============================================================
FLEET ONBOARDING — Friend's Windows Machine
============================================================

Built by Zora on Daystrom for Ray. Same scenario as the Panda
laptop. Friend has authorized; goal is "us reaching IN" for
support, not "her routing changing." VPN is GUI-launch only
(no auto-connect, no default-route hijack).

==========  RUN ORDER (one at a time)  ==========

  01-check-ssh-client.bat
  02-install-ssh-server.bat
  03-install-openvpn.bat
  04-register-laptop.bat   (optional — runs at the end to
                            phone home the laptop's name + IP
                            so Zora knows it's ready)

EACH BATCH FILE MUST BE RUN AS ADMINISTRATOR:
  Right-click → "Run as administrator"

After EACH script, read the last few lines of output. If you
see "STEP COMPLETE" the step worked. If you see an error,
stop and reach Zora before continuing.

==========  IF SSH CLIENT IS PRESENT  ==========

If 01 reports the SSH client is already installed, you can
reach Zora's tmux session from her machine BEFORE running 02
and 03. Open a new Command Prompt (NOT admin needed) and:

  ssh oldbones@daystrom.finestoflines.net

Use your normal Daystrom password.

Once on Daystrom, send Zora a fleet message — she will see it:

  pathfinder-send zora "Ray here on the friend's laptop, ready
  to proceed."

To send her any text from the friend's machine:

  pathfinder-send zora "your message here"

To get a peek at her tmux pane:

  sudo tmux -S /tmp/tmux-0/default attach -t zora-persistent

Detach without killing her session: press Ctrl-B then D.

==========  IF SSH CLIENT IS NOT PRESENT  ==========

01-check-ssh-client.bat will install it for you. Run that
first, then come back and use the SSH commands above.

==========  WHAT EACH SCRIPT DOES  ==========

01-check-ssh-client.bat
  Checks for ssh.exe in PATH. If absent, installs the
  built-in Windows OpenSSH Client (Microsoft feature, no
  third-party download). Does NOT touch sshd server or
  firewall. Outputs the SSH commands you can use.

02-install-ssh-server.bat
  Installs OpenSSH Server, starts the service, opens the
  Windows firewall for TCP 22, writes Zora's public key to
  C:\ProgramData\ssh\administrators_authorized_keys with the
  Windows-required ACLs. After this Zora can SSH IN as any
  local administrator account on the laptop.

03-install-openvpn.bat
  Downloads + installs the OpenVPN community Windows client
  (no third-party stuff, official OpenVPN.org installer).
  Drops the pre-built friend-foltc.ovpn config into
  C:\Program Files\OpenVPN\config\ (manual GUI connect, NOT
  config-auto — no default-route hijack). Adds the OpenVPN
  GUI to the user's startup so the tray icon appears on next
  login. VPN is OFF by default — right-click the tray icon
  and Connect when needed, Disconnect to drop. Her normal
  internet routing is NEVER changed.

04-register-laptop.bat
  Optional. POSTs the laptop's hostname + IP to a Daystrom
  callback so Zora gets notified the install is complete and
  can verify reachability.

==========  IF YOU NEED TO STOP MID-OP  ==========

You can stop after any of the four scripts without leaving
the laptop in a broken state. SSH server and OpenVPN can be
disabled later from Services if needed. Friend's normal use
is unaffected at every step.

==========  CONTACT IF SOMETHING BREAKS  ==========

If internet breaks on her machine and you cannot reach Zora:
- Stop running scripts immediately
- Reboot the laptop (clears any half-applied firewall rule)
- If still broken: Windows → Settings → Network → Reset
- The scripts do NOT modify her routing table or DHCP, so
  internet should be unaffected. If it IS affected, that
  is the OpenVPN install step — open Services and Stop
  the OpenVPNService, set it to Manual.

— Zora, on Daystrom