second night: scratch guest 9202 built (R-481 CLOSED, persists); controller v0.242.0 delivered (R-487 R-491 R-490 R-476 R-456 CLOSED, R-489 re-scoped); R-492 filed; rotation restarted from bentopdf; morning note

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/operations/nodes.md

@@ -185,6 +185,25 @@ to demo-hp's below (swap the host_id). So a lost N100 key is recoverable the sam
 
 Details, and the two hard rules that apply to any host node, in `operations/tailscale.md`.
 
+### demo-hp scratch guest — LXC 9202 `demo-hp-scratch` (R-481, built 2026-09-13)
+
+- **Disposition:** the nightly rotation's throwaway host. Under the **demo-hp customer** (same domain,
+  same dashboard password), **hub reporting OFF, Cloudflare tunnel OFF, agent local API OFF, off-site
+  OFF, self-update OFF** (the image is set by hand in `/etc/felhom-controller-image`). **Persists across
+  nights on purpose.** Apps on it are throwaways; nothing on it is a customer promise. Not in the felhom
+  pool, so the hub never sees it. Tags `scratch,r481`; the same text sits in the guest at
+  `/etc/felhom-scratch-disposition`, in the host's `pct` description and in its bootstrap file.
+- **Reach:** `https://192.168.0.114` with the demo-hp Host names (`felhom.enkisfelhom.hu`,
+  `<sub>.enkisfelhom.hu`) — LAN only. Helper: the scratch twin of `ctl.sh`.
+- **Shape:** 7 cores, 25 898 MB cap, rootfs 32 G + data 70 G, both on the `nvme-scratch` dir storage
+  at `/mnt/hdd_1` (the runbook's NVMe path; a `dir` storage was re-added there). Unprivileged.
+  "Second drive" for Tier 2: host `/mnt/hdd_1/scratch-drives/scratch_hdd` mounted at
+  `/mnt/felhom-drives/scratch_hdd` (mp8), registered as the default storage path.
+- **Rebuild from nothing:** restore the golden (`local:backup/felhom-golden-<ver>.tar.zst`) with
+  `pct restore … --storage nvme-scratch`, add mp0/mp8/mp9 as above, fix ownership from the host with
+  the unprivileged mapping (100000), seed `controller.yaml` (hub/tunnel/agent/off-site off) and a
+  claimed `settings.json`, then start `felhom-controller-bootstrap.service`.
+
 ## What is NOT enrolled here (deliberately)
 
 - **No PBS datastore, no offsite target** on demo-hp; the DR tier is the N100's.