REPORT: the burn-down night (2026-10-06)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,9 +1,13 @@
-# REPORT — 2026-10-05 burn-down round 2 (catalog)
+# REPORT — the burn-down night (2026-10-06)
 
-Full session report: `felhom.eu/REPORT-burndown2-2026-10-05.md`. Baseline `29ac711`.
+Full session report: `felhom.eu/REPORT-burndown3-2026-10-06.md`. Baseline `4828dc7`.
 
-Fixed: R-593, R-760, R-594, R-605, R-781, R-806 (scheme half), plus the stale `test_catalog_gates.py`. Tests and red-proofs:
-`felhom.eu/documentation/audits/burndown2-2026-10-05/catalog-red-proofs.txt`. `catalog_gates.py --fast` green;
-`test_catalog_gates.py` 11/11.
+**Pushed to the live catalog** (`c265b37`, 2026-10-06 00:30, release window 1): R-758 (eight memory figures = their
+sums; gate `mem-limit-sum`), R-127 leg (a) (four `data_key` flags; gate `data-key`), R-798 (grimmory's API-docs switch),
+R-763 + R-764 (wger closes its sign-up and guest users, mails through the relay — wger stays hidden), R-786 (record),
+R-731 (`scripts/check-currency.py`), two stale gate tools. Later (`75f3584`): R-426 decoys — image-pins could be fooled
+three ways (a quoted `"image":` key, `${APP_IMAGE:-x}`, a bare `@sha256:`), fixed.
 
-Not done: R-469 and the R-605 exit-code line in `CLAUDE.md` — a permission check refused the instruction-file edit; asked.
+**Held back, NOT on main** (each owes a 9202 proof; the commits are kept on the drill repo `admin/app-catalog-drill`):
+R-776 (kimai, zipline, vikunja, nextcloud see each visitor behind the tunnel), R-613 (nextcloud probe
+`"installed":true`). The live-proof helper did not reach them; 9202 was put back byte-identical.