night 2026-10-23 docs: CONTEXT (0.340.0 candidate), REPORT (both review rounds, rc.8 re-proof), the OffsiteStateAwaitingRecoveryKey comment corrected (its hub claim was measured false: felhom.eu R-1230); no behaviour change

REPORT.md

@@ -37,5 +37,23 @@ limit set by ldflags, never pushed) → the timed-out container removed, the par
 | C7 | the image tag, not its ID; no `--pull never` | REAL → fixed; „no memory cgroup → uncapped": NOT-A-FINDING (every Felhom guest is an LXC on a cgroup-v2 Proxmox kernel; the guest's own memory figures come from it) |
 | C8 | README: „out of every backup" | REAL → fixed (the `.fab` export and the whole-guest snapshot still hold it) |
 
-**Images:** `0.340.0-rc.5` (= `66a69d4`), `0.340.0-rc.6` (= `943c517`, on tonight's test box). CI: `66a69d4` 2227,
+## The second review (tonight's own code) and the commits' security review
+
+| # | Finding | Verdict |
+|---|---|---|
+| N2 | one failed `docker rm` refused every restore until a restart | REAL → per-name strays, cleared by a later removal (`9d9e404`) |
+| N3 | the start-up retry removed this process's own copies | REAL → `running` names skipped (`9d9e404`) |
+| N4 | a second copy into the same destination killed the first | REAL → one copy per destination at a time (`9d9e404`) |
+| N5 | `RunTier2` from the „Tier 2 on" save ignored a running restore | REAL, pre-existing → refused for every caller (`9d9e404`) |
+| N9 | the import refusal advised removing an unhealthy app | REAL → „kérd az üzemeltető segítségét" (`9d9e404`) |
+| S1 | the start-up removal could hit a copy starting between list and remove | REAL → the destination's lock (TryLock) (`1babfe9`) |
+| S2 | a restore beginning between the copy's check and its record | REAL → one step under the restore record's lock, every leg asks again (`1babfe9`) |
+
+Each with a test seen failing first; `-race` clean. **Re-proven on 9202 with rc.8** (felhom.eu
+`audits/night-2026-10-23/P1-straycopy/1*`): two runs into the same destination → the second waited, no kill, no failure;
+the restart mid-copy and the restore refusal as before; the redo equal to the source. Also corrected: the comment on
+`OffsiteStateAwaitingRecoveryKey` claimed the hub's delivery check skips a held box — measured false on the test night
+(felhom.eu R-1230, fixed in the hub).
+
+**Images:** `0.340.0-rc.5` (= `66a69d4`), `0.340.0-rc.6` (= `943c517`), `rc.7` (= `9d9e404`, not used), `rc.8` (= `1babfe9`, on 9202 and on the test box for the night). CI: `66a69d4` 2227,
 `912e592` 2228 green; `943c517` and the docs commit: see felhom.eu `REPORT-night-2026-10-23.md`.