diff --git a/STATUS.md b/STATUS.md
index de9509ff..7c8b4b81 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -1,10 +1,11 @@
 # STATUS — what works, what's broken, what's next
 
-**Ready for the first real tester (Tester-2): yes. Tester 2 is installed and running (since 2026-10-04 18:06).**
+**Ready for the first real tester (Tester-2): yes. Tester 2 is installed, but offline since 2026-10-04 20:06 local.**
 
-**Updated 2026-10-04 (night): installed boxes can now get new root files by a signed job; test approvals end with the
-test; the controller repairs itself after a Docker socket restart. Both demo boxes run host agent 0.143.0 and controller
-0.293.0. Hub 0.133.0. Installer 1.31.0. New installs get golden 0.293.0 with agent 0.143.0.**
+**Updated 2026-10-05 (morning, after the OS-update night): every box of ours healthy; the ruled undo proven (48 s);
+decision 78 proven on a fresh Tester 1 box; two P2 defects found (a new box's first app install can fail; the off-site
+clean-up refuses normal retention and mails an error weekly). One test (a power cut mid-update) not run — needs your
+permission. Morning note: `documentation/audits/night-2026-10-04/MORNING-NOTE.md`.**
 
 ## Today (2026-10-04, night): root files for installed boxes, test approvals, Docker self-repair
 
diff --git a/documentation/audits/night-2026-10-04/ACCIDENTS.md b/documentation/audits/night-2026-10-04/ACCIDENTS.md
new file mode 100644
index 00000000..5410dd90
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/ACCIDENTS.md
@@ -0,0 +1,63 @@
+# The accidents — five lines each (household saw · box did by itself · time to steady · alarm fired, true? · alarm owed, missing?)
+
+All times UTC. Evidence beside this file in `accidents/`.
+
+## A2 — Docker's socket re-created during a whole-guest backup (demo-felhom, 20:16)
+
+"Mentés most" (`POST /api/guest-backup/trigger`) at 20:16:12; the app stop began 20:16:16; `systemctl restart docker.socket`
+in the guest at 20:16:23 (socket inode 151 → 646).
+- **Household saw:** opengist (the one app stopped for the backup) down 20:16:16 → 20:17:50 (94 s); the dashboard briefly
+  unable to show app states; the timeline "Controller elindult" once. No mail.
+- **Box did by itself:** the `felhom-backup` copy finished honestly (`backup: completed`, 20:16:43 — vzdump does not use
+  the socket). The unquiesce could not restart opengist (`exit code 1`: the controller was blind). The controller's
+  socket watch exited it at 20:17:33 after 60 s of refusals (R-860), Docker restarted it on the new socket, boot
+  reconciliation restarted opengist at 20:17:50, and the controller restarted traefik onto the new socket at 20:18:05.
+  The `felhom-pbs` tier answered BUSY (the agent's heavy-op gate was held) and was deferred 15 min, as designed. Then the
+  `night` OS leg ran (20:18–20:18:56: guest, host, Docker all "nothing").
+- **Time to steady:** 102 s (20:16:23 → 20:18:05).
+- **Alarms fired:** none. True: nothing stayed broken.
+- **Alarms owed and missing:** none — the box healed within two minutes. (The failed restart at unquiesce left no event;
+  acceptable because boot reconciliation repaired it 64 s later.)
+
+## A3 — the hub out of reach (Tester 1 box, 20:26:09 → 20:56:10, 30 min)
+
+Blackhole route to the hub's address on the host and in the guest.
+- **Household saw:** nothing (the dashboard and apps go through the tunnel, not the hub).
+- **Box did by itself:** two host reports failed (22:40:49, 22:55:49 local — `hub: report failed; keeping current
+  interval`); the next one after the unblock arrived on time (21:10:49 UTC); the controller's report went through at
+  20:57:04. Missed host reports are snapshots and are not replayed — the next one replaces them. **The debug OS pass could
+  not run at all** (it fetches its plan from the hub — R-866); the daemon's own leg would use its saved plan, but the
+  20-hour gap held it back (this box's leg ran at 19:49).
+- **Time to steady:** at the first report after the unblock, 14 min 39 s (the report interval).
+- **Alarms fired:** none. True: 30 min is under the 45 min stale threshold.
+- **Alarms owed and missing:** none. The 7-day OS alarms stayed quiet.
+
+## A4 — the system disk nearly full (Tester 1 box guest, 20:24)
+
+The guest's `/` filled to 400 MB free; a one-package-set plan (bind9 ×3, Debian-Security) handed to the wrapper as the
+agent writes it.
+- **Household saw:** nothing (the disk was freed 3 minutes later; the apps live on the data volume).
+- **Box did by itself:** the wrapper refused BEFORE downloading: `REFUSED: R8 free space 419430400 B is below max(500 MB,
+  3 x download 0 B)`, exit 2, nothing installed (bind9 stayed at the old version). **But the download was measured as
+  0 B** — `apt-get -s --print-uris` prints no URIs (R-865), so only the 500 MB floor ever applies.
+- **Time to steady:** immediate (a refusal changes nothing).
+- **Alarms fired:** none (a refused debug plan reports nothing to the hub). True.
+- **Alarms owed and missing:** none for a debug run; a NIGHT leg refused by R8 reports `refused` and the stale alarm
+  fires after 7 days — not exercised.
+
+## A5 — the agent killed in the middle of a pass (demo-hp, 02:57 UTC)
+
+Six guest packages rolled back (simulated first: 0 removals); a debug pass started; when `apt-get` ran, the pass and the
+agent daemon were `kill -9`-ed (02:57:18).
+- **Household saw:** nothing.
+- **Box did by itself:** the root wrapper (its own process under sudo) finished all six packages; `dpkg --audit` clean;
+  systemd restarted the daemon in < 20 s (`NRestarts` 1; the self-update rollback did nothing — no pending update).
+- **Time to steady:** < 20 s.
+- **Alarms fired:** none. True.
+- **Alarms owed and missing:** none — but the killed pass's report never reached the hub (R-868); no duplicate report.
+
+## A1 — a power cut in the middle of an OS update (demo-hp) — NOT RUN
+
+The host crash (`echo c > /proc/sysrq-trigger` while dpkg ran) was refused by this session's permission check
+("interfere with workloads"). Not attempted another way. The six rolled-back packages were brought forward by a normal
+debug pass (applied, healthy); dpkg clean; demo-hp's guest package list equals the 21:47 baseline. Operator decision 2.
diff --git a/documentation/audits/night-2026-10-04/MORNING-NOTE.md b/documentation/audits/night-2026-10-04/MORNING-NOTE.md
new file mode 100644
index 00000000..51acb00b
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/MORNING-NOTE.md
@@ -0,0 +1,105 @@
+# Morning note — the OS-update night, 2026-10-04/05
+
+## 1. Is any box off or broken right now?
+
+**No box of ours is off or broken.** At 05:20 local: demo-hp 21 of 21 apps healthy, demo-felhom 5 of 5, scratch box 9202
+6 of 6, the new Tester 1 box 9 of 9; every crash guard armed. Nothing for you to do on them.
+
+**Tester 2 is still offline** — since 20:06 local yesterday, before anything of tonight. I read it every 15–30 minutes; it
+never came back, so I sent it nothing. Worth asking the tester whether the box is switched off.
+
+**One test I could not do: A1 (a power cut in the middle of an update).** The crash command for demo-hp was refused by
+this session's permission check. I did not look for another way. demo-hp is clean (the rolled-back packages were brought
+forward again; its package list equals the evening's). Decision 2 below.
+
+## Decisions I took myself (you may reverse each)
+
+- **The undo test and accident A2 ran on demo-felhom in the evening, not after its night.** Its whole-guest backup runs
+  at ~07:45 local, after my 06:30 stop. A2's "backup now" counted as its night run (the update step ran right after it:
+  nothing to install), so the real approval of the fixes is not delayed.
+- **A5 (the agent killed mid-update) ran on demo-hp, not demo-felhom**, inside A1's allowed rollback.
+- **The new Tester 1 box stays running** (it is the returning-household box; it costs demo-hp 8 GB of memory).
+
+## Slips of mine you should know
+
+- **On demo-felhom I rolled back 8 packages by hand for A5, which tonight's rules did not allow — and apt removed 18
+  others with them, including Python and the guest's network tool.** I put every one back within a minute, before any
+  restart; the package list equals the evening's, line by line. From then on I simulated every downgrade first.
+- **My first database query printed Tester 1's Cloudflare tokens into my own session output** (not into any file).
+  Tester 1 is the test customer. Decision 1 below.
+- I did not pull the "USB stick" at the end of the Tester 1 install (the guide says to), so the box started the
+  installer again; I pulled it and it booted normally.
+
+## 2. The prediction table, with the real times (local time)
+
+| Box | Step | Predicted | Real | |
+|---|---|---|---|---|
+| all 3 | database dump | 02:30 | 02:30 (demo-hp 1 m 30 s, Tester 1 40 s, demo-felhom 1 s) | ✓ |
+| all 3 | second copy | 03:30 | 03:30 (demo-felhom: no second drive, said so) | ✓ |
+| all 3 | off-site | 04:15 | demo-hp 04:15–04:17 OK; demo-felhom 04:15 OK **+ an error mail (below)**; **Tester 1 skipped** | ✗ Tester 1 |
+| demo-hp | whole-guest backup | ~04:35–04:40 | 04:35:24–04:40:16 | ✓ |
+| demo-hp | update step (guest, host, Docker) | right after, nothing to install | 04:41:46–04:42:46, nothing in all three | ✓ |
+| demo-hp | controller self-update 04:30 | no action | no action; no overlap with the update step | ✓ |
+| demo-felhom | whole-guest backup + update step | ~07:50 | **moved: 22:16 / 22:18 by A2's "backup now"**, nothing to install | changed (my test) |
+| Tester 1 | first backup + update step | minutes after install | 21:47 backup, 21:49 update step: **0 installed** (nothing approved) | ✓ |
+| — | the 20-hour gap | skips nothing | nothing was skipped by it | ✓ |
+
+**Surprise:** Tester 1's off-site copy waited for the household's recovery code, which I had not made (a first-hour step
+I skipped). I made it at 05:07 and pressed "run now" — see 3.
+
+## 3. Decision 78 on the fresh Tester 1 box — PROVEN (by a "run now" at 05:08, not the night run)
+
+The box found the old off-site copy of earlier Tester 1 boxes (made with a key it does not have), moved it aside
+(`…felhom-repo.orphaned-20261005`, nothing deleted), started a fresh copy and saved all 3 apps in 54 s. The household's
+timeline got two lines ("orphaned", then "reset — old history kept"); you got one mail. The old copy is untouched.
+
+## 4. The ruled undo — PROVEN on demo-felhom: 48 seconds down
+
+Three packages rolled back, a whole-guest backup, an update pass forward, then the backup restored over the live guest:
+down 22:12:54 → every app healthy 22:13:42 (48 s); the three packages back at the "before" versions; no mail; the hub kept
+the box. A pass then brought them forward. There was no written way to do this — the guide is written now.
+
+## 5. The accidents
+
+- **A1 power cut mid-update (demo-hp): NOT RUN** — the crash was refused by the permission check (decision 2).
+- **A2 Docker socket re-created during a backup (demo-felhom):** the household saw one app down 94 s, nothing else.
+  The box healed itself: the backup finished honestly, the controller restarted itself after 60 s, restarted the app and
+  the web router. Steady in 102 s. No alarm, none owed.
+- **A3 the hub out of reach for 30 min (Tester 1):** the household saw nothing. Two reports failed, the next arrived on
+  time after the block. No alarm (right: under the 45-min limit). The debug update pass cannot run without the hub
+  (a gap, filed).
+- **A4 the disk nearly full (Tester 1):** refused at once with a clear reason, nothing installed. But the free-space rule
+  measures every download as 0 bytes, so only its 500 MB floor ever works (filed).
+- **A5 the agent killed mid-update (demo-hp):** the install finished anyway (the root helper runs on its own), the agent
+  restarted in under 20 s, packages clean. The hub never got that pass's report (filed). No duplicate.
+
+## 6. Every mail of the night
+
+| Mail | To | True? |
+|---|---|---|
+| Bind link, setup code (Tester 1 install) | household | true |
+| demo-felhom "off-site clean-up refused" (error, 04:15) | you | **true fact, wrong alarm** — a defect: the clean-up's guard refuses normal 7-day retention, so every weekly clean-up will refuse and mail you (filed P2) |
+| Tester 1 "off-site repository orphaned" (05:08) | you | true, expected for a returning household |
+
+No household mail besides the two install mails.
+
+## 7. Rows
+
+Register before **334**, after **341**. Opened, each before I moved on:
+- **P2** — a new box's first app install can fail: the box's one-time image clean-up deletes the image the install is
+  downloading (BookStack on Tester 1; the second press worked).
+- **P2** — the off-site clean-up guard refuses normal 7-day retention and mails an error every week; nothing is pruned.
+- **P3** — the update free-space rule always measures the download as 0 bytes.
+- **P4** ×4 — a failed install logs the start of the error and cuts the error itself; the debug update pass needs the
+  hub; a killed pass's report is lost; the move-aside log line prints an empty destination.
+
+## 8. Decisions for you
+
+1. **Rotate Tester 1's Cloudflare tokens?** They appeared in my session output (not in a file).
+   - **A (my pick): rotate them** — Tester 1 is our test customer; it costs a few minutes in Cloudflare.
+   - **B: leave them.** If you do nothing: nothing changes; the risk is that session log.
+2. **A1, the power cut mid-update — how to run it?**
+   - **A (my pick): allow it once** for demo-hp in this kind of night (a permission rule for the crash command on demo-hp
+     only), and I run it next night.
+   - **B: you press the crash yourself** next time while I watch.
+   If you do nothing: A1 stays untested; the crash guard itself was proven on 2026-10-04 by day.
diff --git a/documentation/audits/night-2026-10-04/accidents/a1-not-run-forward-pass.txt b/documentation/audits/night-2026-10-04/accidents/a1-not-run-forward-pass.txt
new file mode 100644
index 00000000..bad01c6d
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a1-not-run-forward-pass.txt
@@ -0,0 +1,15 @@
+02:58:42
+    "healthy": true,
+    "outcome": "applied",
+    "healthy": true,
+    "outcome": "nothing",
+    "healthy": true,
+    "outcome": "nothing",
+audit_rc=0
+bind9-dnsutils	1:9.20.29-1~deb13u1
+bind9-host	1:9.20.29-1~deb13u1
+bind9-libs:amd64	1:9.20.29-1~deb13u1
+libpcre2-8-0:amd64	10.46-1~deb13u3
+libssh2-1t64:amd64	1.11.1-1+deb13u2
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u3
+demo-hp guest IDENTICAL to the 21:47 baseline
diff --git a/documentation/audits/night-2026-10-04/accidents/a1-rollback-simulation.txt b/documentation/audits/night-2026-10-04/accidents/a1-rollback-simulation.txt
new file mode 100644
index 00000000..054896cb
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a1-rollback-simulation.txt
@@ -0,0 +1,7 @@
+0 upgraded, 0 newly installed, 6 downgraded, 0 to remove and 0 not upgraded.
+Inst libpcre2-8-0 [10.46-1~deb13u3] (10.46-1~deb13u2 Debian:13.7/stable [amd64])
+Inst libxml2 [2.12.7+dfsg+really2.9.14-2.1+deb13u3] (2.12.7+dfsg+really2.9.14-2.1+deb13u1 Debian-Security:13/stable-security [amd64])
+Inst bind9-host [1:9.20.29-1~deb13u1] (1:9.20.26-1~deb13u1 Debian:13.7/stable [amd64]) []
+Inst bind9-dnsutils [1:9.20.29-1~deb13u1] (1:9.20.26-1~deb13u1 Debian:13.7/stable [amd64]) []
+Inst bind9-libs [1:9.20.29-1~deb13u1] (1:9.20.26-1~deb13u1 Debian:13.7/stable [amd64])
+Inst libssh2-1t64 [1.11.1-1+deb13u2] (1.11.1-1+deb13u1 Debian-Security:13/stable-security [amd64])
diff --git a/documentation/audits/night-2026-10-04/accidents/a1-rollback.txt b/documentation/audits/night-2026-10-04/accidents/a1-rollback.txt
new file mode 100644
index 00000000..f912af20
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a1-rollback.txt
@@ -0,0 +1,6 @@
+0 upgraded, 0 newly installed, 6 downgraded, 0 to remove and 0 not upgraded.
+0 upgraded, 0 newly installed, 6 downgraded, 0 to remove and 0 not upgraded.
+Oct 05 04:57:23 demo-hp systemd[1]: Started felhom-agent.service - Felhom host agent (Proxmox host tier; hub control loop + PBS verify + storage watchdog).
+Oct 05 04:57:23 demo-hp felhom-agent[2031788]: time=2026-10-05T04:57:23.746+02:00 level=INFO msg="felhom-agent daemon starting" version=0.143.0 host_id=demo-hp-bb76ea hub_url=https://hub.felhom.eu int
+Oct 05 04:57:25 demo-hp felhom-agent[2031788]: time=2026-10-05T04:57:25.550+02:00 level=INFO msg="controller-supervisor: started" interval=30s confirm_sweeps=2 crashloop_max=3 crashloop_window=15m0s s
+21
diff --git a/documentation/audits/night-2026-10-04/accidents/a3-hub-blocked.txt b/documentation/audits/night-2026-10-04/accidents/a3-hub-blocked.txt
index bda442ca..d663a8f0 100644
--- a/documentation/audits/night-2026-10-04/accidents/a3-hub-blocked.txt
+++ b/documentation/audits/night-2026-10-04/accidents/a3-hub-blocked.txt
@@ -4,3 +4,14 @@ guest: 000blocked
 PASS 20:26:10
 selftest=os-update: desired state: hub: transport error: Get "https://hub.felhom.eu/api/v1/hosts/tester-1-d70be4/desired-state": dial tcp 192.168.0.192:443: connect: invalid argument
 PASS-END 20:26:11
+ tester-1-d70be4 Tester 1 0.143.0 9.2.2 7.0.2-6-pve ONLINE 1/1 
+ Last Report 30 min ago 
+UNBLOCK 20:56:10
+Oct 04 22:40:49 felhom felhom-agent[2492]: time=2026-10-04T22:40:49.055+02:00 level=WARN msg="hub: report failed; keeping current interval" err="hub: transport error: Post \"https://hub.felhom.eu/api/
+Oct 04 22:55:49 felhom felhom-agent[2492]: time=2026-10-04T22:55:49.082+02:00 level=WARN msg="hub: report failed; keeping current interval" err="hub: transport error: Post \"https://hub.felhom.eu/api/
+== 21:12:07
+ Last Report 1 min ago 
+2026/10/04 20:57:04 [INFO] [scheduler] Running job: hub-report
+2026/10/04 20:57:05 [INFO] [scheduler] Job hub-report completed (took 759ms)
+2026/10/04 21:12:04 [INFO] [scheduler] Running job: hub-report
+2026/10/04 21:12:05 [INFO] [scheduler] Job hub-report completed (took 841ms)
diff --git a/documentation/audits/night-2026-10-04/accidents/a5-kill.txt b/documentation/audits/night-2026-10-04/accidents/a5-kill.txt
new file mode 100644
index 00000000..5042209f
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a5-kill.txt
@@ -0,0 +1,20 @@
+daemon pid before 447632
+pass pid 2030197 start 02:56:59.583
+KILLED at 02:57:18.480: the pass + the daemon (apt-get was running)
+/root/a5.sh: line 11: 2030197 Killed                  nohup sudo -u felhom-agent /usr/local/bin/felhom-agent --config /etc/felhom-agent/agent.json --selftest=os-update -vmid 9201 > /root/a5-pass1.log 2>&1
+dpkg running after kill: 0
+   1015   41981 /usr/sbin/dnsmasq -x /run/dnsmasq/dnsmasq.pid -u dnsmasq -7 /etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new --local-service --trust-anchor=.,20326,8,2,E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D --trust-anchor=.,38696,8,2,683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16
+2030216      20 sudo -n /usr/local/sbin/felhom-os-apply --plan /var/lib/felhom-agent/os/plan-20261005T025659Z-guest-apply.json
+2030219      20 /usr/bin/python3 /usr/local/sbin/felhom-os-apply --plan /var/lib/felhom-agent/os/plan-20261005T025659Z-guest-apply.json
+2031523       2 lxc-attach -n 9201 --keep-env -- env DEBIAN_FRONTEND=noninteractive APT_LISTCHANGES_FRONTEND=none NEEDRESTART_MODE=l LC_ALL=C apt-get -y -q -o Dpkg::Options::=--force-confold -o Dpkg::Options::=--force-confdef install --only-upgrade --no-install-recommends libpcre2-8-0=10.46-1~deb13u3 libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3 bind9-host=1:9.20.29-1~deb13u1 bind9-dnsutils=1:9.20.29-1~deb13u1 bind9-libs=1:9.20.29-1~deb13u1 libssh2-1t64=1.11.1-1+deb13u2
+2031555       1 apt-get -y -q -o Dpkg::Options::=--force-confold -o Dpkg::Options::=--force-confdef install --only-upgrade --no-install-recommends libpcre2-8-0=10.46-1~deb13u3 libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3 bind9-host=1:9.20.29-1~deb13u1 bind9-dnsutils=1:9.20.29-1~deb13u1 bind9-libs=1:9.20.29-1~deb13u1 libssh2-1t64=1.11.1-1+deb13u2
+daemon pid after 2031788 state active restarts 1
+audit rc=0
+bind9-dnsutils	1:9.20.29-1~deb13u1
+bind9-host	1:9.20.29-1~deb13u1
+bind9-libs:amd64	1:9.20.29-1~deb13u1
+libpcre2-8-0:amd64	10.46-1~deb13u3
+libssh2-1t64:amd64	1.11.1-1+deb13u2
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u3
+=== felhom-agent 0.143.0 selftest=os-update vmid=9201 ring=0 enabled=true guest-release=false host-release=false appliance=true ===
+time=2026-10-05T04:56:59.730+02:00 level=INFO msg="osupdate: START" run=20261005T025659Z layer=guest vmid=9201 ring=0 trigger=debug enabled=true release=ring0-20261005T025659Z
diff --git a/documentation/audits/night-2026-10-04/accidents/a5a1-rollback.txt b/documentation/audits/night-2026-10-04/accidents/a5a1-rollback.txt
new file mode 100644
index 00000000..e1086cf1
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a5a1-rollback.txt
@@ -0,0 +1,3 @@
+02:56:41
+0 upgraded, 0 newly installed, 6 downgraded, 0 to remove and 0 not upgraded.
+guard armed True in_window 0
diff --git a/documentation/audits/night-2026-10-04/final-state.txt b/documentation/audits/night-2026-10-04/final-state.txt
new file mode 100644
index 00000000..05598b50
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/final-state.txt
@@ -0,0 +1,6 @@
+03:19:45
+ Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 -- demo-felhom-8363b5 Demo Ügyfél 0.143.0 9.2.2 7.0.2-6-pve ONLINE 1/2 -- demo-hp-bb76ea Demo HP 0.143.0 9.2.2 7.0.14-20-pve ONLINE 1/2 -- tester-1-d70be4 Tester 1 0.143.0 9.2.2 7.0.2-6-pve ONLINE 1/1 
+demo-hp: 0 not-healthy of 21 containers; guard 10
+felhom-pve: 0 not-healthy of 5 containers; guard 10
+9202: 6 containers, controller Up 9 hours (healthy)
+tester1: 9 healthy containers
diff --git a/documentation/audits/night-2026-10-04/night/n1-demo-hp-0030-0140.txt b/documentation/audits/night-2026-10-04/night/n1-demo-hp-0030-0140.txt
new file mode 100644
index 00000000..655136f2
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/night/n1-demo-hp-0030-0140.txt
@@ -0,0 +1,12 @@
+2026/10/05 00:30:00 scheduler.go:346: [INFO] [scheduler] Running job: db-dump
+2026/10/05 00:31:29 scheduler.go:363: [INFO] [scheduler] Job db-dump completed (took 1m29.61s)
+2026/10/05 01:30:00 scheduler.go:346: [INFO] [scheduler] Running job: tier2-backup
+2026/10/05 01:30:00 scheduler.go:346: [INFO] [scheduler] Running job: fill-watch
+2026/10/05 01:30:00 fillwatch.go:267: [INFO] [fillwatch] checked 3 filesystem(s), 0 unreadable/skipped, 0 notification(s); bands: all ok
+2026/10/05 01:30:00 scheduler.go:363: [INFO] [scheduler] Job fill-watch completed (took 0s)
+2026/10/05 01:30:01 tier2.go:425: [INFO] [backup] Tier 2 copied adventurelog → /mnt/felhom-drives/hdd_1/backups/secondary/adventurelog (336.4 MB, 0 leg(s), 2s)
+2026/10/05 01:30:01 tier2.go:425: [INFO] [backup] Tier 2 copied bentopdf → /mnt/felhom-drives/hdd_1/backups/secondary/bentopdf (13.6 KB, 0 leg(s), 0s)
+2026/10/05 01:30:02 tier2.go:425: [INFO] [backup] Tier 2 copied bookstack → /mnt/felhom-drives/hdd_1/backups/secondary/bookstack (159.4 MB, 0 leg(s), 1s)
+2026/10/05 01:30:02 tier2.go:425: [INFO] [backup] Tier 2 copied calibre-web → /mnt/sys_drive/felhom-data/backups/secondary/calibre-web (5.6 MB, 1 leg(s), 0s) [SSD: state-only]
+2026/10/05 01:30:02 tier2.go:425: [INFO] [backup] Tier 2 copied docmost → /mnt/felhom-drives/hdd_1/backups/secondary/docmost (83.5 MB, 0 leg(s), 0s)
+2026/10/05 01:30:03 tier2.go:425: [INFO] [backup] Tier 2 copied kimai → /mnt/felhom-drives/hdd_1/backups/secondary/kimai (173.0 MB, 0 leg(s), 1s)
diff --git a/documentation/audits/night-2026-10-04/night/n1-felhom-pve-0030-0140.txt b/documentation/audits/night-2026-10-04/night/n1-felhom-pve-0030-0140.txt
new file mode 100644
index 00000000..628bc7b5
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/night/n1-felhom-pve-0030-0140.txt
@@ -0,0 +1,9 @@
+2026/10/05 00:30:00 [INFO] [scheduler] Running job: db-dump
+2026/10/05 00:30:00 [INFO] [scheduler] Job db-dump completed (took 998ms)
+2026/10/05 01:30:00 [INFO] [scheduler] Running job: tier2-backup
+2026/10/05 01:30:00 [INFO] [scheduler] Running job: fill-watch
+2026/10/05 01:30:00 [INFO] [fillwatch] checked 2 filesystem(s), 0 unreadable/skipped, 0 notification(s); bands: all ok
+2026/10/05 01:30:00 [INFO] [scheduler] Job fill-watch completed (took 0s)
+2026/10/05 01:30:00 [INFO] [backup] Tier 2 for opengist: no off-drive target — nincs másik fizikai meghajtó — a 2. mentéshez 2. meghajtó szükséges
+2026/10/05 01:30:00 [INFO] [backup] Tier 2 run complete: 1 app(s) processed (incl. volume-only — F6)
+2026/10/05 01:30:00 [INFO] [scheduler] Job tier2-backup completed (took 6ms)
diff --git a/documentation/audits/night-2026-10-04/night/n1-tester1-0030-0140.txt b/documentation/audits/night-2026-10-04/night/n1-tester1-0030-0140.txt
new file mode 100644
index 00000000..869a438c
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/night/n1-tester1-0030-0140.txt
@@ -0,0 +1,9 @@
+2026/10/05 00:30:00 [INFO] [scheduler] Running job: db-dump
+2026/10/05 00:30:39 [INFO] [scheduler] Job db-dump completed (took 39.504s)
+2026/10/05 01:30:00 [INFO] [fillwatch] checked 3 filesystem(s), 0 unreadable/skipped, 0 notification(s); bands: all ok
+2026/10/05 01:30:00 [INFO] [scheduler] Running job: tier2-backup
+2026/10/05 01:30:00 [INFO] [backup] Tier 2 copied bookstack → /mnt/felhom-drives/adatlemez/backups/secondary/bookstack (154.2 MB, 0 leg(s), 1s)
+2026/10/05 01:30:00 [INFO] [backup] Tier 2 copied paperless-ngx → /mnt/sys_drive/felhom-data/backups/secondary/paperless-ngx (69.8 MB, 1 leg(s), 0s) [SSD: state-only]
+2026/10/05 01:30:01 [INFO] [backup] Tier 2 copied privatebin → /mnt/felhom-drives/adatlemez/backups/secondary/privatebin (28.3 KB, 0 leg(s), 0s)
+2026/10/05 01:30:01 [INFO] [backup] Tier 2 run complete: 3 app(s) processed (incl. volume-only — F6)
+2026/10/05 01:30:01 [INFO] [scheduler] Job tier2-backup completed (took 1.303s)
diff --git a/documentation/audits/night-2026-10-04/night/n2-demo-hp-offsite.txt b/documentation/audits/night-2026-10-04/night/n2-demo-hp-offsite.txt
new file mode 100644
index 00000000..18ad1f97
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/night/n2-demo-hp-offsite.txt
@@ -0,0 +1,34 @@
+2026/10/05 02:14:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:14:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:15:00 scheduler.go:346: [INFO] [scheduler] Running job: offbox-backup
+2026/10/05 02:15:00 offbox.go:1001: [INFO] [offbox] backup run started (9 app(s) toggled)
+2026/10/05 02:16:20 offbox.go:1048: [INFO] [offbox] pre-push dump leg completed in 1m20.405s — snapshot pair is coherent
+2026/10/05 02:16:27 offbox.go:1479: [INFO] [offbox] backed up opengist (/mnt/sys_drive/felhom-data/backups/primary/opengist, 0 mandatory path(s))
+2026/10/05 02:16:28 offbox.go:1479: [INFO] [offbox] backed up privatebin (/mnt/sys_drive/felhom-data/backups/primary/privatebin, 0 mandatory path(s))
+2026/10/05 02:16:30 offbox.go:1479: [INFO] [offbox] backed up romm (/mnt/felhom-drives/hdd_1/backups/primary/romm, 0 mandatory path(s))
+2026/10/05 02:16:33 offbox.go:1479: [INFO] [offbox] backed up bookstack (/mnt/sys_drive/felhom-data/backups/primary/bookstack, 0 mandatory path(s))
+2026/10/05 02:16:35 offbox.go:1479: [INFO] [offbox] backed up docmost (/mnt/sys_drive/felhom-data/backups/primary/docmost, 0 mandatory path(s))
+2026/10/05 02:16:38 offbox.go:1479: [INFO] [offbox] backed up kimai (/mnt/sys_drive/felhom-data/backups/primary/kimai, 0 mandatory path(s))
+2026/10/05 02:16:44 offbox.go:1476: [WARN] [offbox] backed up bentopdf (/mnt/sys_drive/felhom-data/backups/primary/bentopdf, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it
+2026/10/05 02:16:46 offbox.go:1479: [INFO] [offbox] backed up calibre-web (/mnt/felhom-drives/hdd_1/backups/primary/calibre-web, 1 mandatory path(s))
+2026/10/05 02:16:48 offbox_window.go:206: [INFO] [offbox] retention skipped (after-run): no clean-up window now (not due (last window 2026-10-04T05:36:14Z)) — nothing deleted (decision 68)
+2026/10/05 02:16:53 offbox.go:1244: [INFO] [offbox] backup OK: 9 app(s) backed up, 136 snapshot(s), 1m48s
+2026/10/05 02:16:53 unattended.go:270: [INFO] [update-leg] started (after-offsite): window 02:30, no step starts at or after 07:30
+2026/10/05 02:16:53 unattended.go:248: [INFO] [update-leg] update leg (after-offsite): done=0 undone=0 held=0 failed=0 skipped=1 in 0s [skipped: romm=held]
+2026/10/05 02:16:53 scheduler.go:363: [INFO] [scheduler] Job offbox-backup completed (took 1m53.096s)
+2026/10/05 02:19:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:19:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:24:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:24:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:29:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:29:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:34:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:34:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:39:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:39:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 1ms)
+2026/10/05 02:44:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:44:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:49:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:49:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:54:59 scheduler.go:346: [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:54:59 scheduler.go:363: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
diff --git a/documentation/audits/night-2026-10-04/night/n2-felhom-pve-offsite.txt b/documentation/audits/night-2026-10-04/night/n2-felhom-pve-offsite.txt
new file mode 100644
index 00000000..37578316
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/night/n2-felhom-pve-offsite.txt
@@ -0,0 +1,27 @@
+2026/10/05 02:12:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:12:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:15:00 [INFO] [scheduler] Running job: offbox-backup
+2026/10/05 02:15:00 [INFO] [offbox] backup run started (1 app(s) toggled)
+2026/10/05 02:15:00 [INFO] [offbox] pre-push dump leg completed in 894ms — snapshot pair is coherent
+2026/10/05 02:15:05 [INFO] [offbox] backed up opengist (/mnt/sys_drive/felhom-data/backups/primary/opengist, 0 mandatory path(s))
+2026/10/05 02:15:10 [ERROR] [offbox] clean-up window 3: the fake-snapshot guard REFUSED — nothing deleted: the policy would remove snapshot 343d57a5 from 2026-09-28T02:15:05Z — younger than 8 days and not superseded the same day, which honest retention never does (R-822)
+2026/10/05 02:15:15 [INFO] [offbox] backup OK: 1 app(s) backed up, 15 snapshot(s), 12s
+2026/10/05 02:15:15 [INFO] [update-leg] started (after-offsite): window 02:30, no step starts at or after 07:30
+2026/10/05 02:15:15 [INFO] [update-leg] update leg (after-offsite): done=0 undone=0 held=0 failed=0 skipped=0 in 0s [skipped: ]
+2026/10/05 02:15:15 [INFO] [scheduler] Job offbox-backup completed (took 15.079s)
+2026/10/05 02:17:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:17:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:22:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:22:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:27:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:27:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:32:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:32:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:37:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:37:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:42:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:42:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:47:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:47:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:52:35 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:52:35 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
diff --git a/documentation/audits/night-2026-10-04/night/n2-tester1-offsite.txt b/documentation/audits/night-2026-10-04/night/n2-tester1-offsite.txt
new file mode 100644
index 00000000..782ed0ba
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/night/n2-tester1-offsite.txt
@@ -0,0 +1,23 @@
+2026/10/05 02:12:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:12:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:15:00 [INFO] [scheduler] Running job: offbox-backup
+2026/10/05 02:15:00 [INFO] [offbox] skipped — pending key escrow (no offsite run until the repo password is escrowed under R)
+2026/10/05 02:15:00 [INFO] [update-leg] started (after-offsite): window 02:30, no step starts at or after 07:30
+2026/10/05 02:15:00 [INFO] [update-leg] update leg (after-offsite): done=0 undone=0 held=0 failed=0 skipped=0 in 0s [skipped: ]
+2026/10/05 02:15:00 [INFO] [scheduler] Job offbox-backup completed (took 107ms)
+2026/10/05 02:17:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:17:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:22:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:22:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:27:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:27:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:32:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:32:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:37:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:37:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:42:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:42:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:47:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:47:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
+2026/10/05 02:52:04 [INFO] [scheduler] Running job: offsite-credential-retry
+2026/10/05 02:52:04 [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
diff --git a/documentation/audits/night-2026-10-04/night/n3-demo-hp-wholeguest-osleg.txt b/documentation/audits/night-2026-10-04/night/n3-demo-hp-wholeguest-osleg.txt
new file mode 100644
index 00000000..ab175901
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/night/n3-demo-hp-wholeguest-osleg.txt
@@ -0,0 +1,32 @@
+Oct 05 04:39:24 demo-hp felhom-agent[447632]: time=2026-10-05T04:39:24.344+02:00 level=INFO msg="janitor: stale-lock sweep deferred — a heavy operation is in flight" busy=backup:local
+Oct 05 04:40:16 demo-hp felhom-agent[447632]: time=2026-10-05T04:40:16.647+02:00 level=INFO msg="backup: completed" vmid=9201 target=local archive=local:backup/vzdump-lxc-9201-2026_10_05-04_35_24.tar.zst size_bytes=4882309520 uncovered_volumes=2
+Oct 05 04:40:16 demo-hp felhom-agent[447632]: time=2026-10-05T04:40:16.647+02:00 level=INFO msg="local-api: backup job complete" vmid=9201 target=local job=backup-9201-1791167723831350602 archive=local:backup/vzdump-lxc-9201-2026_10_05-04_35_24.tar.zst
+Oct 05 04:41:46 demo-hp felhom-agent[447632]: time=2026-10-05T04:41:46.648+02:00 level=INFO msg="osupdate: START" run=20261005T024146Z layer=guest vmid=9201 ring=0 trigger=night enabled=true release=ring0-20261005T024146Z
+Oct 05 04:41:47 demo-hp felhom-os-apply[1985513]: os-apply: START release=ring0-20261005T024146Z layer=guest:9201 lane=fast mode=apply select=pending-fast packages=0
+Oct 05 04:41:57 demo-hp felhom-os-apply[1985958]: os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0
+Oct 05 04:41:57 demo-hp felhom-os-apply[1985959]: os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)
+Oct 05 04:42:04 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:04.983+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: START release=ring0-20261005T024146Z layer=guest:9201 lane=fast mode=apply select=pending-fast packages=0"
+Oct 05 04:42:04 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:04.983+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0"
+Oct 05 04:42:04 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:04.983+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)"
+Oct 05 04:42:04 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:04.983+02:00 level=INFO msg="osupdate: DONE" run=20261005T024146Z layer=guest vmid=9201 ring=0 trigger=night outcome=nothing healthy=true reason="" upgraded=0 pending=0 not_covered=0 restart_n
+Oct 05 04:42:05 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:05.036+02:00 level=INFO msg="osupdate: START" run=20261005T024146Z layer=host vmid=9201 ring=0 trigger=night enabled=true release=ring0-20261005T024146Z
+Oct 05 04:42:06 demo-hp felhom-os-apply[1986777]: os-apply: START release=ring0-20261005T024146Z layer=host lane=fast mode=apply select=pending-fast packages=0
+Oct 05 04:42:14 demo-hp felhom-os-apply[1987237]: os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0
+Oct 05 04:42:14 demo-hp felhom-os-apply[1987238]: os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)
+Oct 05 04:42:22 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:22.500+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: START release=ring0-20261005T024146Z layer=host lane=fast mode=apply select=pending-fast packages=0"
+Oct 05 04:42:22 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:22.500+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0"
+Oct 05 04:42:22 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:22.500+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)"
+Oct 05 04:42:23 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:23.580+02:00 level=INFO msg="osupdate: DONE" run=20261005T024146Z layer=host vmid=9201 ring=0 trigger=night outcome=nothing healthy=true reason="" upgraded=0 pending=78 not_covered=78 restart_
+Oct 05 04:42:25 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:25.734+02:00 level=INFO msg="osupdate: START" run=20261005T024146Z layer=docker vmid=9201 ring=0 trigger=night enabled=true release=ring0-20261005T024146Z
+Oct 05 04:42:27 demo-hp felhom-os-apply[1988603]: os-apply: START release=ring0-20261005T024146Z layer=docker:9201 lane=slow mode=apply select=pending-docker packages=0 authority=ring0
+Oct 05 04:42:37 demo-hp felhom-os-apply[1989188]: os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0
+Oct 05 04:42:37 demo-hp felhom-os-apply[1989189]: os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)
+Oct 05 04:42:46 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:46.151+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: START release=ring0-20261005T024146Z layer=docker:9201 lane=slow mode=apply select=pending-docker packages=0 authority=ring0"
+Oct 05 04:42:46 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:46.151+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: PLAN upgrade=0 already=0 not-installed=0 from-snapshot=0"
+Oct 05 04:42:46 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:46.151+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)"
+Oct 05 04:42:46 demo-hp felhom-agent[447632]: time=2026-10-05T04:42:46.152+02:00 level=INFO msg="osupdate: DONE" run=20261005T024146Z layer=docker vmid=9201 ring=0 trigger=night outcome=nothing healthy=true reason="" upgraded=0 pending=0 not_covered=0 restart_
+2026/10/05 02:35:02 quiesce.go:505: [INFO] [quiesce] backup due on 1 tier(s) — quiescing 9 stack(s): [adventurelog bentopdf bookstack calibre-web docmost kimai opengist paperless-ngx privatebin]
+2026/10/05 02:35:23 quiesce.go:554: [INFO] [quiesce] tier local: backup job backup-9201-1791167723831350602 started — polling
+2026/10/05 02:35:33 quiesce.go:623: [INFO] [quiesce] tier local: job backup-9201-1791167723831350602 snapshotted — resuming app early (8B.2)
+2026/10/05 02:35:33 quiesce.go:492: [INFO] [quiesce] unquiescing (snapshotted (early resume, last tier)): restarting 9 stack(s)
+2026/10/05 02:40:21 quiesce.go:628: [INFO] [quiesce] tier local: backup job backup-9201-1791167723831350602 done
diff --git a/documentation/audits/night-2026-10-04/night/n4-demo-felhom-prune-guard.txt b/documentation/audits/night-2026-10-04/night/n4-demo-felhom-prune-guard.txt
new file mode 100644
index 00000000..edf921c9
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/night/n4-demo-felhom-prune-guard.txt
@@ -0,0 +1,2 @@
+2026/10/05 02:15:10 [ERROR] [offbox] clean-up window 3: the fake-snapshot guard REFUSED — nothing deleted: the policy would remove snapshot 343d57a5 from 2026-09-28T02:15:05Z — younger than 8 days and not superseded the same day, which honest retention never does (R-822)
+2026/10/05 02:15:15 [INFO] [update-leg] started (after-offsite): window 02:30, no step starts at or after 07:30
diff --git a/documentation/audits/night-2026-10-04/night/n5-notifications-night.txt b/documentation/audits/night-2026-10-04/night/n5-notifications-night.txt
new file mode 100644
index 00000000..174416a8
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/night/n5-notifications-night.txt
@@ -0,0 +1,3 @@
+('demo-felhom', 'offsite_prune_guard_refused', 'sent', 'operator', '', '2026-10-05 02:15:11')
+('demo-felhom', 'offsite_prune_guard_refused', 'skipped', 'customer', 'operator_only', '2026-10-05 02:15:11')
+('tester-1', 'offbox_repo_orphaned', 'sent', 'operator', '', '2026-10-05 03:08:58')
diff --git a/documentation/audits/night-2026-10-04/tester1/t13-escrow.txt b/documentation/audits/night-2026-10-04/tester1/t13-escrow.txt
new file mode 100644
index 00000000..2e5fa209
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t13-escrow.txt
@@ -0,0 +1,7 @@
+03:07:37
+{"data":{"job_id":"escrow-1791169657458544213","phase":"running"},"error":"","ok":true}
+{'claimable': True, 'detail': '', 'entropy_bits': 129.24070185585344, 'phase': 'done', 'restic_pw_sealed': True, 'uploaded': True}
+03:07:42
+claim ok True keys ['recovery_code'] err 
+escrow_state pending
+escrow_state=escrowed 03:08:15
diff --git a/documentation/audits/night-2026-10-04/tester1/t14-d78-offsite-run.txt b/documentation/audits/night-2026-10-04/tester1/t14-d78-offsite-run.txt
new file mode 100644
index 00000000..30287bb3
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t14-d78-offsite-run.txt
@@ -0,0 +1,14 @@
+2026/10/05 03:08:23 [INFO] [offbox] backup run started (3 app(s) toggled)
+2026/10/05 03:08:56 [INFO] [offbox] pre-push dump leg completed in 32.838s — snapshot pair is coherent
+2026/10/05 03:08:58 [INFO] [offbox] orphaned repo, auto (returning household — this box never made an off-site copy; decision 78) — setting the old copy aside (move-aside + re-init, nothing deleted)
+2026/10/05 03:08:58 [WARN] [offbox] resetting orphaned repo (auto (returning household — this box never made an off-site copy; decision 78)): asking the hub to set /home/felhom-repo aside, then re-init
+2026/10/05 03:08:58 [INFO] Event pushed: offbox_repo_orphaned (warning) [hu-only] — A távoli mentési tároló elárvult: a benne lévő mentések egy korábbi, már nem elérhető kulccsal készültek (újratelepítés). Új mentés a tároló visszaállításáig nem készül.
+2026/10/05 03:08:58 [INFO] [offbox] the hub set the orphaned repo aside: /home/felhom-repo ->  (nothing deleted)
+2026/10/05 03:09:02 [INFO] [offbox] orphaned repo reset complete — old history set aside at /home/felhom-repo.orphaned-20261005 (move-aside, not deleted); fresh repo initialized
+2026/10/05 03:09:02 [INFO] Event pushed: offbox_repo_reset (info) [hu-only] — A távoli mentési tároló visszaállítva: a régi előzmény félretéve (nem törölve), és egy üres, új tároló jött létre a mostani kulccsal.
+2026/10/05 03:09:05 [INFO] [offbox] backed up privatebin (/mnt/sys_drive/felhom-data/backups/primary/privatebin, 0 mandatory path(s))
+2026/10/05 03:09:09 [INFO] [offbox] backed up paperless-ngx (/mnt/felhom-drives/adatlemez/backups/primary/paperless-ngx, 1 mandatory path(s))
+2026/10/05 03:09:12 [INFO] [offbox] backed up bookstack (/mnt/sys_drive/felhom-data/backups/primary/bookstack, 0 mandatory path(s))
+2026/10/05 03:09:16 [INFO] [offbox] clean-up window 4: the policy removes nothing
+2026/10/05 03:09:21 [INFO] [offbox] backup OK: 3 app(s) backed up, 3 snapshot(s), 54s
+2026/10/05 03:09:21 [INFO] [offbox] manual run progress reporting ended after 57s
diff --git a/documentation/audits/night-2026-10-04/tester2-hourly.txt b/documentation/audits/night-2026-10-04/tester2-hourly.txt
new file mode 100644
index 00000000..992b5721
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester2-hourly.txt
@@ -0,0 +1,11 @@
+== 21:12:40 Tester 2
+ Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 21:13:33  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 21:43:34  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 22:13:34  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 22:43:34  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 23:13:42  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 23:28:43  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 23:43:44  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 23:58:44  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
+== 00:13:45  Tester-2-be8404 Tester 2 0.142.0 9.2.2 7.0.2-6-pve DOWN 1/1 
diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md
index e9711013..ca73ffc2 100644
--- a/documentation/backlog/OPEN-ITEMS.md
+++ b/documentation/backlog/OPEN-ITEMS.md
@@ -197,6 +197,7 @@ stopping line that lies.
 
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
+| **R-867** | Backup & restore | P2 | **The off-site clean-up's fake-snapshot guard refuses honest 7-day retention: every weekly window on a box with more than 7 nightly snapshots refuses, deletes nothing, and mails the operator an error.** MEASURED 2026-10-05 02:15 UTC on demo-felhom (controller v0.293.0): `clean-up window 3: the fake-snapshot guard REFUSED — nothing deleted: the policy would remove snapshot 343d57a5 from 2026-09-28T02:15:05Z — younger than 8 days and not superseded the same day, which honest retention never does (R-822)`; operator mail `offsite_prune_guard_refused` (error) sent. The snapshot was 7 days + 5 s old — exactly the one a keep-7-dailies policy drops at the same hour each night. So the guard's 8-day line sits inside honest retention: pruning never happens (the repository only grows) and a true-looking error mail arrives every window — the cry-wolf shape R-824 closed for same-day copies. Fix direction: the guard's age line must exceed the policy's own keep-window (e.g. keep-daily N → refuse only younger than N days minus a margin, derived from the same constant), pinned by a test that runs the real policy over 8 nightly snapshots. `audits/night-2026-10-04/night/n4-demo-felhom-prune-guard.txt` | **READY — owner: CC** | — | fix + the 8-night test | CC |
 | **R-32** | Backup & restore | P2 | **[P2-HIGH] RESET must purge the customer base dir; the orphan card must stay honest; unattributed bytes must be visible.** The rehearsal's S7 said in advance that an orphan card would BE a finding — and one appeared (16:58:14). Cause: RESET's `"hetzner":"ok"` leg destroys the sub-account, but **a Hetzner sub-account is an access-control object, not a data object** — its directory survives, so re-enabling offsite recreated an account over the previous lifecycle's ciphertext, encrypted under a key that same RESET had destroyed. **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-21, size M, roadmap state `idea`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** | — | **Ruling from the run (three parts, deliberately separate):** (1) because RESET destroys custody, the ciphertext it leaves behind is unrecoverable **BY DESIGN** → RESET gains a **main-account purge of the customer base dir** (the existing operator ack already covers it); (2) the **move-aside guard STAYS** for reinstall-*without*-RESET — there custody survives and the card's "history recoverable" promise is true (R-26 depends on exactly that); (3) the operator **Restic tab shows per-customer directory bytes vs attributed snapshot bytes**, so dead data cannot hide. Measured on the pool box that night: **49 M attributed** (2 snapshots, 48.717 MiB) against **1.4 G + 3.0 M unattributed** across TWO `.orphaned-*` dirs. Evidence `restic-and-pool.txt` | CC |
 | **R-95** | Backup & restore | P2 | restic offsite credential **can delete** (`readonly=False`, `forget --prune` runs from the box); SFTP cannot express append-only | **NARROWED — the box can no longer delete (2026-10-03); weekly windows ON since 2026-10-04 with the fixed guard; LEFT: one window that actually removes snapshots, expected from ~2026-10-11 when the first candidates are older than 8 days** **DATED CHECK 2026-10-12 (DUE-CHECKS block), what to look at, on both demo boxes:** (1) the controller's window lines since 2026-10-10 — `pct exec 9201 -- docker logs felhom-controller 2>&1 | grep 'clean-up window'` on demo-hp (`ssh demo-hp`) and demo-felhom (`ssh felhom-pve`): a `clean-up window <id> (...): N of M planned snapshot(s) removed, A -> B` line with N > 0 and no `guard REFUSED`; (2) the snapshot count before and after — that line's `A -> B`, matching the hub's `offsite_windows` row (`count_before`, `count_after`, `box_result pruned`); (3) the hub's count check quiet — no `offsite_window_drop`, `offsite_prune_guard_refused` or `offsite_window_failed` event for either box since 2026-10-10; (4) the key file clean — operator `POST /offsite/key-audit` reads 0 findings for both. **All four hold → close R-95. Any one fails → the reason is a new row, and R-95 stays.** Since hub v0.129.0 a window refused only by the count cap after a gap can be cleared with one raised-cap grant (R-833). **MEASURED 2026-10-03 (R-436 CLOSED) — append-only HOLDS for a pinned key; it is NOT yet protection.** On the provider (`u629488-sub4`, scratch repo, removed): a key pinned to `command="rclone serve restic --stdio --append-only <dir>",restrict` backs up, restores (bytes identical) and checks; `forget <id> --prune`, `forget --keep-last 1` and a real `prune` are refused with `blob not removed, server response: 403 Forbidden (403)`; the unpinned control deletes. **What still defeats it:** the sub-account PASSWORD logs in on ports 22 and 23 and rewrote `authorized_keys` in this session, and a box can obtain that password from the hub at will (R-820). **Also found:** an add-only key can plant future-dated snapshots that make the box's own retention policy select every real snapshot (R-822); the hub holds every sub-account password in the clear (R-821); FOUR box features need a deleting login, not two — both `forget` sites, the orphan move-aside (`mv`) and the abandonment (`rm -rf`). **PROPOSAL (operator decides — STATUS):** the hub becomes the key registrar so the box never sees the password; switch boxes to the pinned key with no box-side retention first (quota headroom is months); then a weekly hub-opened clean-up window with a poisoning guard. `audits/offsite-append-only-2026-10-03/DESIGN.md`. The rank stays the operator's. **BUILT 2026-10-03 (decisions 68–69).** Both demo boxes migrated to a hub-pinned append-only key with history kept (11→13, 91→100); a delete from each box is refused (403); the old password endpoint answers 410 to demo-hp's own key; the daily key check is live; the clean-up window opened, refused by the guard and closed live on demo-hp. Left: R-824 (the guard refuses after any manual run, so no real prune has run), R-822 residual, R-823. `audits/offsite-lock-build-2026-10-03/` | — | Root exposure still open. Mitigation now ARMED — split prune off-box or move to REST `--append-only` **-- UNBLOCKED 2026-09-22, not closed.** The premise in this row's own title - *SFTP cannot express append-only* - is answered by Hetzner (ticket #2026090103040671, recorded in R-433 and R-436): on a Storage Box the `rclone serve restic --stdio --append-only` backend can be pinned to an SSH key as a FORCED COMMAND, so append-only IS expressible without a new machine. **The row stays open because nothing has been measured**: no forced-command key exists on `u629488`, no `forget --prune` has been refused through one, and the protection only holds if EVERY key that can reach the repository carries the prefix. The next step is R-436's, and it is small. | CC  **SPIKE 2026-09-01 — `audits/SPIKE-r95-offsite-delete-2026-09-01.md`. THE WORD "ARMED" ABOVE IS NOT SUPPORTED AND IS WITHDRAWN PENDING R-429:** no `.snapshots` is visible to either box's sub-account (measured, both machines, with controls), so the seven-day bound is unverified and unverifiable from the product side. **Q3 (documented, `hub/internal/hetznerapi/hetznerapi.go:38-45`): the sub-account API has ONE permission axis, `readonly` — there is no append-only, so the PBS shape does NOT transfer** (PBS is a server that can refuse; a Storage Box is a filesystem that runs nothing). **Q5 (measured): withdrawing delete does NOT wedge the store** — restic treats a dead owner's lock as stale and proceeds — so the constraint everyone feared is not the blocker; but `unlock --remove-all` lies about success (R-430), and the crash-lock window is UNKNOWN. **Q6 (measured): restic 0.14.0 DOES speak `rest:`** (control: `banana:` → invalid backend), and append-only is a rest-server flag, not a restic one — reachable, but it needs a machine in the recovery path and ep0 is protected. **Q7 (measured): detection is nearly free** — `snapshot_count` already reaches the hub and the hub APPENDS reports, so the comparison needs no box change. **RECOMMENDATION: answer R-429 first (Viktor, ten minutes), then build detection, then move retention off the box; defer the transport change.** Two `forget --prune` sites must be disarmed together — `offbox.go:1388` AND `offbox.go:1759` — or R-191 repeats.  **RE-SCOPED 2026-09-01 — THE STORY WAS WORSE THAN THE TRUTH FOR TWO MONTHS.** The box can delete its own LIVE repository, **but it cannot write to the daily snapshots of it** — MEASURED, not cited: a write into `/.zfs/snapshot` is refused on both boxes while the same write to the account home succeeds (R-432). Seven daily snapshots are confirmed in the panel (R-429). **So a deletion costs at most the data written since the last daily snapshot, and the rest is recoverable — file by file, one customer at a time, with no effect on anyone else** (vendor: *"You can download individual files or entire directories as usual"*; *"It is not possible to write to the `/.zfs` directory or its subfolder"*). **NOT open-ended loss.** Two caveats kept honest: a panel-driven snapshot restore rolls back the WHOLE Storage Box and deletes newer snapshots, which is why the per-file route matters; and per-file recovery is **operator-only today** (R-432). **DETECTION SHIPPED hub v0.111.0 (R-431)** — an unexplained fall is noticed within a day. **THE RANKING IS VIKTOR'S:** this has been #1 since July on the old story. On the new facts I would rank it below the items that can still lose data outright, but I am not re-ranking it myself. `audits/SPIKE-r95-offsite-delete-2026-09-01.md`  **DRILL 2026-09-01, LATER THE SAME DAY — THE RE-SCOPE'S SECOND HALF IS WITHDRAWN.** The drill that was to walk the recovery found there is no route to walk: **no snapshot is reachable from a sub-account by ANY name** (R-433) — 777,600 exact names in the vendor format over nine days, zero hits, with a passing control, plus the structural reason (`/home` st_dev 0,82 vs `/.zfs/snapshot` st_dev 0,276, and `/home/.zfs` absent). **Clause (a) stands: the box can delete the live repo and cannot write into the snapshot area.** Clause (b) — *"the rest is recoverable file by file"* — is NOT SUPPORTED. **The drill was STOPPED before its destructive phase on the operator's ruling**, because with no recovery route the deletion would have destroyed real history to buy only an alarm test that could not fire at the specified size (R-435). Nothing was deleted; the store is verified untouched at 69 snapshots. **So the comfort that lowered this row rested on an unwalked route, and the route does not exist.** Two new leads decide what happens next: **R-433** (can the MAIN account see them? nobody here holds that credential) and **R-436** (`rclone serve restic --stdio` is offered server-side and restic speaks `rclone:` — measured — which could make real prevention cheap, IF the provider pins `--append-only`). **The rank stays Viktor's. Plainly: the argument that moved this row down is the argument the drill removed.** `audits/evidence-drill-r95-recovery-2026-09-01/` **BLOCKED-ON-PROVIDER 2026-09-01, and the record of the demotion is kept deliberately: this row spent ONE DAY demoted on a clause that did not hold.** It was re-scoped down on the morning of 2026-09-01 on the strength of *"recoverable file by file"*, and that clause was measured false the same afternoon (R-433). **On today's evidence it belongs back near the top — that is a proposal, not an action; CC has not re-ranked it and will not.** Both questions that can settle it are drafted in `documentation/runbooks/provider-questions-2026-09-01.md`: **Q1** decides how urgent this is, **Q2** (R-436) could remove the root cause cheaply. **Precondition on any build here: R-430**, which is harmless only while the box can still delete. |
 | **R-105** | Backup & restore | P2 | **Three hub-held DR records are empty on the entire live fleet.** `hosts.dr_record_json` = `{}` on all 3 hosts; `host_escrow.directive_json` = `{}` on both escrowed hosts; `dr_recipe.host_half.drives` = `[]` on every customer **including two with enrolled data drives** (916 GB USB on demo-felhom, 938 GB NVMe on demo-hp) **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-28, size M, roadmap state `READY — 2026-07-28`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. ****PARTLY FIXED BY ITS OWN UPDATE.** The `drives` third was traced and populated on both demo boxes on 2026-07-28 (the enrolled drives were never PVE storages, so `isUserDataDrive` never saw them). The other two thirds — `hosts.dr_record_json` and `host_escrow.directive_json` — were NOT re-verified this session and are carried as written.** | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** | — | These are exactly the fields a host-loss recovery reads: `05-hub-architecture.md:175-176,186` names the slim DR record as one of four durable sources; `06-offsite-connectivity.md:148-150` says the escrow upload carried the DR directive; `felhom-agent/internal/dr/plan.go:34-35` makes `PlannedDrive` the re-attach-by-`durable_id` wrong-disk guard. **The three may have different causes** — `isUserDataDrive` (`internal/hub/dr_recipe.go:129-136`) requires type `usb`/`local-dir` **and** a non-empty `DurableID` **and** `MountPath`, and which of the three fails was not traced. Evidence: `architecture/_recovery-inventory-2026-07-28.md` Part D2.3. **UPDATE 2026-07-28 (vzdump-target move): the `drives` third is TRACED and now POPULATED on both demo boxes.** Cause: the enrolled data drives were never PVE storages at all — only agent-generated systemd mounts — so they never entered `report.StorageTargets` and `isUserDataDrive` never saw them. Giving each drive a `dir` storage at its own mountpoint supplied all three required fields at once (type `local-dir`, fs-UUID durable id, mount path), and the recipe now emits `uuid:91d2dc2d-…`/`/mnt/nvme-1tb` on demo-hp and `uuid:47a3361a-…`/`/mnt/hdd_1` o | CC |
@@ -230,6 +231,7 @@ stopping line that lies.
 | **R-698** | Backup & restore | P3 | **[P3-LOW] A backup stores the image's NAME, not the image — a restore of a version its maker has deleted cannot start.** `RecoveryManifest.image_pins` ("image NOT stored — re-pulled on restore"); since controller v0.275.0 each data file also records its running `ref@digest`, and a restore brings the data back AT ITS OWN VERSION (`07` §6.6) — so a restore asks for exactly the old image. **Measured 2026-09-26** (`audits/version-travel-2026-09-26/A7/`, registry HEADs, no pulls): the catalog's 42 ladder `ref@digest` pairs all resolve (200); an invented digest answers 404 on Docker Hub and ghcr.io (negative control). Not measured: the digests recorded on boxes (older than any ladder entry), how often makers delete versions, the catalog's 66 digest-less compose lines. **Options (decide nothing yet):** (a) keep — a restore of a deleted version fails at the pull and the household uses the next copy or a newer version; (b) mirror every INSTALLED image into the DooPlex registry, restore falls back to it — storage + bandwidth on DooPlex, a new part on the recovery path; (c) mirror only ladder-named versions — bounded, misses pre-ladder boxes; (d) `docker save` into the unit — hundreds of MB per app per copy on every tier. **-- 2026-09-30 late (decision 53):** a box now keeps only an app's running and previous image; a restore to an older version re-pulls it — as every restore already did. The limit above is unchanged. | **OPEN — P3; owner: operator (a decision), CC measures** | — | — | CC + operator |
 | **R-706** | Backup & restore | P3 | **[P3-LOW] Removing an app "with its backups" leaves its off-site verification copy on the drive.** Measured 2026-09-28 on demo-hp: after a full off-site restore of nextcloud (which leaves the downloaded copy in `backups/offsite-restore/nextcloud`, ~1 GB, by design, for the household to inspect), `POST /api/stacks/nextcloud/remove` with `remove_backups: true` removed the unit and listed `backup_paths_removed` WITHOUT the verification copy; it stayed until the restore page's own delete (`POST /backup/offbox/verify-copy/delete`, 302 `scratch_deleted`). A household that removes an app to free space keeps 1 GB it cannot see on the app list. **Fix direction:** the removal with backups also deletes the app's verification copy (the same `DeleteOffsiteRestoreCopy`). Evidence: `audits/kept-offsite-2026-09-28/E/E9-teardown.txt`. **-- 2026-09-28 evening: FIXED in controller v0.279.0** — a removal with its backups also deletes the verification copy and lists it among the removed paths (`TestR706_…`, red-proofed RP7). Not yet seen live (needs a full off-site restore then a removal). | **WATCHING — P3; owner: CC (live)** | — | — | CC |
 | **R-729** | Backup & restore | P3 | **[P3-LOW] An off-site target, once saved on the page, cannot be removed through the product.** MEASURED 2026-09-30 on 9202: `/backup/offbox/config` refuses an empty address and no route clears the target; the session removed its throwaway target from `settings.json` by hand, with the controller stopped (harness teardown on a scratch guest). A household that tries its own NAS and gives up keeps a disabled target forever. **Fix direction:** a „Távoli mentési cél törlése" press that clears the target (never the repository). | **READY — rank P3-LOW; owner: CC (controller)** | — | — | CC |
+| **R-869** | Backup & restore | P4 | **The controller's log line for decision 78's move-aside prints an empty destination: `the hub set the orphaned repo aside: /home/felhom-repo ->  (nothing deleted)`.** 2026-10-05 03:08 UTC, Tester 1 box (controller v0.293.0); the next line names it (`/home/felhom-repo.orphaned-20261005`). Cosmetic, but it is the one line an operator reads to find where the old history went. Fix direction: log the hub's returned path, or the name the controller computes. `audits/night-2026-10-04/tester1/t14-d78-offsite-run.txt` | **READY — owner: CC** | — | — | CC |
 | **R-10** | Backup & restore | P4 | T-6E-1: DB-dump dir-fsync asymmetry (LOW, confirmed in 6E) **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-15, size XS, roadmap state `idea`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. **T-6E-1, confirmed in CAMPAIGN-6E.** | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** | — | One-line hardening; batch with the next controller task | CC |
 | **R-91** | Backup & restore | P4 | Old 13 GB datastore copy at `/srv/pbs-felhom` on ep0's root disk | WATCHING | demo-felhom's first **post-migration** PBS backup | Delete once it lands; fix `CONTEXT.md:1018` same commit | CC |
 | **R-99** | Backup & restore | P4 | Server-side prune **never removes** a phantom snapshot. Confirmed it does NOT count them toward `keep-last` (dry-run kept 2 real + the phantom) so there is **no retention/data-loss bug** — but one accumulates per aborted upload, forever | READY (S) | — | Decide a cleanup path. Deletion on a **customer** datastore is a separate ruling — detection shipped, removal deliberately not automated | CC |
@@ -325,6 +327,7 @@ stopping line that lies.
 | **R-444** | Box system & updates | P3 | **[P3-LOW] Nothing runs `pct fstrim` on the fleet, and demo-hp's thin pool was carrying ~23.8 GB of blocks the guest had already freed.** MEASURED 2026-09-01 during this spike's teardown: the run itself added ~1.05 GiB that `local-lvm` did not reclaim on delete (68.97% -> 70.91%); `fstrim` INSIDE the unprivileged container is refused (`FITRIM ioctl failed: Operation not permitted`, all three mounts); `pct fstrim 9201` from the PVE host then trimmed **30.2 GiB + 57 GiB** and took `local-lvm` to **26.78%** — **23.8 GB BELOW this run's own starting point**, i.e. the surplus was long-standing, not ours. **Why it is not merely housekeeping:** a thin pool that only ever grows can reach 100% from DELETED data alone, and a full thin pool takes every guest on the host read-only. demo-hp had 16.4 GB free before the trim. **Not urgent, and the row says so** — but the appliance has no periodic trim and no operator surface reports the gap between guest-free and pool-used. Owner: **CC.** `audits/SPIKE-app-update-2026-09-01.md` | **OPEN — rank P3-LOW; owner: CC** | — | — | CC |
 | **R-468** | Box system & updates | P3 | **[P3-LOW] THE GOLDEN WAIVER — goldens on a cadence, not per release (operator ruling 2026-09-13).** 25 goldens in 26 days in August, almost one per release, because `golden_currency_gate.py` trips on every release by design and the only honest ways past it were a bake or a declared `--no-verify` (thirteen by 2026-09-01, R-404/R-417). **The ruling: bake WEEKLY, and always before any drill or fresh install.** Every release still raises the FLOOR, so both demo boxes keep getting each release in ~20 s; only the golden — which protects a fresh install and nothing else — moves to a cadence. **The mechanism (built 2026-09-13):** `documentation/tests/golden-waiver. **⚠ CORRECTED THE SAME DAY (R-472): between bakes the floor does NOT carry a release — the hub holds any floor above the vouched golden (publish-train rule 1), so releases between bakes reach the demo boxes only by hand-deploy.**yml`, four lines (`issued`, `expires`, `reason`, `register_row: R-468`), read by the gate. While valid, a golden BEHIND the record makes the gate print a loud ADVISORY and exit 0; when it expires the gate is red again until someone bakes or renews. **The 14-day cap is enforced by the gate, not the runbook** — a longer, undated, unparseable, reason-less or row-less waiver is INCONCLUSIVE (exit 2), never 0 and never silently ignored. **It never covers a golden that is UNRECORDED (R-385)** — that is not a cadence choice. **A dated waiver cannot be forgotten; it just expires** — the difference from R-242's original rule, which recurred the day after it was written. Tests: `scripts/test_golden_currency_gate.py` cases 5–15 (E/F/G/H, a 15-day, absent, unparseable, bad-row and empty-reason waiver each 2; the R-421 decoy — a file saying only `expires` — 2). **This is a PRE-CUSTOMER arrangement: the first external install retires it** (delete the file in that commit). Cadence written into `RUNBOOK-manual-build.md` §4.2 and the `felhom.eu` end-of-session checklist. **Does NOT touch R-242's open half (nothing gates the VOUCH).** | **WATCHING — rank P3-LOW; owner: CC (renew ≤ 14 days or bake); retire at the first external install** | — | — | CC |
 | **R-531** | Box system & updates | P3 | **[P3-LOW] Three supervisor facts measured live and not pinned: restart timing during a deploy was not measured; restarts before the hub first sees the stanza produce no `controller_restarted_by_agent`; deliberate operator kills spend the crash-loop budget.** MEASURED 2026-09-15 on 9201: after 3 test restarts in 13 minutes the 4th kill tripped the 30-minute pause and the dashboard stayed down (the guard as designed, `A4-kill-middeploy-9201.txt`). The hub checker seeds silently on first sight, so the three restarts before the first v0.131.0 report emitted nothing (only the crash-loop did). **What it needs:** a deploy-kill timing on a fresh budget; the operator's view whether a restart after minutes of uptime should count toward the budget **MEASURED 2026-09-16 on the drill box, both halves.** (1) **Timing during a deploy (F9'):** the controller was killed 5 s into a deploy on an EMPTY budget; the agent saw it on the next sweep, confirmed on the one after, and the dashboard answered 200 again **37 s** after the kill; the interrupted app ended `not_deployed`, not stuck. (2) **The budget's shape (F9''):** three further kills at idle, 20 minutes apart, recovered in **61 s / 41 s / 61 s** - and NONE of them accumulated, because the window is 15 minutes. Four restarts this session, zero pauses, zero crash-loop events. **So the brake catches a FAST loop and is blind to a SLOW one:** a controller dying every 20 minutes is restarted forever and the only trace is an `info` event that mails nobody. That is a design question for the operator (leave it / add a longer second counter / raise the severity of the Nth restart in a day), and this session deliberately measured it without changing it. Evidence: `audits/evidence-drill-0243-2026-09-16/phase2-f9prime.txt` and `phase2-f9dprime.txt`. | **READY — rank P3-LOW; owner: CC (measure) · operator (budget rule)** | — | — | CC + operator |
+| **R-868** | Box system & updates | P4 | **An OS pass whose agent is killed mid-install still installs (the root wrapper runs on under sudo), but its report never reaches the hub.** MEASURED 2026-10-05 02:57 UTC on demo-hp (night drill A5): the debug pass and the daemon `kill -9`-ed while `apt-get` ran; the wrapper finished all 6 packages, dpkg clean, systemd restarted the daemon in < 20 s (`NRestarts` 1, no rollback). The hub never got that pass's `applied` report; the next pass said `nothing`. For a NIGHT leg the hub would therefore miss which packages a ring-0 box installed that night (the approval set is still read from the next inventory). Fix direction: the wrapper keeps its last report on disk; the agent sends an unsent one at start. `audits/night-2026-10-04/accidents/a5-kill.txt` | **READY — owner: CC** | — | — | CC |
 | **R-184** | Box system & updates | P4 | **Nothing prevents the hub from vouching an agent version that was never released.** The R-115 gate proves every RELEASED version is installable, but it works from git tags — so a hub artifact-manifest entry naming a version with no tag and no package is invisible to it. The installer would then die at step 5 on a virgin machine, as root | **READY (S) — NEW 2026-08-03** | — | **Filed BECAUSE the R-115 gate deliberately does not cover it, rather than leaving the gap unstated.** CI cannot check it: the hub's `/api/v1/artifacts/<customer>` answers **401** without a per-customer retrieval passphrase and Gitea's package **listing** api answers **401** without a token (both measured 2026-08-03, P-C), so a credential-free gate can ask *"is this version installable"* but never *"which version is vouched"*. **Two shapes, and the second is better:** (a) give CI a hub credential — expands what CI can reach, and is the operator's call not a gate author's; (b) **validate at vouch time, in the hub**: the operator UI's Day-0 artifact form refuses a version whose package is not downloadable. (b) fails closed at the moment of the decision, needs no new credential anywhere, and puts the check where the mistake is actually made. **Exposure is low and should be said so:** vouching is a deliberate operator action against a version they have just released, and R-115's release path now makes released-but-unpublished nearly impossible. This is the residue, not the main risk | CC |
 | **R-194** | Box system & updates | P4 | **PVE's permission cache delays every grant-state verdict by an unknown amount, so "the agent can read it" and "the ACL exists" are not the same measurement.** Observed twice while validating R-190's self-repair on demo-felhom 2026-08-04: both ACL rows for `/storage/felhom-backup` were deleted, and `GET /access/permissions` continued to report `Datastore.AllocateSpace` present — for **~40 s** in one run and **~16 minutes** in another. During that window the capability probe reads healthy and the self-repair does not fire | **OPEN** | — | **Why it matters beyond the delay:** it puts a floor under how fast a lost grant can be noticed, it makes any single permission read a lagging indicator, and — the interesting part — **it is a candidate contributor to R-190's own timeline**: a grant removed at an unknown moment could keep working until a cache expiry, which is exactly the shape of *worked at 04:44, refused at 09:24*. That does not explain what removed it, but it may explain when the refusal SURFACED, and the two have been treated as the same instant. **Not a defect in our code** — it is PVE behaviour, and the mitigation already tolerates it (the repair fires on the next probe after the cache clears). **What is worth deciding:** whether the store-grant probe should ALSO consult the storage content listing as a second signal, since that appeared to reflect the loss immediately (`{"data":[]}` while the permission read still said present) — two signals disagreeing is itself information, and today only one of them is read | CC |
 | **R-373** | Box system & updates | P4 | **`SysDataGrowGB` is the intended lever for the system-data volume, it works, and nothing sets it.** Written down 2026-08-02 in `audits/SPIKE-recovery-unit-space-2026-08-02.md:230-232`, under an explicit *"### Not filed"* heading: the 20 G / 50 G mismatch was ruled a tier-sizing decision rather than a defect, *"`SysDataGrowGB` is the intended lever and it works; nothing sets it."* A lever with no caller is the same shape as R-368's comment — a setting that names a behaviour nothing invokes. **Age when filed: 20 days.** | **OPEN — LOW** | R-368 (same shape) | Either wire it to something an operator can reach, or remove it and record the sizing decision where a reader will meet it. | CC |