night shift 2026-09-23: the record, the register, the morning note

DRILL-night-2026-09-23.md: Parts A-E. 09 §3 decisions 21 (operator word),
22 and 23 (CC unattended, operator may reverse); §6.4 parts 4 and 6
(catalog half) shipped; §6.1a residuals R-658/R-659. Register 330 -> 336:
R-651..R-660 opened (R-658 and R-659 P1), R-650/R-640/R-499/R-626 closed.
Capability map, nightly rotation (opengist), STATUS (one question: the
floor), CONTEXT, REPORT. The floor stays 0.266.0.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/CLOSED-ITEMS.md

@@ -358,4 +358,7 @@ Compressed here to title, shipping version, evidence, and the sentences that sta
 | **R-647** | **Three leftovers of the update mail (P3).** v0.265.0: a held update's error is the key `update.error.held`, rendered per reader on both pages and the API; `copy_holds` travels as its key; the two log wordings fixed. | **CLOSED 2026-09-23 — PROVEN-LIVE for (1) (`43-*`, `44-*`); (2)(3) by red-proofed tests** | as above |
 | **R-648** | **The drill's „Mentés most" was whole-box (P3).** No per-app backup endpoint exists; the harness (`audits/cleanup-2026-09-23/walk.py` `backup_now`) now presses nothing and the guarded update's own `backing-up` phase backs up the throwaway app alone. | **CLOSED 2026-09-23 — PROVEN-LIVE (`43-*`: phase `backing-up` for vikunja only)** | as above |
 | **R-649** | **A failed install could leave containers under „not deployed" (P2).** Operator ruling 2026-09-23 (option a): the controller cleans up. Closed in **v0.266.0** (`964ae75`): `runComposeDeploy`'s failure branch runs `compose down` (volumes kept) before the record reads not-deployed. | **CLOSED 2026-09-23 — PROVEN-LIVE (`audits/r649-2026-09-23/`: outline with a never-healthy redis — 0 containers left, 3 volumes kept)** | `git show HEAD~1:documentation/backlog/OPEN-ITEMS.md` |
-
+| **R-650** | **A controller unit test could act on DooPlex's production Docker (P3 → raised to P2 by the night brief).** Closed in **v0.267.0** (`80e6ad8c4772`): `internal/dockerexec` — every docker exec goes through it; under `go test` a real docker is refused with an error naming the command (opt-in `FELHOM_TEST_REAL_DOCKER=1`; a stub under the temp dir allowed). The sweep found 8 `api` tests and the `web`/`stacks`/`backup`/`appexport`/`system` fixtures reaching the real daemon (one `docker-compose down`); `api`/`stacks`/`web` now run under a silent stub. `TestR650_NoBareDockerExec` pins the invariant. | **CLOSED 2026-09-23 — red-proofed twice (guard off → the decoy runs; a bare call → the sweep names it)** | `audits/night-2026-09-23/A1-*` |
+| **R-640** | **A truncated PostgreSQL copy loaded with rc 0 into an empty database (P2, narrowed to the restore paths).** Closed in **v0.267.0**: `appbackup.CheckDumpComplete` (the engine's end marker); the unit restore and the off-site restore refuse before the first mutation, every replay checks again before any load. **Rule:** a dump is judged by its END — the header and a `CREATE TABLE` say nothing about whether it finished. | **CLOSED 2026-09-23 — three red-proofs + PROVEN-LIVE on 9202 (the household's restore button refused a half-length docmost copy; containers untouched; the whole copy then restored)** | `audits/night-2026-09-23/A2-*`, `E1-r640-live.*` |
+| **R-499** | **Every driveless app was told its data was „already in the full system backup (PBS)" (P2).** Closed in **v0.267.0**: the Tier-2 page's sentence has four branches from the box's own whole-system backup target (own drive / same disk / drive gone / cannot ask); „(PBS)" and „nincs külön teendő" only where true. | **CLOSED 2026-09-23 — two red-proofs; live on 9202 (the `unknown` branch, hu + en, matching `/api/storage/backup-target`)** | `audits/night-2026-09-23/A4-*`, `A7-*` |
+| **R-626** | **A removed app came back (P2).** Measured on v0.266.0, NOT reproduced: navidrome removed through the product, 390 s of `docker events` (the remove's destroy seen, no create), a controller restart at +150 s, a guest reboot after → no container, no volume. The two known creators (the restore/remove race R-633, the backup/deploy race R-634) are fixed. **Rule kept from the row:** a check that runs once, immediately, cannot see a thing created just after it — watch a window. Leftover found and filed: R-651. | **CLOSED 2026-09-23 — by measurement (a positive observable: the destroy events)** | `audits/night-2026-09-23/A3-*` |