From 637bdde1bcd7db158103ab41cc341f929a427476 Mon Sep 17 00:00:00 2001
From: saladday <1203511142@qq.com>
Date: Sat, 26 Sep 2026 00:58:28 +0000
Subject: [PATCH 1/4] Add nodes with one sudo command and clean up hosts after
 removal

Add node now generates the sudo-mode command: a leading space, the checked
installer run as root (sudo unless the shell is root) and the one-time token
passed only on standard input. A "No sudo on this host?" disclosure gives the
same command without sudo, with what the node's own user needs, and the log hint
follows the mode on screen. The host requirements describe sudo mode. The dialog
issues no command while the installation's public URL is loopback, and it reads
the console configuration and the installation again on opening and on window
focus, so a fix on the Core host shows without a reload. After Remove, a Clean
up the host dialog gives the host's uninstall command in both forms.
---
 apps/web/DESIGN.md                            |  14 ++
 apps/web/PRODUCT.md                           |   5 +-
 apps/web/e2e/nodes.spec.ts                    |  52 ++++++--
 .../features/sandbox/NodeCleanupDialog.tsx    |  37 +++++
 .../src/features/sandbox/NodeEnrollment.tsx   | 126 ++++++++----------
 .../features/sandbox/SandboxManagerView.css   |   8 +-
 .../features/sandbox/SandboxManagerView.tsx   |  12 ++
 .../sandbox/enrollment-command.test.ts        |  83 ++++++++----
 .../features/sandbox/enrollment-command.ts    |  59 ++++++--
 .../src/features/sandbox/node-commands.tsx    | 112 ++++++++++++++++
 .../features/sandbox/node-enrollment.test.ts  |   6 -
 .../src/features/sandbox/node-enrollment.ts   |  83 +++++++-----
 apps/web/src/lib/locale-strings.ts            |  27 +++-
 docs/web/protocol-coverage.md                 |   6 +-
 14 files changed, 465 insertions(+), 165 deletions(-)
 create mode 100644 apps/web/src/features/sandbox/NodeCleanupDialog.tsx
 create mode 100644 apps/web/src/features/sandbox/node-commands.tsx

diff --git a/apps/web/DESIGN.md b/apps/web/DESIGN.md
index 5f940ca97..937912c16 100644
--- a/apps/web/DESIGN.md
+++ b/apps/web/DESIGN.md
@@ -523,6 +523,20 @@ request runs.
   Graphite hint for automation (`chmod 600`, `--credential-file`). Done is
   outline and forgets the credential; closing the dialog keeps it in a pending
   card, which points to the Connect a host command below.
+- **Add node**: the sandbox limits first, then the one-time command in a Terminal
+  block (expiry countdown and Copy command in its header), the three progress
+  steps, and, once the installer's minute passes, an amber card with the reason
+  and a copyable log command. Below, two folded Hairline disclosures: Host
+  requirements for the default command, which uses sudo (open until this browser
+  has shown it once, with notes that it creates the `parsar-node` system service
+  and, for Docker, that the docker group is root-equivalent), and "No sudo on this
+  host?", with what the node's own user needs and the command without sudo. While
+  it is open, the log command is the user service's. A loopback public URL, or a
+  console without the provider's node files, replaces the limits with one line
+  saying why, and the footer offers nothing to generate.
+- **Clean up the host**: after a node is removed, a dialog gives the host's
+  uninstall command in the same Terminal block, with the no-sudo form behind an
+  "Installed without sudo?" disclosure; Done dismisses it.
 - **How to call**: wherever a new key is shown, a card under it gives three
   copyable samples, each a Margin Gray block with a Hairline and its label and copy
   button in a header row: a Shell block exporting `OPENAI_BASE_URL` (the
diff --git a/apps/web/PRODUCT.md b/apps/web/PRODUCT.md
index c0ab4fc0c..033074557 100644
--- a/apps/web/PRODUCT.md
+++ b/apps/web/PRODUCT.md
@@ -82,7 +82,10 @@ workbench.
   template build's), a review, and advanced settings
   with the complete form — then the node list with each node's capacity, host
   figures and allocations, enrollment, renaming, sandbox limits and removal; Add node
-  asks for the node's sandbox limits before it issues the one-time command), System (the
+  asks for the node's sandbox limits before it issues the one-time command, which installs
+  the node with sudo as a system service (a disclosure gives the command without sudo, as a
+  user service); it issues none while the public URL is loopback or the console lacks the
+  provider's node files; after Remove, a dialog gives the host's uninstall command), System (the
   installation's public address, API base URL, installation ID and source commit, read-only;
   each harness's default model, set, replaced or cleared there beside its read-only startup
   state; the sandbox configuration every project shares, with a link to Nodes where it
diff --git a/apps/web/e2e/nodes.spec.ts b/apps/web/e2e/nodes.spec.ts
index 6d637cd00..7d1adf76b 100644
--- a/apps/web/e2e/nodes.spec.ts
+++ b/apps/web/e2e/nodes.spec.ts
@@ -1,10 +1,10 @@
 import { expect, test } from "@playwright/test";
 
-import { expectManagementBoundary, openConsole, setNode, writes } from "./console";
+import { expectManagementBoundary, openConsole, resetFixture, setNode, writes } from "./console";
 
 test.afterEach(async ({ request }) => expectManagementBoundary(request));
 
-test("adds a node: host requirements, a countdown, the same command after closing, a new one after expiry, then its own node's registration", async ({ page, request }) => {
+test("adds a node: host requirements, a sudo command and one without, a countdown, the same command after closing, a new one after expiry, then its own node's registration", async ({ page, request }) => {
   await page.clock.install();
   // Core counts a token's ten minutes on its own clock; the page's clock stands in for it, so fast-forwarding expires a command.
   await page.route("**/core/v1/sandbox/enrollment-tokens", async (route) => {
@@ -15,12 +15,14 @@ test("adds a node: host requirements, a countdown, the same command after closin
   await openConsole(page, request, "nodes");
   await page.getByRole("button", { name: "Add node" }).click();
   const add = page.getByRole("dialog", { name: "Add node" });
-  // What a Docker host needs, with the root commands that prepare it.
-  await expect(add.getByText("Docker at /var/run/docker.sock for that user, enforcing CPU and memory limits")).toBeVisible();
-  await expect(add.getByText("sudo usermod -aG docker NODE_USER")).toBeVisible();
-  await expect(add.getByText("CPUs and memory for at least one sandbox: 2 CPU · 4 GiB")).toBeVisible();
-  await expect(add.getByText(/^Can reach http:\/\/127\.0\.0\.1:\d+ and https:\/\/core\.example\.com; sandboxes must reach https:\/\/core\.example\.com$/)).toBeVisible();
+  // What a Docker host needs for the default command, which installs the node with sudo.
+  await expect(add.getByText("Docker Engine installed and running, enforcing CPU and memory limits (cgroup v2)")).toBeVisible();
+  await expect(add.getByText("CPUs and memory for at least one sandbox: 2 CPU · 4 GiB; about 2 GB of disk for the Runtime image")).toBeVisible();
+  await expect(add.getByText(/^Reaches http:\/\/127\.0\.0\.1:\d+ and https:\/\/core\.example\.com; sandboxes reach https:\/\/core\.example\.com$/)).toBeVisible();
+  await expect(add.getByText("parsar-node joins the docker group, which is equivalent to root on this host.")).toBeVisible();
   await expect(add.getByText(/\/dev\/kvm/)).toHaveCount(0);
+  // Preparing a user instead of using sudo waits behind its disclosure.
+  await expect(add.getByText("sudo usermod -aG docker NODE_USER")).toBeHidden();
   // The fixture console runs on loopback, where another machine can't download from it.
   await expect(add.getByRole("note")).toContainText("other machines can't reach");
   await add.getByLabel("Sandboxes at once").fill("3");
@@ -29,8 +31,11 @@ test("adds a node: host requirements, a countdown, the same command after closin
   await add.getByRole("button", { name: "Generate command" }).click();
   // Docker never suspends, so it retains exactly the sandboxes it runs.
   expect((await issued).postDataJSON()).toEqual({ max_active: 3, max_retained: 3 });
-  const field = add.getByLabel("One-time enrollment command");
+  const field = add.getByLabel("One-time enrollment command", { exact: true });
   await expect(field).toHaveValue(/enroll_fixture_/);
+  // The token goes on stdin to the checked installer, run with sudo unless the shell is root.
+  await expect(field).toHaveValue(/^ \(umask 077;.*\|\| s=sudo\n/);
+  await expect(field).toHaveValue(/\| \$s python3 "\$d\/node-install\.pyz" --enrollment-token-stdin /);
   await expect(add.getByRole("timer")).toHaveText(/^Expires in (10:00|9:\d\d)$/);
   const progress = add.getByRole("status", { name: "Registration progress" });
   await expect(progress).toHaveText(/Waiting for registration.*Connect.*Docker check/);
@@ -81,6 +86,13 @@ test("adds a node: host requirements, a countdown, the same command after closin
   await page.clock.fastForward("01:01");
   const problem = add.getByRole("alert");
   await expect(problem).toContainText("Not connected yet");
+  await expect(problem).toContainText("sudo journalctl -u parsar-node-7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f.service");
+  // Without sudo: what that user needs, the same command without sudo, and its user service's log.
+  await add.getByText("No sudo on this host?").click();
+  await expect(add.getByText("sudo usermod -aG docker NODE_USER")).toBeVisible();
+  const userCommand = add.getByLabel("One-time enrollment command without sudo", { exact: true });
+  await expect(userCommand).toHaveValue(/EXIT\ncurl/);
+  await expect(userCommand).toHaveValue(/\| python3 "\$d\/node-install\.pyz" --enrollment-token-stdin /);
   await expect(problem).toContainText("journalctl --user -u parsar-node-7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f.service");
   // Connected, it reports why Docker isn't ready; once ready, the node is connected.
   await setNode(request, { id: "node-new", online: true, diagnostic: "docker_limits_unsupported" });
@@ -95,14 +107,27 @@ test("adds a node: host requirements, a countdown, the same command after closin
   await expect(add.getByLabel("Sandboxes at once")).toHaveValue("2");
 });
 
-test("says the console has no node files for the provider and issues no command", async ({ page, request }) => {
+test("issues no command for a loopback public URL or without node files, and sees a fix on reopening", async ({ page, request }) => {
+  // Nodes on other machines can't reach a loopback public_url; this replaces the note about the browser's address.
+  await openConsole(page, request, "nodes", { installation: "local" });
+  await page.getByRole("button", { name: "Add node" }).click();
+  const add = page.getByRole("dialog", { name: "Add node" });
+  await expect(add.getByRole("status")).toHaveText("Nodes need an HTTPS public URL that other machines and their sandboxes can reach: set public_url in config.json and run parsar apply");
+  await expect(add.getByRole("note")).toHaveCount(0);
+  await expect(add.getByRole("button", { name: "Generate command" })).toHaveCount(0);
+  await add.getByRole("button", { name: "Close dialog" }).click();
+
   // A thin bundle: the console holds no node files at all.
   await openConsole(page, request, "nodes", { nodeArtifacts: [] });
   await page.getByRole("button", { name: "Add node" }).click();
-  const add = page.getByRole("dialog", { name: "Add node" });
   await expect(add.getByRole("status")).toHaveText("This console has no node files for Docker. Install Core from the offline bundle, or add the release artifacts and rerun ./install.sh.");
   await expect(add.getByRole("button", { name: "Generate command" })).toHaveCount(0);
   expect(await writes(request)).toEqual([]);
+  // Rerunning ./install.sh adds them: reopening reads the console again, without a reload.
+  await add.getByRole("button", { name: "Close dialog" }).click();
+  await resetFixture(request);
+  await page.getByRole("button", { name: "Add node" }).click();
+  await expect(add.getByRole("button", { name: "Generate command" })).toBeVisible();
 });
 
 test("removes a node after confirmation", async ({ page, request }) => {
@@ -112,6 +137,13 @@ test("removes a node after confirmation", async ({ page, request }) => {
   await confirm.getByRole("button", { name: "Confirm removal" }).click();
   await expect(confirm).toBeHidden();
   await expect(page.getByRole("table", { name: "Sandbox nodes" })).not.toContainText("edge-03");
+  // The host still runs the node until it is uninstalled there: with sudo, or as the user that installed it.
+  const cleanup = page.getByRole("dialog", { name: "Clean up the host" });
+  await expect(cleanup.getByLabel("Uninstall command", { exact: true })).toHaveValue(/\| s=sudo\n[^]*\n\$s python3 "\$d\/node-install\.pyz" --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f'\)$/);
+  await cleanup.getByText("Installed without sudo?").click();
+  await expect(cleanup.getByLabel("Uninstall command without sudo", { exact: true })).toHaveValue(/\npython3 "\$d\/node-install\.pyz" --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f'\)$/);
+  await cleanup.getByRole("button", { name: "Done" }).click();
+  await expect(cleanup).toBeHidden();
 });
 
 test("sets up own-machine sandboxes page by page, with the Runtime from the distribution", async ({ page, request }) => {
diff --git a/apps/web/src/features/sandbox/NodeCleanupDialog.tsx b/apps/web/src/features/sandbox/NodeCleanupDialog.tsx
new file mode 100644
index 000000000..2d04859ba
--- /dev/null
+++ b/apps/web/src/features/sandbox/NodeCleanupDialog.tsx
@@ -0,0 +1,37 @@
+import { useTranslation } from "react-i18next";
+
+import { Modal } from "../../components/Modal";
+import { nodeUninstallCommand } from "./enrollment-command";
+import { CommandBlock } from "./node-commands";
+
+/** A node Core has just removed, with what builds its host's uninstall command. */
+export interface NodeCleanup {
+  name: string;
+  sourceUrl: string;
+  installationId: string;
+  scriptDigest: string;
+}
+
+/**
+ * After Remove: the command that removes the node's service and files from its
+ * host. The installer uninstalls only once Core refuses the node's credential,
+ * which it does from the removal on. The sudo form escalates by itself, so a node
+ * installed without sudo gets its own command, run as that node's user.
+ */
+export function NodeCleanupDialog({ cleanup, open, onClose }: { cleanup: NodeCleanup | null; open: boolean; onClose: () => void }) {
+  const { t } = useTranslation("sandbox");
+  const command = (mode: "sudo" | "user") => cleanup ? nodeUninstallCommand({ sourceUrl: cleanup.sourceUrl, installationId: cleanup.installationId, scriptDigest: cleanup.scriptDigest, mode }) : "";
+  return <Modal open={open} title={t("Clean up the host")} onClose={onClose} footer={<button className="button primary" type="button" onClick={onClose}>{t("Done")}</button>}>
+    {cleanup ? <div className="sandbox-add-node form-stack">
+      <p>{t("{{name}} is removed from Core. To remove its service and files from the host, run:", { name: cleanup.name })}</p>
+      <CommandBlock key={command("sudo")} value={command("sudo")} label={t("Uninstall command")} copyLabel={t("Copy uninstall command")} autoFocus />
+      <details className="sandbox-host-requirements sandbox-no-sudo">
+        <summary>{t("Installed without sudo?")}</summary>
+        <div className="sandbox-no-sudo-body">
+          <p>{t("Run this as that user instead:")}</p>
+          <CommandBlock key={command("user")} value={command("user")} label={t("Uninstall command without sudo")} copyLabel={t("Copy the uninstall command without sudo")} />
+        </div>
+      </details>
+    </div> : null}
+  </Modal>;
+}
diff --git a/apps/web/src/features/sandbox/NodeEnrollment.tsx b/apps/web/src/features/sandbox/NodeEnrollment.tsx
index 685a4d018..7b5b88f1f 100644
--- a/apps/web/src/features/sandbox/NodeEnrollment.tsx
+++ b/apps/web/src/features/sandbox/NodeEnrollment.tsx
@@ -1,18 +1,21 @@
 import { createPortal } from "react-dom";
-import { Check, Copy, Terminal, TriangleAlert } from "lucide-react";
+import { TriangleAlert } from "lucide-react";
 import { useCallback, useEffect, useId, useRef, useState } from "react";
 import type { SandboxAdminClient, SandboxDeployment, SandboxEnrollment, SandboxNode } from "@agents-core-web/agents-client";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useTranslation } from "react-i18next";
 import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
 import { Modal } from "../../components/Modal";
 import { formatBytes } from "../../lib/format";
+import { installationQuery } from "../../lib/installation";
 import { sandboxDiagnosticMessage } from "../../lib/sandbox-diagnostic";
 import { sandboxRequestError } from "../../lib/sandbox-labels";
-import { useCopy } from "../api-keys/IssuedKey";
 import { sandboxCoreOrigin, sandboxSetupOrigin } from "./core-origin";
 import { nodeFilesAvailable, type SandboxConsoleConfig } from "./console-config";
-import { nodeInstallCommand, nodeLogCommand } from "./enrollment-command";
-import { enrolledNode, enrollmentProgress, formatCountdown, hostPrerequisites, progressSteps, USER_MANAGER_RESTART, type StepState } from "./node-enrollment";
+import { nodeInstallCommand, nodeLogCommand, type NodeInstallMode } from "./enrollment-command";
+import { CommandBlock, CopyCommand, HostRequirements, NoSudoGuide } from "./node-commands";
+import { enrolledNode, enrollmentProgress, formatCountdown, progressSteps, type StepState } from "./node-enrollment";
+import { sandboxConsoleConfigQuery } from "./sandbox-queries";
 
 /** The host requirements open by default until this browser has shown them once. */
 const REQUIREMENTS_SEEN = "agents-core-web.node-requirements-seen";
@@ -32,8 +35,13 @@ const DEFAULT_RETAINED = "8";
  * one-time enrollment command that approves them
  * (`POST /core/v1/sandbox/enrollment-tokens`). Only microsandbox suspends
  * sandboxes, so only it asks for a retained limit; Docker retains exactly the
- * sandboxes it runs at once. A console that reports no node files for the
- * deployment's provider (`node_artifacts`) says so instead and issues no command.
+ * sandboxes it runs at once. The command runs the installer with sudo, which
+ * installs the node as a system service; a disclosure offers the same command
+ * without sudo, which installs a user service. An installation whose public URL
+ * is loopback (`local_only`), or a console that reports no node files for the
+ * deployment's provider (`node_artifacts`), says so instead and issues no command.
+ * Each opening, and each return to the window while open, reads both again, so a
+ * fix on the Core host shows without a reload.
  *
  * The page keeps this dialog mounted, so a command survives closing it: it is
  * shown again until it expires or its node connects. An expired command is
@@ -62,10 +70,12 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   const [enrollment, setEnrollment] = useState<SandboxEnrollment | null>(null);
   const [appeared, setAppeared] = useState<{ id: string; at: number } | null>(null);
   const [error, setError] = useState<unknown>(null);
-  const [copied, setCopied] = useState(false);
-  const [copyFailed, setCopyFailed] = useState(false);
   const [now, setNow] = useState(Date.now);
   const [requirementsOpen, setRequirementsOpen] = useState(() => !requirementsSeen());
+  // The no-sudo disclosure; while it is open, log hints are for a user service.
+  const [noSudoOpen, setNoSudoOpen] = useState(false);
+  const queryClient = useQueryClient();
+  const installation = useQuery(installationQuery);
   // When the latest node-list read this dialog asked for began (Date.now()), once it has finished.
   const [checkedAt, setCheckedAt] = useState(0);
   const reading = useRef(false);
@@ -74,11 +84,18 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   const sourceUrl = sandboxCoreOrigin(window.location.origin);
   const coreUrl = sandboxCoreOrigin(deployment.core_url || window.location.origin);
   const available = Boolean(consoleConfig.node_installer && sourceUrl && coreUrl);
-  // Without the provider's node files the installer would fail on the host, so no command is issued.
-  const nodeFiles = nodeFilesAvailable(consoleConfig, deployment.provider);
+  const provider = deployment.provider === "docker" || deployment.provider === "microsandbox" ? deployment.provider : null;
+  const backend = provider === "microsandbox" ? "microsandbox" : "Docker";
+  // Nodes and their sandboxes reach Core at its public URL, so a loopback one serves no other machine;
+  // and without the provider's node files the installer would fail on the host. Either way no command is issued.
+  const blocker = installation.data?.local_only === true
+    ? t("Nodes need an HTTPS public URL that other machines and their sandboxes can reach: set public_url in config.json and run parsar apply")
+    : !nodeFilesAvailable(consoleConfig, deployment.provider)
+      ? t("This console has no node files for {{provider}}. Install Core from the offline bundle, or add the release artifacts and rerun ./install.sh.", { provider: backend })
+      : null;
   // The command downloads from this console's own address. A loopback one (or any
   // address sandboxSetupOrigin refuses for guests) resolves to the node host itself.
-  const localOnly = sourceUrl !== null && sandboxSetupOrigin(sourceUrl) === null;
+  const consoleLoopback = sourceUrl !== null && sandboxSetupOrigin(sourceUrl) === null;
   // Core takes whole numbers from 1 to a million, with the retained limit at least the active one.
   const suspends = deployment.provider === "microsandbox";
   const whole = (value: string) => (/^\d+$/.test(value.trim()) ? Number(value.trim()) : null);
@@ -100,8 +117,9 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   const lapsed = Boolean(enrollment && expiresAt <= now);
   // Expired only once a read begun after the expiry found no node for the command.
   const expired = lapsed && checkedAt >= expiresAt;
-  const command = enrollment && available && (registered || !expired) && !ready
-    ? nodeInstallCommand(enrollment.token, coreUrl!, sourceUrl!, deployment.provider, deployment.installation_id, consoleConfig.node_installer_sha256) : "";
+  const commandFor = (mode: NodeInstallMode) => enrollment && provider && available && (registered || !expired) && !ready
+    ? nodeInstallCommand({ token: enrollment.token, coreUrl: coreUrl!, sourceUrl: sourceUrl!, provider, installationId: deployment.installation_id, scriptDigest: consoleConfig.node_installer_sha256, mode }) : "";
+  const command = commandFor("sudo");
   const nodeId = node?.id ?? null;
   const polling = open && enrollment !== null && !ready && (registered || !expired);
   const check = useCallback(async () => {
@@ -113,6 +131,17 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   }, [onRefresh]);
   useEffect(() => () => { generation.current++; request.current?.abort(); }, []);
   useEffect(() => { if (open) rememberRequirementsSeen(); }, [open]);
+  // Rerunning ./install.sh or parsar apply on the Core host changes what the console and the installation report.
+  useEffect(() => {
+    if (!open) return;
+    const reread = () => {
+      void queryClient.invalidateQueries({ queryKey: sandboxConsoleConfigQuery.queryKey });
+      void queryClient.invalidateQueries({ queryKey: installationQuery.queryKey });
+    };
+    reread();
+    window.addEventListener("focus", reread);
+    return () => window.removeEventListener("focus", reread);
+  }, [open, queryClient]);
   // The command's node may have registered while the dialog was closed.
   useEffect(() => { if (open && enrollment) void check(); }, [open]); // eslint-disable-line react-hooks/exhaustive-deps
   // At expiry, one more read decides between the command's node and "Command expired".
@@ -137,7 +166,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   function close() {
     generation.current++;
     request.current?.abort(); request.current = null;
-    setError(null); setBusy(false); setCopied(false); setCopyFailed(false);
+    setError(null); setBusy(false);
     // A connected node ends the command; otherwise it waits here for the next opening.
     if (ready) { setEnrollment(null); setAppeared(null); }
     // The limits stay only with an unfinished flow: a command still waiting for its node.
@@ -151,14 +180,14 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
    */
   function changeLimits() {
     generation.current++;
-    setEnrollment(null); setAppeared(null); setError(null); setCopied(false); setCopyFailed(false);
+    setEnrollment(null); setAppeared(null); setError(null);
   }
   async function generate() {
-    if (request.current || !available || !nodeFiles || !limitsReady || activeLimit === null || retainedLimit === null) return;
+    if (request.current || !available || blocker || !limitsReady || activeLimit === null || retainedLimit === null) return;
     const capacity = { max_active: activeLimit, max_retained: retainedLimit };
     generation.current++;
     const controller = new AbortController(); request.current = controller;
-    setBusy(true); setError(null); setCopied(false); setCopyFailed(false);
+    setBusy(true); setError(null);
     try {
       // A node the previous command enrolled since the last read is that command's success:
       // follow it instead of issuing another command.
@@ -182,36 +211,17 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
     }
     finally { if (!controller.signal.aborted) { request.current = null; setBusy(false); } }
   }
-  async function copyCommand() {
-    const current = generation.current;
-    try { await navigator.clipboard.writeText(command); if (current === generation.current) { setCopied(true); setCopyFailed(false); } }
-    catch { if (current === generation.current) { setCopied(false); setCopyFailed(true); } }
-  }
-  const backend = suspends ? "microsandbox" : "Docker";
   const size = deployment.specification?.resources;
   const values = {
     console: sourceUrl ?? "", core: coreUrl ?? "",
     size: size ? t("{{cpus}} CPU · {{memory}}", { cpus: size.cpus, memory: formatBytes(size.memory_mib * 2 ** 20) }) : "",
   };
-  const requirements = deployment.provider === "docker" || deployment.provider === "microsandbox" ? (
-    <details className="sandbox-host-requirements" open={requirementsOpen} onToggle={(event) => setRequirementsOpen(event.currentTarget.open)}>
-      <summary>{t("Host requirements")}</summary>
-      <ul>
-        {hostPrerequisites(deployment.provider, Boolean(size)).map((item) => (
-          <li key={item.label}>
-            <span>{t(item.label, values)}</span>
-            {item.command ? <CopyCommand value={item.command} /> : null}
-          </li>
-        ))}
-      </ul>
-      <div className="sandbox-host-requirements-note">
-        <p>{t("After a group change, sign in again as that user. If its systemd manager was already running, restart it (or reboot):")}</p>
-        <CopyCommand value={USER_MANAGER_RESTART} />
-      </div>
-    </details>
-  ) : null;
+  const requirements = provider ? <>
+    <HostRequirements provider={provider} sized={Boolean(size)} values={values} open={requirementsOpen} onToggle={setRequirementsOpen} />
+    <NoSudoGuide provider={provider} values={values} command={commandFor("user")} open={noSudoOpen} onToggle={setNoSudoOpen} />
+  </> : null;
   const limitsForm = `${id}-limits`;
-  const footer = !available || (!enrollment && !nodeFiles) ? undefined
+  const footer = !available || (!enrollment && blocker) ? undefined
     : !enrollment ? <>
       <button className="button outline" type="button" onClick={close}>{t("Cancel")}</button>
       <button className="button primary" type="submit" form={limitsForm} disabled={busy || !limitsReady}>{busy ? t("Preparing your command…") : t("Generate command")}</button>
@@ -220,7 +230,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
     : registered ? <button className="button outline" type="button" onClick={changeLimits}>{t("Add another node")}</button>
     : <>
       <button className="button outline" type="button" disabled={busy} onClick={changeLimits}>{t("Change limits")}</button>
-      {expired && nodeFiles ? <button className="button primary" type="button" autoFocus disabled={busy} onClick={() => void generate()}>{busy ? t("Preparing your command…") : t("Generate new command")}</button> : null}
+      {expired && !blocker ? <button className="button primary" type="button" autoFocus disabled={busy} onClick={() => void generate()}>{busy ? t("Preparing your command…") : t("Generate new command")}</button> : null}
     </>;
   // Tense tells a step's state: done in the past, the current one waiting, later ones as plain nouns.
   // Readiness from an unconfirmed read still counts as waiting.
@@ -240,11 +250,11 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
       {!available ? <p role="status">{consoleConfig.node_installer && coreUrl && !sourceUrl
         ? t("Open this console over HTTPS to add a node: the installer downloads only over HTTPS.")
         : t("Node installation is unavailable. Ask the deployment administrator to enable the node installer on this console.")}</p>
-      : !enrollment && !nodeFiles ? <p role="status">{t("This console has no node files for {{provider}}. Install Core from the offline bundle, or add the release artifacts and rerun ./install.sh.", { provider: backend })}</p>
+      : !enrollment && blocker ? <p role="status">{blocker}</p>
       : !enrollment ? (
         <form id={limitsForm} className="form-stack" onSubmit={(event) => { event.preventDefault(); void generate(); }}>
           <p>{t("Set the sandbox limits for the host you want to add.")}</p>
-          {localOnly ? <p className="sandbox-add-node-warning" role="note"><TriangleAlert size={14} aria-hidden="true" /><span>{t("This console is open at {{origin}}, which other machines can't reach. To add another machine, open the console at its HTTPS address, then generate the command.", { origin: sourceUrl })}</span></p> : null}
+          {consoleLoopback ? <p className="sandbox-add-node-warning" role="note"><TriangleAlert size={14} aria-hidden="true" /><span>{t("This console is open at {{origin}}, which other machines can't reach. To add another machine, open the console at its HTTPS address, then generate the command.", { origin: sourceUrl })}</span></p> : null}
           <div className="field">
             <span className="field-label-row"><label htmlFor={`${id}-active`}>{t("Sandboxes at once")}</label><HelpTip>{t("The most sandboxes Core places on this node at the same time.")}</HelpTip></span>
             <input id={`${id}-active`} inputMode="numeric" autoComplete="off" autoFocus={open} value={active} onChange={(event) => setActive(event.target.value)} aria-invalid={Boolean(activeProblem)} />
@@ -263,15 +273,8 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
       ) : <>
         {/* Once used, the command only recovers its own node: running it on another host fails. */}
         {command ? <p>{registered && node ? t("Rerun only on {{name}} if asked", { name: node.name }) : t("Run on the host you want to add.")}</p> : null}
-        {command ? <div className="sandbox-command">
-          <div className="sandbox-command-heading">
-            <span><Terminal size={15} />{t("Terminal")}</span>
-            {!registered ? <span className="sandbox-command-expiry" role="timer" title={new Date(enrollment.expires_at).toLocaleString(locale)}>{t("Expires in {{time}}", { time: formatCountdown(Date.parse(enrollment.expires_at) - now) })}</span> : null}
-            <button type="button" className="button outline" autoFocus aria-label={copied ? t("Copied") : t("Copy node command")} onClick={() => void copyCommand()}>{copied ? <Check size={14} /> : <Copy size={14} />}{copied ? t("Copied") : t("Copy command")}</button>
-          </div>
-          <label className="field"><span className="sr-only">{t("One-time enrollment command")}</span><textarea readOnly rows={5} value={command} onClick={(event) => event.currentTarget.select()} spellCheck={false} /></label>
-        </div> : null}
-        {copyFailed && !ready ? <p role="alert">{t("Select the command above and copy it manually.")}</p> : null}
+        {command ? <CommandBlock key={command} value={command} label={t("One-time enrollment command")} copyLabel={t("Copy node command")} autoFocus
+          extra={!registered ? <span className="sandbox-command-expiry" role="timer" title={new Date(enrollment.expires_at).toLocaleString(locale)}>{t("Expires in {{time}}", { time: formatCountdown(Date.parse(enrollment.expires_at) - now) })}</span> : null} /> : null}
         {/* One live region for the whole flow; only its contents change, so each change is announced. */}
         <div role="status" aria-label={t("Registration progress")}>
           {ready && node ? <div className="sandbox-enrollment-status connected"><span className="sandbox-status-dot" />{t("{{name}} · Connected", { name: node.name })}</div>
@@ -282,7 +285,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
         </div>
         {problem && !ready ? <div className="sandbox-enrollment-problem" role="alert">
           <p><strong>{problem.label}</strong> {problem.advice}{problem.help ? <HelpTip>{problem.help}</HelpTip> : null}</p>
-          <div className="sandbox-log-hint"><span>{t("Check the log on the host:")}</span><CopyCommand value={nodeLogCommand(deployment.installation_id)} /></div>
+          <div className="sandbox-log-hint"><span>{t("Check the log on the host:")}</span><CopyCommand value={nodeLogCommand(deployment.installation_id, noSudoOpen ? "user" : "sudo")} /></div>
         </div> : null}
         {!fresh ? <p>{t("Connection status unavailable. Refresh to check your node.")}</p> : null}
         {!ready ? requirements : null}
@@ -291,18 +294,3 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   </Modal>, document.body);
 }
 
-/** A short command to run on the host, copied with one click. */
-function CopyCommand({ value }: { value: string }) {
-  const { t } = useTranslation("sandbox");
-  const { state, copy } = useCopy(value);
-  const label = state === "copied" ? t("Copied") : t("Copy {{command}}", { command: value });
-  return <span className="sandbox-copy-command">
-    <span className="sandbox-copy-command-row">
-      <code>{value}</code>
-      <button type="button" className="icon-button ghost" aria-label={label} title={label} onClick={() => void copy()}>
-        {state === "copied" ? <Check size={13} strokeWidth={1.7} aria-hidden="true" /> : <Copy size={13} strokeWidth={1.7} aria-hidden="true" />}
-      </button>
-    </span>
-    {state === "failed" ? <span className="field-error" role="alert">{t("Select the command and copy it manually.")}</span> : null}
-  </span>;
-}
diff --git a/apps/web/src/features/sandbox/SandboxManagerView.css b/apps/web/src/features/sandbox/SandboxManagerView.css
index d242b4de0..1e4264fdd 100644
--- a/apps/web/src/features/sandbox/SandboxManagerView.css
+++ b/apps/web/src/features/sandbox/SandboxManagerView.css
@@ -32,8 +32,6 @@
   .sandbox-enrollment { padding: 18px; }
 }
 
-.sandbox-add-node .sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip-path: inset(50%); white-space: nowrap; border: 0; }
-
 /* The node manager page uses the shared console header and body rhythm. */
 .sandbox-manager-page { display: flex; padding: 0; overflow: hidden; }
 .sandbox-manager-page > .console-page-body { max-width: none; margin: 0; }
@@ -80,6 +78,12 @@
 .sandbox-host-requirements li { display: list-item; }
 .sandbox-host-requirements li .sandbox-copy-command { margin-top: 4px; }
 .sandbox-host-requirements-note { display: grid; gap: 4px; padding: 8px 12px 10px; }
+/* Without sudo: the same list style, inside the disclosure's own padding, with the command after it. */
+.sandbox-host-requirements + .sandbox-no-sudo { margin-top: -4px; }
+.sandbox-no-sudo-body { display: grid; gap: 8px; padding: 0 12px 12px; }
+.sandbox-no-sudo-body > p { font-size: 12.5px; }
+.sandbox-host-requirements .sandbox-no-sudo-body ul { padding: 0 0 0 18px; }
+.sandbox-no-sudo-body .sandbox-host-requirements-note { padding: 0; }
 .sandbox-add-node .sandbox-host-requirements-note p { font-size: 12px; }
 .sandbox-copy-command { display: grid; justify-items: start; gap: 2px; max-width: 100%; }
 .sandbox-copy-command-row { display: flex; align-items: flex-start; gap: 2px; max-width: 100%; }
diff --git a/apps/web/src/features/sandbox/SandboxManagerView.tsx b/apps/web/src/features/sandbox/SandboxManagerView.tsx
index 10a99f8ff..c09361a88 100644
--- a/apps/web/src/features/sandbox/SandboxManagerView.tsx
+++ b/apps/web/src/features/sandbox/SandboxManagerView.tsx
@@ -19,6 +19,8 @@ import { NodeEnrollment } from "./NodeEnrollment";
 import { NodeList } from "./NodeList";
 import { NodeDetail } from "./NodeDetail";
 import { NodeEditDialog } from "./NodeEditDialog";
+import { NodeCleanupDialog, type NodeCleanup } from "./NodeCleanupDialog";
+import { sandboxCoreOrigin } from "./core-origin";
 import "./SandboxManagerView.css";
 
 /** Nodes: the deployment provider, the node list and one node's detail (`#nodes?id=…`). */
@@ -72,6 +74,8 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
   const [adding, setAdding] = useState(false);
   const [removing, setRemoving] = useState(false);
   const [removeError, setRemoveError] = useState<string | null>(null);
+  // After a removal, the host's uninstall command; it stays for the closing animation.
+  const [cleanup, setCleanup] = useState<{ node: NodeCleanup; open: boolean } | null>(null);
   // When a deployment write last had an uncertain outcome; only a read begun after it confirms the state again.
   const [uncertainSince, setUncertainSince] = useState<number | null>(null);
   const setupNeedsRefresh = uncertainSince !== null && !(snapshot && snapshot.readAt > uncertainSince);
@@ -168,6 +172,11 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
         setRemoveTarget(null);
         if (params.id === target.id) navigate("nodes");
         refresh();
+        // The host still runs the node's service until it is uninstalled there.
+        const sourceUrl = sandboxCoreOrigin(window.location.origin);
+        if (consoleConfig.node_installer && sourceUrl && snapshot) {
+          setCleanup({ node: { name: target.name || target.id, sourceUrl, installationId: snapshot.deployment.installation_id, scriptDigest: consoleConfig.node_installer_sha256 }, open: true });
+        }
       }
     } catch (error) {
       // Keep the dialog open with Core's reason; the refreshed list shows what actually happened.
@@ -211,6 +220,7 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
     <p>{t("{{name}} will be removed from this deployment.", { name: removeName })}</p>
     <p>{t("Core rejects removal while allocations or retained resources remain.")}</p>
   </ConfirmDialog>;
+  const cleanupDialog = <NodeCleanupDialog cleanup={cleanup?.node ?? null} open={cleanup?.open ?? false} onClose={() => setCleanup((current) => current && { ...current, open: false })} />;
   // Rendered first in both the list and a node's page, so an open command outlives the navigation.
   const enrollment = hostedNodes && snapshot ? <NodeEnrollment key={snapshot.deployment.generation} client={client} consoleConfig={consoleConfig} deployment={snapshot.deployment} nodes={snapshot.nodes} open={adding} fresh={confirmed} onClose={() => setAdding(false)} onRefresh={refresh} /> : null;
 
@@ -234,6 +244,7 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
         ) : null}
       </div>
       {dialog}
+      {cleanupDialog}
       {writeDialog}
       <NodeEditDialog
         key={editTarget?.id ?? "closed"}
@@ -277,6 +288,7 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
       </> : null}
     </div>
     {dialog}
+    {cleanupDialog}
     {writeDialog}
   </>;
 }
diff --git a/apps/web/src/features/sandbox/enrollment-command.test.ts b/apps/web/src/features/sandbox/enrollment-command.test.ts
index dc3c0c675..a9dcae7f8 100644
--- a/apps/web/src/features/sandbox/enrollment-command.test.ts
+++ b/apps/web/src/features/sandbox/enrollment-command.test.ts
@@ -4,20 +4,35 @@ import { createHash } from "node:crypto";
 import { chmodSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { nodeInstallCommand, selfHostedInstallCommand } from "./enrollment-command";
+import { nodeInstallCommand, nodeLogCommand, nodeUninstallCommand, selfHostedInstallCommand, type NodeInstallMode } from "./enrollment-command";
 
 describe("sandbox connection and enrollment", () => {
-  it("creates a compact verified installer command with no credential argument or redirect following", () => {
-    const command = nodeInstallCommand("secret'onetime", "https://core.example", "https://console.example", "docker", "installation", "a".repeat(64));
-    expect(command).toContain("PARSAR_NODE_ENROLLMENT_TOKEN='secret'\\''onetime' python3");
-    expect(command).toContain("https://console.example/node-install/node-install.pyz");
-    expect(command).toContain("sha256sum -c --status &&");
-    expect(command).toContain("--max-time 30 --max-filesize 1048576");
-    expect(command).not.toMatch(/--location| -L/);
-    expect(command).not.toContain("--insecure");
-    expect(command).toContain("--source-url 'https://console.example' --core-url 'https://core.example' --provider 'docker' --installation-id 'installation'");
-    expect(command).not.toContain("--enrollment-token");
-    expect(command.split("\n")).toHaveLength(4);
+  const digest = "a".repeat(64);
+  const install = (mode: NodeInstallMode) => nodeInstallCommand({ token: "secret'onetime", coreUrl: "https://core.example", sourceUrl: "https://console.example", provider: "docker", installationId: "7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", scriptDigest: digest, mode });
+  it("creates the exact sudo command: a leading space, the checked installer run as root, the token only on stdin", () => {
+    expect(install("sudo")).toBe(` (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
+curl -fsS --max-time 30 --max-filesize 1048576 'https://console.example/node-install/node-install.pyz' -o "$d/node-install.pyz" &&
+printf '%s  %s\\n' '${digest}' "$d/node-install.pyz" | sha256sum -c --status &&
+printf '%s\\n' 'secret'\\''onetime' | $s python3 "$d/node-install.pyz" --enrollment-token-stdin --source-url 'https://console.example' --core-url 'https://core.example' --provider 'docker' --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f')`);
+  });
+  it("creates the exact no-sudo command, which differs only in never calling sudo", () => {
+    expect(install("user")).toBe(` (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT
+curl -fsS --max-time 30 --max-filesize 1048576 'https://console.example/node-install/node-install.pyz' -o "$d/node-install.pyz" &&
+printf '%s  %s\\n' '${digest}' "$d/node-install.pyz" | sha256sum -c --status &&
+printf '%s\\n' 'secret'\\''onetime' | python3 "$d/node-install.pyz" --enrollment-token-stdin --source-url 'https://console.example' --core-url 'https://core.example' --provider 'docker' --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f')`);
+  });
+  it("creates the exact uninstall commands, with no token", () => {
+    const uninstall = (mode: NodeInstallMode) => nodeUninstallCommand({ sourceUrl: "https://console.example", installationId: "7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", scriptDigest: digest, mode });
+    expect(uninstall("sudo")).toBe(` (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
+curl -fsS --max-time 30 --max-filesize 1048576 'https://console.example/node-install/node-install.pyz' -o "$d/node-install.pyz" &&
+printf '%s  %s\\n' '${digest}' "$d/node-install.pyz" | sha256sum -c --status &&
+$s python3 "$d/node-install.pyz" --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f')`);
+    expect(uninstall("user").split("\n").at(-1)).toBe(`python3 "$d/node-install.pyz" --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f')`);
+  });
+  it("points at the node's journal in each mode", () => {
+    expect(nodeLogCommand("7f3c2a90-fixture", "sudo")).toBe("sudo journalctl -u parsar-node-7f3c2a90-fixture.service");
+    expect(nodeLogCommand("7f3c2a90-fixture", "user")).toBe("journalctl --user -u parsar-node-7f3c2a90-fixture.service");
+    expect(nodeLogCommand("a b", "user")).toBe("journalctl --user -u 'parsar-node-a b.service'");
   });
   it("creates the exact self-hosted executor install command, every value quoted", () => {
     const command = selfHostedInstallCommand({ publicUrl: "https://core.example", digest: "b".repeat(64), environmentId: "env'1", remoteUrl: "wss://core.example/api/v1/agent-daemon/ws" });
@@ -26,14 +41,15 @@ curl -fsS --max-time 30 --max-filesize 1048576 'https://core.example/node-instal
 printf '%s  %s\\n' '${"b".repeat(64)}' "$d/install.pyz" | sha256sum -c --status &&
 python3 "$d/install.pyz" --source-url 'https://core.example' --environment-id 'env'\\''1' --remote 'wss://core.example/api/v1/agent-daemon/ws')`);
   });
-  it.each(["success", "download failure", "checksum mismatch", "installer failure"])("executes safely and cleans private downloads after %s", (scenario) => {
+  // "as root": a root shell runs the sudo command without sudo; "no sudo": the no-sudo command.
+  it.each(["success", "download failure", "checksum mismatch", "installer failure", "as root", "no sudo"])("executes safely, passes the token only on stdin and cleans private downloads after %s", (scenario) => {
     const parent = join(homedir(), ".parsar", "tests");
     mkdirSync(parent, { recursive: true });
     const root = mkdtempSync(join(parent, "node-command-"));
     const bin = join(root, "bin"), temporary = join(root, "tmp");
     mkdirSync(bin); mkdirSync(temporary);
     const payload = "verified installer fixture\n";
-    const fixture = join(root, "fixture"), report = join(root, "report.json");
+    const fixture = join(root, "fixture"), report = join(root, "report.json"), sudoReport = join(root, "sudo.json");
     writeFileSync(fixture, payload);
     function executable(name: string, code: string) {
       const path = join(bin, name);
@@ -50,24 +66,41 @@ const line=fs.readFileSync(0,'utf8').trimEnd(), split=line.indexOf('  ');
 if(split!==64) process.exit(2);
 const actual=crypto.createHash('sha256').update(fs.readFileSync(line.slice(split+2))).digest('hex');
 process.exit(actual===line.slice(0,split)?0:1);`);
+    executable("id", `console.log(process.env.SCENARIO==='as root'?'0':'1000');`);
+    executable("sudo", `const fs=require('node:fs'), {spawnSync}=require('node:child_process');
+fs.writeFileSync(process.env.SUDO_REPORT,JSON.stringify({args:process.argv.slice(2),env:process.env}));
+process.exit(spawnSync(process.argv[2],process.argv.slice(3),{stdio:'inherit'}).status ?? 1);`);
     executable("python3", `const fs=require('node:fs');
-fs.writeFileSync(process.env.REPORT,JSON.stringify({args:process.argv.slice(2),token:process.env.PARSAR_NODE_ENROLLMENT_TOKEN,mode:fs.statSync(process.argv[2]).mode&511}));
+const stdin=fs.readFileSync(0,'utf8');
+fs.writeFileSync(process.env.REPORT,JSON.stringify({args:process.argv.slice(2),env:process.env,stdin,mode:fs.statSync(process.argv[2]).mode&511}));
 process.exit(process.env.SCENARIO==='installer failure'?7:0);`);
     const digest = scenario === "checksum mismatch" ? "0".repeat(64) : createHash("sha256").update(payload).digest("hex");
     const token = "fixture'one-time";
+    const mode: NodeInstallMode = scenario === "no sudo" ? "user" : "sudo";
     try {
-      const command = nodeInstallCommand(token, "http://127.0.0.1:8091", "http://localhost:8080", "docker", "fixture-installation", digest);
-      const result = spawnSync("sh", ["-c", command], { env: { ...process.env, PATH: `${bin}:${process.env.PATH}`, TMPDIR: temporary, SCENARIO: scenario, FIXTURE: fixture, REPORT: report }, encoding: "utf8" });
-      expect(result.status).toBe(scenario === "success" ? 0 : scenario === "installer failure" ? 7 : scenario === "download failure" ? 22 : 1);
+      const command = nodeInstallCommand({ token, coreUrl: "http://127.0.0.1:8091", sourceUrl: "http://localhost:8080", provider: "docker", installationId: "fixture-installation", scriptDigest: digest, mode });
+      const result = spawnSync("sh", ["-c", command], { env: { ...process.env, PATH: `${bin}:${process.env.PATH}`, TMPDIR: temporary, SCENARIO: scenario, FIXTURE: fixture, REPORT: report, SUDO_REPORT: sudoReport }, encoding: "utf8" });
+      expect(result.status).toBe(scenario === "installer failure" ? 7 : scenario === "download failure" ? 22 : scenario === "checksum mismatch" ? 1 : 0);
       expect(readdirSync(temporary)).toEqual([]);
-      if (scenario === "success" || scenario === "installer failure") {
-        const invocation = JSON.parse(readFileSync(report, "utf8")) as { args: string[]; token: string; mode: number };
-        expect(invocation.token).toBe(token);
-        expect(invocation.args).not.toContain(token);
-        expect(invocation.args.slice(1)).toEqual(["--source-url", "http://localhost:8080", "--core-url", "http://127.0.0.1:8091", "--provider", "docker", "--installation-id", "fixture-installation"]);
-        expect(invocation.mode & 0o077).toBe(0);
-      } else {
+      if (scenario === "download failure" || scenario === "checksum mismatch") {
         expect(readdirSync(root)).not.toContain("report.json");
+        expect(readdirSync(root)).not.toContain("sudo.json");
+        return;
+      }
+      const invocation = JSON.parse(readFileSync(report, "utf8")) as { args: string[]; env: Record<string, string>; stdin: string; mode: number };
+      // The token arrives on stdin alone: in no argument and no environment variable, the installer's or sudo's.
+      expect(invocation.stdin).toBe(`${token}\n`);
+      expect(invocation.args.some((arg) => arg.includes("one-time"))).toBe(false);
+      expect(Object.values(invocation.env).some((value) => value.includes("one-time"))).toBe(false);
+      expect(invocation.args.slice(1)).toEqual(["--enrollment-token-stdin", "--source-url", "http://localhost:8080", "--core-url", "http://127.0.0.1:8091", "--provider", "docker", "--installation-id", "fixture-installation"]);
+      expect(invocation.mode & 0o077).toBe(0);
+      if (scenario === "as root" || scenario === "no sudo") {
+        expect(readdirSync(root)).not.toContain("sudo.json");
+      } else {
+        const sudo = JSON.parse(readFileSync(sudoReport, "utf8")) as { args: string[]; env: Record<string, string> };
+        expect(sudo.args.slice(0, 1)).toEqual(["python3"]);
+        expect(sudo.args.some((arg) => arg.includes("one-time"))).toBe(false);
+        expect(Object.values(sudo.env).some((value) => value.includes("one-time"))).toBe(false);
       }
     } finally { rmSync(root, { recursive: true, force: true }); }
   });
diff --git a/apps/web/src/features/sandbox/enrollment-command.ts b/apps/web/src/features/sandbox/enrollment-command.ts
index 4be6f51f7..9dcbb69f2 100644
--- a/apps/web/src/features/sandbox/enrollment-command.ts
+++ b/apps/web/src/features/sandbox/enrollment-command.ts
@@ -1,10 +1,49 @@
 const quote = (value: string) => `'${value.replaceAll("'", "'\\''")}'`;
 
-export function nodeInstallCommand(token: string, coreUrl: string, sourceUrl: string, provider: string, installationId: string, scriptDigest: string): string {
-  return `(umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT
-curl -fsS --max-time 30 --max-filesize 1048576 ${quote(sourceUrl + "/node-install/node-install.pyz")} -o "$d/install.py" &&
-printf '%s  %s\\n' ${quote(scriptDigest)} "$d/install.py" | sha256sum -c --status &&
-PARSAR_NODE_ENROLLMENT_TOKEN=${quote(token)} python3 "$d/install.py" --source-url ${quote(sourceUrl)} --core-url ${quote(coreUrl)} --provider ${quote(provider)} --installation-id ${quote(installationId)})`;
+/**
+ * How the node installer runs on the host. "sudo" (the default) runs it as root,
+ * through `sudo` unless the shell already is root, which installs the node as the
+ * `parsar-node` system service; "user" runs it as the signed-in user, which
+ * installs a user service of that user. The installer picks the mode from its
+ * effective uid (deploy/install/node_install.py `main`).
+ */
+export type NodeInstallMode = "sudo" | "user";
+
+/**
+ * The start the node commands share: a private directory removed on exit, then
+ * the console's installer, checked against its digest before anything runs. The
+ * leading space keeps the command out of shell history under
+ * HISTCONTROL=ignorespace. In sudo mode `s` is set before the `&&` chain, so a
+ * failed download or check stops the command. It ends where the installer's own
+ * line begins.
+ */
+function nodeInstaller(sourceUrl: string, scriptDigest: string, mode: NodeInstallMode): string {
+  return ` (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT${mode === "sudo" ? `; s=; [ "$(id -u)" -eq 0 ] || s=sudo` : ""}
+curl -fsS --max-time 30 --max-filesize 1048576 ${quote(sourceUrl + "/node-install/node-install.pyz")} -o "$d/node-install.pyz" &&
+printf '%s  %s\\n' ${quote(scriptDigest)} "$d/node-install.pyz" | sha256sum -c --status &&
+`;
+}
+
+/** Runs the downloaded installer, as root in sudo mode. */
+const runInstaller = (mode: NodeInstallMode) => `${mode === "sudo" ? "$s " : ""}python3 "$d/node-install.pyz"`;
+
+/**
+ * Adds this host as a node. The one-time token reaches the installer only on
+ * standard input (`printf` is a shell builtin), never in an argument, the
+ * environment or sudo's command line.
+ */
+export function nodeInstallCommand({ token, coreUrl, sourceUrl, provider, installationId, scriptDigest, mode }: {
+  token: string; coreUrl: string; sourceUrl: string; provider: "docker" | "microsandbox"; installationId: string; scriptDigest: string; mode: NodeInstallMode;
+}): string {
+  return `${nodeInstaller(sourceUrl, scriptDigest, mode)}printf '%s\\n' ${quote(token)} | ${runInstaller(mode)} --enrollment-token-stdin --source-url ${quote(sourceUrl)} --core-url ${quote(coreUrl)} --provider ${quote(provider)} --installation-id ${quote(installationId)})`;
+}
+
+/**
+ * Removes a node Core no longer lists from its host: its service, its files and,
+ * when no node uses it, the service user. It holds no secret.
+ */
+export function nodeUninstallCommand({ sourceUrl, installationId, scriptDigest, mode }: { sourceUrl: string; installationId: string; scriptDigest: string; mode: NodeInstallMode }): string {
+  return `${nodeInstaller(sourceUrl, scriptDigest, mode)}${runInstaller(mode)} --uninstall --installation-id ${quote(installationId)})`;
 }
 
 /**
@@ -20,8 +59,12 @@ printf '%s  %s\\n' ${quote(digest)} "$d/install.pyz" | sha256sum -c --status &&
 python3 "$d/install.pyz" --source-url ${quote(publicUrl)} --environment-id ${quote(environmentId)} --remote ${quote(remoteUrl)})`;
 }
 
-/** The node service's journal: the installer names its systemd user unit after the installation (deploy/install/node_install.py:340, 410-411). */
-export function nodeLogCommand(installationId: string): string {
+/**
+ * The node service's journal. The installer names the unit after the
+ * installation (node_install.py `unit_name`): a system unit in sudo mode, a user
+ * unit of the node's user otherwise.
+ */
+export function nodeLogCommand(installationId: string, mode: NodeInstallMode): string {
   const unit = `parsar-node-${installationId}.service`;
-  return `journalctl --user -u ${/^[A-Za-z0-9._-]+$/.test(unit) ? unit : quote(unit)}`;
+  return `${mode === "sudo" ? "sudo journalctl" : "journalctl --user"} -u ${/^[A-Za-z0-9._-]+$/.test(unit) ? unit : quote(unit)}`;
 }
diff --git a/apps/web/src/features/sandbox/node-commands.tsx b/apps/web/src/features/sandbox/node-commands.tsx
new file mode 100644
index 000000000..2855b9aec
--- /dev/null
+++ b/apps/web/src/features/sandbox/node-commands.tsx
@@ -0,0 +1,112 @@
+import { Check, Copy, Terminal } from "lucide-react";
+import type { ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+
+import { useCopy } from "../api-keys/IssuedKey";
+import { hostRequirements, userModePrerequisites, USER_MANAGER_RESTART, type HostPrerequisite } from "./node-enrollment";
+
+/** A multi-line command to paste into a terminal, with its copy button. Key it by the command so its copy state starts over. */
+export function CommandBlock({ value, label, copyLabel, extra, autoFocus = false }: {
+  value: string;
+  /** Names the command's field for assistive technology. */
+  label: string;
+  /** Names the copy button until it has copied. */
+  copyLabel: string;
+  /** Shown in the heading before the copy button, such as the command's expiry. */
+  extra?: ReactNode;
+  autoFocus?: boolean;
+}) {
+  const { t } = useTranslation("sandbox");
+  const { state, copy } = useCopy(value);
+  return <>
+    <div className="sandbox-command">
+      <div className="sandbox-command-heading">
+        <span><Terminal size={15} />{t("Terminal")}</span>
+        {extra}
+        <button type="button" className="button outline" autoFocus={autoFocus} aria-label={state === "copied" ? t("Copied") : copyLabel} onClick={() => void copy()}>
+          {state === "copied" ? <Check size={14} /> : <Copy size={14} />}{state === "copied" ? t("Copied") : t("Copy command")}
+        </button>
+      </div>
+      {/* Named by aria-label: a wrapping label would fold the command into its own name. */}
+      <div className="field"><textarea aria-label={label} readOnly rows={5} value={value} onClick={(event) => event.currentTarget.select()} spellCheck={false} /></div>
+    </div>
+    {state === "failed" ? <p role="alert">{t("Select the command above and copy it manually.")}</p> : null}
+  </>;
+}
+
+/** A short command to run on the host, copied with one click. */
+export function CopyCommand({ value }: { value: string }) {
+  const { t } = useTranslation("sandbox");
+  const { state, copy } = useCopy(value);
+  const label = state === "copied" ? t("Copied") : t("Copy {{command}}", { command: value });
+  return <span className="sandbox-copy-command">
+    <span className="sandbox-copy-command-row">
+      <code>{value}</code>
+      <button type="button" className="icon-button ghost" aria-label={label} title={label} onClick={() => void copy()}>
+        {state === "copied" ? <Check size={13} strokeWidth={1.7} aria-hidden="true" /> : <Copy size={13} strokeWidth={1.7} aria-hidden="true" />}
+      </button>
+    </span>
+    {state === "failed" ? <span className="field-error" role="alert">{t("Select the command and copy it manually.")}</span> : null}
+  </span>;
+}
+
+/** The addresses and sandbox size the requirement labels name. */
+export type RequirementValues = { console: string; core: string; size: string };
+
+function PrerequisiteList({ items, values }: { items: HostPrerequisite[]; values: RequirementValues }) {
+  const { t } = useTranslation("sandbox");
+  return <ul>
+    {items.map((item) => (
+      <li key={item.label}>
+        <span>{t(item.label, values)}</span>
+        {item.command ? <CopyCommand value={item.command} /> : null}
+      </li>
+    ))}
+  </ul>;
+}
+
+/** What the host needs for the default command, which installs the node as a system service. */
+export function HostRequirements({ provider, sized, values, open, onToggle }: {
+  provider: "docker" | "microsandbox";
+  sized: boolean;
+  values: RequirementValues;
+  open: boolean;
+  onToggle: (open: boolean) => void;
+}) {
+  const { t } = useTranslation("sandbox");
+  return <details className="sandbox-host-requirements" open={open} onToggle={(event) => onToggle(event.currentTarget.open)}>
+    <summary>{t("Host requirements")}</summary>
+    <PrerequisiteList items={hostRequirements(provider, sized)} values={values} />
+    <div className="sandbox-host-requirements-note">
+      <p>{t("The command creates the parsar-node service user and a system service. It installs no software; if something is missing it stops and says what to install.")}</p>
+      {provider === "docker" ? <p>{t("parsar-node joins the docker group, which is equivalent to root on this host.")}</p> : null}
+    </div>
+  </details>;
+}
+
+/**
+ * The command without sudo, which installs the node as a user service of the
+ * user who runs it, with what that user needs. Before a command exists it
+ * shows only the preparation.
+ */
+export function NoSudoGuide({ provider, values, command, open, onToggle }: {
+  provider: "docker" | "microsandbox";
+  values: RequirementValues;
+  command: string;
+  open: boolean;
+  onToggle: (open: boolean) => void;
+}) {
+  const { t } = useTranslation("sandbox");
+  return <details className="sandbox-host-requirements sandbox-no-sudo" open={open} onToggle={(event) => onToggle(event.currentTarget.open)}>
+    <summary>{t("No sudo on this host?")}</summary>
+    <div className="sandbox-no-sudo-body">
+      <p>{t("Without sudo, the node runs as a user service of the user who runs the command. That user needs:")}</p>
+      <PrerequisiteList items={userModePrerequisites(provider)} values={values} />
+      <div className="sandbox-host-requirements-note">
+        <p>{t("After a group change, sign in again as that user. If its systemd manager was already running, restart it (or reboot):")}</p>
+        <CopyCommand value={USER_MANAGER_RESTART} />
+      </div>
+      {command ? <CommandBlock key={command} value={command} label={t("One-time enrollment command without sudo")} copyLabel={t("Copy the command without sudo")} /> : null}
+    </div>
+  </details>;
+}
diff --git a/apps/web/src/features/sandbox/node-enrollment.test.ts b/apps/web/src/features/sandbox/node-enrollment.test.ts
index 093d3136e..643723786 100644
--- a/apps/web/src/features/sandbox/node-enrollment.test.ts
+++ b/apps/web/src/features/sandbox/node-enrollment.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, it } from "vitest";
 
 import { node } from "../overview/test-fixtures";
-import { nodeLogCommand } from "./enrollment-command";
 import { enrolledNode, enrollmentProgress, formatCountdown, NODE_READY_WAIT_MS, progressSteps } from "./node-enrollment";
 
 describe("node enrollment", () => {
@@ -41,9 +40,4 @@ describe("node enrollment", () => {
     expect(progressSteps("registered")).toEqual(["done", "current", "future"]);
     expect(progressSteps("connected")).toEqual(["done", "done", "current"]);
   });
-
-  it("points at the installer's systemd user unit", () => {
-    expect(nodeLogCommand("7f3c2a90-fixture")).toBe("journalctl --user -u parsar-node-7f3c2a90-fixture.service");
-    expect(nodeLogCommand("a b")).toBe("journalctl --user -u 'parsar-node-a b.service'");
-  });
 });
diff --git a/apps/web/src/features/sandbox/node-enrollment.ts b/apps/web/src/features/sandbox/node-enrollment.ts
index a6dd7047c..0e8225f6f 100644
--- a/apps/web/src/features/sandbox/node-enrollment.ts
+++ b/apps/web/src/features/sandbox/node-enrollment.ts
@@ -17,48 +17,59 @@ export interface HostPrerequisite {
 }
 
 /**
- * What a node host needs, exactly as the enrollment command, the installer and
- * the node's readiness probe check it (line numbers as of this revision):
- * - the command runs curl, sha256sum and python3 (enrollment-command.ts);
- *   deploy/install/node_install.py:67-69 needs Python 3.9+, Linux amd64 and a non-root user;
- * - Docker: node_install.py:73-74 runs `docker info` through /var/run/docker.sock,
- *   and the node is ready only when Docker enforces CPU and memory limits
- *   (services/agents-api/internal/sandbox/config/probe.go:37-38), which the
- *   installer waits for (node_install.py:363-364);
- * - microsandbox: read/write /dev/kvm (node_install.py:75-76);
- * - node_install.py:71-72 needs lingering. It starts the user's systemd manager,
- *   whose services, the node's included, keep the groups it started with; so the
- *   group changes above come first, or that manager is restarted after them. A
- *   shell open before the change lacks the group too, so the user signs in again;
- * - microsandbox: the host libraries its binaries link (the ldd check,
- *   node_install.py:249-253), and a home short enough for ~/.parsar/m/<12 hex> to
- *   fit in 48 bytes (node_install.py:205-209): at most 48 - len("/.parsar/m/") - 12 = 25 bytes;
- * - the host's CPUs and total memory hold one sandbox of the deployment's size
- *   (probe.go:43 and 75, config/capacity.go:9), else the node reports capacity_insufficient;
- * - node_install.py:70 needs the user's own systemd session (`systemctl --user`),
- *   which sudo -u and su don't provide;
+ * What a host needs for the default command, which runs the installer as root
+ * and the node as the `parsar-node` system service (sudo mode), as the command
+ * and deploy/install/node_install.py check it:
+ * - the command runs curl, sha256sum and python3 (enrollment-command.ts), and
+ *   `sudo` unless the shell is root; `host_checks` needs Python 3.9+, Linux amd64
+ *   and systemd as the init system;
+ * - Docker: `provider_group` needs Docker Engine running with a group-accessible
+ *   socket, enforcing CPU and memory limits (the node is ready only then:
+ *   services/agents-api/internal/sandbox/config/probe.go); it installs nothing;
+ * - microsandbox: `provider_group` needs /dev/kvm, and `prepare_runtime` the
+ *   libraries its binaries link (the ldd check);
+ * - `host_capacity`: the host's CPUs and memory hold one sandbox of the
+ *   deployment's size (else the node reports capacity_insufficient); the Runtime
+ *   image needs about 2 GB of disk;
  * - network: node files and artifacts only from the console (`fetch` and
- *   `metadata` in node_install.py, which never use a release URL), Core's /api/v1
- *   (node_spec.py:89, the `register` call in node_install.py), and sandboxes reach
- *   Core as well (`provider_config` in node_install.py).
+ *   `metadata`, which never use a release URL), Core's /api/v1 (node_spec.py, the
+ *   `register` call), and sandboxes reach Core as well (`provider_config`).
  * `sized` says whether the deployment's sandbox size is known for the capacity item.
  */
-export function hostPrerequisites(provider: "docker" | "microsandbox", sized: boolean): HostPrerequisite[] {
-  const access: HostPrerequisite = provider === "docker"
-    ? { label: "Docker at /var/run/docker.sock for that user, enforcing CPU and memory limits", command: "sudo usermod -aG docker NODE_USER" }
-    : { label: "Read and write access to /dev/kvm for that user", command: "sudo usermod -aG kvm NODE_USER" };
-  const microsandbox: HostPrerequisite[] = provider === "microsandbox" ? [
-    { label: "The shared libraries microsandbox needs, on a glibc system" },
-    { label: "A home directory of 25 bytes or less, such as /home/parsar" },
-  ] : [];
+export function hostRequirements(provider: "docker" | "microsandbox", sized: boolean): HostPrerequisite[] {
   return [
-    { label: "Linux amd64 with Python 3.9+, curl and sha256sum, and a non-root user to run the node (NODE_USER below)" },
-    access,
+    { label: "Linux amd64 with systemd; Python 3.9+, curl and sha256sum; root or sudo" },
+    provider === "docker"
+      ? { label: "Docker Engine installed and running, enforcing CPU and memory limits (cgroup v2)" }
+      : { label: "/dev/kvm (hardware or nested virtualization) and the libraries microsandbox links (glibc)" },
+    { label: sized ? "CPUs and memory for at least one sandbox: {{size}}; about 2 GB of disk for the Runtime image" : "CPUs and memory for at least one sandbox; about 2 GB of disk for the Runtime image" },
+    { label: "Reaches {{console}} and {{core}}; sandboxes reach {{core}}" },
+  ];
+}
+
+/**
+ * What the node's own user needs besides the host requirements when the command
+ * runs without sudo, so the node is that user's systemd service (node_install.py
+ * `preflight` and `install`):
+ * - a non-root user, with Docker's socket or read/write /dev/kvm through its group;
+ * - lingering. It starts the user's systemd manager, whose services, the node's
+ *   included, keep the groups it started with; so the group change comes first,
+ *   or that manager is restarted after it (USER_MANAGER_RESTART). A shell open
+ *   before the change lacks the group too, so the user signs in again;
+ * - the user's own systemd session (`systemctl --user`), which sudo -u and su
+ *   don't provide;
+ * - microsandbox: a home short enough for ~/.parsar/m/<12 hex> to fit in 48 bytes
+ *   (`micro_home`): at most 48 - len("/.parsar/m/") - 12 = 25 bytes.
+ */
+export function userModePrerequisites(provider: "docker" | "microsandbox"): HostPrerequisite[] {
+  return [
+    { label: "A non-root user to run the node (NODE_USER below)" },
+    provider === "docker"
+      ? { label: "Docker at /var/run/docker.sock for that user, enforcing CPU and memory limits", command: "sudo usermod -aG docker NODE_USER" }
+      : { label: "Read and write access to /dev/kvm for that user", command: "sudo usermod -aG kvm NODE_USER" },
     { label: "systemd lingering for that user, enabled after the group change", command: "sudo loginctl enable-linger NODE_USER" },
-    ...microsandbox,
-    { label: sized ? "CPUs and memory for at least one sandbox: {{size}}" : "CPUs and memory for at least one sandbox" },
+    ...(provider === "microsandbox" ? [{ label: "A home directory of 25 bytes or less, such as /home/parsar" } satisfies HostPrerequisite] : []),
     { label: "Run the command signed in as that user: over SSH, or with", command: "sudo machinectl shell NODE_USER@" },
-    { label: "Can reach {{console}} and {{core}}; sandboxes must reach {{core}}" },
   ];
 }
 
diff --git a/apps/web/src/lib/locale-strings.ts b/apps/web/src/lib/locale-strings.ts
index a43e4d2ec..4c5852fd4 100644
--- a/apps/web/src/lib/locale-strings.ts
+++ b/apps/web/src/lib/locale-strings.ts
@@ -44,16 +44,33 @@ export const chinese = {
   "Change limits": "修改上限",
   "Add another node": "添加另一个节点",
   "Host requirements": "主机要求",
-  "Linux amd64 with Python 3.9+, curl and sha256sum, and a non-root user to run the node (NODE_USER below)": "Linux amd64，装有 Python 3.9+、curl 和 sha256sum，并有一个运行节点的非 root 用户（即下文的 NODE_USER）",
+  "Linux amd64 with systemd; Python 3.9+, curl and sha256sum; root or sudo": "Linux amd64，使用 systemd；装有 Python 3.9+、curl 和 sha256sum；有 root 或 sudo 权限",
+  "Docker Engine installed and running, enforcing CPU and memory limits (cgroup v2)": "已安装并运行 Docker Engine，且能限制 CPU 和内存（cgroup v2）",
+  "/dev/kvm (hardware or nested virtualization) and the libraries microsandbox links (glibc)": "/dev/kvm（硬件或嵌套虚拟化），以及 microsandbox 链接的库（glibc）",
+  "CPUs and memory for at least one sandbox: {{size}}; about 2 GB of disk for the Runtime image": "CPU 和内存至少够一个沙箱：{{size}}；Runtime 镜像约需 2 GB 磁盘",
+  "CPUs and memory for at least one sandbox; about 2 GB of disk for the Runtime image": "CPU 和内存至少够一个沙箱；Runtime 镜像约需 2 GB 磁盘",
+  "Reaches {{console}} and {{core}}; sandboxes reach {{core}}": "能访问 {{console}} 和 {{core}}；沙箱也要能访问 {{core}}",
+  "The command creates the parsar-node service user and a system service. It installs no software; if something is missing it stops and says what to install.": "命令会创建 parsar-node 服务用户和一个系统服务。它不安装任何软件；缺少什么时会停下并说明要装什么。",
+  "parsar-node joins the docker group, which is equivalent to root on this host.": "parsar-node 会加入 docker 组，这在这台主机上等同于 root 权限。",
+  "No sudo on this host?": "这台主机没有 sudo？",
+  "Without sudo, the node runs as a user service of the user who runs the command. That user needs:": "不用 sudo 时，节点作为用户服务运行在执行命令的用户下。该用户需要：",
+  "A non-root user to run the node (NODE_USER below)": "一个运行节点的非 root 用户（即下文的 NODE_USER）",
+  "One-time enrollment command without sudo": "不用 sudo 的一次性注册命令",
+  "Copy the command without sudo": "复制不用 sudo 的命令",
+  "Nodes need an HTTPS public URL that other machines and their sandboxes can reach: set public_url in config.json and run parsar apply": "节点需要一个其他机器及其沙箱都能访问的 HTTPS 公网地址：请在 config.json 里设置 public_url，然后运行 parsar apply",
+  "Clean up the host": "清理主机",
+  "{{name}} is removed from Core. To remove its service and files from the host, run:": "{{name}} 已从 Core 移除。要删除它在主机上的服务和文件，请运行：",
+  "Uninstall command": "卸载命令",
+  "Copy uninstall command": "复制卸载命令",
+  "Installed without sudo?": "安装时没用 sudo？",
+  "Run this as that user instead:": "请改为以该用户运行：",
+  "Uninstall command without sudo": "不用 sudo 的卸载命令",
+  "Copy the uninstall command without sudo": "复制不用 sudo 的卸载命令",
   "Docker at /var/run/docker.sock for that user, enforcing CPU and memory limits": "该用户能使用 /var/run/docker.sock 上的 Docker，且 Docker 能限制 CPU 和内存",
   "Read and write access to /dev/kvm for that user": "该用户能读写 /dev/kvm",
-  "The shared libraries microsandbox needs, on a glibc system": "microsandbox 需要的共享库（glibc 系统）",
   "A home directory of 25 bytes or less, such as /home/parsar": "主目录路径不超过 25 字节，例如 /home/parsar",
   "systemd lingering for that user, enabled after the group change": "为该用户开启 systemd lingering（在改用户组之后）",
-  "CPUs and memory for at least one sandbox: {{size}}": "CPU 和内存至少够一个沙箱：{{size}}",
-  "CPUs and memory for at least one sandbox": "CPU 和内存至少够一个沙箱",
   "Run the command signed in as that user: over SSH, or with": "以该用户登录后运行命令：通过 SSH，或使用",
-  "Can reach {{console}} and {{core}}; sandboxes must reach {{core}}": "能访问 {{console}} 和 {{core}}；沙箱也要能访问 {{core}}",
   "After a group change, sign in again as that user. If its systemd manager was already running, restart it (or reboot):": "改完用户组后请以该用户重新登录；如果它的 systemd 管理器已在运行，请重启它（或重启主机）：",
   "Copy {{command}}": "复制 {{command}}",
   "Select the command and copy it manually.": "请选中命令手动复制。",
diff --git a/docs/web/protocol-coverage.md b/docs/web/protocol-coverage.md
index dd8139bb9..248b92bc6 100644
--- a/docs/web/protocol-coverage.md
+++ b/docs/web/protocol-coverage.md
@@ -117,7 +117,7 @@ without the installer shows no Connect a host.
 | Resource owners | `GET /core/v1/projects/{project_id}/resource-owners` | The Creator column of every resource list and the creator fact of detail pages, in batches of up to 100 IDs. An asset an administrator copied in an earlier release shows **Admin copy**; a resource without a record shows **Unknown** |
 | Write operations | `GET /core/v1/projects/{project_id}/write-operations` | A project's write history, newest first, filtered by key and resource type, 50 per page |
 | Summary | `GET /core/v1/summary` | Overview (per project), the Agents list (`group_by=agent`), a project's page (per project and `group_by=key`), Agent metrics (to skip idle projects, and usage by creating key since the start of the range), the Projects list (last activity) |
-| Installation | `GET /core/v1/installation` | System's Installation facts (`public_url`, `api_base_url`, `installation_id`, `source_commit`) and read-only Startup settings (`configuration.settings` under its `path`, `apply_command` and `applied_at`; a sensitive setting shows only whether it is `configured`); `api_base_url` in the how-to-call samples under a new key; `public_url` in a self-hosted Session's Connect a host command; `path` and `apply_command` beside a sandbox configuration Core rejected. A sensitive setting with a value, or an unknown member, fails the read; `configuration: null` shows a note |
+| Installation | `GET /core/v1/installation` | System's Installation facts (`public_url`, `api_base_url`, `installation_id`, `source_commit`) and read-only Startup settings (`configuration.settings` under its `path`, `apply_command` and `applied_at`; a sensitive setting shows only whether it is `configured`); `api_base_url` in the how-to-call samples under a new key; `public_url` in a self-hosted Session's Connect a host command; `local_only` stops Add node from issuing a command; `path` and `apply_command` beside a sandbox configuration Core rejected. A sensitive setting with a value, or an unknown member, fails the read; `configuration: null` shows a note |
 | Core metrics | `GET /core/v1/metrics?range=` | Core metrics page; the Core popover on Overview. A Core without the route (404) is shown as not reporting; the popover then shows only Core's status. Measurements are defined in the [Core metrics contract](../../contracts/agents-api/core-metrics.md); the Process section's CPU and resident memory are a [requested extension](core-process-metrics-requirements.md) and show as missing until Core reports them |
 
 Summary figures are cumulative per Session and are not billing records. Sessions
@@ -146,9 +146,9 @@ consumed; the list carries each provider.
 | Nodes | `GET /core/v1/sandbox/nodes` | Nodes page; fleet on Overview; node capacity on Sandbox metrics. An online node's `diagnostic` (`docker_unavailable`, `docker_limits_unsupported`, `runtime_image_unavailable`, `kvm_unavailable`, `microsandbox_artifacts_unavailable`, `capacity_insufficient`, `provider_unavailable`; any other value reads as `provider_unavailable`) marks it degraded and names the reason and fix in the help tip beside its status on each of these and on the node's page. A node whose `core_url` (the address it enrolled with) differs from the deployment's `core_url` is named on the Nodes page as bound to an old address, to be removed and added again. **Add node** follows only the node whose `enrollment_id` equals its command's; a node enrolled before Core recorded it reports null and never matches |
 | Node detail | `GET /core/v1/sandbox/nodes/{node_id}?range=1h\|6h\|24h` | Sandbox metrics node dialog: the host's CPU busy share and memory from its last heartbeat, and their history over the page's range |
 | Allocations | `GET /core/v1/sandbox/nodes/{node_id}/allocations` | Nodes page; Sandbox metrics. Under microsandbox, a node's page shows from `compute_phase_changed_at` how long each allocation has been in its compute phase and, while suspended, about when Core reclaims it (that time plus the deployment's `suspension.retention_seconds`); a null time shows a dash |
-| Enrollment | `POST /core/v1/sandbox/enrollment-tokens` | **Add node**: the administrator sets the node's sandbox limits (`max_active`; `max_retained` only for microsandbox, equal to `max_active` for Docker) before Core issues a single-use token inside a command that verifies the installer checksum, with the command's `enrollment_id`, which the node it registers reports. When `/console/config` lists `node_artifacts` without the deployment's provider (null reads as none; an absent field blocks nothing), the dialog says this console has no node files for it and requests no token |
+| Enrollment | `POST /core/v1/sandbox/enrollment-tokens` | **Add node**: the administrator sets the node's sandbox limits (`max_active`; `max_retained` only for microsandbox, equal to `max_active` for Docker) before Core issues a single-use token inside a command that verifies the installer checksum, with the command's `enrollment_id`, which the node it registers reports. The command runs the installer with sudo (a system service) and passes the token on standard input; a "No sudo on this host?" disclosure gives the same command without sudo (a user service) and what that user needs, and the log hint follows the disclosure. When the installation is `local_only`, or `/console/config` lists `node_artifacts` without the deployment's provider (null reads as none; an absent field blocks nothing), the dialog says why and requests no token; it reads both again on opening and when the window regains focus |
 | Update node | `PATCH /core/v1/sandbox/nodes/{node_id}` | **Edit node**: the name and sandbox limits together (the retained limit only for microsandbox; under Docker, Core sets it to the active limit) |
-| Remove node | `DELETE /core/v1/sandbox/nodes/{node_id}` | Confirmed node removal; the row goes only after Core acknowledges the deletion |
+| Remove node | `DELETE /core/v1/sandbox/nodes/{node_id}` | Confirmed node removal; the row goes only after Core acknowledges the deletion, and a Clean up the host dialog then gives the host's uninstall command (with sudo, and without it behind a disclosure) |
 | Runtime observations | `GET /core/v1/sandbox/runtime-observations` | Sandbox metrics: hosted Runtimes of every project, each labelled with its project; an E2B sandbox's dialog adds its `observation.disk` as used / limit (null elsewhere) |
 
 Signing in grants administration, so `/console/config` reports only the node

From c22f3906422fa5cdeebfd85bc189acb62f5fc18c Mon Sep 17 00:00:00 2001
From: saladday <1203511142@qq.com>
Date: Sat, 26 Sep 2026 01:38:57 +0000
Subject: [PATCH 2/4] Wait for the installation before Add node issues a
 command and cover stale hosts in clean-up

Add node now issues no command until the installation is read: it says it is
checking, and a failed read blocks with Try again. The log hint follows the
command last copied (with the system service's log after the no-sudo one, for a
root shell), and a finished or restarted flow forgets it. The enrollment poll
reads only the node list. The sudo checklist adds SELinux and names rootful
Docker's docker group and /dev/kvm's kvm group; the no-sudo preparation is an
administrator's one-time step, run from SSH or su.

The clean-up dialog says it deletes no sandboxes, volumes or images (and keeps
microsandbox's store), carries the loopback console note, and for a node enrolled
with an earlier Core address offers the --force form. Closing it returns focus to
the page heading. Copy buttons' names start with their visible text, and the
command test proves the token goes through the shell's builtin printf.
---
 apps/web/DESIGN.md                            | 18 ++++--
 apps/web/PRODUCT.md                           |  5 +-
 apps/web/e2e/nodes.spec.ts                    | 32 +++++++++--
 apps/web/e2e/public-url.spec.ts               |  5 ++
 .../features/sandbox/NodeCleanupDialog.tsx    | 41 +++++++++++---
 .../src/features/sandbox/NodeEnrollment.tsx   | 56 ++++++++++++-------
 .../features/sandbox/SandboxManagerView.css   |  1 +
 .../features/sandbox/SandboxManagerView.tsx   | 29 +++++++---
 .../sandbox/enrollment-command.test.ts        |  9 ++-
 .../features/sandbox/enrollment-command.ts    |  8 ++-
 .../src/features/sandbox/node-commands.tsx    | 17 +++---
 .../features/sandbox/node-enrollment.test.ts  |  2 +-
 .../src/features/sandbox/node-enrollment.ts   | 29 ++++++----
 apps/web/src/lib/locale-strings.ts            | 25 ++++++---
 docs/web/protocol-coverage.md                 |  4 +-
 15 files changed, 197 insertions(+), 84 deletions(-)

diff --git a/apps/web/DESIGN.md b/apps/web/DESIGN.md
index 937912c16..f357761f6 100644
--- a/apps/web/DESIGN.md
+++ b/apps/web/DESIGN.md
@@ -530,13 +530,19 @@ request runs.
   requirements for the default command, which uses sudo (open until this browser
   has shown it once, with notes that it creates the `parsar-node` system service
   and, for Docker, that the docker group is root-equivalent), and "No sudo on this
-  host?", with what the node's own user needs and the command without sudo. While
-  it is open, the log command is the user service's. A loopback public URL, or a
-  console without the provider's node files, replaces the limits with one line
-  saying why, and the footer offers nothing to generate.
+  host?", with what the node's own user needs and the command without sudo. The
+  log command follows the command last copied; after the no-sudo one it adds the
+  system service's, for a root shell. Until the installation is read, a line says
+  it is being checked; a failed read, a loopback public URL, or a console without
+  the provider's node files replaces the limits with one line saying why (the
+  failed read with Try again), and the footer offers nothing to generate.
 - **Clean up the host**: after a node is removed, a dialog gives the host's
-  uninstall command in the same Terminal block, with the no-sudo form behind an
-  "Installed without sudo?" disclosure; Done dismisses it.
+  uninstall command in the same Terminal block, a Graphite line that it deletes no
+  sandboxes, volumes or images (and, for microsandbox, keeps its image store and
+  data), and the no-sudo form behind an "Installed without sudo?" disclosure. A
+  node enrolled with an earlier Core address adds an "Old Core address gone?"
+  disclosure with the `--force` form; a loopback console carries Add node's amber
+  note. Done dismisses it and focus returns to the page heading.
 - **How to call**: wherever a new key is shown, a card under it gives three
   copyable samples, each a Margin Gray block with a Hairline and its label and copy
   button in a header row: a Shell block exporting `OPENAI_BASE_URL` (the
diff --git a/apps/web/PRODUCT.md b/apps/web/PRODUCT.md
index 033074557..a534df76e 100644
--- a/apps/web/PRODUCT.md
+++ b/apps/web/PRODUCT.md
@@ -84,8 +84,9 @@ workbench.
   figures and allocations, enrollment, renaming, sandbox limits and removal; Add node
   asks for the node's sandbox limits before it issues the one-time command, which installs
   the node with sudo as a system service (a disclosure gives the command without sudo, as a
-  user service); it issues none while the public URL is loopback or the console lacks the
-  provider's node files; after Remove, a dialog gives the host's uninstall command), System (the
+  user service); it issues none before the installation is read, while the public URL is
+  loopback, or when the console lacks the provider's node files; after Remove, a dialog gives
+  the host's uninstall command), System (the
   installation's public address, API base URL, installation ID and source commit, read-only;
   each harness's default model, set, replaced or cleared there beside its read-only startup
   state; the sandbox configuration every project shares, with a link to Nodes where it
diff --git a/apps/web/e2e/nodes.spec.ts b/apps/web/e2e/nodes.spec.ts
index 7d1adf76b..0f829cafe 100644
--- a/apps/web/e2e/nodes.spec.ts
+++ b/apps/web/e2e/nodes.spec.ts
@@ -16,7 +16,8 @@ test("adds a node: host requirements, a sudo command and one without, a countdow
   await page.getByRole("button", { name: "Add node" }).click();
   const add = page.getByRole("dialog", { name: "Add node" });
   // What a Docker host needs for the default command, which installs the node with sudo.
-  await expect(add.getByText("Docker Engine installed and running, enforcing CPU and memory limits (cgroup v2)")).toBeVisible();
+  await expect(add.getByText("Rootful Docker Engine running, its socket owned by the docker group with mode 0660, enforcing CPU and memory limits (cgroup v2)")).toBeVisible();
+  await expect(add.getByText("SELinux is not enforcing (otherwise use the no-sudo command)")).toBeVisible();
   await expect(add.getByText("CPUs and memory for at least one sandbox: 2 CPU · 4 GiB; about 2 GB of disk for the Runtime image")).toBeVisible();
   await expect(add.getByText(/^Reaches http:\/\/127\.0\.0\.1:\d+ and https:\/\/core\.example\.com; sandboxes reach https:\/\/core\.example\.com$/)).toBeVisible();
   await expect(add.getByText("parsar-node joins the docker group, which is equivalent to root on this host.")).toBeVisible();
@@ -84,16 +85,20 @@ test("adds a node: host requirements, a sudo command and one without, a countdow
   await expect(add.getByText("Rerun only on edge-04 if asked")).toBeVisible();
   // Past the installer's minute without connecting, the dialog points at the node's log.
   await page.clock.fastForward("01:01");
-  const problem = add.getByRole("alert");
+  const problem = add.getByRole("alert").filter({ hasText: "Check the log on the host:" });
   await expect(problem).toContainText("Not connected yet");
   await expect(problem).toContainText("sudo journalctl -u parsar-node-7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f.service");
-  // Without sudo: what that user needs, the same command without sudo, and its user service's log.
+  // Without sudo: what that user needs and the same command without sudo. Once that one is copied, the log
+  // hint names its user service, and the system service in case root ran it.
   await add.getByText("No sudo on this host?").click();
   await expect(add.getByText("sudo usermod -aG docker NODE_USER")).toBeVisible();
   const userCommand = add.getByLabel("One-time enrollment command without sudo", { exact: true });
   await expect(userCommand).toHaveValue(/EXIT\ncurl/);
   await expect(userCommand).toHaveValue(/\| python3 "\$d\/node-install\.pyz" --enrollment-token-stdin /);
+  await expect(problem).not.toContainText("journalctl --user");
+  await add.getByRole("button", { name: "Copy command without sudo" }).click();
   await expect(problem).toContainText("journalctl --user -u parsar-node-7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f.service");
+  await expect(problem).toContainText("If root ran it, it is a system service:sudo journalctl -u parsar-node-7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f.service");
   // Connected, it reports why Docker isn't ready; once ready, the node is connected.
   await setNode(request, { id: "node-new", online: true, diagnostic: "docker_limits_unsupported" });
   await expect(problem).toContainText("Docker limits unsupported");
@@ -107,11 +112,25 @@ test("adds a node: host requirements, a sudo command and one without, a countdow
   await expect(add.getByLabel("Sandboxes at once")).toHaveValue("2");
 });
 
-test("issues no command for a loopback public URL or without node files, and sees a fix on reopening", async ({ page, request }) => {
-  // Nodes on other machines can't reach a loopback public_url; this replaces the note about the browser's address.
+test("issues no command before the installation is read, for a loopback public URL or without node files, and sees a fix on reopening", async ({ page, request }) => {
+  // Until the installation is read, and while it can't be, nothing is issued: the read decides.
+  let release = () => {};
+  const held = new Promise<void>((resolve) => { release = resolve; });
+  await page.route("**/core/v1/installation", async (route) => {
+    await held;
+    await route.fulfill({ status: 500, json: { error: { message: "Unavailable.", type: "server_error", code: null, param: null } } });
+  });
   await openConsole(page, request, "nodes", { installation: "local" });
   await page.getByRole("button", { name: "Add node" }).click();
   const add = page.getByRole("dialog", { name: "Add node" });
+  await expect(add.getByRole("status")).toHaveText("Checking this installation's public URL…");
+  await expect(add.getByRole("button", { name: "Generate command" })).toHaveCount(0);
+  release();
+  await expect(add.getByRole("alert")).toContainText("The installation couldn't be read, so no command can be issued.");
+  await expect(add.getByRole("button", { name: "Generate command" })).toHaveCount(0);
+  await page.unroute("**/core/v1/installation");
+  await add.getByRole("button", { name: "Try again" }).click();
+  // Nodes on other machines can't reach a loopback public_url; this replaces the note about the browser's address.
   await expect(add.getByRole("status")).toHaveText("Nodes need an HTTPS public URL that other machines and their sandboxes can reach: set public_url in config.json and run parsar apply");
   await expect(add.getByRole("note")).toHaveCount(0);
   await expect(add.getByRole("button", { name: "Generate command" })).toHaveCount(0);
@@ -142,8 +161,11 @@ test("removes a node after confirmation", async ({ page, request }) => {
   await expect(cleanup.getByLabel("Uninstall command", { exact: true })).toHaveValue(/\| s=sudo\n[^]*\n\$s python3 "\$d\/node-install\.pyz" --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f'\)$/);
   await cleanup.getByText("Installed without sudo?").click();
   await expect(cleanup.getByLabel("Uninstall command without sudo", { exact: true })).toHaveValue(/\npython3 "\$d\/node-install\.pyz" --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f'\)$/);
+  // Nothing to force for a node on the current address; closing leaves focus on the page, as the row is gone.
+  await expect(cleanup.getByText("Old Core address gone?")).toHaveCount(0);
   await cleanup.getByRole("button", { name: "Done" }).click();
   await expect(cleanup).toBeHidden();
+  await expect(page.getByRole("heading", { name: "Nodes", level: 1 })).toBeFocused();
 });
 
 test("sets up own-machine sandboxes page by page, with the Runtime from the distribution", async ({ page, request }) => {
diff --git a/apps/web/e2e/public-url.spec.ts b/apps/web/e2e/public-url.spec.ts
index 7ef359f2d..d49731c9b 100644
--- a/apps/web/e2e/public-url.spec.ts
+++ b/apps/web/e2e/public-url.spec.ts
@@ -65,4 +65,9 @@ test("warns on Nodes about a node bound to an old Core address until it is remov
   await page.getByRole("dialog", { name: "Remove node" }).getByRole("button", { name: "Confirm removal" }).click();
   await expect(page.getByRole("table", { name: "Sandbox nodes" })).not.toContainText("core-01");
   await expect(warning).toHaveCount(0);
+  // Its host's uninstall confirms the removal at that old address; if it no longer answers, --force skips the check.
+  const cleanup = page.getByRole("dialog", { name: "Clean up the host" });
+  await cleanup.getByText("Old Core address gone?").click();
+  await expect(cleanup).toContainText("core-01 still points at the old Core address https://core-old.example.com.");
+  await expect(cleanup.getByLabel("Uninstall command with --force", { exact: true })).toHaveValue(/--uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f' --force\)$/);
 });
diff --git a/apps/web/src/features/sandbox/NodeCleanupDialog.tsx b/apps/web/src/features/sandbox/NodeCleanupDialog.tsx
index 2d04859ba..6ec17d80b 100644
--- a/apps/web/src/features/sandbox/NodeCleanupDialog.tsx
+++ b/apps/web/src/features/sandbox/NodeCleanupDialog.tsx
@@ -1,37 +1,62 @@
+import { TriangleAlert } from "lucide-react";
 import { useTranslation } from "react-i18next";
 
 import { Modal } from "../../components/Modal";
-import { nodeUninstallCommand } from "./enrollment-command";
+import { sandboxSetupOrigin } from "./core-origin";
+import { nodeUninstallCommand, type NodeInstallMode } from "./enrollment-command";
 import { CommandBlock } from "./node-commands";
 
 /** A node Core has just removed, with what builds its host's uninstall command. */
 export interface NodeCleanup {
   name: string;
+  /** This console's address, which the command downloads the installer from. */
   sourceUrl: string;
   installationId: string;
   scriptDigest: string;
+  provider: string;
+  /** The Core address the node enrolled with, when it is no longer the deployment's; else null. */
+  oldAddress: string | null;
 }
 
 /**
  * After Remove: the command that removes the node's service and files from its
- * host. The installer uninstalls only once Core refuses the node's credential,
- * which it does from the removal on. The sudo form escalates by itself, so a node
- * installed without sudo gets its own command, run as that node's user.
+ * host (deploy/install/node_install.py `uninstall_system` and `uninstall_user`).
+ * The installer first confirms with Core, at the node's own address, that the
+ * node is removed, which holds from the removal on. The sudo form escalates by
+ * itself, so a node installed without sudo gets its own command, run as that
+ * node's user. A node enrolled with an earlier address may find it gone; then
+ * `--force` skips only that confirmation. Nothing deletes sandboxes, volumes or
+ * images.
  */
 export function NodeCleanupDialog({ cleanup, open, onClose }: { cleanup: NodeCleanup | null; open: boolean; onClose: () => void }) {
-  const { t } = useTranslation("sandbox");
-  const command = (mode: "sudo" | "user") => cleanup ? nodeUninstallCommand({ sourceUrl: cleanup.sourceUrl, installationId: cleanup.installationId, scriptDigest: cleanup.scriptDigest, mode }) : "";
+  const { t, i18n } = useTranslation("sandbox");
+  // Sentences run on with a space in English and without one in Chinese.
+  const join = (...sentences: string[]) => sentences.join(i18n.resolvedLanguage?.startsWith("zh") ? "" : " ");
+  const command = (mode: NodeInstallMode, force = false) => cleanup
+    ? nodeUninstallCommand({ sourceUrl: cleanup.sourceUrl, installationId: cleanup.installationId, scriptDigest: cleanup.scriptDigest, mode, force }) : "";
   return <Modal open={open} title={t("Clean up the host")} onClose={onClose} footer={<button className="button primary" type="button" onClick={onClose}>{t("Done")}</button>}>
     {cleanup ? <div className="sandbox-add-node form-stack">
       <p>{t("{{name}} is removed from Core. To remove its service and files from the host, run:", { name: cleanup.name })}</p>
-      <CommandBlock key={command("sudo")} value={command("sudo")} label={t("Uninstall command")} copyLabel={t("Copy uninstall command")} autoFocus />
+      {/* Like Add node's command, this one downloads from the console's own address. */}
+      {sandboxSetupOrigin(cleanup.sourceUrl) === null ? <p className="sandbox-add-node-warning" role="note"><TriangleAlert size={14} aria-hidden="true" /><span>{t("This console is open at {{origin}}, which other machines can't reach. On another machine, replace it in the command with the console's HTTPS address.", { origin: cleanup.sourceUrl })}</span></p> : null}
+      <CommandBlock key={command("sudo")} value={command("sudo")} label={t("Uninstall command")} autoFocus />
+      <p className="sandbox-cleanup-note">{join(t("It never deletes sandboxes, volumes or images."),
+        ...(cleanup.provider === "microsandbox" ? [t("It keeps microsandbox's image store and sandbox data, and prints how to remove them by hand.")] : []))}</p>
       <details className="sandbox-host-requirements sandbox-no-sudo">
         <summary>{t("Installed without sudo?")}</summary>
         <div className="sandbox-no-sudo-body">
           <p>{t("Run this as that user instead:")}</p>
-          <CommandBlock key={command("user")} value={command("user")} label={t("Uninstall command without sudo")} copyLabel={t("Copy the uninstall command without sudo")} />
+          <CommandBlock key={command("user")} value={command("user")} label={t("Uninstall command without sudo")} copyName={t("Copy command without sudo")} />
         </div>
       </details>
+      {cleanup.oldAddress !== null ? <details className="sandbox-host-requirements sandbox-no-sudo">
+        <summary>{t("Old Core address gone?")}</summary>
+        <div className="sandbox-no-sudo-body">
+          <p>{join(t("{{name}} still points at the old Core address {{address}}.", { name: cleanup.name, address: cleanup.oldAddress }),
+            t("If this node's old Core address no longer responds, first remove it on the Nodes page, then add --force to the uninstall command."))}</p>
+          <CommandBlock key={command("sudo", true)} value={command("sudo", true)} label={t("Uninstall command with --force")} copyName={t("Copy command with --force")} />
+        </div>
+      </details> : null}
     </div> : null}
   </Modal>;
 }
diff --git a/apps/web/src/features/sandbox/NodeEnrollment.tsx b/apps/web/src/features/sandbox/NodeEnrollment.tsx
index 7b5b88f1f..ccdb9e04d 100644
--- a/apps/web/src/features/sandbox/NodeEnrollment.tsx
+++ b/apps/web/src/features/sandbox/NodeEnrollment.tsx
@@ -37,11 +37,13 @@ const DEFAULT_RETAINED = "8";
  * sandboxes, so only it asks for a retained limit; Docker retains exactly the
  * sandboxes it runs at once. The command runs the installer with sudo, which
  * installs the node as a system service; a disclosure offers the same command
- * without sudo, which installs a user service. An installation whose public URL
- * is loopback (`local_only`), or a console that reports no node files for the
- * deployment's provider (`node_artifacts`), says so instead and issues no command.
- * Each opening, and each return to the window while open, reads both again, so a
- * fix on the Core host shows without a reload.
+ * without sudo, which installs a user service, and the log hint follows the
+ * command last copied. No command is issued until the installation is read: one
+ * whose public URL is loopback (`local_only`), an unreadable one, or a console
+ * that reports no node files for the deployment's provider (`node_artifacts`)
+ * says so instead. Each opening, and each return to the window while open, reads
+ * the installation and the console again, so a fix on the Core host shows
+ * without a reload.
  *
  * The page keeps this dialog mounted, so a command survives closing it: it is
  * shown again until it expires or its node connects. An expired command is
@@ -72,8 +74,9 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   const [error, setError] = useState<unknown>(null);
   const [now, setNow] = useState(Date.now);
   const [requirementsOpen, setRequirementsOpen] = useState(() => !requirementsSeen());
-  // The no-sudo disclosure; while it is open, log hints are for a user service.
   const [noSudoOpen, setNoSudoOpen] = useState(false);
+  // The command last copied, so the log hint names that one's service.
+  const [copiedMode, setCopiedMode] = useState<NodeInstallMode>("sudo");
   const queryClient = useQueryClient();
   const installation = useQuery(installationQuery);
   // When the latest node-list read this dialog asked for began (Date.now()), once it has finished.
@@ -87,12 +90,15 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   const provider = deployment.provider === "docker" || deployment.provider === "microsandbox" ? deployment.provider : null;
   const backend = provider === "microsandbox" ? "microsandbox" : "Docker";
   // Nodes and their sandboxes reach Core at its public URL, so a loopback one serves no other machine;
-  // and without the provider's node files the installer would fail on the host. Either way no command is issued.
-  const blocker = installation.data?.local_only === true
-    ? t("Nodes need an HTTPS public URL that other machines and their sandboxes can reach: set public_url in config.json and run parsar apply")
-    : !nodeFilesAvailable(consoleConfig, deployment.provider)
-      ? t("This console has no node files for {{provider}}. Install Core from the offline bundle, or add the release artifacts and rerun ./install.sh.", { provider: backend })
-      : null;
+  // and without the provider's node files the installer would fail on the host. Either way no command
+  // is issued, nor before the installation is read: a failed read (an older Core, say) proves nothing.
+  const blocker: { text: string; failed?: boolean } | null = installation.data === undefined
+    ? installation.isError ? { text: t("The installation couldn't be read, so no command can be issued."), failed: true } : { text: t("Checking this installation's public URL…") }
+    : installation.data.local_only
+      ? { text: t("Nodes need an HTTPS public URL that other machines and their sandboxes can reach: set public_url in config.json and run parsar apply") }
+      : !nodeFilesAvailable(consoleConfig, deployment.provider)
+        ? { text: t("This console has no node files for {{provider}}. Install Core from the offline bundle, or add the release artifacts and rerun ./install.sh.", { provider: backend }) }
+        : null;
   // The command downloads from this console's own address. A loopback one (or any
   // address sandboxSetupOrigin refuses for guests) resolves to the node host itself.
   const consoleLoopback = sourceUrl !== null && sandboxSetupOrigin(sourceUrl) === null;
@@ -169,8 +175,8 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
     setError(null); setBusy(false);
     // A connected node ends the command; otherwise it waits here for the next opening.
     if (ready) { setEnrollment(null); setAppeared(null); }
-    // The limits stay only with an unfinished flow: a command still waiting for its node.
-    if (!enrollment || ready) { setActive(DEFAULT_ACTIVE); setRetained(DEFAULT_RETAINED); }
+    // The limits, and which command was copied, stay only with an unfinished flow: a command still waiting for its node.
+    if (!enrollment || ready) { setActive(DEFAULT_ACTIVE); setRetained(DEFAULT_RETAINED); forgetMode(); }
     onClose();
   }
   /**
@@ -180,7 +186,11 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
    */
   function changeLimits() {
     generation.current++;
-    setEnrollment(null); setAppeared(null); setError(null);
+    setEnrollment(null); setAppeared(null); setError(null); forgetMode();
+  }
+  /** A flow that ends or starts over forgets which command was copied, and folds the no-sudo command away. */
+  function forgetMode() {
+    setCopiedMode("sudo"); setNoSudoOpen(false);
   }
   async function generate() {
     if (request.current || !available || blocker || !limitsReady || activeLimit === null || retainedLimit === null) return;
@@ -201,7 +211,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
       }
       const result = await client.createEnrollment({ signal: controller.signal }, capacity);
       if (!controller.signal.aborted) {
-        setEnrollment({ token: result.token, expires_at: result.expires_at, enrollment_id: result.enrollment_id }); setAppeared(null); setNow(Date.now());
+        setEnrollment({ token: result.token, expires_at: result.expires_at, enrollment_id: result.enrollment_id }); setAppeared(null); setNow(Date.now()); forgetMode();
         // Seen with the limits; the command comes first now.
         setRequirementsOpen(false);
       }
@@ -218,7 +228,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   };
   const requirements = provider ? <>
     <HostRequirements provider={provider} sized={Boolean(size)} values={values} open={requirementsOpen} onToggle={setRequirementsOpen} />
-    <NoSudoGuide provider={provider} values={values} command={commandFor("user")} open={noSudoOpen} onToggle={setNoSudoOpen} />
+    <NoSudoGuide provider={provider} values={values} command={commandFor("user")} open={noSudoOpen} onToggle={setNoSudoOpen} onCopy={() => setCopiedMode("user")} />
   </> : null;
   const limitsForm = `${id}-limits`;
   const footer = !available || (!enrollment && blocker) ? undefined
@@ -250,7 +260,9 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
       {!available ? <p role="status">{consoleConfig.node_installer && coreUrl && !sourceUrl
         ? t("Open this console over HTTPS to add a node: the installer downloads only over HTTPS.")
         : t("Node installation is unavailable. Ask the deployment administrator to enable the node installer on this console.")}</p>
-      : !enrollment && blocker ? <p role="status">{blocker}</p>
+      : !enrollment && blocker ? blocker.failed
+        ? <p role="alert">{blocker.text} <button className="text-action" type="button" disabled={installation.isFetching} onClick={() => void installation.refetch()}>{t("Try again")}</button></p>
+        : <p role="status">{blocker.text}</p>
       : !enrollment ? (
         <form id={limitsForm} className="form-stack" onSubmit={(event) => { event.preventDefault(); void generate(); }}>
           <p>{t("Set the sandbox limits for the host you want to add.")}</p>
@@ -273,7 +285,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
       ) : <>
         {/* Once used, the command only recovers its own node: running it on another host fails. */}
         {command ? <p>{registered && node ? t("Rerun only on {{name}} if asked", { name: node.name }) : t("Run on the host you want to add.")}</p> : null}
-        {command ? <CommandBlock key={command} value={command} label={t("One-time enrollment command")} copyLabel={t("Copy node command")} autoFocus
+        {command ? <CommandBlock key={command} value={command} label={t("One-time enrollment command")} autoFocus onCopy={() => setCopiedMode("sudo")}
           extra={!registered ? <span className="sandbox-command-expiry" role="timer" title={new Date(enrollment.expires_at).toLocaleString(locale)}>{t("Expires in {{time}}", { time: formatCountdown(Date.parse(enrollment.expires_at) - now) })}</span> : null} /> : null}
         {/* One live region for the whole flow; only its contents change, so each change is announced. */}
         <div role="status" aria-label={t("Registration progress")}>
@@ -285,7 +297,11 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
         </div>
         {problem && !ready ? <div className="sandbox-enrollment-problem" role="alert">
           <p><strong>{problem.label}</strong> {problem.advice}{problem.help ? <HelpTip>{problem.help}</HelpTip> : null}</p>
-          <div className="sandbox-log-hint"><span>{t("Check the log on the host:")}</span><CopyCommand value={nodeLogCommand(deployment.installation_id, noSudoOpen ? "user" : "sudo")} /></div>
+          <div className="sandbox-log-hint">
+            <span>{t("Check the log on the host:")}</span><CopyCommand value={nodeLogCommand(deployment.installation_id, copiedMode)} />
+            {/* Run by root, the no-sudo command installs the system service after all. */}
+            {copiedMode === "user" ? <><span>{t("If root ran it, it is a system service:")}</span><CopyCommand value={nodeLogCommand(deployment.installation_id, "sudo")} /></> : null}
+          </div>
         </div> : null}
         {!fresh ? <p>{t("Connection status unavailable. Refresh to check your node.")}</p> : null}
         {!ready ? requirements : null}
diff --git a/apps/web/src/features/sandbox/SandboxManagerView.css b/apps/web/src/features/sandbox/SandboxManagerView.css
index 1e4264fdd..e15609e9a 100644
--- a/apps/web/src/features/sandbox/SandboxManagerView.css
+++ b/apps/web/src/features/sandbox/SandboxManagerView.css
@@ -85,6 +85,7 @@
 .sandbox-host-requirements .sandbox-no-sudo-body ul { padding: 0 0 0 18px; }
 .sandbox-no-sudo-body .sandbox-host-requirements-note { padding: 0; }
 .sandbox-add-node .sandbox-host-requirements-note p { font-size: 12px; }
+.sandbox-add-node .sandbox-cleanup-note { font-size: 12px; }
 .sandbox-copy-command { display: grid; justify-items: start; gap: 2px; max-width: 100%; }
 .sandbox-copy-command-row { display: flex; align-items: flex-start; gap: 2px; max-width: 100%; }
 .sandbox-copy-command code { min-width: 0; padding: 2px 6px; color: var(--fg); font-family: var(--font-mono); font-size: 11.5px; background: var(--surface-subtle); border-radius: 5px; overflow-wrap: anywhere; }
diff --git a/apps/web/src/features/sandbox/SandboxManagerView.tsx b/apps/web/src/features/sandbox/SandboxManagerView.tsx
index c09361a88..0bb303e6a 100644
--- a/apps/web/src/features/sandbox/SandboxManagerView.tsx
+++ b/apps/web/src/features/sandbox/SandboxManagerView.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useRef, useState, type ReactNode } from "react";
+import { useCallback, useEffect, useRef, useState, type ReactNode, type RefObject } from "react";
 import type { InitializeSandboxDeployment, SandboxDeployment, SandboxNode } from "@agents-core-web/agents-client";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { ArrowLeft, Pencil, Plus, Server, Trash2 } from "lucide-react";
@@ -33,12 +33,12 @@ export function SandboxManagerView() {
 }
 
 /** The page header; an E2B deployment has no machines, so the page is its sandbox backend. */
-function NodesPageHeader({ title, count, back, actions, cloud = false }: { title?: ReactNode; count?: number; back?: () => void; actions?: ReactNode; cloud?: boolean }) {
+function NodesPageHeader({ title, count, back, actions, cloud = false, headingRef }: { title?: ReactNode; count?: number; back?: () => void; actions?: ReactNode; cloud?: boolean; headingRef?: RefObject<HTMLHeadingElement | null> }) {
   const { t } = useTranslation("sandbox");
   return <header className="page-header">
     <div className="console-page-heading">
       {back ? <button type="button" className="icon-button ghost back-button" aria-label={t("Back")} title={t("Back")} onClick={back}><ArrowLeft size={16} strokeWidth={1.6} aria-hidden="true" /></button> : null}
-      <h1>{title ?? t(cloud ? "Sandbox backend" : "Nodes")}</h1>
+      <h1 ref={headingRef} tabIndex={headingRef ? -1 : undefined}>{title ?? t(cloud ? "Sandbox backend" : "Nodes")}</h1>
       {count === undefined ? null : <span className="heading-count">{count}</span>}
       {back ? null : <HelpTip>{t(cloud ? "E2B runs this deployment's sandboxes in its cloud. There are no machines to add." : "Your hosts for running sandboxes.")}</HelpTip>}
     </div>
@@ -91,9 +91,13 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
     setRevision((value) => value + 1);
     // The wizard reads the address and config file from the installation.
     void queryClient.invalidateQueries({ queryKey: installationQuery.queryKey });
-    // Settles when the read does; the enrollment dialog waits for it before calling a command expired.
     return refetch();
   }, [queryClient, refetch]);
+  // The enrollment dialog's reads: the node list alone, every few seconds while it waits. It settles
+  // when the read does, which the dialog waits for before calling a command expired.
+  const refreshNodes = useCallback(() => refetch(), [refetch]);
+  // Where focus goes once a dialog about a node that is gone closes.
+  const heading = useRef<HTMLHeadingElement>(null);
   const toast = useToast();
   // A refresh the administrator asks for reports its failure even while an earlier one is still unconfirmed;
   // the enrollment dialog's own repeated refreshes do not.
@@ -175,7 +179,11 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
         // The host still runs the node's service until it is uninstalled there.
         const sourceUrl = sandboxCoreOrigin(window.location.origin);
         if (consoleConfig.node_installer && sourceUrl && snapshot) {
-          setCleanup({ node: { name: target.name || target.id, sourceUrl, installationId: snapshot.deployment.installation_id, scriptDigest: consoleConfig.node_installer_sha256 }, open: true });
+          const { deployment } = snapshot;
+          setCleanup({ node: {
+            name: target.name || target.id, sourceUrl, installationId: deployment.installation_id, scriptDigest: consoleConfig.node_installer_sha256,
+            provider: deployment.provider, oldAddress: target.core_url !== deployment.core_url ? target.core_url : null,
+          }, open: true });
         }
       }
     } catch (error) {
@@ -220,15 +228,20 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
     <p>{t("{{name}} will be removed from this deployment.", { name: removeName })}</p>
     <p>{t("Core rejects removal while allocations or retained resources remain.")}</p>
   </ConfirmDialog>;
-  const cleanupDialog = <NodeCleanupDialog cleanup={cleanup?.node ?? null} open={cleanup?.open ?? false} onClose={() => setCleanup((current) => current && { ...current, open: false })} />;
+  const cleanupDialog = <NodeCleanupDialog cleanup={cleanup?.node ?? null} open={cleanup?.open ?? false} onClose={() => {
+    setCleanup((current) => current && { ...current, open: false });
+    // The removed node's button is gone, so focus returns to the page, after the dialog restores its own.
+    window.requestAnimationFrame(() => heading.current?.focus());
+  }} />;
   // Rendered first in both the list and a node's page, so an open command outlives the navigation.
-  const enrollment = hostedNodes && snapshot ? <NodeEnrollment key={snapshot.deployment.generation} client={client} consoleConfig={consoleConfig} deployment={snapshot.deployment} nodes={snapshot.nodes} open={adding} fresh={confirmed} onClose={() => setAdding(false)} onRefresh={refresh} /> : null;
+  const enrollment = hostedNodes && snapshot ? <NodeEnrollment key={snapshot.deployment.generation} client={client} consoleConfig={consoleConfig} deployment={snapshot.deployment} nodes={snapshot.nodes} open={adding} fresh={confirmed} onClose={() => setAdding(false)} onRefresh={refreshNodes} /> : null;
 
   if (params.id && hostedNodes) {
     const back = () => goBack("nodes");
     return <>
       {enrollment}
       <NodesPageHeader
+        headingRef={heading}
         back={back}
         title={selected ? selected.name || selected.id : params.id}
         actions={<>
@@ -270,7 +283,7 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
   </>;
   return <>
     {enrollment}
-    <NodesPageHeader count={hostedNodes ? nodes.length : undefined} actions={actions} cloud={snapshot?.deployment.provider === "e2b"} />
+    <NodesPageHeader headingRef={heading} count={hostedNodes ? nodes.length : undefined} actions={actions} cloud={snapshot?.deployment.provider === "e2b"} />
     <div className="console-page-body sandbox-content">
       {status}
       {snapshot && !snapshot.deployment.provider ? <SandboxSetupWizard key={revision} coreUrl={snapshot.deployment.core_url} disabled={busy || loading || setupNeedsRefresh || error !== null} onSubmit={initialize} /> : null}
diff --git a/apps/web/src/features/sandbox/enrollment-command.test.ts b/apps/web/src/features/sandbox/enrollment-command.test.ts
index a9dcae7f8..0e60a7107 100644
--- a/apps/web/src/features/sandbox/enrollment-command.test.ts
+++ b/apps/web/src/features/sandbox/enrollment-command.test.ts
@@ -28,6 +28,8 @@ curl -fsS --max-time 30 --max-filesize 1048576 'https://console.example/node-ins
 printf '%s  %s\\n' '${digest}' "$d/node-install.pyz" | sha256sum -c --status &&
 $s python3 "$d/node-install.pyz" --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f')`);
     expect(uninstall("user").split("\n").at(-1)).toBe(`python3 "$d/node-install.pyz" --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f')`);
+    expect(nodeUninstallCommand({ sourceUrl: "https://console.example", installationId: "7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", scriptDigest: digest, mode: "sudo", force: true }).split("\n").at(-1))
+      .toBe(`$s python3 "$d/node-install.pyz" --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f' --force)`);
   });
   it("points at the node's journal in each mode", () => {
     expect(nodeLogCommand("7f3c2a90-fixture", "sudo")).toBe("sudo journalctl -u parsar-node-7f3c2a90-fixture.service");
@@ -49,7 +51,7 @@ python3 "$d/install.pyz" --source-url 'https://core.example' --environment-id 'e
     const bin = join(root, "bin"), temporary = join(root, "tmp");
     mkdirSync(bin); mkdirSync(temporary);
     const payload = "verified installer fixture\n";
-    const fixture = join(root, "fixture"), report = join(root, "report.json"), sudoReport = join(root, "sudo.json");
+    const fixture = join(root, "fixture"), report = join(root, "report.json"), sudoReport = join(root, "sudo.json"), printfReport = join(root, "printf.log");
     writeFileSync(fixture, payload);
     function executable(name: string, code: string) {
       const path = join(bin, name);
@@ -67,6 +69,8 @@ if(split!==64) process.exit(2);
 const actual=crypto.createHash('sha256').update(fs.readFileSync(line.slice(split+2))).digest('hex');
 process.exit(actual===line.slice(0,split)?0:1);`);
     executable("id", `console.log(process.env.SCENARIO==='as root'?'0':'1000');`);
+    // The shell's builtin printf feeds the token; an external one would put it in an argv.
+    executable("printf", `require('node:fs').appendFileSync(process.env.PRINTF_REPORT,'called\\n');`);
     executable("sudo", `const fs=require('node:fs'), {spawnSync}=require('node:child_process');
 fs.writeFileSync(process.env.SUDO_REPORT,JSON.stringify({args:process.argv.slice(2),env:process.env}));
 process.exit(spawnSync(process.argv[2],process.argv.slice(3),{stdio:'inherit'}).status ?? 1);`);
@@ -79,9 +83,10 @@ process.exit(process.env.SCENARIO==='installer failure'?7:0);`);
     const mode: NodeInstallMode = scenario === "no sudo" ? "user" : "sudo";
     try {
       const command = nodeInstallCommand({ token, coreUrl: "http://127.0.0.1:8091", sourceUrl: "http://localhost:8080", provider: "docker", installationId: "fixture-installation", scriptDigest: digest, mode });
-      const result = spawnSync("sh", ["-c", command], { env: { ...process.env, PATH: `${bin}:${process.env.PATH}`, TMPDIR: temporary, SCENARIO: scenario, FIXTURE: fixture, REPORT: report, SUDO_REPORT: sudoReport }, encoding: "utf8" });
+      const result = spawnSync("sh", ["-c", command], { env: { ...process.env, PATH: `${bin}:${process.env.PATH}`, TMPDIR: temporary, SCENARIO: scenario, FIXTURE: fixture, REPORT: report, SUDO_REPORT: sudoReport, PRINTF_REPORT: printfReport }, encoding: "utf8" });
       expect(result.status).toBe(scenario === "installer failure" ? 7 : scenario === "download failure" ? 22 : scenario === "checksum mismatch" ? 1 : 0);
       expect(readdirSync(temporary)).toEqual([]);
+      expect(readdirSync(root)).not.toContain("printf.log");
       if (scenario === "download failure" || scenario === "checksum mismatch") {
         expect(readdirSync(root)).not.toContain("report.json");
         expect(readdirSync(root)).not.toContain("sudo.json");
diff --git a/apps/web/src/features/sandbox/enrollment-command.ts b/apps/web/src/features/sandbox/enrollment-command.ts
index 9dcbb69f2..463fedf6d 100644
--- a/apps/web/src/features/sandbox/enrollment-command.ts
+++ b/apps/web/src/features/sandbox/enrollment-command.ts
@@ -40,10 +40,12 @@ export function nodeInstallCommand({ token, coreUrl, sourceUrl, provider, instal
 
 /**
  * Removes a node Core no longer lists from its host: its service, its files and,
- * when no node uses it, the service user. It holds no secret.
+ * when no node uses it, the service user. It holds no secret. The installer first
+ * confirms with Core, at the address the node enrolled with, that the node is
+ * removed; `force` skips that check, for an address that no longer answers.
  */
-export function nodeUninstallCommand({ sourceUrl, installationId, scriptDigest, mode }: { sourceUrl: string; installationId: string; scriptDigest: string; mode: NodeInstallMode }): string {
-  return `${nodeInstaller(sourceUrl, scriptDigest, mode)}${runInstaller(mode)} --uninstall --installation-id ${quote(installationId)})`;
+export function nodeUninstallCommand({ sourceUrl, installationId, scriptDigest, mode, force = false }: { sourceUrl: string; installationId: string; scriptDigest: string; mode: NodeInstallMode; force?: boolean }): string {
+  return `${nodeInstaller(sourceUrl, scriptDigest, mode)}${runInstaller(mode)} --uninstall --installation-id ${quote(installationId)}${force ? " --force" : ""})`;
 }
 
 /**
diff --git a/apps/web/src/features/sandbox/node-commands.tsx b/apps/web/src/features/sandbox/node-commands.tsx
index 2855b9aec..26be2c95c 100644
--- a/apps/web/src/features/sandbox/node-commands.tsx
+++ b/apps/web/src/features/sandbox/node-commands.tsx
@@ -6,15 +6,17 @@ import { useCopy } from "../api-keys/IssuedKey";
 import { hostRequirements, userModePrerequisites, USER_MANAGER_RESTART, type HostPrerequisite } from "./node-enrollment";
 
 /** A multi-line command to paste into a terminal, with its copy button. Key it by the command so its copy state starts over. */
-export function CommandBlock({ value, label, copyLabel, extra, autoFocus = false }: {
+export function CommandBlock({ value, label, copyName, extra, autoFocus = false, onCopy }: {
   value: string;
   /** Names the command's field for assistive technology. */
   label: string;
-  /** Names the copy button until it has copied. */
-  copyLabel: string;
+  /** Names the copy button when a dialog has more than one; it starts with the visible "Copy command". */
+  copyName?: string;
   /** Shown in the heading before the copy button, such as the command's expiry. */
   extra?: ReactNode;
   autoFocus?: boolean;
+  /** Called when the administrator copies this command. */
+  onCopy?: () => void;
 }) {
   const { t } = useTranslation("sandbox");
   const { state, copy } = useCopy(value);
@@ -23,7 +25,7 @@ export function CommandBlock({ value, label, copyLabel, extra, autoFocus = false
       <div className="sandbox-command-heading">
         <span><Terminal size={15} />{t("Terminal")}</span>
         {extra}
-        <button type="button" className="button outline" autoFocus={autoFocus} aria-label={state === "copied" ? t("Copied") : copyLabel} onClick={() => void copy()}>
+        <button type="button" className="button outline" autoFocus={autoFocus} aria-label={state === "copied" ? t("Copied") : copyName} onClick={() => { onCopy?.(); void copy(); }}>
           {state === "copied" ? <Check size={14} /> : <Copy size={14} />}{state === "copied" ? t("Copied") : t("Copy command")}
         </button>
       </div>
@@ -89,24 +91,25 @@ export function HostRequirements({ provider, sized, values, open, onToggle }: {
  * user who runs it, with what that user needs. Before a command exists it
  * shows only the preparation.
  */
-export function NoSudoGuide({ provider, values, command, open, onToggle }: {
+export function NoSudoGuide({ provider, values, command, open, onToggle, onCopy }: {
   provider: "docker" | "microsandbox";
   values: RequirementValues;
   command: string;
   open: boolean;
   onToggle: (open: boolean) => void;
+  onCopy: () => void;
 }) {
   const { t } = useTranslation("sandbox");
   return <details className="sandbox-host-requirements sandbox-no-sudo" open={open} onToggle={(event) => onToggle(event.currentTarget.open)}>
     <summary>{t("No sudo on this host?")}</summary>
     <div className="sandbox-no-sudo-body">
-      <p>{t("Without sudo, the node runs as a user service of the user who runs the command. That user needs:")}</p>
+      <p>{t("Without sudo, the node runs as a user service of the user who runs the command. An administrator prepares that user once:")}</p>
       <PrerequisiteList items={userModePrerequisites(provider)} values={values} />
       <div className="sandbox-host-requirements-note">
         <p>{t("After a group change, sign in again as that user. If its systemd manager was already running, restart it (or reboot):")}</p>
         <CopyCommand value={USER_MANAGER_RESTART} />
       </div>
-      {command ? <CommandBlock key={command} value={command} label={t("One-time enrollment command without sudo")} copyLabel={t("Copy the command without sudo")} /> : null}
+      {command ? <CommandBlock key={command} value={command} label={t("One-time enrollment command without sudo")} copyName={t("Copy command without sudo")} onCopy={onCopy} /> : null}
     </div>
   </details>;
 }
diff --git a/apps/web/src/features/sandbox/node-enrollment.test.ts b/apps/web/src/features/sandbox/node-enrollment.test.ts
index 643723786..683c925df 100644
--- a/apps/web/src/features/sandbox/node-enrollment.test.ts
+++ b/apps/web/src/features/sandbox/node-enrollment.test.ts
@@ -20,7 +20,7 @@ describe("node enrollment", () => {
     expect(enrolledNode([node("old"), fresh, other], command)?.id).toBe("new");
     expect(enrolledNode([node("old"), other], command)).toBeNull();
     // A command without an ID matches nothing, not even nodes without one.
-    expect(enrolledNode([node("old"), node("absent", { enrollment_id: undefined })], { enrollment_id: "" })).toBeNull();
+    expect(enrolledNode([node("old"), node("absent", { enrollment_id: null })], { enrollment_id: "" })).toBeNull();
   });
 
   it("follows the node from registered to ready, and reports it once the installer's wait has passed", () => {
diff --git a/apps/web/src/features/sandbox/node-enrollment.ts b/apps/web/src/features/sandbox/node-enrollment.ts
index 0e8225f6f..7294c960d 100644
--- a/apps/web/src/features/sandbox/node-enrollment.ts
+++ b/apps/web/src/features/sandbox/node-enrollment.ts
@@ -21,13 +21,16 @@ export interface HostPrerequisite {
  * and the node as the `parsar-node` system service (sudo mode), as the command
  * and deploy/install/node_install.py check it:
  * - the command runs curl, sha256sum and python3 (enrollment-command.ts), and
- *   `sudo` unless the shell is root; `host_checks` needs Python 3.9+, Linux amd64
- *   and systemd as the init system;
- * - Docker: `provider_group` needs Docker Engine running with a group-accessible
- *   socket, enforcing CPU and memory limits (the node is ready only then:
- *   services/agents-api/internal/sandbox/config/probe.go); it installs nothing;
- * - microsandbox: `provider_group` needs /dev/kvm, and `prepare_runtime` the
- *   libraries its binaries link (the ldd check);
+ *   `sudo` unless the shell is root; `host_checks` needs Python 3.9+, Linux amd64,
+ *   systemd as the init system, and SELinux not enforcing;
+ * - Docker: `provider_group` needs rootful Docker Engine running, its socket
+ *   group-accessible (0660) and, through `device_group`, owned by the docker
+ *   group, which the service user joins; and CPU and memory limits enforced (the
+ *   node is ready only then: services/agents-api/internal/sandbox/config/probe.go).
+ *   It installs nothing;
+ * - microsandbox: `provider_group` needs /dev/kvm, readable and writable by all or
+ *   group-accessible in the kvm group, and `prepare_runtime` the libraries its
+ *   binaries link (the ldd check);
  * - `host_capacity`: the host's CPUs and memory hold one sandbox of the
  *   deployment's size (else the node reports capacity_insufficient); the Runtime
  *   image needs about 2 GB of disk;
@@ -39,9 +42,10 @@ export interface HostPrerequisite {
 export function hostRequirements(provider: "docker" | "microsandbox", sized: boolean): HostPrerequisite[] {
   return [
     { label: "Linux amd64 with systemd; Python 3.9+, curl and sha256sum; root or sudo" },
+    { label: "SELinux is not enforcing (otherwise use the no-sudo command)" },
     provider === "docker"
-      ? { label: "Docker Engine installed and running, enforcing CPU and memory limits (cgroup v2)" }
-      : { label: "/dev/kvm (hardware or nested virtualization) and the libraries microsandbox links (glibc)" },
+      ? { label: "Rootful Docker Engine running, its socket owned by the docker group with mode 0660, enforcing CPU and memory limits (cgroup v2)" }
+      : { label: "/dev/kvm in the kvm group (hardware or nested virtualization) and the libraries microsandbox links (glibc)" },
     { label: sized ? "CPUs and memory for at least one sandbox: {{size}}; about 2 GB of disk for the Runtime image" : "CPUs and memory for at least one sandbox; about 2 GB of disk for the Runtime image" },
     { label: "Reaches {{console}} and {{core}}; sandboxes reach {{core}}" },
   ];
@@ -56,8 +60,9 @@ export function hostRequirements(provider: "docker" | "microsandbox", sized: boo
  *   included, keep the groups it started with; so the group change comes first,
  *   or that manager is restarted after it (USER_MANAGER_RESTART). A shell open
  *   before the change lacks the group too, so the user signs in again;
- * - the user's own systemd session (`systemctl --user`), which sudo -u and su
- *   don't provide;
+ * - the user's systemd manager (`systemctl --user`): from an SSH session, or from
+ *   su or sudo -iu, which leave no session bus, through the bus lingering keeps
+ *   running (`user_bus`);
  * - microsandbox: a home short enough for ~/.parsar/m/<12 hex> to fit in 48 bytes
  *   (`micro_home`): at most 48 - len("/.parsar/m/") - 12 = 25 bytes.
  */
@@ -69,7 +74,7 @@ export function userModePrerequisites(provider: "docker" | "microsandbox"): Host
       : { label: "Read and write access to /dev/kvm for that user", command: "sudo usermod -aG kvm NODE_USER" },
     { label: "systemd lingering for that user, enabled after the group change", command: "sudo loginctl enable-linger NODE_USER" },
     ...(provider === "microsandbox" ? [{ label: "A home directory of 25 bytes or less, such as /home/parsar" } satisfies HostPrerequisite] : []),
-    { label: "Run the command signed in as that user: over SSH, or with", command: "sudo machinectl shell NODE_USER@" },
+    { label: "Run the command as that user: over SSH, or from a root shell with", command: "su - NODE_USER" },
   ];
 }
 
diff --git a/apps/web/src/lib/locale-strings.ts b/apps/web/src/lib/locale-strings.ts
index 4c5852fd4..fdba4f7e4 100644
--- a/apps/web/src/lib/locale-strings.ts
+++ b/apps/web/src/lib/locale-strings.ts
@@ -45,32 +45,42 @@ export const chinese = {
   "Add another node": "添加另一个节点",
   "Host requirements": "主机要求",
   "Linux amd64 with systemd; Python 3.9+, curl and sha256sum; root or sudo": "Linux amd64，使用 systemd；装有 Python 3.9+、curl 和 sha256sum；有 root 或 sudo 权限",
-  "Docker Engine installed and running, enforcing CPU and memory limits (cgroup v2)": "已安装并运行 Docker Engine，且能限制 CPU 和内存（cgroup v2）",
-  "/dev/kvm (hardware or nested virtualization) and the libraries microsandbox links (glibc)": "/dev/kvm（硬件或嵌套虚拟化），以及 microsandbox 链接的库（glibc）",
+  "SELinux is not enforcing (otherwise use the no-sudo command)": "SELinux 不是 enforcing（否则请使用不带 sudo 的命令）",
+  "Rootful Docker Engine running, its socket owned by the docker group with mode 0660, enforcing CPU and memory limits (cgroup v2)": "Docker Engine 以 rootful 模式运行，套接字属于 docker 组、权限 0660，且能限制 CPU 和内存（cgroup v2）",
+  "/dev/kvm in the kvm group (hardware or nested virtualization) and the libraries microsandbox links (glibc)": "属于 kvm 组的 /dev/kvm（硬件或嵌套虚拟化），以及 microsandbox 链接的库（glibc）",
+  "Without sudo, the node runs as a user service of the user who runs the command. An administrator prepares that user once:": "不用 sudo 时，节点作为用户服务运行在执行命令的用户下。管理员需要先为该用户准备一次：",
+  "Run the command as that user: over SSH, or from a root shell with": "以该用户运行命令：通过 SSH，或在 root shell 中使用",
+  "Copy command without sudo": "复制命令（不用 sudo）",
+  "Copy command with --force": "复制命令（--force）",
+  "Checking this installation's public URL…": "正在检查这个安装的公网地址…",
+  "The installation couldn't be read, so no command can be issued.": "无法读取安装信息，暂时不能生成命令。",
+  "If root ran it, it is a system service:": "如果是 root 运行的，它是系统服务：",
+  "This console is open at {{origin}}, which other machines can't reach. On another machine, replace it in the command with the console's HTTPS address.": "当前控制台地址 {{origin}} 其他机器访问不到。在其他机器上运行前，请把命令里的这个地址换成控制台的 HTTPS 地址。",
+  "It never deletes sandboxes, volumes or images.": "它不会删除任何沙箱、卷或镜像。",
+  "It keeps microsandbox's image store and sandbox data, and prints how to remove them by hand.": "它会保留 microsandbox 的镜像存储和沙箱数据，并打印手动删除的方法。",
+  "Old Core address gone?": "旧 Core 地址已失效？",
+  "{{name}} still points at the old Core address {{address}}.": "{{name}} 仍指向旧的 Core 地址 {{address}}。",
+  "If this node's old Core address no longer responds, first remove it on the Nodes page, then add --force to the uninstall command.": "如果这个节点的旧 Core 地址已无法访问，请先在“节点”页移除它，再在卸载命令后加上 --force。",
+  "Uninstall command with --force": "带 --force 的卸载命令",
   "CPUs and memory for at least one sandbox: {{size}}; about 2 GB of disk for the Runtime image": "CPU 和内存至少够一个沙箱：{{size}}；Runtime 镜像约需 2 GB 磁盘",
   "CPUs and memory for at least one sandbox; about 2 GB of disk for the Runtime image": "CPU 和内存至少够一个沙箱；Runtime 镜像约需 2 GB 磁盘",
   "Reaches {{console}} and {{core}}; sandboxes reach {{core}}": "能访问 {{console}} 和 {{core}}；沙箱也要能访问 {{core}}",
   "The command creates the parsar-node service user and a system service. It installs no software; if something is missing it stops and says what to install.": "命令会创建 parsar-node 服务用户和一个系统服务。它不安装任何软件；缺少什么时会停下并说明要装什么。",
   "parsar-node joins the docker group, which is equivalent to root on this host.": "parsar-node 会加入 docker 组，这在这台主机上等同于 root 权限。",
   "No sudo on this host?": "这台主机没有 sudo？",
-  "Without sudo, the node runs as a user service of the user who runs the command. That user needs:": "不用 sudo 时，节点作为用户服务运行在执行命令的用户下。该用户需要：",
   "A non-root user to run the node (NODE_USER below)": "一个运行节点的非 root 用户（即下文的 NODE_USER）",
   "One-time enrollment command without sudo": "不用 sudo 的一次性注册命令",
-  "Copy the command without sudo": "复制不用 sudo 的命令",
   "Nodes need an HTTPS public URL that other machines and their sandboxes can reach: set public_url in config.json and run parsar apply": "节点需要一个其他机器及其沙箱都能访问的 HTTPS 公网地址：请在 config.json 里设置 public_url，然后运行 parsar apply",
   "Clean up the host": "清理主机",
   "{{name}} is removed from Core. To remove its service and files from the host, run:": "{{name}} 已从 Core 移除。要删除它在主机上的服务和文件，请运行：",
   "Uninstall command": "卸载命令",
-  "Copy uninstall command": "复制卸载命令",
   "Installed without sudo?": "安装时没用 sudo？",
   "Run this as that user instead:": "请改为以该用户运行：",
   "Uninstall command without sudo": "不用 sudo 的卸载命令",
-  "Copy the uninstall command without sudo": "复制不用 sudo 的卸载命令",
   "Docker at /var/run/docker.sock for that user, enforcing CPU and memory limits": "该用户能使用 /var/run/docker.sock 上的 Docker，且 Docker 能限制 CPU 和内存",
   "Read and write access to /dev/kvm for that user": "该用户能读写 /dev/kvm",
   "A home directory of 25 bytes or less, such as /home/parsar": "主目录路径不超过 25 字节，例如 /home/parsar",
   "systemd lingering for that user, enabled after the group change": "为该用户开启 systemd lingering（在改用户组之后）",
-  "Run the command signed in as that user: over SSH, or with": "以该用户登录后运行命令：通过 SSH，或使用",
   "After a group change, sign in again as that user. If its systemd manager was already running, restart it (or reboot):": "改完用户组后请以该用户重新登录；如果它的 systemd 管理器已在运行，请重启它（或重启主机）：",
   "Copy {{command}}": "复制 {{command}}",
   "Select the command and copy it manually.": "请选中命令手动复制。",
@@ -211,7 +221,6 @@ export const chinese = {
   "Core origin reachable from nodes and guests": "节点和沙箱可访问的 Core 地址",
   "Initialize sandbox deployment": "初始化沙箱部署",
   "Copied": "已复制",
-  "Copy node command": "复制节点命令",
   "Select the command above and copy it manually.": "请选择上方命令并手动复制。",
   "Choose the next provider": "选择下一个运行后端",
   "One provider serves this entire Core deployment. Switching requires maintenance and verified cleanup of all existing execution resources.": "整个 Core 部署使用一个运行后端。切换前需进入维护模式，并确认所有现有执行资源已清理。",
diff --git a/docs/web/protocol-coverage.md b/docs/web/protocol-coverage.md
index 248b92bc6..f76b7249a 100644
--- a/docs/web/protocol-coverage.md
+++ b/docs/web/protocol-coverage.md
@@ -146,9 +146,9 @@ consumed; the list carries each provider.
 | Nodes | `GET /core/v1/sandbox/nodes` | Nodes page; fleet on Overview; node capacity on Sandbox metrics. An online node's `diagnostic` (`docker_unavailable`, `docker_limits_unsupported`, `runtime_image_unavailable`, `kvm_unavailable`, `microsandbox_artifacts_unavailable`, `capacity_insufficient`, `provider_unavailable`; any other value reads as `provider_unavailable`) marks it degraded and names the reason and fix in the help tip beside its status on each of these and on the node's page. A node whose `core_url` (the address it enrolled with) differs from the deployment's `core_url` is named on the Nodes page as bound to an old address, to be removed and added again. **Add node** follows only the node whose `enrollment_id` equals its command's; a node enrolled before Core recorded it reports null and never matches |
 | Node detail | `GET /core/v1/sandbox/nodes/{node_id}?range=1h\|6h\|24h` | Sandbox metrics node dialog: the host's CPU busy share and memory from its last heartbeat, and their history over the page's range |
 | Allocations | `GET /core/v1/sandbox/nodes/{node_id}/allocations` | Nodes page; Sandbox metrics. Under microsandbox, a node's page shows from `compute_phase_changed_at` how long each allocation has been in its compute phase and, while suspended, about when Core reclaims it (that time plus the deployment's `suspension.retention_seconds`); a null time shows a dash |
-| Enrollment | `POST /core/v1/sandbox/enrollment-tokens` | **Add node**: the administrator sets the node's sandbox limits (`max_active`; `max_retained` only for microsandbox, equal to `max_active` for Docker) before Core issues a single-use token inside a command that verifies the installer checksum, with the command's `enrollment_id`, which the node it registers reports. The command runs the installer with sudo (a system service) and passes the token on standard input; a "No sudo on this host?" disclosure gives the same command without sudo (a user service) and what that user needs, and the log hint follows the disclosure. When the installation is `local_only`, or `/console/config` lists `node_artifacts` without the deployment's provider (null reads as none; an absent field blocks nothing), the dialog says why and requests no token; it reads both again on opening and when the window regains focus |
+| Enrollment | `POST /core/v1/sandbox/enrollment-tokens` | **Add node**: the administrator sets the node's sandbox limits (`max_active`; `max_retained` only for microsandbox, equal to `max_active` for Docker) before Core issues a single-use token inside a command that verifies the installer checksum, with the command's `enrollment_id`, which the node it registers reports. The command runs the installer with sudo (a system service) and passes the token on standard input; a "No sudo on this host?" disclosure gives the same command without sudo (a user service) and what that user needs, and the log hint follows the command last copied. Until the installation is read, when it can't be read, when it is `local_only`, or when `/console/config` lists `node_artifacts` without the deployment's provider (null reads as none; an absent field blocks nothing), the dialog says why and requests no token; it reads both again on opening and when the window regains focus |
 | Update node | `PATCH /core/v1/sandbox/nodes/{node_id}` | **Edit node**: the name and sandbox limits together (the retained limit only for microsandbox; under Docker, Core sets it to the active limit) |
-| Remove node | `DELETE /core/v1/sandbox/nodes/{node_id}` | Confirmed node removal; the row goes only after Core acknowledges the deletion, and a Clean up the host dialog then gives the host's uninstall command (with sudo, and without it behind a disclosure) |
+| Remove node | `DELETE /core/v1/sandbox/nodes/{node_id}` | Confirmed node removal; the row goes only after Core acknowledges the deletion, and a Clean up the host dialog then gives the host's uninstall command (with sudo, and without it behind a disclosure; for a node enrolled with another address than the deployment's, also with `--force`, which skips the installer's confirmation with Core) |
 | Runtime observations | `GET /core/v1/sandbox/runtime-observations` | Sandbox metrics: hosted Runtimes of every project, each labelled with its project; an E2B sandbox's dialog adds its `observation.disk` as used / limit (null elsewhere) |
 
 Signing in grants administration, so `/console/config` reports only the node

From 18e8f16d652e5e5378332f85d688888ec5aa0490 Mon Sep 17 00:00:00 2001
From: saladday <1203511142@qq.com>
Date: Sat, 26 Sep 2026 02:17:25 +0000
Subject: [PATCH 3/4] Say the Core installer reads the Standard sizes

---
 .../web/src/features/sandbox/deployment-specification.ts | 2 +-
 apps/web/src/features/sandbox/standard-sizes.md          | 9 +++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/apps/web/src/features/sandbox/deployment-specification.ts b/apps/web/src/features/sandbox/deployment-specification.ts
index e628c62c4..9bf59c471 100644
--- a/apps/web/src/features/sandbox/deployment-specification.ts
+++ b/apps/web/src/features/sandbox/deployment-specification.ts
@@ -10,7 +10,7 @@ interface Manifest {
   microsandbox?: { runtime_sha256?: string; firmware_sha256?: string };
 }
 
-// The Standard sizes are a contract with the node installer; see standard-sizes.md before changing their structure.
+// The Standard sizes are a contract with the Core installer (install.sh); see standard-sizes.md before changing their structure.
 export function defaultSandboxResources(provider: SandboxProvider): SandboxResources {
   return { ...(provider === "microsandbox" ? standardSizes.microsandbox : standardSizes.docker) };
 }
diff --git a/apps/web/src/features/sandbox/standard-sizes.md b/apps/web/src/features/sandbox/standard-sizes.md
index 223fd9b86..830f6fe28 100644
--- a/apps/web/src/features/sandbox/standard-sizes.md
+++ b/apps/web/src/features/sandbox/standard-sizes.md
@@ -27,12 +27,13 @@ accept.
   `deployment-specification.ts`.
 - The release bundle: `build-core-distribution.sh` copies this file to
   `<bundle>/standard-sizes.json`.
-- The node installer, which reads the bundled copy for its default deployment.
+- The Core installer: `install.sh --sandbox` reads the bundled copy to create
+  the default deployment.
 
 ## Contract
 
-The keys and structure are a contract with the installer. Changing a value is
-fine. Renaming, removing or adding keys, or restructuring the file, must be
-coordinated with the backend first, because the installer parses the bundled copy.
+The keys and structure are a contract with the Core installer. Changing a value
+is fine. Renaming, removing or adding keys, or restructuring the file, must be
+coordinated with the backend first, because `install.sh` parses the bundled copy.
 `deployment-specification.test.ts` pins the structure so that an accidental
 change fails.

From c3581c9e2d8f7372af6775384701d922ac3876bc Mon Sep 17 00:00:00 2001
From: saladday <1203511142@qq.com>
Date: Sat, 26 Sep 2026 04:23:56 +0000
Subject: [PATCH 4/4] Say that a host serves one Core and that rerunning the
 command resumes the download

---
 apps/web/e2e/nodes.spec.ts                           | 2 ++
 apps/web/src/features/sandbox/NodeEnrollment.tsx     | 2 ++
 apps/web/src/features/sandbox/SandboxManagerView.css | 2 +-
 apps/web/src/features/sandbox/node-enrollment.ts     | 5 ++++-
 apps/web/src/lib/locale-strings.ts                   | 2 ++
 5 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/apps/web/e2e/nodes.spec.ts b/apps/web/e2e/nodes.spec.ts
index 0f829cafe..4740fc031 100644
--- a/apps/web/e2e/nodes.spec.ts
+++ b/apps/web/e2e/nodes.spec.ts
@@ -18,6 +18,7 @@ test("adds a node: host requirements, a sudo command and one without, a countdow
   // What a Docker host needs for the default command, which installs the node with sudo.
   await expect(add.getByText("Rootful Docker Engine running, its socket owned by the docker group with mode 0660, enforcing CPU and memory limits (cgroup v2)")).toBeVisible();
   await expect(add.getByText("SELinux is not enforcing (otherwise use the no-sudo command)")).toBeVisible();
+  await expect(add.getByText("One Core per host: a host already running a node for another Core is refused.")).toBeVisible();
   await expect(add.getByText("CPUs and memory for at least one sandbox: 2 CPU · 4 GiB; about 2 GB of disk for the Runtime image")).toBeVisible();
   await expect(add.getByText(/^Reaches http:\/\/127\.0\.0\.1:\d+ and https:\/\/core\.example\.com; sandboxes reach https:\/\/core\.example\.com$/)).toBeVisible();
   await expect(add.getByText("parsar-node joins the docker group, which is equivalent to root on this host.")).toBeVisible();
@@ -37,6 +38,7 @@ test("adds a node: host requirements, a sudo command and one without, a countdow
   // The token goes on stdin to the checked installer, run with sudo unless the shell is root.
   await expect(field).toHaveValue(/^ \(umask 077;.*\|\| s=sudo\n/);
   await expect(field).toHaveValue(/\| \$s python3 "\$d\/node-install\.pyz" --enrollment-token-stdin /);
+  await expect(add.getByText("If the command is interrupted or the download stalls, run the same command again: the download resumes.")).toBeVisible();
   await expect(add.getByRole("timer")).toHaveText(/^Expires in (10:00|9:\d\d)$/);
   const progress = add.getByRole("status", { name: "Registration progress" });
   await expect(progress).toHaveText(/Waiting for registration.*Connect.*Docker check/);
diff --git a/apps/web/src/features/sandbox/NodeEnrollment.tsx b/apps/web/src/features/sandbox/NodeEnrollment.tsx
index ccdb9e04d..ca1b0238f 100644
--- a/apps/web/src/features/sandbox/NodeEnrollment.tsx
+++ b/apps/web/src/features/sandbox/NodeEnrollment.tsx
@@ -287,6 +287,8 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
         {command ? <p>{registered && node ? t("Rerun only on {{name}} if asked", { name: node.name }) : t("Run on the host you want to add.")}</p> : null}
         {command ? <CommandBlock key={command} value={command} label={t("One-time enrollment command")} autoFocus onCopy={() => setCopiedMode("sudo")}
           extra={!registered ? <span className="sandbox-command-expiry" role="timer" title={new Date(enrollment.expires_at).toLocaleString(locale)}>{t("Expires in {{time}}", { time: formatCountdown(Date.parse(enrollment.expires_at) - now) })}</span> : null} /> : null}
+        {/* The installer keeps partial downloads and exits 130 on Ctrl-C; the token lasts until the countdown ends. */}
+        {command ? <p className="sandbox-command-note">{t("If the command is interrupted or the download stalls, run the same command again: the download resumes.")}</p> : null}
         {/* One live region for the whole flow; only its contents change, so each change is announced. */}
         <div role="status" aria-label={t("Registration progress")}>
           {ready && node ? <div className="sandbox-enrollment-status connected"><span className="sandbox-status-dot" />{t("{{name}} · Connected", { name: node.name })}</div>
diff --git a/apps/web/src/features/sandbox/SandboxManagerView.css b/apps/web/src/features/sandbox/SandboxManagerView.css
index e15609e9a..7c59df740 100644
--- a/apps/web/src/features/sandbox/SandboxManagerView.css
+++ b/apps/web/src/features/sandbox/SandboxManagerView.css
@@ -85,7 +85,7 @@
 .sandbox-host-requirements .sandbox-no-sudo-body ul { padding: 0 0 0 18px; }
 .sandbox-no-sudo-body .sandbox-host-requirements-note { padding: 0; }
 .sandbox-add-node .sandbox-host-requirements-note p { font-size: 12px; }
-.sandbox-add-node .sandbox-cleanup-note { font-size: 12px; }
+.sandbox-add-node .sandbox-cleanup-note, .sandbox-add-node .sandbox-command-note { font-size: 12px; }
 .sandbox-copy-command { display: grid; justify-items: start; gap: 2px; max-width: 100%; }
 .sandbox-copy-command-row { display: flex; align-items: flex-start; gap: 2px; max-width: 100%; }
 .sandbox-copy-command code { min-width: 0; padding: 2px 6px; color: var(--fg); font-family: var(--font-mono); font-size: 11.5px; background: var(--surface-subtle); border-radius: 5px; overflow-wrap: anywhere; }
diff --git a/apps/web/src/features/sandbox/node-enrollment.ts b/apps/web/src/features/sandbox/node-enrollment.ts
index 7294c960d..9bc1d8bd3 100644
--- a/apps/web/src/features/sandbox/node-enrollment.ts
+++ b/apps/web/src/features/sandbox/node-enrollment.ts
@@ -22,7 +22,9 @@ export interface HostPrerequisite {
  * and deploy/install/node_install.py check it:
  * - the command runs curl, sha256sum and python3 (enrollment-command.ts), and
  *   `sudo` unless the shell is root; `host_checks` needs Python 3.9+, Linux amd64,
- *   systemd as the init system, and SELinux not enforcing;
+ *   systemd as the init system, and SELinux not enforcing; `other_node` refuses a
+ *   host that already runs a sudo-mode node for another installation, since
+ *   sudo-mode nodes share the parsar-node account;
  * - Docker: `provider_group` needs rootful Docker Engine running, its socket
  *   group-accessible (0660) and, through `device_group`, owned by the docker
  *   group, which the service user joins; and CPU and memory limits enforced (the
@@ -43,6 +45,7 @@ export function hostRequirements(provider: "docker" | "microsandbox", sized: boo
   return [
     { label: "Linux amd64 with systemd; Python 3.9+, curl and sha256sum; root or sudo" },
     { label: "SELinux is not enforcing (otherwise use the no-sudo command)" },
+    { label: "One Core per host: a host already running a node for another Core is refused." },
     provider === "docker"
       ? { label: "Rootful Docker Engine running, its socket owned by the docker group with mode 0660, enforcing CPU and memory limits (cgroup v2)" }
       : { label: "/dev/kvm in the kvm group (hardware or nested virtualization) and the libraries microsandbox links (glibc)" },
diff --git a/apps/web/src/lib/locale-strings.ts b/apps/web/src/lib/locale-strings.ts
index fdba4f7e4..7ae842d69 100644
--- a/apps/web/src/lib/locale-strings.ts
+++ b/apps/web/src/lib/locale-strings.ts
@@ -46,6 +46,8 @@ export const chinese = {
   "Host requirements": "主机要求",
   "Linux amd64 with systemd; Python 3.9+, curl and sha256sum; root or sudo": "Linux amd64，使用 systemd；装有 Python 3.9+、curl 和 sha256sum；有 root 或 sudo 权限",
   "SELinux is not enforcing (otherwise use the no-sudo command)": "SELinux 不是 enforcing（否则请使用不带 sudo 的命令）",
+  "One Core per host: a host already running a node for another Core is refused.": "每台主机只能接入一个 Core：已为其他 Core 运行节点的主机会被拒绝。",
+  "If the command is interrupted or the download stalls, run the same command again: the download resumes.": "如果命令被中断或下载卡住，重新运行同一条命令即可，下载会接着进行。",
   "Rootful Docker Engine running, its socket owned by the docker group with mode 0660, enforcing CPU and memory limits (cgroup v2)": "Docker Engine 以 rootful 模式运行，套接字属于 docker 组、权限 0660，且能限制 CPU 和内存（cgroup v2）",
   "/dev/kvm in the kvm group (hardware or nested virtualization) and the libraries microsandbox links (glibc)": "属于 kvm 组的 /dev/kvm（硬件或嵌套虚拟化），以及 microsandbox 链接的库（glibc）",
   "Without sudo, the node runs as a user service of the user who runs the command. An administrator prepares that user once:": "不用 sudo 时，节点作为用户服务运行在执行命令的用户下。管理员需要先为该用户准备一次：",