felhom.eu/documentation/audits/RETIRE-peti-2026-09-25.md

# RETIRE — Peti's box (`peti-felhom`), 2026-09-25

Operator ruling 2026-09-25: Peti's box is retired (the tester wiped his server; it will not return); its off-site
backup holds no user data and is to be deleted; it leaves the protected list. Architecture read first:
`runbooks/target-selection.md`, `05-hub-architecture.md` §14 (what a customer delete deprovisions),
`06-offsite-connectivity.md`, `04-control-plane-authorization.md`. Evidence: `audits/retire-peti-2026-09-25/`.

## Not done, or changed

- **Nothing of Peti's was on ep0.** No PBS namespace (`ns`: demo-felhom, demo-hp, tester-1), no WireGuard peer in
  the live `wg show`, no config naming him. His only off-site item was a Storage Box **sub-account**
  (`u629488-sub2`, id 269130, label `felhom-customer=peti-felhom`, home `felhom-peti-felhom`) on the pool box.
- **The "backup" was never a backup.** The sub-account's folder held ONE file: `.ssh/authorized_keys`, 81 bytes. No
  restic repository was ever created — all 482 of his reports (2026-07-10 … 07-15) show 0 off-site snapshots and
  0 bytes; his escrow stayed pending. The operator's "no user data" is confirmed by the listing, not only by word.
- **To list and empty the folder I reset the sub-account's password through the Hetzner API** (the product's own
  `reset_subaccount_password` action, scoped to id 269130 after re-reading its label). The key file was removed from
  inside the folder, then the hub deleted the sub-account. Whether Hetzner deletes a sub-account's folder with it
  is NOT measured here — so the folder was emptied first, and nothing of his could remain either way.
- **Cloudflare:** his customer config carried a Cloudflare tunnel token and an API token (for `sajatfelhom.hu`).
  They were purged with the customer record. The hub's delete dialog says "tunnel/zone removed", but no leg of the
  cascade calls Cloudflare — the tunnel and DNS records on Cloudflare's side, if any remain, were NOT inventoried or
  removed (a row: R-688).
- **A second, older Storage Box** (`PBS-storage-1`, u629193, box 611421) once held a folder `felhom-peti-spike/`
  (spike leftovers, per `RUNBOOK-ep0-datastore-volume-2026-07-27.md`). Its mount on ep0 is gone, and the box is
  not visible to either API token (404). The register row "delete the box" is the operator's. Not touched.
- **Code comments that name Peti were left** (hub `rollup.go`, `appliances.go`, `notify/templates.go`; agent pbsdr
  tests). They explain why code is shaped as it is; no behaviour depends on Peti.

## A1 — inventory (before anything was removed)

| where | item | how found |
|---|---|---|
| hub | customer `peti-felhom` („Peti  Proxmox", domain `sajatfelhom.hu`, dr_tier 0) with 482 reports, 123 events, 1,036 telemetry rows, DR recipe, one-time secret, claim, 1 log tail | copy of the hub DB (with its -wal), every table's `customer_id` / `host_id` |
| hub | host `peti-felhom-86d37d` — already DELETED 2026-07-15 08:56:22 (`host_deletions`, escrow_acked 0); no host, guest, escrow, recovery or PBS-secret rows | same |
| hub | WireGuard peer — none in `wg_peers` | same |
| Storage Box | sub-account id 269130 `u629488-sub2`, home `felhom-peti-felhom`, label `felhom-customer=peti-felhom`, created 2026-07-10 | Hetzner API with the hub's own token, matched on the LABEL |
| ep0 | nothing (namespaces, peers, `/etc`, `/root`, `/srv` grep — one false hit, "competing" in `lvm.conf`) | ssh read-only |
| documents | 48 non-history files + workspace rules + 21 memory notes (whole-word pattern; positive control target-selection.md 7 hits, negative control catalog templates 0) | `A1-documents.txt` |

**Control, before:** pool box `size_data 3,120,562,176`, sub-accounts sub1 (demo-felhom), sub3 (demo-hp), sub4
(tester-1); ep0 namespaces demo-felhom 2 snapshots / 220K, demo-hp 2 / 540K, tester-1 2 / 368K; demo boxes'
off-site `last_status ok` (11 and 90 snapshots, runs 02:15:46Z / 02:18:41Z).

## A3 — removal

1. `POST …/subaccounts/269130/actions/reset_subaccount_password` → success (password kept 0600 in the scratchpad,
   deleted afterwards).
2. As `u629488-sub2`: `rm .ssh/authorized_keys`, `rmdir .ssh` → `ls -la` empty, `du -s .` 1.
3. Hub preview `GET /configs/peti-felhom/delete` — 0 hosts, off-site `u629488-sub2`, residue 1,519. Then
   `POST /configs/peti-felhom/delete` (ack_hosts, ack_reset, ack_purge, confirm_id, expect_hosts=0) → 303. The hub's
   log: sub-account 269130 deprovisioned; PBS tenancy `existed=false`; claim reset; residue purged (reports 482,
   telemetry 1,036, log tails 1); cascade COMPLETE (journal #20).

## A4 — nothing else moved

| item | before | after |
|---|---|---|
| sub-accounts | sub1, sub2 (Peti), sub3, sub4 | sub1, sub3, sub4 — labels and homes unchanged |
| pool box `size_data` | 3,120,562,176 | 3,120,562,176 |
| login as `u629488-sub2` | worked | "Permission denied" |
| ep0 namespaces (snapshots / du) | demo-felhom 2/220K, demo-hp 2/540K, tester-1 2/368K | identical |
| ep0 WireGuard peers | .2 .3 .4 .250 | identical |
| hub hosts | demo-felhom, demo-hp, drill-r50 | identical |
| hub customers | demo-felhom, demo-hp, drill-r50, peti-felhom, tester-1 | without peti-felhom |
| hub rows naming peti | — | events 124, notification_log 80, host_deletions 1, customer_resets 1 (audit, by design), app_log_issues 8 (R-244) |

## A5 — documents changed

`runbooks/target-selection.md` (Tier 2 = DooPlex + ep0, ep0's reason rewritten, Peti's section retired); the
unprompted-work rule (4 identical copies); `03`, `06`, `00-capability-map`; runbooks `TASK-identity-only-escrow`
(obsolete note), `RUNBOOK-vzdump-target-move` (row 9), `RUNBOOK-island-migration`; retired banners on
`pilot/PETI-tester-agreement.md`, `RUNBOOK-peti-return`, `RUNBOOK-peti-pbsdr`; register (PETI closed as retired,
R-530, R-244, R-600 annotated); CONTEXT; STATUS; memory notes. Historic audits, tests and CHANGELOGs keep their text.

## Claims in the brief

1. *Peti's backup is on ep0* — **WRONG.** ep0 held nothing of his; the item was a Storage Box sub-account.
2. *The hub's host delete removes the WireGuard peer* — **not testable here:** the host was deleted in July and
   ep0 carries no peer for it now; whether that delete removed one is not recorded (R-600 annotated).
3. *The backup holds no user data* — **TRUE, and stronger:** it held no backup at all (one 81-byte key file).

## Part B — controller v0.272.0 (`44ae4de`), floor 0.272.0

Red-proofs, each seen failing (`retire-peti-2026-09-25/B/redproof-*.txt`): R-670 (undo read with the validating
loader → "the undo logged a false backup-block ERROR"), R-671 (remover call dropped → "copies were left behind"; wiring
dropped → "main.go never calls SetUndoCopyRemover"), R-677 (always catalog_since → "got 3 days, want 0"), R-685 page
(line dropped → "a space skip must be said on the page"). Full suite + controller gates green; parity unchanged.

Live on 9202, drill catalog (`B/live/`): navidrome installed at 0.64.0 with a wrong probe; the step to 0.64.1 failed and
its undo failed → HOLD, 1 undo copy kept; **R-670:** 0 "backup block rejected" lines while the undo ran (my first count
of 3 "unreadable" was disk-watch lines — corrected in `r670-verdict.txt`); **R-671:** the backup page's restore →
"update hold … CLEARED", "removed 1 undo cop(y/ies)", 0 copies left, the seeded user read back; **R-677:** the head
re-tested at a new digest → „Frissítés elérhető — ma" / "Update available — today" (catalog_since two days old).
**R-685 page line: not live** — 9202 has no agent, and no demo box is short of space. Teardown: navidrome removed
through the product (0 volumes, 0 copies), 9202 back on the live catalog, drill reset to live `main`.
Floor saved 09:31:31Z; both demo boxes on 0.272.0 at 09:31:55Z; demo-hp's backup page renders in both languages.

## Part C — the night watch: NOT REACHED

The session ended in the daytime (≈11:40 CEST).