REPORT: the morning after (2026-10-06)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,13 +1,8 @@
-# REPORT — the burn-down night (2026-10-06)
+# REPORT — the morning after (2026-10-06)
 
-Full session report: `felhom.eu/REPORT-burndown3-2026-10-06.md`. Baseline `4828dc7`.
+Full session report: `felhom.eu/REPORT-morning-after-2026-10-06.md`. Baseline `d955df1`.
 
-**Pushed to the live catalog** (`c265b37`, 2026-10-06 00:30, release window 1): R-758 (eight memory figures = their
-sums; gate `mem-limit-sum`), R-127 leg (a) (four `data_key` flags; gate `data-key`), R-798 (grimmory's API-docs switch),
-R-763 + R-764 (wger closes its sign-up and guest users, mails through the relay — wger stays hidden), R-786 (record),
-R-731 (`scripts/check-currency.py`), two stale gate tools. Later (`75f3584`): R-426 decoys — image-pins could be fooled
-three ways (a quoted `"image":` key, `${APP_IMAGE:-x}`, a bare `@sha256:`), fixed.
-
-**Held back, NOT on main** (each owes a 9202 proof; the commits are kept on the drill repo `admin/app-catalog-drill`):
-R-776 (kimai, zipline, vikunja, nextcloud see each visitor behind the tunnel), R-613 (nextcloud probe
-`"installed":true`). The live-proof helper did not reach them; 9202 was put back byte-identical.
+**Pushed to the live catalog** (`3896cb0`, 06:46Z) after a proof on scratch 9202, each against a control: R-776 (kimai,
+zipline, vikunja, nextcloud see each visitor behind the tunnel — the household is no longer throttled by a stranger, and
+a forged leftmost address does not help the stranger) and R-613 (nextcloud's probe asks for `"installed":true`).
+Evidence: felhom.eu `documentation/audits/morning-after-2026-10-06/live-9202/`. CI 1408 success.