BIGNIGHT audit: teardown section (layer 1 done, host layer pending)

documentation/audits/BIGNIGHT-household-month-2026-09-14.md

@@ -86,3 +86,16 @@ pages: DB copies and „Távoli rendszermentés nincs beállítva" honest; the w
 (R-517); the „a few seconds" promise (R-518). **Off-site restore onto 9202: not walked — no off-site copy exists on this
 record.** A local restore of BookStack after a deleted page: 24 s, page back, attachments sha equal. **The alarm
 truth table** is `evidence-bignight-2026-09-14/alarm-truth-table.md`.
+
+## Phase 7 — teardown, three layers
+
+- **Machine (VM 333):** destroyed with both disks at 22:25:58Z; ISO 1.27.1 and harness files removed from demo-hp; no
+  firewall table left. `pvesm status`: `nvme-scratch` back to 10 140 556 KiB (10 134 820 before the drill), `local`
+  23 071 188 KiB (23 041 736 before), `local-lvm` 44.17 % unchanged all night. Evidence `teardown-before.txt`,
+  `teardown-layer1-machine.txt`. `pct fstrim` not applied: only deleted qcow2 files on a dir storage were used.
+- **Host (hub record + ep0 peer):** see `teardown-layer3-hub.txt` — the host record `tester-1-a61396` is deleted once
+  the hub marks it stale, and its WireGuard peer on ep0 is checked gone read-only.
+- **Hub customer:** **„Tester 1" is KEPT** (the volunteer's record). Its off-site data on ep0 — namespace `tester-1`,
+  one snapshot directory from the doorstep walk — is **kept, stated**, for the operator to rule (R-511 context).
+- **Untouched, and checked:** demo-hp 9201 and 9202 (running throughout; only read-only loopback probes, R-513);
+  `drill-r50` (does not exist, R-461); DooPlex (read-only plus git pushes); Peti's box (not contacted); ep0 (read only).