diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-appcards.txt b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-appcards.txt
new file mode 100644
index 00000000..b5fbdb11
--- /dev/null
+++ b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-appcards.txt
@@ -0,0 +1,8 @@
+## vaultwarden: first steps: Első lépések Nyisd meg a vault.DOMAIN/admin címet, és lépj be az admin panel tokenjével (Beállítások → Automatikusan generált értékek) A „Users" fülön az „Invite User" mezőben hívd meg a saját és a családtagok e-mail címét — a regisztráció alapból le van zárva, csak meghívott cím nyithat fiókot Nyisd meg a vault.DOMAIN címet, válaszd a „Create account" lehetőséget a meghívott címmel, és adj meg erős mesterjelszót Tel
+   admin/admin mentioned: False | invite fragment: True
+## paperless-ngx: first steps: Első lépések Nyisd meg a paperless.DOMAIN címet a böngészőben Lépj be: felhasználó "admin", a jelszó a Beállítások oldalon található (Automatikusan generált értékek) Tölts fel egy dokumentumot a webfelületen, VAGY dobd a Fájlkezelőben (FileBrowser) az import/paperless mappába — onnan automatikusan beolvassa és OCR-rel feldolgozza. A Fájlkezelő belépése a Fájlkezelő alkalmazás oldalán található Sok dokumentumot egysze
+   admin/admin mentioned: False | invite fragment: False
+## privatebin: first steps: Első lépések Nyisd meg a paste.DOMAIN címet a böngészőben Írd be a szöveget és kattints a Küldés gombra Oszd meg a generált linket - a titkosítási kulcs az URL-ben van Dokumentáció Hivatalos dokumentáció ↗ (function(){ var burger=document.querySelector('.nav-burger'); var sidebar=document.getElementById('sidebar'); var backdrop=document.querySelector('.nav-backdrop'); if(!burger||!sidebar||!backdrop)return; function 
+   admin/admin mentioned: False | invite fragment: False
+## nextcloud: first steps: Első lépések Nyisd meg a cloud.DOMAIN címet a böngészőben Jelentkezz be a telepítéskor megadott admin fiókkal Telepítsd a Nextcloud asztali alkalmazást a számítógépedre Telepítsd a Nextcloud mobil alkalmazást a telefonodra Hívd meg a családtagokat felhasználói fiókok létrehozásával Előfeltételek Külső HDD szükséges a fájlok tárolásához Legalább 1 GB szabad RAM (Nextcloud + MariaDB + Redis) x86 processzor ajánlott a l
+   admin/admin mentioned: False | invite fragment: False
diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-apps.txt b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-apps.txt
index dac2aaa5..5a14398b 100644
--- a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-apps.txt
+++ b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-apps.txt
@@ -4,3 +4,5 @@
   2026-09-16T10:21:58Z paperless-ngx deploy http=202 {"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
   2026-09-16T10:22:18Z nextcloud deploy http=202 {"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
   2026-09-16T10:23:29Z nextcloud=starting paperless-ngx=starting privatebin=running vaultwarden=running
+  2026-09-16T10:23:59Z nextcloud=starting paperless-ngx=starting privatebin=running vaultwarden=running
+  2026-09-16T10:24:29Z nextcloud=running paperless-ngx=running privatebin=running vaultwarden=running
diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-manualbackup.txt b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-manualbackup.txt
new file mode 100644
index 00000000..474a1ce9
--- /dev/null
+++ b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-manualbackup.txt
@@ -0,0 +1,4 @@
+## 2026-09-16T10:27:01Z 'Mentés most' on the fresh box — app downtime measured against the button's copy
+  privatebin before: 200
+  trigger http=200
+{"data":{"started":true},"ok":true}
diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-paperless.txt b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-paperless.txt
new file mode 100644
index 00000000..81d126cd
--- /dev/null
+++ b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-paperless.txt
@@ -0,0 +1,4 @@
+## 2026-09-16T10:25:26Z paperless token len 40
+  posted at 2026-09-16T10:25:26Z
+  tasks: {'SUCCESS': 20}
+  documents: 20
diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-provision.txt b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-provision.txt
index fe0946da..9fe75617 100644
--- a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-provision.txt
+++ b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-provision.txt
@@ -29,3 +29,9 @@ Permission denied, please try again.
 [0.243.0] …site Configuration ← All Customers Tester 1 Last report: 1 min ago · Controller 0.243.0 Auto-refresh (paused) Tester 1 ok Controller 0.243.0 Last report 1 min ago Containers 0/0 Overview Applications Setup Edit Backup & DR Events Notificati…
 [Agent] …ter-1-652049 → tester-1-652049 ONLINE Host ID tester-1-652049 Customer Tester 1 Agent Version 0.131.0 PBS wrapper matches vouched 104db0a4401f… Enrolled 3 min ago Last Report 2 min ago Desired Generation 1 Vitals CPU 0% Memory 20% Disk (roo…
 ## 2026-09-16T10:17:40Z 2026/09/16 12:17:16 [INFO] host-report from tester-1-652049 (1 guests, 2 storage targets, 1 backups, 0 restore-tests, 0 pbs-snapshots, 11172 bytes)
+host: tester1
+agent: felhom-agent 0.131.0
+VMID       Status     Lock         Name                
+9201       running    backup       tester-1            
+controller image: gitea.dooplex.hu/admin/felhom-controller:0.243.0
+golden marker: 
diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-selfbind.txt b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-selfbind.txt
index ff04557d..764bd7fc 100644
--- a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-selfbind.txt
+++ b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-selfbind.txt
@@ -14,3 +14,4 @@ Sikeres összekötés.
 ##   "Elkészült a Felhom dobozod, és készen áll az összekötésre. … https://hub.felhom.eu/bind/<TOKEN REDACTED> …
 ##    1. A párosító kódot, amely a doboz képernyőjén (a monitoron) látható.
 ##    2. A tulajdonosi jelmondatodat (az 5 szóból álló kifejezést) … A hivatkozás 7 napig érvényes. … 5 sikertelen próbálkozás után zárolódik"
+## selfbind-sent line on the Setup tab: Kapcsolódó link elküldve: 2026-09-16 09:59 UTC (operator button) It is sent automatically when the customer is created or RESET, when an e-mail is set on a customer with no box, and when this customer's host is deleted. 
diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-vaultwarden.txt b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-vaultwarden.txt
new file mode 100644
index 00000000..469935b8
--- /dev/null
+++ b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-vaultwarden.txt
@@ -0,0 +1,3 @@
+## 2026-09-16T10:25:05Z Vaultwarden on the fresh box (catalog default SIGNUPS_ALLOWED=false):
+  stranger send-verification-email -> HTTP 400 message: Registration not allowed or user already exists
+  /api/config reachable: 200
diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/screens/33-console-after-claim.png b/documentation/audits/evidence-drill-0243-2026-09-16/screens/33-console-after-claim.png
new file mode 100644
index 00000000..a0e22218
Binary files /dev/null and b/documentation/audits/evidence-drill-0243-2026-09-16/screens/33-console-after-claim.png differ
diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md
index e21d1008..d34ec994 100644
--- a/documentation/backlog/OPEN-ITEMS.md
+++ b/documentation/backlog/OPEN-ITEMS.md
@@ -719,6 +719,7 @@ class (an image `VOLUME` at an unmounted path) is still live — `immich-server`
 | **R-522** | **[P3-LOW] While the box has no internet, the dashboard's „Cloudflare Tunnel" tile keeps saying „Fut", and no page tells the household the box is offline.** MEASURED 2026-09-14 (BIGNIGHT F8, VM 333): VM 333's traffic off the LAN and to the hub was dropped at demo-hp's bridge 21:08:36 → 21:26:07Z. Throughout, the LAN dashboard (probed every 26 s from demo-hp) answered 200 and, polled every 2 min, showed no banner and the tile „Cloudflare Tunnel — Biztonságos internetkapcsolat — a szerver portnyitás nélkül érhető el kívülről. · **Fut** · Védett"; meanwhile cloudflared logged ≈ 20 errors every 2 minutes, the public name answered 530, and the controller logged `[report] Push failed … context deadline exceeded` and `Job hub-report failed: hub push failed after 3 attempts`. The tile reports the container, not the connection. A household whose remote access is gone sees „Fut". **Fix shape:** the tile reads the tunnel's connection state (cloudflared's registered connections or the report push result) and says „Nincs internetkapcsolat" when either fails. | **READY — rank P3-LOW; owner: CC (controller)** |
 | **R-524** | **[P2-MEDIUM] When the catalog moves an app back to an older version, a box that already updated shows „Frissítés elérhető" — and the offered Update is a downgrade.** MEASURED 2026-09-15 (BIGNIGHT Phase 6, VM 333): privatebin was updated 2.0.5 → 2.0.6 through the guarded Update after the drill bump; the catalog was then reverted to 2.0.5 (`a161ccb`). At 22:13:37Z the box reads `installed privatebin/pdo:2.0.6`, `catalog privatebin/pdo:2.0.5`, `catalog_since 2026-09-14`, and the app page tag „**Frissítés elérhető — ma**" with the title „Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot." The label compares for *difference*, not for *newer* (`09-update-architecture.md` §5.4 render table); the guarded Update would advance the pin „to the catalog's current definition" — 2.0.6 → 2.0.5. The same state follows any real upstream yank. **Not pressed tonight.** **Fix shape:** compare versions (or `catalog_since` against the installed record) and render „Naprakész" / „a katalógusnál újabb" when the box is ahead; refuse a pin move to an older tag without an operator word. | **READY — rank P2-MEDIUM; owner: CC (controller)** |
 | **R-534** | **[P1-HIGH] The off-site tier cannot be provisioned or adopted for a rebuilt box: the hub's endpoint token lacks `Datastore.Modify`, so every re-issue fails.** MEASURED 2026-09-16 on the drill box (`tester-1-652049`, fresh install from published ISO 1.27.1): the WG-registration hook refused as R-511 describes („the endpoint already holds a PBS token … use the explicit Re-issue PBS credentials action"); the operator pressed exactly that, hub v0.114.0's ADOPT path ran, and the endpoint answered **`Process exited with status 255 (stderr: Error: permission check failed - missing Datastore.Modify on /datastore/felhom-offsite)`** → HTTP 502, no descriptor written, no secret stored (fail-closed, correct). So the code fix of 2026-09-15 is sound and INERT: a rebuilt box has no whole-guest off-site tier, and the customer's „Távoli rendszermentés" stays absent. **Not run by hand on ep0** (fenced). **Fix shape (operator):** grant the hub's tenantsync user `Datastore.Modify` on `/datastore/felhom-offsite` (it already holds the create/delete grants the provision path uses), or give the script a token-only re-key op that needs no Modify. Evidence: `audits/evidence-drill-0243-2026-09-16/phase1-pbsdr.txt`. | **WAITING-ON-OPERATOR — rank P1-HIGH; owner: operator (ep0 grant) · CC (verify after)** |
+| **R-535** | **[P2-MEDIUM] The box's console still says „a doboz készen áll, és a párosításra vár" long after the box is bound, claimed and running apps — and it promises that the screen refreshes itself.** MEASURED 2026-09-16 on the drill box (fresh install, ISO 1.27.1, controller 0.243.0): bind succeeded 10:01:14Z, claim 10:06:18Z, four apps deploying by 10:22Z — and at 10:23Z the console still showed the pairing banner with the code `37S-NFE` and the line „Ez a képernyő magától frissül — nincs teendő a doboznál" (`audits/evidence-drill-0243-2026-09-16/screens/33-console-after-claim.png`). A volunteer watching the monitor has no way to tell the box is finished; worse, the screen says it updates itself, so waiting longer does not help. **Fix shape:** the first-boot banner unit re-renders on claim/bind state (the controller already knows: it reports `controller_started` and the hub holds `claimed`), showing „A doboz össze van kötve — a vezérlőpult a https://felhom.<domain> címen érhető el"; or at minimum stop printing the pairing code once the appliance is claimed. | **READY — rank P2-MEDIUM; owner: CC (ISO payload `felhom-bootstrap.sh` — ships with the next ISO)** |
 | **R-525** | **[P3-LOW] FileBrowser has its own login; putting it behind the dashboard session (traefik forwardAuth or Quantum proxy auth) is a new mechanism nobody has measured.** Filed 2026-09-15 by the P1-fixes task (B.5). R-513 closed the default-password hole with a generated password; a household still has two logins. **What it needs:** a spike on a scratch guest — forwardAuth to the controller session, and what FileBrowser Quantum does with a trusted header. | **READY — rank P3-LOW; owner: CC (spike)** |
 | **R-526** | **[P3-LOW] A host delete cannot release only the customer's ep0 PBS token: the endpoint's one removal op destroys every backup group too.** MEASURED 2026-09-15 from source: `tenantsync.Deprovision` „DESTROYS the customer's PBS namespace, all its backup groups, and its token". The task asked for „PBS token elengedése" on host delete; building it needs a new token-only op in the ep0 tenantsync script — a new operation on a protected box. Not built. R-511's adopt path makes the kept token usable instead. | **WAITING-ON-OPERATOR — rank P3-LOW; owner: operator (new ep0 op yes/no), CC (build)** |
 | **R-527** | **[P3-LOW] The catalog flag `locked_after_deploy` is read by no controller code — every setting is read-only after install whatever the catalog says.** FOUND 2026-09-15: `stacks/metadata.go` parses it; `grep -rn LockedAfterDeploy` finds no reader; `deploy.html` renders „Az alábbi beállítások csak olvashatók" for every field. Recorded as the design in `02-controller-module-map.md`; the flag is a seam never wired. **Fix shape:** remove the flag from the catalog, or wire an editable-after-install allow-list (a bigger change). | **READY — rank P3-LOW; owner: CC** |