Day 4 (2026-10-09): kernel night read back, release delivered, ep0-copy job live, D1-D4 proven; R-279/R-30/R-79/R-35/R-901 closed

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/operations/nodes.md

@@ -42,7 +42,7 @@ DooPlex while the boxes are away (`felhom-pve-lan` → `No route to host`, 2026-
 | PVE node name | `felhom` (its certificate: `CN=felhom.enkicsifelhom.hu`) |
 | LAN address | **DHCP** — read 2026-10-06 as `192.168.0.154` (MAC `bc:24:11:ac:e3:f9`; find it with `ip neigh` after a ping) |
 | Customer / guest | `tester-1`; guest LXC 9201 at `192.168.0.101`, dashboard `felhom.enkicsifelhom.hu` |
-| SSH | through the HP box: `ssh -J demo-hp root@<VM address>` — **DooPlex's key is NOT authorized there yet** (2026-10-06: `Permission denied (publickey,password)`); `box_walk.py` `TARGET=tester-1` holds the route |
+| SSH | **`ssh root@192.168.0.154` from DooPlex works BY KEY** (measured 2026-10-09: `BatchMode=yes`, used for the release read-back); the old route `ssh -J demo-hp root@<VM address>` stays the fallback; `box_walk.py` `TARGET=tester-1` holds the route |
 | Identity checked | 2026-10-06: the agent's own report `host.node=felhom` = the VM's certificate; the guest answers its domain (200) and not demo-hp's (404) — `audits/readback-2026-10-07/E1-identity-match.txt` |
 
 **Which box is safe to break, and what may be done to each: