Host delete alone** (Hosts → `Tester-2-be8404` → Delete; allowed because the box is offline; no key-package tick is
needed — there is none):
- removes the host record, its keys and its WireGuard peer; records the deletion; mails the friend a new link;
- **keeps** the off-site descriptor and whatever the Storage Box repository holds, the ep0 namespace with the
  2026-10-04 whole-box copy and its prune job, the DR recipe, the claim;
- the new box gets new off-site credentials and mints a **new** off-site key; with no package to carry, it never asks
  for an old recovery code. If the old repository holds snapshots, the new box sets them aside on its first night and
  they stay on the Storage Box, unreadable, until the abandonment clean-up (R-1182) removes them. The ep0 copy stays
  until its prune job ages it out.

**Customer RESET** (Configs → `Tester-2` → Reset, after the host delete; type the customer id; no key-package tick —
there is none). From the code (`hub/internal/web/customer_reset.go`, `store/customer_reset.go`) and A20:
- **destroys on the Storage Box:** Tester-2's off-site folder — the repository and any set-aside copy — through its own
  sub-account login, then the sub-account (the Hetzner leg — only because off-site is on). This purge is hub 0.142.0's
  (R-32) and **has never run live**: Tester 2's RESET is its first. If the purge fails, the sub-account is kept and the
  leg reads `failed` — press Reset again; CC reads the journal after;
- **destroys on ep0:** the `Tester-2` PBS namespace **with the 2026-10-04 whole-box copy**, its token and its prune job
  (`felhom-tenantsync` deprovision);
- **destroys on the hub:** the claim (a fresh setup code at the next install), the provisioned off-site descriptor (the tier stays
  „on" but unprovisioned until the operator presses Save on the customer page — section 3), the DR recipe, the one-time secret, log bundles; pending operator actions are
  cancelled;
- **keeps:** the customer, its address, domain, language, Cloudflare settings, the off-site tier CHOICE and its mail
  list; every event (the audit trail);
- at the end it mails the friend a new link itself.

**Recommendation (taken 2026-10-22): host delete, then RESET.** „Fresh start, nothing to keep" is exactly what RESET is for: the new box
starts with an empty Storage Box path and an empty ep0 namespace, instead of carrying a set-aside history nobody can
open and a stale whole-box copy. **RESET deletes data on ep0 and on the Storage Box — that is the operator's press,
never CC's** (both are Tier 2). It is proven live twice (A20, 2026-07-18), each leg idempotent: a failed leg is
re-run from the top, and nothing on the hub is purged until both external legs are ok.

## 1. The operator, before the friend starts — **DONE 2026-10-22** (checked by CC, read only)

**Status: steps 1–4 done on 2026-10-22; next: step 5 — give the passphrase and tell the friend „go".**
- Step 1: the mail language is now **Magyar** (`hu`).
- Step 2: host `Tester-2-be8404` deleted 12:54:47 UTC.
- Step 3: RESET 12:55:56–12:56:04 UTC, every leg `ok`. The off-site folder held no repository (nothing to delete) and
  its sub-account is gone; ep0's `Tester-2` namespace, its 2026-10-04 copy, its prune job and its token are gone; no
  other customer's data changed (Storage Box and ep0 counts before = after). The friend got the newest link mail at
  12:56:05 UTC (the one sent at 12:54:48 no longer works).
- Step 4, seen from outside: `felhom.sajatfelhom.hu` and `files.sajatfelhom.hu` answer Cloudflare 530 — the route to his
  tunnel exists and waits for a box. Evidence `audits/tester2-reset-2026-10-22/`.


| # | What | Where | Done when |
|---|---|---|---|
| 1 | (If the friend reads Hungarian) set the mail language to Magyar | Configs → `Tester-2` | the page shows Magyar |
| 2 | **Delete the old host.** Tick the box-off confirmation if the page asks; type the host id | Hosts → `Tester-2-be8404` → Delete | the host is gone from the Hosts page. A `409` means the hub still sees the box online — it is not (last report 2026-10-04), so a 409 here is worth telling CC |
| 3 | **RESET the customer.** Read the preview: host count 0, off-site on (shared), no key-package line | Configs → `Tester-2` → Reset → type `Tester-2` | every leg reads `ok` (hetzner, pbs, claim, descriptor, db_purge); a failed leg: press Reset again (it resumes) |
| 4 | Check the Cloudflare tunnel still routes `*.<his domain>` (R-494) — RESET does not touch it | Cloudflare | the tunnel exists; its token is on the customer page |
| 5 | Give the friend the 5-word **owner passphrase** in person or by message (never by the link mail) and the page in section 2. Tell him „go". | — | — |

## 2. The friend — one page, Hungarian (send it as it is)

> **Szia! Így telepítsd újra a Felhom dobozodat.** Kb. egy óra. A gépen minden adat törlődik — a régi rendszerre nincs
> szükség.
>
> **Előtte:** építsd be az új meghajtót. Kell egy legalább 4 GB-os USB-kulcs, hálózati kábel a routerhez, a Felhomtól
> kapott **Tulajdonosi jelmondat** (5 szó) és az e-mail fiókod.
>
> 1. **Letöltés:** nyisd meg a https://felhom.eu/letoltes oldalt, és nyomd meg a **„Letöltés (1,6 GB)"** gombot.
> 2. **Ellenőrzés:** az oldal kiírja a fájl ellenőrző összegét (SHA-256), és azt is, hogyan számold ki a gépeden.
>    A két érték legyen pontosan ugyanaz. Ha nem az, ne telepítsd — szólj.
> 3. **USB-kulcs:** írd ki a fájlt a kulcsra balenaEtcherrel (vagy Windows-on Rufusszal, „DD" módban).
> 4. **Telepítés:** indítsd a gépet a kulcsról. A képernyők angolul vannak — ez rendben van.
>    - Felhom logó, két sor: **„Felhom telepítés"**. Utána: **I agree**.
>    - **Target harddisk — ez a legfontosabb lépés.** A telepítő felsorolja a lemezeket méretükkel. Válaszd azt, amelyre
>      a rendszer kerüljön (a gép belső rendszerlemeze). **Az új meghajtót ne válaszd** — azt a doboz később, a
>      Tárhely oldalon kapja meg. Ha nem tudod, melyik melyik, állj meg és szólj.
>    - Country / Timezone / Keyboard: hagyd így. Root password: adj meg bármilyen legalább 8 karakteres jelszót kétszer
>      (a Felhom később lecseréli). Administrator email: a saját címed. Hostname: `felhom.<a-te-domained>`.
>    - Summary: a jobbra nyíllal lépj az **Install** gombra, és nyomd meg. A gép a végén magától újraindul — a másolás
>      alatt húzd ki az USB-kulcsot.
> 5. **Párosító kód:** a doboz képernyőjén 2–4 perc múlva megjelenik: „Párosító kód: XXX-XXX". Írd fel.
> 6. **Összekötés:** nyisd meg a **„Kösd össze a Felhom dobozodat"** e-mailt (ha kettő jött, a frissebbet), kattints a
>    hivatkozásra, és add meg a Párosító kódot és a Tulajdonosi jelmondatot.
> 7. **Vezérlőpult jelszó:** kb. 3 perc múlva jön a **beállító kódos** e-mail. Kattints a benne lévő címre, add meg a
>    Beállító kódot (3 szó), és válassz legalább 12 karakteres jelszót. Ez a vezérlőpult jelszava.
> 8. **Helyreállítási kód:** a vezérlőpult kéri, hogy hozd létre. Írd le **papírra**, és tartsd a gépen kívül. Amíg
>    nincs meg, a távoli mentés nem indul el.
> 9. **Első két alkalmazás:** Alkalmazások → például **BookStack** és **PrivateBin** → Telepítés. Ha valamelyik
>    jelszót kér, nyomd meg a „Generálás" gombot.
>
> **Ha valami nem működik:** írd le röviden, mit csináltál, mit vártál, és mi történt helyette, és ha tudsz, küldj
> képernyőképet. Küldd el a Felhom üzemeltetőjének azon a címen, ahol eddig is levelezettetek.
>
> **Amit ne csinálj:** visszaállítás közben ne húzd ki a gépet a konnektorból, és ne kapcsold ki. A helyreállítási
> kódot ne a gépen vagy a laptopon tárold.

## 3. The operator, after the install

- **Off-site, if the friend wants it:** Configs → `Tester-2` → Edit → **Save** (off-site stays ticked). After the RESET
  the tier is on but unprovisioned — the page says so — and the hub provisions a fresh Storage Box account only on
  Save (about 25 s; do not click twice). Then the box's off-site starts once the friend has made the recovery code.
  If he does not want it: untick off-site, Save. Nothing else.

## 4. CC, after (tell CC „Tester 2 installed")

1. **A read-only box walk:** `scripts/https_only_check.py` with Tester 2 in it (R-1104); containers, unhealthy and
   restarting counts; the controller's error lines; the agent's capability self-check and the config bundle (a fresh
   install has both).
2. **The host swap (D28):** from the host report — our installer gives this 16 GB machine 8 GB; the new rule says
   short only below 90 % of min(the guest's swap, 8 GB). No `host_swap_short` expected.
3. **The first night chain, the next morning:** database dump, second-drive copy (if the new drive was set up as the
   backup target), off-site copy (if switched on), the whole-box copy to ep0 (CC confirms the new host's PBS namespace
   was made again after the RESET), the integrity check — each ran.
4. **The hub alarms for 24 hours** after the install, read from the hub.
5. **The mail list:** the hub's row was never saved by a household, so the new box pushes its default list once and
   keeps it; the hub and the box page must agree.

Rows: R-862 and R-1139 close when Tester 2 is reinstalled; R-1104 is checked by step 4.1.