felhom.eu/REPORT-fixes-first-tester-2026-09-30.md

REPORT — 2026-09-30: the fixes before the first real tester

Architecture read first: 07 §6 (the 2026-09-16 ruling), 03 (the restore test's selection), 05 (self-bind), 04 §3.1 (signed delivery), 09 §3 decisions 45–49; rows R-719 … R-727, R-95, R-240, R-494, R-600, R-688. Releases: controller v0.283.0 + v0.283.1, agent v0.138.0, hub v0.126.0. Evidence: documentation/audits/evidence-fixes-first-tester-2026-09-30/ (part0, partA, partC, partD, partE, release).

Tester-2 — read-only checklist (nothing on Tester-2, Cloudflare, ep0 or the Storage Box was changed)

#	item	state	where to fix
1	Tunnel token pasted	done — tunnel 3ce0eccd… (Peti's original, reused)	—
2	DNS of sajatfelhom.hu	done — ONE record *.sajatfelhom.hu → that same tunnel; no leftover pointing elsewhere; today 530 (no connector, right with no box)	—
3	The tunnel's route *.sajatfelhom.hu → https://traefik, No TLS Verify	UNKNOWN — the record's Cloudflare key reads DNS only (Authentication error on the tunnel; stopped there)	Cloudflare → Zero Trust → Networks → Tunnels → this tunnel → Published application routes
4	Off-site	done — shared 100 GB, new sub-account 322460 (username sub2 reused; Peti's was emptied and deleted 2026-09-25)	—
5	DR tier (ep0)	done — ON; nothing of Tester-2 or Peti on ep0 yet (made at the first connection)	—
6	The connect e-mail	sent twice at 07:36 UTC (the customer was created twice, R-728) — only one of the two links works; valid until 2026-10-07 07:36 UTC	Tell your friend: if one link says „expired", use the other; or press „Send self-bind link" once just before the install
7	E-mail language	English — mail, bind page and the box start in English	Hub → Tester-2 → Edit, if Hungarian is wanted
8	Owner passphrase	yours to hand over	in person / by phone
9	Customer id Tester-2 has a capital letter	never walked before; no known break	note only

The Parts

Part	state	note
0 Tester-2 read-only	done	checklist above; items 3 and 6 need you
A1 measure the over-quota path	done	it deletes nothing extra: refuses new pushes, runs only the ruled retention; now pinned
A2 apps off-site by default + one press for older apps	done	controller v0.283.0; live on 9202
A3 size warning	done	page card; unit + parity proven (a household NAS target has no quota to test live)
B guide + slips	done / narrowed	six stale lines rewritten (the sixth found on the way: auto-reboot); R-724/R-725 partly, the rest narrowed
C1 ep0 cleanup	done	three archives removed; every other namespace byte-identical
C2 agent v0.138.0	done	signed delivery to both demo boxes (340 s); due-check normal on both
D fresh link for a returning customer	changed	the brief's trigger cannot be built (a registering box is unclaimed); built „Új linket kérek" on the expired/used page
E Stop holds	done, after a live failure	v0.283.0 was wrong in production (adapter); v0.283.1 fixed and proven live
F day-one mails	done	unit + red-proof; live proof at Tester-2's first hour

Claims in the brief that turned out wrong, named

• "The over-quota path prunes history" — wrong. Over the quota the box refuses new pushes and runs the SAME retention as every night; with no new snapshots nothing extra ages out. No P1.
• "Peti's Cloudflare records for sajatfelhom.hu may still be there" — there is exactly one record, and it points at the tunnel Tester-2 now carries (Peti's tunnel, reused). Nothing stale to remove.
• "A PBS archive carries its box's key fingerprint or host id" — half right: the key fingerprint yes (PVE content encrypted), a host id no (the comment is only „felhom local-api", the owner is the customer's token).
• "The hub sends no link at registration" — right, and it cannot: the registration carries nothing of a customer. The fix was changed to a button on the old link's page.
• "Stop is lost at the backup's resume only" — wrong: also at the nightly volume dump, the update leg and the startup crash recovery; all four fixed.
• Mine, from 2026-09-30: "the ✗ names the wrong tier" — misread; the local-tier heading was the NEXT section.

Red-proofs (each seen failing on its assertion, then restored)

RP31 new app not ON · RP32 earlier OFF overridden · RP33 hook not wired · RP34 over-quota forget differs · RP35 exact quota "does not fit" · RP36 quiesce restarts a stopped app · RP37 dump restarts it · RP38 update leg presses it · RP39 (agent) an earlier box's archive picked · RP40 new box "recovered" · RP41 first-hour skip mailed · RP42 no fresh link · RP43 the production adapter does not answer · RP44 crash recovery restarts it. Outputs: evidence-fixes-first-tester-2026-09-30/ and the scratchpad rp/ copies.

Slips of mine, said

• The first hub/evidence commit went out after my secret-scan script crashed (it looked for last night's shredded files). Scanned right after: 5 125 files, 7 secrets, 0 hits, control 1. Nothing leaked.
• v0.283.0 shipped the Stop fix un-wired in production; the live test caught it; v0.283.1 is the second controller release this session (the one-release rule bent, reason in its CHANGELOG).

Rows

Closed R-719, R-720, R-721, R-722, R-727. Fixed pending live proof R-723. Narrowed R-724, R-725. Opened R-728 (customer created twice), R-729 (no way to remove an off-site target). Register 359 → 361 rows. R-726 (a returning customer's orphaned repository) stays open — a NEW record does not meet it.

Teardown

• 9202: controller left on 0.283.1 (scratch; the floor does not reach it); the throwaway NAS target switched off through the form and then removed from settings.json with the controller stopped (R-729: no product path); glance removed with its data; paperless-ngx running; the off-site switches back OFF.
• Demo boxes: controller 0.283.1 by the floor, agent 0.138.0 by signed jobs — nothing else.
• ep0: only the three archives of decision 51. Hub: floor 0.283.1 (MinAgent 0.131.0 declared); hub 0.126.0.
• Tester-2 / Cloudflare: read only. DooPlex: pushes, builds, the hub deploy, signing.