second night: scratch guest 9202 built (R-481 CLOSED, persists); controller v0.242.0 delivered (R-487 R-491 R-490 R-476 R-456 CLOSED, R-489 re-scoped); R-492 filed; rotation restarted from bentopdf; morning note

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/01-topology-and-trust.md

@@ -64,6 +64,14 @@ customer box.
   one host (a company environment) is **not precluded** — the agent manages a *set* of
   guests. The only multi-tenant-specific work deferred to "if it becomes real" is resource
   fairness (per-guest disk/RAM/CPU quotas).
+- **A scratch guest is a second guest of the SAME customer, unenrolled** (operator ruling
+  2026-09-13, R-481; built as LXC 9202 on demo-hp, persists). The hub ties one host to one
+  customer, so a second enrolled customer on a box is not a thing the product does. The scratch
+  guest runs with the hub, the tunnel, the agent link, off-site and self-update all off, and its
+  controller image is set by hand — the one place that is allowed. Two of its properties were
+  *decided by CC unattended — operator may reverse*: **it never binds the customer's real data
+  drive** (a throwaway must not be able to reach real data) and **it never starts cloudflared**
+  (a second connector would serve the public domain from a scratch box).
 
 ---
 

documentation/architecture/07-backup-architecture.md

@@ -277,7 +277,7 @@ what the unit holds** — for an app whose data is a bind mount that is the defi
 (R-479). **Removal and the tiers (controller v0.240.0):** removing an app with its backups KEPT keeps
 the unit, the Tier-2 mirror AND the Tier-2 record, so „Teljes visszaállítás" still works afterwards
 (R-486); „Mentési adatok törlése" deletes the unit, every mirror and the app's backup preferences, and
-never touches off-site snapshots (R-474). A removed app is listed on neither backup page (R-487, open). **For a bind-data app the update's tier order is second drive → off-site → own unit (R-479, v0.241.0), because the unit does not hold the files.**
+never touches off-site snapshots (R-474). A removed app whose unit was kept is listed on both local backup pages with its restore since controller v0.242.0 (R-487): **the local lists are keyed on the drives, not on what is deployed** — the rule R-237 set for the off-site list — and the restore opens the unit where it sits, a data drive included. **For a bind-data app the update's tier order is second drive → off-site → own unit (R-479, v0.241.0), because the unit does not hold the files.**
 
 ### 6.1 The four tiers, as configured on the live fleet