docs: STOP-1 live leg PASSED — H4 window proven closed on the demo box

Endpoint-level supervised run against snapshot 49e7cb46, the same one that
aborted in round 2. Controller log shows stop -> 'Starting stack immich
services only: [immich-postgres]' -> replay rc-0 in 20s -> full start.

No 'already exists'. Operation reported success (round 2: failure). immich's
own DatabaseService logged 'No schema drift detected' twice, where round 2
left it reporting drift. 11 assets active, 4/4 containers healthy, 231
public indexes.

Credentials were supplied file-to-file, never echoed, and shredded with both
cookie jars at the end of the run.

CHANGELOG.md

@@ -76,8 +76,24 @@ the catalog's real immich template, and the empty-list refusal. Three companion
 reverted: the pre-fix full start on the offsite path, the pre-fix full start on the local path, and
 deletion of both fail-closed gates — each failing on the intended assertion. 23/23 packages green.
 
-**Not yet live-validated.** The supervised reconstitute on the demo box (STOP-1) and Viktor's C6
+**Live-validated on the demo box, 2026-07-20 (operator present).** Endpoint-level, against the SAME
-customer-restore UI run remain outstanding.
+snapshot (`49e7cb46`) that aborted in round 2:
+
+```
+15:39:42  [stacks] Stopping stack: immich
+15:39:43  [stacks] Starting stack immich services only: [immich-postgres]
+15:39:43  [backup] Restore immich: replaying DB dump into immich-postgres (postgres)
+15:40:03  [backup] Restore immich: replayed 1 DB dump(s)          <- rc-0, no "already exists"
+15:40:03  [stacks] Starting stack: immich
+15:40:27  [offbox] reconstituted immich: 6 file(s) placed, 1 DB dump(s) replayed, skewed=false
+```
+
+The operation reported **success** (round 2 reported failure); immich's own DatabaseService logged
+**`No schema drift detected`** twice, where round 2 left it reporting drift; 11 assets `active`, all
+four containers healthy, 231 `public` indexes. Details in `REPORT.md` §4b.
+
+**Still outstanding:** golden 0.153.0 (Phase C) and Viktor's C6 customer-restore UI run — plus the
+immich timeline screenshot, which needs a browser.
 
 
 ### v0.152.0 — Megosztás on a Mac: mDNS in the image, and the page stops giving Mac users a dead form (2026-07-20)

REPORT.md

@@ -96,14 +96,62 @@ as the pin) — the exact input a line scan would misread.
 
 ## 4. Deployment
 
-Recorded on completion of Phase B — see the CHANGELOG entry for the shipped version.
+Built + pushed from the clean tree at `78ff991`: `gitea.dooplex.hu/admin/felhom-controller:0.153.0`,
+digest `sha256:cc02c950c47456dac01aa754f23befbdfb3d4897b0a9863aafa3589cff95b8ab`. Deployed to guest
+9201 via the bootstrap path (pull → `/etc/felhom-controller-image` → restart bootstrap service).
+Verified: `gitea.dooplex.hu/admin/felhom-controller:0.153.0 | Up (healthy)`, clean startup, and
+`Event pushed: controller_started (info) — Controller elindult (0.153.0)`.
+
+## 4b. STOP-1 — supervised live leg: **PASSED** (2026-07-20, operator present)
+
+Method: **endpoint-level** — the exact endpoints the UI posts to, driven with an authenticated
+session inside the guest (no browser on DooPlex; no state hand-setting, no `docker exec` shortcut
+around the pipeline). App: **immich** (a real DB-indexed app), snapshot `49e7cb46` — the SAME
+snapshot that aborted in round 2.
+
+Baseline before the run: **11 assets, all `active`**.
+
+1. `POST /backup/offbox/restore` `app=immich mode=full confirm=1` → 302; scratch staged
+   **15:30:08 UTC**: `restored immich (49e7cb46, full=true) → …/backups/offsite-restore/immich`.
+2. `POST /backup/offbox/reconstitute` `app=immich confirm=1` → 302, fired **15:39:36 UTC**.
+
+**Controller log — the ordering, live:**
+
+```
+15:39:42  [offbox] immich: pre-restore safety dump written -> pre-restore-20260720T153941Z-immich-postgres.sql (49.9 MB)
+15:39:42  [stacks] Stopping stack: immich
+15:39:43  [stacks] Starting stack immich services only: [immich-postgres]      <- THE FIX
+15:39:43  [backup] Restore immich: replaying DB dump into immich-postgres (postgres)
+15:40:03  [backup] Restore immich: replayed 1 DB dump(s)                        <- rc-0, 20 s
+15:40:03  [stacks] Starting stack: immich                                       <- full start, only now
+15:40:27  [offbox] reconstituted immich from snapshot 49e7cb46: 6 file(s) placed,
+          1 DB dump(s) replayed, safety dump=pre-restore-…, skewed=false
+```
+
+**Verification through the system's own surfaces:**
+
+| Check | Round 2 (v0.148.0) | This run (v0.153.0) |
+|---|---|---|
+| `already exists` / replay abort | `ERROR relation "clip_index" already exists` (exit 3) | **none** — replay exited 0 |
+| App up during replay | yes (immich-server rebuilt `clip_index` mid-replay) | **no** — only `immich-postgres` was up |
+| Operation outcome | reported FAILURE | **success**, `dbs=1` |
+| immich's own schema verdict | **schema drift** reported | **`No schema drift detected`** — twice (Microservices + Api) |
+| Assets | 11 (recovered by luck of `pg_dump` ordering) | **11, all `active`** |
+| Containers | — | all four immich containers `Up (healthy)` |
+| `public` indexes | incomplete (aborted script) | **231** |
+
+The decisive line is `Starting stack immich services only: [immich-postgres]` followed by a replay
+that exits 0 — the window in which H4 occurred no longer exists. The DB service name was resolved
+from the LIVE compose by `DBServiceNames`, unassisted.
+
+Credentials handling per GL-1: the operator's password was supplied file→file, never echoed, and the
+file plus both cookie jars (host and guest) were shredded at the end of the run.
 
 ## 5. NOT yet live-validated — remaining human/supervised work
 
-- **STOP-1 (supervised, Viktor present):** prepare a full offsite restore scratch for immich through
+- ~~**STOP-1**~~ — **DONE 2026-07-20, PASSED.** See §4b for the log ordering, timestamps and the
-  the real endpoints, then fire `/backup/offbox/reconstitute` and verify through the system's own
+  before/after comparison against round 2. Residual: the immich **timeline screenshot** still cannot
-  surfaces — controller log showing stop → db-only up → replay rc-0 → full up, no `already exists`,
+  be captured from here (no browser on DooPlex) — that one visual remains the operator's.
-  no drift, immich healthy with content visible. Timestamps to be recorded here afterwards.
 - **Phase C (golden 0.153.0):** probes P1–P3 first. **P3 is load-bearing** — the drill environment is
   at the vacation site and must be proven able to pull
   `gitea.dooplex.hu/admin/felhom-controller:0.153.0` BEFORE any bake. If unreachable: stop and