BIGNIGHT morning note (STATUS), topic report, capability-map annotations; teardown layer 1 done, layer 3 pending

documentation/audits/evidence-bignight-2026-09-14/journal.md

@@ -678,3 +678,18 @@ attachments sha equal.** PASS. (Harness: the poll loop missed the status's `last
 taken separately at 22:24:57Z.)
 
 Phase 6 evidence pulled off the box 22:26Z (`box-logs-phase6/`), before any teardown.
+
+## Phase 7 — teardown, three layers
+
+**Layer 1 — the machine** (`teardown-before.txt`, `teardown-layer1-machine.txt`), 22:25:58Z: `qm stop 333`, `qm destroy
+333 --purge 1 --destroy-unreferenced-disks 1` (system and data qcow2 on `nvme-scratch` removed; `/mnt/hdd_1/images/`
+now holds only `9202`); ISO 1.27.1 removed from `local:iso`; `/root/bn` harness files removed; nft: only `inet
+felhom_oob` (the drill's bridge table was already deleted at the end of F8). `pvesm status` before → after:
+`nvme-scratch` 59 436 396 → **10 140 556 KiB** (before the drill 10 134 820); `local` 24 728 328 → **23 071 188 KiB**
+(before the drill 23 041 736); `local-lvm` 44.17 % unchanged all night. `qm list` empty; **9201 and 9202 running**.
+`pct fstrim`: not applied — the drill used only qcow2 files on a dir storage, now deleted; 9201 and 9202 were not
+touched and are not trimmed.
+
+**ep0 read-only before the host delete** (`teardown-ep0-before-host-delete.txt`, 22:26:02Z): WireGuard peer
+`10.77.0.5/32` present; namespaces `demo-felhom demo-hp tester-1`; `tester-1/ct/9201` with 1 snapshot directory (the
+doorstep walk's data). Nothing was written to ep0 tonight.