diff --git a/documentation/audits/evidence-backup-promise-2026-09-16/phaseE-freshbox.txt b/documentation/audits/evidence-backup-promise-2026-09-16/phaseE-freshbox.txt
index 1aa611de..1315be25 100644
--- a/documentation/audits/evidence-backup-promise-2026-09-16/phaseE-freshbox.txt
+++ b/documentation/audits/evidence-backup-promise-2026-09-16/phaseE-freshbox.txt
@@ -312,3 +312,35 @@ urllib.error.HTTPError: HTTP Error 403: Forbidden
 ##   nothing, the operator pressed nothing. It has no app pointed at it yet, which is the next step.
 ##   The drive itself: „Adatlemez · /mnt/felhom-drives/adatlemez · Alapértelmezett · Aktív ·
 ##   0.0 GB / 97.9 GB · ext4 · /dev/sdb · Nincs alkalmazás ezen a tárolón".
+## 2026-09-16T17:04:52Z deploying Nextcloud onto the registered drive
+  POST /api/stacks/nextcloud/deploy -> http=400  {"ok":false,"error":"a(z) \"Admin jelszó\" mező kitöltése kötelező — használja a Generálás gombot vagy írjon be egy jelszót"}
+## WHAT A HOUSEHOLD IS ASKED FOR, and what the box mints itself (GET …/deploy-fields):
+##   asked:     DOMAIN (prefilled from the customer record: enkicsifelhom.hu), SUBDOMAIN (default
+##              „cloud"), HDD_PATH (the data drive) — all three required.
+##   generated: DB_PASSWORD (password:24), MYSQL_ROOT_PASSWORD (password:24),
+##              NEXTCLOUD_ADMIN_PASSWORD (password:16); NEXTCLOUD_ADMIN_USER defaults to „admin".
+##   So no customer ever types an app password, and none is defaulted to something guessable —
+##   the same shape R-513 closed for the file manager.
+  final state: not_deployed
+## 2026-09-16T17:15:33Z deploy retried WITH the secrets supplied (the box refused an empty admin password)
+  POST deploy -> http=202  Telepítés elindítva – az állapot a kártyán követhető
+  (the three app secrets are held out-of-band in a 0600 file; none appears in any committed file)
+## A CONTRADICTION WORTH RECORDING (measured 2026-09-16 on the fresh box, controller 0.244.0):
+##   `GET /api/stacks/nextcloud/deploy-fields` describes NEXTCLOUD_ADMIN_PASSWORD as
+##     type=password, required=FALSE, generate=password:16
+##   but `POST /api/stacks/nextcloud/deploy` with that value absent is REFUSED 400:
+##     „a(z) „Admin jelszó" mező kitöltése kötelező — használja a Generálás gombot vagy írjon be
+##      egy jelszót"
+##   The browser fills it with the „Generálás" button before submitting, so a household never meets
+##   this; an API caller that believes the metadata does. The refusal itself is good behaviour —
+##   fail-closed, in Hungarian, naming the button — but `required:false` for a field the server
+##   requires is the label disagreeing with the code.
+## 2026-09-16T17:16:09Z R-536 live on a fresh box: the hub right after the 202, before the app is up
+   2026/09/16 19:15:34 [INFO] Event from tester-1: app_deploy_started (info) — Alkalmazás telepítése elindult: Nextcloud
+   deploy_started seen: 1
+   app_deployed seen (must be 0 while it is still installing): 0
+##   WHAT THAT PROVES: the acceptance now says „telepítése elindult" and NOTHING claims the app is
+##   installed while it is still installing. Measured at 19:15:34 CEST, seconds after the 202, with
+##   the stack still pulling images. On 2026-09-16 morning the same moment produced
+##   „Alkalmazás telepítve: Mealie" — an install that was then killed 5 s later and never happened.
+##   The other half of the pair (app_deployed at COMPLETION) is checked when the stack reaches running.