diff --git a/documentation/audits/release-2026-11-03/part1/README.md b/documentation/audits/release-2026-11-03/part1/README.md
new file mode 100644
index 00000000..70f8ff2b
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/README.md
@@ -0,0 +1,38 @@
+# Part 1 — controller 0.350.0, 2026-11-03
+
+**Image:** 0.350.0 from `5c336d82` (CI 2568 green), `sha256:9ee53908e6d95f0340c41bf4eaba954280084a8e6927de59779440e3551df261`. rc.1 from `13e34d4` (CI 2562
+green), `sha256:cbf4d42fd4c86a30854a2f4202b06b6b97073380e0de0bd2fffed524021fd8d4`.
+
+## The fix itself (9202 only, from the LAN: the demo-hp host; `traefik_load.py`, `load-before.txt`, `load-after.txt`)
+
+Four processes open short TLS connections (84 a second), each one request to the dashboard route with `Authorization: NTLM …`; the controller answers 302
+(so the request reached a backend). Memory: `anon` of Traefik's cgroup, every 10 s. The load stops at twice the start figure or at 300 s.
+
+| | v3.7.16 (`traefik:v3.7.16`) | v3.7.17 (`traefik:v3.7.17`) |
+|---|---|---|
+| anon at start | 18.7 MiB | 16.2 MiB |
+| after about 920 connections | **79.0 MiB** (stopped: over twice the start) | 25.3 MiB |
+| after 25,116 connections, 300 s | not run: the bound stopped it at 11 s | **25.4 MiB, flat** (24.9–26.3 all the way) |
+| 30 s after the load stopped | 80.0 MiB, not released | 25.4 MiB |
+
+So the fix is proven by behaviour, not only by the version: about 65 KiB per connection on the old one, and nothing per connection on the new one. Limit of the
+proof: the old curve has one point, because the bound stopped it, and it ran on a Traefik seven hours up, the new one on a Traefik seconds old.
+
+## The boxes (`walk-9202-rc1.txt`, `walk-3boxes.txt`, `public-names.txt`, `https-only.txt`, `files-signin-*.txt`, `rollout-wait.txt`)
+
+Per-box floors 07:04:24 UTC; all three on 0.350.0 with Traefik v3.7.17 by 07:05:06. Traefik's image id `sha256:a72cb2f4…` on all four boxes. Walk green on 9202 (rc.1), Tester 1, demo-hp, demo-felhom: 0 unhealthy, 0 refusals, 0 ERROR lines,
+login and file manager 200, every app route answers through Traefik; 26 public names from outside: all 200/302/401; `https_only_check.py` green.
+
+**File manager sign-in** (dashboard → one-time pass → files cookie → a listing through Traefik 200; without the cookie 401): 9202, Tester 1, demo-hp. **Not driven on demo-felhom:** it is the lived-in box and the brief allows no hand step on
+it; its anonymous file manager page reads 200.
+
+**R-1351 and R-1323 did not fire on these starts** (0 ERROR lines): as last night, no live difference between old and new for them; test proof only.
+
+## One local restore on Tester 1, release build (`restore-tester1.txt`, `restore_tester1.py`)
+
+The household's button, `privatebin`, last night's copy: a marker written after the copy is gone, the 5 files read the same (hash `857384e0f0cd2b8f`), front door 200, state running, no hold, 62.8 s, 0 ERROR lines.
+A plain restore: it exercises the restore path on the release build, not R-1347's or R-1348's staged faults (those were proven last night on the test image of the same code).
+
+## The floor (`global-floor.txt`, `global-floor-readback.txt`, `floors-cleared.txt`, `watch-30min.txt`)
+
+Global floor 0.350.0 / MinAgent 0.158.1 at 07:18:16 UTC, its own save, 303 `floor_set`; the hub log and the configuration page agree. Per-box floors cleared 07:18:18.
diff --git a/documentation/audits/release-2026-11-03/part1/ctl-0350-build.txt b/documentation/audits/release-2026-11-03/part1/ctl-0350-build.txt
new file mode 100644
index 00000000..e13cc61f
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/ctl-0350-build.txt
@@ -0,0 +1,150 @@
+
+[INFO]  ╔══════════════════════════════════════╗
+[INFO]  ║  felhom-controller image builder     ║
+[INFO]  ╚══════════════════════════════════════╝
+[INFO]  Version:    0.350.0
+[INFO]  Commit:     5c336d8
+[INFO]  Repo:       /mnt/5_hdd/felhom.eu/git/felhom-controller
+[INFO]  Source:     /mnt/5_hdd/felhom.eu/git/felhom-controller/controller
+[INFO]  Build dir:  /mnt/5_hdd/felhom.eu/build/felhom-controller/workspace
+[INFO]  Image:      gitea.dooplex.hu/admin/felhom-controller:0.350.0
+
+[STEP]  0/4 — Checking the registry: is 0.350.0 already published?
+[INFO]  0.350.0 is not present in the registry — proceeding.
+[INFO]  Source tree is clean and at origin/main.
+[STEP]  1/4 — Preparing build workspace...
+[INFO]  Source copied: 1133 Go files
+[STEP]  2/4 — Syncing app assets...
+[INFO]  Synced 263 assets (52 SVG + 16 PNG logos, 195 screenshots)
+[STEP]  3/4 — Preparing Go modules...
+[INFO]  Running go mod tidy...
+[STEP]  4/4 — Building Docker image...
+[INFO]  Building for current platform + pushing...
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 7.32kB done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
+#2 DONE 0.0s
+
+#3 [internal] load metadata for docker.io/library/golang:1.27.3-trixie@sha256:fbb7ae40b62ff8afe31662df570d39b4f5052ac32b90dae8e60d7657a20a74f4
+#3 DONE 0.0s
+
+#4 [internal] load .dockerignore
+#4 transferring context: 2B done
+#4 DONE 0.0s
+
+#5 [restic 1/3] FROM docker.io/library/debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
+#5 resolve docker.io/library/debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f 0.0s done
+#5 DONE 0.0s
+
+#6 [internal] load build context
+#6 ...
+
+#7 [builder 1/7] FROM docker.io/library/golang:1.27.3-trixie@sha256:fbb7ae40b62ff8afe31662df570d39b4f5052ac32b90dae8e60d7657a20a74f4
+#7 resolve docker.io/library/golang:1.27.3-trixie@sha256:fbb7ae40b62ff8afe31662df570d39b4f5052ac32b90dae8e60d7657a20a74f4 0.0s done
+#7 DONE 0.0s
+
+#6 [internal] load build context
+#6 transferring context: 70.40MB 0.8s done
+#6 DONE 0.8s
+
+#8 [builder 5/7] COPY . .
+#8 CACHED
+
+#9 [builder 2/7] WORKDIR /build
+#9 CACHED
+
+#10 [builder 3/7] COPY go.mod ./
+#10 CACHED
+
+#11 [builder 4/7] RUN go mod download || true
+#11 CACHED
+
+#12 [builder 6/7] RUN go mod tidy
+#12 CACHED
+
+#13 [builder 7/7] RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build     -ldflags="-s -w         -X main.Version=0.350.0         -X main.BuildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)         -X main.GitCommit=5c336d8"     -o /build/felhom-controller     ./cmd/controller/
+#13 DONE 23.7s
+
+#14 [restic 3/3] RUN set -eu;     apt-get update && apt-get install -y --no-install-recommends ca-certificates curl gnupg gpgv bzip2;     case "amd64" in       amd64) want="f415415624dcc452f2a02b8c33641791a8c6d6d3b65bbb3543fcf9a25151585c" ;;       arm64) want="a5f64aaab53d51e311fa3829124c5b703f2d14cf187d8640b6be3b2b49376465" ;;       *) echo "no pinned restic checksum for architecture 'amd64'" >&2; exit 1 ;;     esac;     f="restic_0.19.1_linux_amd64.bz2";     url="https://github.com/restic/restic/releases/download/v0.19.1";     cd /tmp;     curl -fsSL -o "$f" "$url/$f"; curl -fsSL -o SHA256SUMS "$url/SHA256SUMS"; curl -fsSL -o SHA256SUMS.asc "$url/SHA256SUMS.asc";     gpg --dearmor < /tmp/restic-release-key.asc > /tmp/restic-release-key.gpg;     gpgv --keyring /tmp/restic-release-key.gpg SHA256SUMS.asc SHA256SUMS;     grep " ${f}\$" SHA256SUMS | sha256sum -c -;     echo "${want}  ${f}" | sha256sum -c -;     bunzip2 -c "$f" > /usr/local/bin/restic; chmod 0755 /usr/local/bin/restic;     /usr/local/bin/restic version | grep -q "^restic 0.19.1 "
+#14 CACHED
+
+#15 [stage-2 3/7] COPY --from=restic /usr/local/bin/restic /usr/local/bin/restic
+#15 CACHED
+
+#16 [stage-2 4/7] RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker.gpg     && . /etc/os-release     && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.gpg]        https://download.docker.com/linux/debian ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list     && apt-get update     && apt-get install -y --no-install-recommends docker-ce-cli docker-compose-plugin     && rm -rf /var/lib/apt/lists/*
+#16 CACHED
+
+#17 [stage-2 2/7] RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends     ca-certificates     curl     gnupg     git     util-linux     rsync     openssh-client     && rm -rf /var/lib/apt/lists/*
+#17 CACHED
+
+#18 [restic 2/3] COPY third_party/restic/restic-release-key.asc /tmp/restic-release-key.asc
+#18 CACHED
+
+#19 [stage-2 5/7] RUN mkdir -p /opt/docker/felhom-controller/data
+#19 CACHED
+
+#20 [stage-2 6/7] COPY --from=builder /build/felhom-controller /usr/local/bin/felhom-controller
+#20 DONE 0.6s
+
+#21 [stage-2 7/7] COPY assets/ /usr/share/felhom/assets/
+#21 DONE 0.7s
+
+#22 exporting to image
+#22 exporting layers
+#22 exporting layers 3.2s done
+#22 exporting manifest sha256:c985879bc13f81e5a61e49238479c4dea6957e06f504ad0c0d42ca86c2f2dc6f
+#22 exporting manifest sha256:c985879bc13f81e5a61e49238479c4dea6957e06f504ad0c0d42ca86c2f2dc6f 0.2s done
+#22 exporting config sha256:1f32a260789abfa00620b8ce36a02627185df4586c43b6c666586d7d404e5aa3
+#22 exporting config sha256:1f32a260789abfa00620b8ce36a02627185df4586c43b6c666586d7d404e5aa3 0.2s done
+#22 exporting attestation manifest sha256:9a79e9e1746b954643fb51437f166eccda4ee967b18c61f73c9a638967345a42 0.0s done
+#22 exporting manifest list sha256:9ee53908e6d95f0340c41bf4eaba954280084a8e6927de59779440e3551df261 0.0s done
+#22 naming to gitea.dooplex.hu/admin/felhom-controller:0.350.0 done
+#22 unpacking to gitea.dooplex.hu/admin/felhom-controller:0.350.0
+#22 unpacking to gitea.dooplex.hu/admin/felhom-controller:0.350.0 0.4s done
+#22 naming to gitea.dooplex.hu/admin/felhom-controller:latest done
+#22 unpacking to gitea.dooplex.hu/admin/felhom-controller:latest done
+#22 DONE 4.2s
+[INFO]  Pushing...
+The push refers to repository [gitea.dooplex.hu/admin/felhom-controller]
+c3f83389ce1b: Waiting
+44136fa355b3: Waiting
+ecc510c1e359: Waiting
+6d600408d36c: Waiting
+e853ea6ba36f: Waiting
+ecc510c1e359: Layer already exists
+e81c1fce9826: Layer already exists
+63a1406b1961: Layer already exists
+f566b4c9671c: Waiting
+c3f83389ce1b: Layer already exists
+44136fa355b3: Already exists
+d747c9b6922d: Layer already exists
+6d600408d36c: Pushed
+f566b4c9671c: Pushed
+e853ea6ba36f: Pushed
+0.350.0: digest: sha256:9ee53908e6d95f0340c41bf4eaba954280084a8e6927de59779440e3551df261 size: 856
+The push refers to repository [gitea.dooplex.hu/admin/felhom-controller]
+44136fa355b3: Waiting
+6d600408d36c: Waiting
+ecc510c1e359: Waiting
+c3f83389ce1b: Waiting
+f566b4c9671c: Layer already exists
+44136fa355b3: Already exists
+ecc510c1e359: Layer already exists
+c3f83389ce1b: Layer already exists
+e853ea6ba36f: Layer already exists
+6d600408d36c: Already exists
+e81c1fce9826: Layer already exists
+63a1406b1961: Layer already exists
+d747c9b6922d: Layer already exists
+latest: digest: sha256:9ee53908e6d95f0340c41bf4eaba954280084a8e6927de59779440e3551df261 size: 856
+
+[INFO]  ╔══════════════════════════════════════╗
+[INFO]  ║  Build complete ✓                    ║
+[INFO]  ╚══════════════════════════════════════╝
+[INFO]  Image: gitea.dooplex.hu/admin/felhom-controller:0.350.0
+[INFO]  Size:  486M
+
diff --git a/documentation/audits/release-2026-11-03/part1/ctl-rc1-build.txt b/documentation/audits/release-2026-11-03/part1/ctl-rc1-build.txt
new file mode 100644
index 00000000..59358e74
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/ctl-rc1-build.txt
@@ -0,0 +1,157 @@
+
+[INFO]  ╔══════════════════════════════════════╗
+[INFO]  ║  felhom-controller image builder     ║
+[INFO]  ╚══════════════════════════════════════╝
+[INFO]  Version:    0.350.0-rc.1
+[INFO]  Commit:     13e34d4
+[INFO]  Repo:       /mnt/5_hdd/felhom.eu/git/felhom-controller
+[INFO]  Source:     /mnt/5_hdd/felhom.eu/git/felhom-controller/controller
+[INFO]  Build dir:  /mnt/5_hdd/felhom.eu/build/felhom-controller/workspace
+[INFO]  Image:      gitea.dooplex.hu/admin/felhom-controller:0.350.0-rc.1
+
+[STEP]  0/4 — Checking the registry: is 0.350.0-rc.1 already published?
+[INFO]  0.350.0-rc.1 is not present in the registry — proceeding.
+[INFO]  Source tree is clean and at origin/main.
+[STEP]  1/4 — Preparing build workspace...
+[INFO]  Source copied: 1133 Go files
+[STEP]  2/4 — Syncing app assets...
+[INFO]  Synced 263 assets (52 SVG + 16 PNG logos, 195 screenshots)
+[STEP]  3/4 — Preparing Go modules...
+[INFO]  Running go mod tidy...
+[STEP]  4/4 — Building Docker image...
+[INFO]  Building for current platform + pushing...
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 7.32kB done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/golang:1.27.3-trixie@sha256:fbb7ae40b62ff8afe31662df570d39b4f5052ac32b90dae8e60d7657a20a74f4
+#2 ...
+
+#3 [auth] library/debian:pull token for registry-1.docker.io
+#3 DONE 0.0s
+
+#4 [auth] library/golang:pull token for registry-1.docker.io
+#4 DONE 0.0s
+
+#5 [internal] load metadata for docker.io/library/debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
+#5 ...
+
+#2 [internal] load metadata for docker.io/library/golang:1.27.3-trixie@sha256:fbb7ae40b62ff8afe31662df570d39b4f5052ac32b90dae8e60d7657a20a74f4
+#2 DONE 1.0s
+
+#5 [internal] load metadata for docker.io/library/debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
+#5 DONE 1.2s
+
+#6 [internal] load .dockerignore
+#6 transferring context: 2B done
+#6 DONE 0.0s
+
+#7 [builder 1/7] FROM docker.io/library/golang:1.27.3-trixie@sha256:fbb7ae40b62ff8afe31662df570d39b4f5052ac32b90dae8e60d7657a20a74f4
+#7 resolve docker.io/library/golang:1.27.3-trixie@sha256:fbb7ae40b62ff8afe31662df570d39b4f5052ac32b90dae8e60d7657a20a74f4 0.0s done
+#7 DONE 0.0s
+
+#8 [restic 1/3] FROM docker.io/library/debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
+#8 resolve docker.io/library/debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f 0.0s done
+#8 DONE 0.0s
+
+#9 [internal] load build context
+#9 transferring context: 16.86MB 0.2s done
+#9 DONE 0.3s
+
+#10 [builder 2/7] WORKDIR /build
+#10 CACHED
+
+#11 [builder 3/7] COPY go.mod ./
+#11 CACHED
+
+#12 [builder 4/7] RUN go mod download || true
+#12 CACHED
+
+#13 [builder 5/7] COPY . .
+#13 DONE 0.9s
+
+#14 [builder 6/7] RUN go mod tidy
+#14 0.761 go: downloading gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405
+#14 0.849 go: downloading modernc.org/fileutil v1.3.40
+#14 0.850 go: downloading github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e
+#14 0.940 go: downloading golang.org/x/term v0.47.0
+#14 1.564 go: downloading golang.org/x/tools v0.38.0
+#14 1.565 go: downloading modernc.org/goabi0 v0.2.0
+#14 1.565 go: downloading modernc.org/cc/v4 v4.27.1
+#14 1.565 go: downloading modernc.org/ccgo/v4 v4.30.1
+#14 1.717 go: downloading modernc.org/token v1.1.0
+#14 1.718 go: downloading modernc.org/sortutil v1.2.1
+#14 1.718 go: downloading modernc.org/strutil v1.2.1
+#14 1.718 go: downloading modernc.org/opt v0.1.4
+#14 1.820 go: downloading modernc.org/gc/v2 v2.6.5
+#14 1.820 go: downloading golang.org/x/mod v0.29.0
+#14 1.820 go: downloading modernc.org/gc/v3 v3.1.1
+#14 1.989 go: downloading github.com/hashicorp/golang-lru/v2 v2.0.7
+#14 2.265 go: downloading golang.org/x/sync v0.17.0
+#14 DONE 2.6s
+
+#15 [builder 7/7] RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build     -ldflags="-s -w         -X main.Version=0.350.0-rc.1         -X main.BuildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)         -X main.GitCommit=13e34d4"     -o /build/felhom-controller     ./cmd/controller/
+#15 DONE 23.3s
+
+#16 [stage-2 2/7] RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends     ca-certificates     curl     gnupg     git     util-linux     rsync     openssh-client     && rm -rf /var/lib/apt/lists/*
+#16 CACHED
+
+#17 [restic 2/3] COPY third_party/restic/restic-release-key.asc /tmp/restic-release-key.asc
+#17 CACHED
+
+#18 [restic 3/3] RUN set -eu;     apt-get update && apt-get install -y --no-install-recommends ca-certificates curl gnupg gpgv bzip2;     case "amd64" in       amd64) want="f415415624dcc452f2a02b8c33641791a8c6d6d3b65bbb3543fcf9a25151585c" ;;       arm64) want="a5f64aaab53d51e311fa3829124c5b703f2d14cf187d8640b6be3b2b49376465" ;;       *) echo "no pinned restic checksum for architecture 'amd64'" >&2; exit 1 ;;     esac;     f="restic_0.19.1_linux_amd64.bz2";     url="https://github.com/restic/restic/releases/download/v0.19.1";     cd /tmp;     curl -fsSL -o "$f" "$url/$f"; curl -fsSL -o SHA256SUMS "$url/SHA256SUMS"; curl -fsSL -o SHA256SUMS.asc "$url/SHA256SUMS.asc";     gpg --dearmor < /tmp/restic-release-key.asc > /tmp/restic-release-key.gpg;     gpgv --keyring /tmp/restic-release-key.gpg SHA256SUMS.asc SHA256SUMS;     grep " ${f}\$" SHA256SUMS | sha256sum -c -;     echo "${want}  ${f}" | sha256sum -c -;     bunzip2 -c "$f" > /usr/local/bin/restic; chmod 0755 /usr/local/bin/restic;     /usr/local/bin/restic version | grep -q "^restic 0.19.1 "
+#18 CACHED
+
+#19 [stage-2 3/7] COPY --from=restic /usr/local/bin/restic /usr/local/bin/restic
+#19 CACHED
+
+#20 [stage-2 4/7] RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker.gpg     && . /etc/os-release     && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.gpg]        https://download.docker.com/linux/debian ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list     && apt-get update     && apt-get install -y --no-install-recommends docker-ce-cli docker-compose-plugin     && rm -rf /var/lib/apt/lists/*
+#20 CACHED
+
+#21 [stage-2 5/7] RUN mkdir -p /opt/docker/felhom-controller/data
+#21 CACHED
+
+#22 [stage-2 6/7] COPY --from=builder /build/felhom-controller /usr/local/bin/felhom-controller
+#22 DONE 0.1s
+
+#23 [stage-2 7/7] COPY assets/ /usr/share/felhom/assets/
+#23 DONE 0.1s
+
+#24 exporting to image
+#24 exporting layers
+#24 exporting layers 2.4s done
+#24 exporting manifest sha256:5c2e0b26286f0374c885cfb9d48b98b8220b78d143b8218900eb8f01df1d6e96 0.0s done
+#24 exporting config sha256:9e6047ed588084622e9401ed63c8b7ff2fa3f38ebef395ed6c365b2007f4cf0b 0.0s done
+#24 exporting attestation manifest sha256:86c2328f317481c82b8b2356cc12775ecc3db5c67a1718507378a65008f48d65 0.0s done
+#24 exporting manifest list sha256:cbf4d42fd4c86a30854a2f4202b06b6b97073380e0de0bd2fffed524021fd8d4 done
+#24 naming to gitea.dooplex.hu/admin/felhom-controller:0.350.0-rc.1 done
+#24 unpacking to gitea.dooplex.hu/admin/felhom-controller:0.350.0-rc.1
+#24 unpacking to gitea.dooplex.hu/admin/felhom-controller:0.350.0-rc.1 0.5s done
+#24 DONE 2.9s
+[INFO]  Pushing...
+The push refers to repository [gitea.dooplex.hu/admin/felhom-controller]
+44136fa355b3: Waiting
+ecc510c1e359: Waiting
+c3f83389ce1b: Waiting
+3249e53688b6: Waiting
+44136fa355b3: Already exists
+ecc510c1e359: Layer already exists
+c3f83389ce1b: Layer already exists
+d747c9b6922d: Layer already exists
+d3649d86b9dc: Waiting
+e81c1fce9826: Layer already exists
+63a1406b1961: Layer already exists
+8a47c11b7d1f: Waiting
+3249e53688b6: Pushed
+d3649d86b9dc: Pushed
+8a47c11b7d1f: Pushed
+0.350.0-rc.1: digest: sha256:cbf4d42fd4c86a30854a2f4202b06b6b97073380e0de0bd2fffed524021fd8d4 size: 856
+
+[INFO]  ╔══════════════════════════════════════╗
+[INFO]  ║  Build complete ✓                    ║
+[INFO]  ╚══════════════════════════════════════╝
+[INFO]  Image: gitea.dooplex.hu/admin/felhom-controller:0.350.0-rc.1
+[INFO]  Size:  486M
+
diff --git a/documentation/audits/release-2026-11-03/part1/files-signin-9202.txt b/documentation/audits/release-2026-11-03/part1/files-signin-9202.txt
new file mode 100644
index 00000000..73254055
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/files-signin-9202.txt
@@ -0,0 +1,4 @@
+1. dashboard /__files/open -> HTTP/2 302 | to files host: True
+2. files host /_felhom/sso -> HTTP/2 302 | files cookie set: True
+3. a listing through traefik with the files cookie -> 200
+4. the same without any cookie (control) -> 401
diff --git a/documentation/audits/release-2026-11-03/part1/files-signin-boxes.txt b/documentation/audits/release-2026-11-03/part1/files-signin-boxes.txt
new file mode 100644
index 00000000..cd8ef7c6
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/files-signin-boxes.txt
@@ -0,0 +1,12 @@
+== tester-1
+1. dashboard /__files/open -> HTTP/2 302 | to files host: True
+2. files host /_felhom/sso -> HTTP/2 302 | files cookie set: True
+3. a listing through traefik with the files cookie -> 200
+4. the same without any cookie (control) -> 401
+== demo-hp
+login failed: no session cookie
+== demo-hp
+1. dashboard /__files/open -> HTTP/2 302 | to files host: True
+2. files host /_felhom/sso -> HTTP/2 302 | files cookie set: True
+3. a listing through traefik with the files cookie -> 200
+4. the same without any cookie (control) -> 401
diff --git a/documentation/audits/release-2026-11-03/part1/floors-cleared.txt b/documentation/audits/release-2026-11-03/part1/floors-cleared.txt
new file mode 100644
index 00000000..2d9319c7
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/floors-cleared.txt
@@ -0,0 +1,9 @@
+== tester-1
+HTTP/1.1 303 See Other
+Location: /customers/tester-1?flash=floor_set
+== demo-hp
+HTTP/1.1 303 See Other
+Location: /customers/demo-hp?flash=floor_set
+== demo-felhom
+HTTP/1.1 303 See Other
+Location: /customers/demo-felhom?flash=floor_set
diff --git a/documentation/audits/release-2026-11-03/part1/floors-per-box.txt b/documentation/audits/release-2026-11-03/part1/floors-per-box.txt
new file mode 100644
index 00000000..2d9319c7
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/floors-per-box.txt
@@ -0,0 +1,9 @@
+== tester-1
+HTTP/1.1 303 See Other
+Location: /customers/tester-1?flash=floor_set
+== demo-hp
+HTTP/1.1 303 See Other
+Location: /customers/demo-hp?flash=floor_set
+== demo-felhom
+HTTP/1.1 303 See Other
+Location: /customers/demo-felhom?flash=floor_set
diff --git a/documentation/audits/release-2026-11-03/part1/floors-set-at.txt b/documentation/audits/release-2026-11-03/part1/floors-set-at.txt
new file mode 100644
index 00000000..ac92883d
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/floors-set-at.txt
@@ -0,0 +1 @@
+floors set at 2026-11-03T07:04:24Z
diff --git a/documentation/audits/release-2026-11-03/part1/global-floor-readback.txt b/documentation/audits/release-2026-11-03/part1/global-floor-readback.txt
new file mode 100644
index 00000000..07eba46a
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/global-floor-readback.txt
@@ -0,0 +1,3 @@
+2026/11/03 08:18:16 [INFO] Global controller-version floor set to "0.350.0" (declared MinAgent "0.158.1")
+2026/11/03 08:18:16 [INFO] access token "cc-releases-2": POST /configuration/global-floor  303
+page floor: 0.350.0 min_agent: 0.158.1
diff --git a/documentation/audits/release-2026-11-03/part1/global-floor.txt b/documentation/audits/release-2026-11-03/part1/global-floor.txt
new file mode 100644
index 00000000..0da19fbf
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/global-floor.txt
@@ -0,0 +1,3 @@
+2026-11-03T07:18:16Z
+HTTP/1.1 303 See Other
+Location: /configuration?flash=floor_set
diff --git a/documentation/audits/release-2026-11-03/part1/https-only.txt b/documentation/audits/release-2026-11-03/part1/https-only.txt
new file mode 100644
index 00000000..dcd31fd2
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/https-only.txt
@@ -0,0 +1,34 @@
+control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
+== tester-1 (enkicsifelhom.hu): 6 public name(s)
+   OK   control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
+== demo-hp (enkisfelhom.hu): 15 public name(s)
+   OK   http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
+   OK   http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
+   OK   http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
+   OK   http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
+   OK   http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
+   OK   http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
+   OK   http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
+   OK   http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
+   OK   http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
+   OK   http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
+   OK   http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
+   OK   http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
+   OK   http://time.enkisfelhom.hu/r1033-check?q=1 -> 301 https://time.enkisfelhom.hu/r1033-check?q=1
+   OK   http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
+   OK   http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
+== demo-felhom (demo-felhom.eu): 8 public name(s)
+   OK   http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
+   OK   http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
+   OK   http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
+   OK   http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
+   OK   http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
+== every public name redirects http -> https
diff --git a/documentation/audits/release-2026-11-03/part1/load-after.txt b/documentation/audits/release-2026-11-03/part1/load-after.txt
new file mode 100644
index 00000000..d1862902
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/load-after.txt
@@ -0,0 +1,36 @@
+# v3.7.17-after version: 3.7.17
+# v3.7.17-after image: traefik:v3.7.17 sha256:a72cb2f4a2109f1ae52261c86d56b7d33a27dc5c4e211ce3c7835b772338b94f
+t_s,connections,current_MiB,anon_MiB
+0,0,201.1,16.2
+11,926,214.7,25.3
+22,1857,215.0,25.0
+33,2794,214.3,24.9
+44,3729,215.0,25.3
+55,4657,215.2,25.0
+66,5587,216.6,25.9
+77,6520,215.8,25.6
+89,7452,215.9,25.5
+100,8382,215.2,24.9
+111,9307,216.2,25.3
+122,10241,215.4,25.2
+133,11174,215.6,25.4
+144,12109,216.0,25.6
+155,13037,216.6,25.9
+166,13960,216.0,25.7
+177,14885,216.9,25.8
+189,15812,216.2,25.5
+200,16741,217.4,26.2
+211,17677,216.8,25.8
+222,18616,217.4,26.1
+233,19549,216.3,25.4
+244,20482,216.6,25.7
+256,21406,217.4,26.0
+267,22338,217.2,26.3
+278,23261,216.9,25.6
+289,24187,215.8,25.4
+300,25116,215.9,25.4
+# stopped: 300 s passed; 25120 connections in 301 s = 84/s
+# answers: {302: 25067}
+after-stop,311,215.1,25.4
+after-stop,322,214.9,25.4
+after-stop,333,214.7,25.4
diff --git a/documentation/audits/release-2026-11-03/part1/load-before.txt b/documentation/audits/release-2026-11-03/part1/load-before.txt
new file mode 100644
index 00000000..144c6892
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/load-before.txt
@@ -0,0 +1,10 @@
+# v3.7.16-before version: 3.7.16
+# v3.7.16-before image: traefik:v3.7.16 sha256:3733df53e74cd0df7d1b839168e30d2bd7f5e77dd6214ef3d8056ee1f21392b7
+t_s,connections,current_MiB,anon_MiB
+0,0,114.0,18.7
+11,920,179.8,79.0
+# stopped: memory passed twice its start (anon 18.7 -> 79.0 MiB, current 114.0 -> 179.8 MiB); 924 connections in 11 s = 84/s
+# answers: {302: 920}
+after-stop,22,179.5,80.0
+after-stop,33,179.3,80.0
+after-stop,44,179.6,80.0
diff --git a/documentation/audits/release-2026-11-03/part1/public-names.txt b/documentation/audits/release-2026-11-03/part1/public-names.txt
new file mode 100644
index 00000000..3fb4b1dd
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/public-names.txt
@@ -0,0 +1,27 @@
+## public names from outside 2026-11-03T07:14:46Z
+arcade.enkisfelhom.hu 401
+books.enkisfelhom.hu 302
+docs.enkisfelhom.hu 200
+gist.demo-felhom.eu 302
+gist.enkisfelhom.hu 302
+ha.enkisfelhom.hu 200
+paperless.enkicsifelhom.hu 302
+papir.enkisfelhom.hu 302
+paste.enkicsifelhom.hu 200
+paste.enkisfelhom.hu 200
+pdf.enkisfelhom.hu 200
+plex.enkisfelhom.hu 401
+prowlarr.demo-felhom.eu 401
+radarr.demo-felhom.eu 401
+sonarr.demo-felhom.eu 401
+time.enkisfelhom.hu 302
+torrent.demo-felhom.eu 200
+travel.enkisfelhom.hu 200
+wiki.enkicsifelhom.hu 302
+wiki.enkisfelhom.hu 302
+felhom.enkicsifelhom.hu 302
+felhom.enkisfelhom.hu 302
+felhom.demo-felhom.eu 302
+files.enkicsifelhom.hu 200
+files.enkisfelhom.hu 200
+files.demo-felhom.eu 200
diff --git a/documentation/audits/release-2026-11-03/part1/read_boxes.sh b/documentation/audits/release-2026-11-03/part1/read_boxes.sh
new file mode 100755
index 00000000..44a2c4c2
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/read_boxes.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# read_boxes.sh — one line per box, read-only: the controller's image and status, Traefik's image.
+for x in "tester-1 root@192.168.0.154" "demo-hp hp" "demo-felhom felhom-pve"; do set -- $x
+  o=$(ssh -o BatchMode=yes -o ConnectTimeout=10 $2 "pct exec 9201 -- docker ps --format '{{.Names}}|{{.Image}}|{{.Status}}'" 2>&1 | grep -E '^(felhom-controller|traefik)\|')
+  echo "$1: $(echo "$o" | sed 's#gitea.dooplex.hu/admin/felhom-controller:##' | cut -d'|' -f2,3 | tr '\n' ' ')"
+done
diff --git a/documentation/audits/release-2026-11-03/part1/restore-tester1.txt b/documentation/audits/release-2026-11-03/part1/restore-tester1.txt
new file mode 100644
index 00000000..9c129d80
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/restore-tester1.txt
@@ -0,0 +1,32 @@
+image: gitea.dooplex.hu/admin/felhom-controller:0.350.0
+offered: [{'time': '2026-11-03T03:15:36Z', 'short_id': 'helyi', 'tier': 1, 'drive_label': 'Belső SSD (rendszer)'}]
+before, files + count: ['857384e0f0cd2b8f', '5']
+front door before: 200
+marker written: 1
+08:16:28   [R] restoring privatebin from snapshot 'helyi' (of 1 offered)
+08:16:28   [R] POST /backup/restore -> HTTP/2 302 ['location: /backups/restore?flash=flash.restore.started']
+08:16:28       +   0.0s restore (True, None, None)
+08:17:31       +  62.8s restore (False, None, None)
+08:17:31   [R] after restore: state=running hold=None phase=None
+{'ok': True, 'snapshot_id': 'helyi', 'http': 'HTTP/2 302', 'location': ['location: /backups/restore?flash=flash.restore.started'], 'seconds': 62.8, 'state_after': 'running', 'hold_after': None}
+after, files + count: ['857384e0f0cd2b8f', '5']
+marker after (0 = gone): 0
+front door after: 200
+state: running hold: None
+2026/11/03 07:16:31 [INFO] [stacks] Redeploying privatebin from recovery unit with 2 env vars
+2026/11/03 07:16:31 [INFO] [stacks] SaveAppConfig: saved config for privatebin
+2026/11/03 07:16:31 [INFO] [stacks] pin privatebin: privatebin=privatebin/pdo:2.1.0
+2026/11/03 07:16:31 [INFO] [stacks] Starting stack: privatebin
+2026/11/03 07:16:31 [INFO] [stacks] SaveAppConfig: saved config for privatebin
+2026/11/03 07:16:31 [INFO] [stacks] Stack privatebin started successfully (took 0.5s)
+2026/11/03 07:16:31 [INFO] [stacks] installed-images privatebin: recorded 1 service(s) (privatebin=privatebin/pdo:2.1.0 (sha256:3400b0a4714d))
+2026/11/03 07:16:31 [INFO] [stacks] SaveAppConfig: saved config for privatebin
+2026/11/03 07:16:34 [INFO] [stacks] Stack privatebin post-start status:
+2026/11/03 07:16:34 [INFO] [stacks]   privatebin   privatebin/pdo:2.1.0@sha256:3400b0a4714d62161727a710c82a3e319cfea364ac6e591aed653f5bb6bb8055   running   Up 3 seconds (
+2026/11/03 07:16:36 [INFO] [busymark] busy: a backup, a restore or an off-site run is running  an operator reboot of the box is refused until it ends
+2026/11/03 07:17:30 [INFO] [backup] Restore-from-unit completed: privatebin  1 volume(s) of 1 listed, 0 database(s) of 0 listed
+2026/11/03 07:17:30 [INFO] [web] Restore completed (async): stack=privatebin in 1m1.635592685s (volumes 1/1, dbs 0/0)
+2026/11/03 07:17:36 [INFO] [busymark] idle again (was: a backup, a restore or an off-site run is running)  an operator reboot of the box is no longer refused for it
+
+ERROR lines since the press: 0
+container volumes after: 0
diff --git a/documentation/audits/release-2026-11-03/part1/restore_tester1.py b/documentation/audits/release-2026-11-03/part1/restore_tester1.py
new file mode 100644
index 00000000..1ef11938
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/restore_tester1.py
@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+"""One local restore on Tester 1 on the release build (R-1347/R-1348 are restore code). The household's button, privatebin (test data
+only, last night's copy). A marker written after the copy must be gone; the copy's files must read the same; the app answers; no hold.
+usage: SC=<dir> EV=<dir> TARGET=tester-1 python3 restore_tester1.py"""
+import os, sys, time
+sys.path.insert(0, "/mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu/scripts")
+import box_walk as w
+
+V = "/var/lib/docker/volumes/privatebin_privatebin_data/_data"
+LIST = f"cd {V} && find . -type f ! -name restore-marker-1103 -exec sha256sum {{}} + | sort | sha256sum | cut -c1-16; find . -type f | wc -l"
+w.login()
+print("image:", w.guest("docker ps --filter name=^/felhom-controller$ --format '{{.Image}}'").strip())
+print("offered:", w.snapshots("privatebin")[:1])
+print("before, files + count:", w.guest(LIST).split())
+print("front door before:", w.guest("curl -sk -o /dev/null -w '%{http_code}' -H 'Host: paste.enkicsifelhom.hu' https://127.0.0.1/"))
+w.guest(f"date -u > {V}/restore-marker-1103; chown --reference={V} {V}/restore-marker-1103; ls {V}/restore-marker-1103")
+print("marker written:", w.guest(f"ls {V} | grep -c restore-marker-1103").strip())
+t0 = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+rec = w.restore("privatebin")
+print({k: rec.get(k) for k in ("ok", "snapshot_id", "http", "location", "seconds", "state_after", "hold_after")})
+time.sleep(10)
+print("after, files + count:", w.guest(LIST).split())
+print("marker after (0 = gone):", w.guest(f"ls {V} | grep -c restore-marker-1103").strip())
+print("front door after:", w.guest("curl -sk -o /dev/null -w '%{http_code}' -H 'Host: paste.enkicsifelhom.hu' https://127.0.0.1/"))
+st = w.stack("privatebin")
+print("state:", st.get("state"), "hold:", st.get("hold_reason"))
+print(w.guest(f"docker logs --since {t0} felhom-controller 2>&1 | grep -aiE 'restore|privatebin' | grep -av DEBUG | tail -14 | cut -c1-170 | iconv -c -t ascii//TRANSLIT"))
+print("ERROR lines since the press:", w.guest(f"docker logs --since {t0} felhom-controller 2>&1 | grep -c '\\[ERROR\\]'").strip())
+print("container volumes after:", w.guest("docker volume ls --format '{{.Name}}' | grep -c pre-restore").strip())
diff --git a/documentation/audits/release-2026-11-03/part1/rollout-wait.txt b/documentation/audits/release-2026-11-03/part1/rollout-wait.txt
new file mode 100644
index 00000000..c6c029b9
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/rollout-wait.txt
@@ -0,0 +1,31 @@
+07:04:27 tester-1: 0.349.0|Up 3 days (healthy) traefik:v3.7.16|Up 4 days  demo-hp: 0.349.0|Up 4 days (healthy) traefik:v3.7.16|Up 5 days  demo-felhom: 0.349.0|Up 3 hours (healthy) traefik:v3.7.16|Up 3 hours  
+07:04:47 tester-1: traefik:v3.7.17|Up Less than a second 0.350.0|Up 8 seconds (healthy)  demo-hp: 0.350.0|Up 10 seconds (healthy) traefik:v3.7.16|Up 5 days  demo-felhom: traefik:v3.7.17|Up 8 seconds 0.350.0|Up 14 seconds (healthy)  
+07:05:06 tester-1: traefik:v3.7.17|Up 19 seconds 0.350.0|Up 27 seconds (healthy)  demo-hp: traefik:v3.7.17|Up 12 seconds 0.350.0|Up 29 seconds (healthy)  demo-felhom: traefik:v3.7.17|Up 27 seconds 0.350.0|Up 33 seconds (healthy)  
+07:05:25 tester-1: traefik:v3.7.17|Up 38 seconds 0.350.0|Up 47 seconds (healthy)  demo-hp: traefik:v3.7.17|Up 31 seconds 0.350.0|Up 48 seconds (healthy)  demo-felhom: traefik:v3.7.17|Up 47 seconds 0.350.0|Up 52 seconds (healthy)  
+07:05:44 tester-1: traefik:v3.7.17|Up 57 seconds 0.350.0|Up About a minute (healthy)  demo-hp: traefik:v3.7.17|Up 50 seconds 0.350.0|Up About a minute (healthy)  demo-felhom: traefik:v3.7.17|Up About a minute 0.350.0|Up About a minute (healthy)  
+07:06:03 tester-1: traefik:v3.7.17|Up About a minute 0.350.0|Up About a minute (healthy)  demo-hp: traefik:v3.7.17|Up About a minute 0.350.0|Up About a minute (healthy)  demo-felhom: traefik:v3.7.17|Up About a minute 0.350.0|Up About a minute (healthy)  
+07:06:22 tester-1: traefik:v3.7.17|Up About a minute 0.350.0|Up About a minute (healthy)  demo-hp: traefik:v3.7.17|Up About a minute 0.350.0|Up About a minute (healthy)  demo-felhom: traefik:v3.7.17|Up About a minute 0.350.0|Up About a minute (healthy)  
+07:06:41 tester-1: traefik:v3.7.17|Up About a minute 0.350.0|Up 2 minutes (healthy)  demo-hp: traefik:v3.7.17|Up About a minute 0.350.0|Up 2 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 2 minutes 0.350.0|Up 2 minutes (healthy)  
+07:07:00 tester-1: traefik:v3.7.17|Up 2 minutes 0.350.0|Up 2 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 2 minutes 0.350.0|Up 2 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 2 minutes 0.350.0|Up 2 minutes (healthy)  
+07:07:20 tester-1: traefik:v3.7.17|Up 2 minutes 0.350.0|Up 2 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 2 minutes 0.350.0|Up 2 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 2 minutes 0.350.0|Up 2 minutes (healthy)  
+07:07:39 tester-1: traefik:v3.7.17|Up 2 minutes 0.350.0|Up 3 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 2 minutes 0.350.0|Up 3 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 3 minutes 0.350.0|Up 3 minutes (healthy)  
+07:07:58 tester-1: traefik:v3.7.17|Up 3 minutes 0.350.0|Up 3 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 3 minutes 0.350.0|Up 3 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 3 minutes 0.350.0|Up 3 minutes (healthy)  
+07:08:17 tester-1: traefik:v3.7.17|Up 3 minutes 0.350.0|Up 3 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 3 minutes 0.350.0|Up 3 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 3 minutes 0.350.0|Up 3 minutes (healthy)  
+07:08:36 tester-1: traefik:v3.7.17|Up 3 minutes 0.350.0|Up 3 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 3 minutes 0.350.0|Up 3 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 3 minutes 0.350.0|Up 4 minutes (healthy)  
+07:08:55 tester-1: traefik:v3.7.17|Up 4 minutes 0.350.0|Up 4 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 4 minutes 0.350.0|Up 4 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 4 minutes 0.350.0|Up 4 minutes (healthy)  
+07:09:14 tester-1: traefik:v3.7.17|Up 4 minutes 0.350.0|Up 4 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 4 minutes 0.350.0|Up 4 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 4 minutes 0.350.0|Up 4 minutes (healthy)  
+07:09:33 tester-1: traefik:v3.7.17|Up 4 minutes 0.350.0|Up 4 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 4 minutes 0.350.0|Up 4 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 4 minutes 0.350.0|Up 5 minutes (healthy)  
+07:09:53 tester-1: traefik:v3.7.17|Up 5 minutes 0.350.0|Up 5 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 4 minutes 0.350.0|Up 5 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 5 minutes 0.350.0|Up 5 minutes (healthy)  
+07:10:12 tester-1: traefik:v3.7.17|Up 5 minutes 0.350.0|Up 5 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 5 minutes 0.350.0|Up 5 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 5 minutes 0.350.0|Up 5 minutes (healthy)  
+07:10:31 tester-1: traefik:v3.7.17|Up 5 minutes 0.350.0|Up 5 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 5 minutes 0.350.0|Up 5 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 5 minutes 0.350.0|Up 5 minutes (healthy)  
+07:10:50 tester-1: traefik:v3.7.17|Up 6 minutes 0.350.0|Up 6 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 5 minutes 0.350.0|Up 6 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 6 minutes 0.350.0|Up 6 minutes (healthy)  
+07:11:09 tester-1: traefik:v3.7.17|Up 6 minutes 0.350.0|Up 6 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 6 minutes 0.350.0|Up 6 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 6 minutes 0.350.0|Up 6 minutes (healthy)  
+07:11:29 tester-1: traefik:v3.7.17|Up 6 minutes 0.350.0|Up 6 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 6 minutes 0.350.0|Up 6 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 6 minutes 0.350.0|Up 6 minutes (healthy)  
+07:11:48 tester-1: traefik:v3.7.17|Up 7 minutes 0.350.0|Up 7 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 6 minutes 0.350.0|Up 7 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 7 minutes 0.350.0|Up 7 minutes (healthy)  
+07:12:09 tester-1: traefik:v3.7.17|Up 7 minutes 0.350.0|Up 7 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 7 minutes 0.350.0|Up 7 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 7 minutes 0.350.0|Up 7 minutes (healthy)  
+07:12:28 tester-1: traefik:v3.7.17|Up 7 minutes 0.350.0|Up 7 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 7 minutes 0.350.0|Up 7 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 7 minutes 0.350.0|Up 7 minutes (healthy)  
+07:12:47 tester-1: traefik:v3.7.17|Up 8 minutes 0.350.0|Up 8 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 7 minutes 0.350.0|Up 8 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 8 minutes 0.350.0|Up 8 minutes (healthy)  
+07:13:06 tester-1: traefik:v3.7.17|Up 8 minutes 0.350.0|Up 8 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 8 minutes 0.350.0|Up 8 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 8 minutes 0.350.0|Up 8 minutes (healthy)  
+07:13:25 tester-1: traefik:v3.7.17|Up 8 minutes 0.350.0|Up 8 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 8 minutes 0.350.0|Up 8 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 8 minutes 0.350.0|Up 8 minutes (healthy)  
+07:13:44 tester-1: traefik:v3.7.17|Up 8 minutes 0.350.0|Up 9 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 8 minutes 0.350.0|Up 9 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 9 minutes 0.350.0|Up 9 minutes (healthy)  
+07:14:03 tester-1: traefik:v3.7.17|Up 9 minutes 0.350.0|Up 9 minutes (healthy)  demo-hp: traefik:v3.7.17|Up 9 minutes 0.350.0|Up 9 minutes (healthy)  demo-felhom: traefik:v3.7.17|Up 9 minutes 0.350.0|Up 9 minutes (healthy)  
diff --git a/documentation/audits/release-2026-11-03/part1/traefik_load.py b/documentation/audits/release-2026-11-03/part1/traefik_load.py
new file mode 100644
index 00000000..2d46491b
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/traefik_load.py
@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""Traefik GHSA-xv5x load test, scratch 9202 ONLY, from the LAN (the demo-hp host), bounded (brief 2026-11-03 Part 1.3):
+many short TLS connections, each one request with an `Authorization: NTLM` header, to the dashboard route (the controller
+answers it, so the request reaches a backend). Traefik's memory is read every 10 s from its cgroup. The load stops at once when
+memory passes twice its start figure, or at 300 s. Usage on demo-hp: traefik_load.py LABEL"""
+import multiprocessing as mp, os, re, socket, ssl, subprocess, sys, time
+
+GUEST, ADDR, HOST = "9202", "192.168.0.158", "felhom.enkisfelhom.hu"
+MAX_S, STEP_S, WORKERS = 300, 10, 4
+REQ = (f"GET / HTTP/1.1\r\nHost: {HOST}\r\nUser-Agent: felhom-ghsa-xv5x-test\r\nAccept: */*\r\n"
+       "Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=\r\n\r\n").encode()
+
+
+def worker(stop, n, codes):
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    ctx.check_hostname = False
+    ctx.verify_mode = ssl.CERT_NONE
+    while not stop.is_set():
+        try:
+            with socket.create_connection((ADDR, 443), timeout=10) as raw, ctx.wrap_socket(raw, server_hostname=HOST) as s:
+                s.sendall(REQ)
+                head = s.recv(4096)
+            m = re.match(rb"HTTP/1\.1 (\d+)", head)
+            key = int(m.group(1)) if m else 0
+            with n.get_lock():
+                n.value += 1
+            codes[key if 0 <= key < 600 else 0] += 1
+        except OSError:
+            codes[1] += 1
+
+
+def guest(cmd):
+    return subprocess.run(["pct", "exec", GUEST, "--", "sh", "-c", cmd], capture_output=True, text=True, timeout=30).stdout
+
+
+def mem():
+    out = guest('id=$(docker inspect traefik --format {{.Id}}); d=/sys/fs/cgroup/system.slice/docker-$id.scope; '
+                'cat $d/memory.current; grep -E "^anon " $d/memory.stat; docker inspect traefik --format {{.Image}}')
+    lines = out.split()
+    return int(lines[0]), int(lines[2])
+
+
+def main():
+    label = sys.argv[1]
+    print("#", label, "version:", guest("docker exec traefik traefik version | head -1").split()[-1], flush=True)
+    print("#", label, "image:", guest("docker inspect traefik --format '{{.Config.Image}} {{.Image}}'").strip(), flush=True)
+    cur0, anon0 = mem()
+    stop, n = mp.Event(), mp.Value("q", 0)
+    codes = mp.Array("q", 600)
+    procs = [mp.Process(target=worker, args=(stop, n, codes), daemon=True) for _ in range(WORKERS)]
+    print("t_s,connections,current_MiB,anon_MiB", flush=True)
+    print(f"0,0,{cur0/2**20:.1f},{anon0/2**20:.1f}", flush=True)
+    for p in procs:
+        p.start()
+    t0, why = time.time(), f"{MAX_S} s passed"
+    while time.time() - t0 < MAX_S:
+        time.sleep(STEP_S)
+        cur, anon = mem()
+        print(f"{int(time.time()-t0)},{n.value},{cur/2**20:.1f},{anon/2**20:.1f}", flush=True)
+        if anon > 2 * anon0 or cur > 2 * cur0:
+            why = f"memory passed twice its start (anon {anon0/2**20:.1f} -> {anon/2**20:.1f} MiB, current {cur0/2**20:.1f} -> {cur/2**20:.1f} MiB)"
+            break
+    stop.set()
+    for p in procs:
+        p.join(15)
+        if p.is_alive():
+            p.terminate()
+    took = time.time() - t0
+    print(f"# stopped: {why}; {n.value} connections in {took:.0f} s = {n.value/took:.0f}/s", flush=True)
+    print("# answers:", {("failed" if i == 1 else "no status" if i == 0 else i): c for i, c in enumerate(codes) if c}, flush=True)
+    for _ in range(3):
+        time.sleep(STEP_S)
+        cur, anon = mem()
+        print(f"after-stop,{int(time.time()-t0)},{cur/2**20:.1f},{anon/2**20:.1f}", flush=True)
+
+
+main()
diff --git a/documentation/audits/release-2026-11-03/part1/versions-before.txt b/documentation/audits/release-2026-11-03/part1/versions-before.txt
new file mode 100644
index 00000000..b007d17d
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/versions-before.txt
@@ -0,0 +1,4 @@
+## before 2026-11-03T07:04:19Z
+tester-1: 0.349.0|Up 3 days (healthy) traefik:v3.7.16|Up 4 days 
+demo-hp: 0.349.0|Up 4 days (healthy) traefik:v3.7.16|Up 5 days 
+demo-felhom: 0.349.0|Up 3 hours (healthy) traefik:v3.7.16|Up 3 hours 
diff --git a/documentation/audits/release-2026-11-03/part1/walk-3boxes.txt b/documentation/audits/release-2026-11-03/part1/walk-3boxes.txt
new file mode 100644
index 00000000..2a82566e
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/walk-3boxes.txt
@@ -0,0 +1,51 @@
+=== root@192.168.0.154 (enkicsifelhom.hu)
+controller: gitea.dooplex.hu/admin/felhom-controller:0.350.0 Up 9 minutes (healthy)
+traefik: traefik:v3.7.17 sha256:a72cb2f4a2109f1ae52261c86d56b7d33a27dc5c4e211ce3c7835b772338b94f running version 3.7.17
+traefik repo digest: traefik@sha256:68ae5fe5b64ca166704b746a9e8afcd385e36b3f569a5691401bf652d57b3748
+containers: 10 total
+not running/unhealthy: none
+refusals since 2026-11-03T07:04:24Z: 0
+ERROR lines since: 0
+login page: 200
+file manager: 200
+route paste.enkicsifelhom.hu [privatebin]: 200
+route paperless.enkicsifelhom.hu [paperless-webserver]: 302
+route wiki.enkicsifelhom.hu [bookstack]: 302
+=== hp (enkisfelhom.hu)
+controller: gitea.dooplex.hu/admin/felhom-controller:0.350.0 Up 9 minutes (healthy)
+traefik: traefik:v3.7.17 sha256:a72cb2f4a2109f1ae52261c86d56b7d33a27dc5c4e211ce3c7835b772338b94f running version 3.7.17
+traefik repo digest: traefik@sha256:68ae5fe5b64ca166704b746a9e8afcd385e36b3f569a5691401bf652d57b3748
+containers: 26 total
+not running/unhealthy: none
+refusals since 2026-11-03T07:04:24Z: 0
+ERROR lines since: 0
+login page: 200
+file manager: 200
+route arcade.enkisfelhom.hu [romm]: 401
+route paste.enkisfelhom.hu [privatebin]: 200
+route plex.enkisfelhom.hu [plex]: 401
+route papir.enkisfelhom.hu [paperless-webserver]: 302
+route gist.enkisfelhom.hu [opengist]: 302
+route time.enkisfelhom.hu [kimai]: 302
+route ha.enkisfelhom.hu [home-assistant]: 200
+route docs.enkisfelhom.hu [docmost]: 200
+route books.enkisfelhom.hu [calibre-web]: 302
+route wiki.enkisfelhom.hu [bookstack]: 302
+route pdf.enkisfelhom.hu [bentopdf]: 200
+route travel.enkisfelhom.hu [adventurelog]: 200
+route travel.enkisfelhom.hu [adventurelog-frontend]: 200
+=== felhom-pve (demo-felhom.eu)
+controller: gitea.dooplex.hu/admin/felhom-controller:0.350.0 Up 10 minutes (healthy)
+traefik: traefik:v3.7.17 sha256:a72cb2f4a2109f1ae52261c86d56b7d33a27dc5c4e211ce3c7835b772338b94f running version 3.7.17
+traefik repo digest: traefik@sha256:68ae5fe5b64ca166704b746a9e8afcd385e36b3f569a5691401bf652d57b3748
+containers: 9 total
+not running/unhealthy: none
+refusals since 2026-11-03T07:04:24Z: 0
+ERROR lines since: 0
+login page: 200
+file manager: 200
+route sonarr.demo-felhom.eu [sonarr]: 401
+route radarr.demo-felhom.eu [radarr]: 401
+route torrent.demo-felhom.eu [qbittorrent]: 200
+route prowlarr.demo-felhom.eu [prowlarr]: 401
+route gist.demo-felhom.eu [opengist]: 302
diff --git a/documentation/audits/release-2026-11-03/part1/walk-9202-rc1.txt b/documentation/audits/release-2026-11-03/part1/walk-9202-rc1.txt
new file mode 100644
index 00000000..ffc935c1
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/walk-9202-rc1.txt
@@ -0,0 +1,10 @@
+controller: gitea.dooplex.hu/admin/felhom-controller:0.350.0-rc.1 Up 6 minutes (healthy)
+traefik: traefik:v3.7.17 sha256:a72cb2f4a2109f1ae52261c86d56b7d33a27dc5c4e211ce3c7835b772338b94f running version 3.7.17
+traefik repo digest: traefik@sha256:30ff62491aacdb862ceb8c9edcf2627da638d7deafdd4b6dab32fe34f8aa3e90
+containers: 6 total
+not running/unhealthy: none
+refusals since 2026-11-03T06:55:30Z: 0
+ERROR lines since: 0
+login page: 200
+file manager: 200
+route paperless.enkisfelhom.hu [paperless-webserver]: 302
diff --git a/documentation/audits/release-2026-11-03/part1/walk_release.sh b/documentation/audits/release-2026-11-03/part1/walk_release.sh
new file mode 100755
index 00000000..d6b6a33f
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/walk_release.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# walk_release.sh <ssh-host> <vmid> <domain> <since RFC3339> — the release box walk, read-only, from inside the guest:
+# the controller's image and health; Traefik's image and digest; every container up and not unhealthy; the controller log since
+# the switch (refusals, errors); the dashboard login page and the file manager through the box's own proxy (GET only);
+# every app route the box serves, through Traefik with its own Host (the public name is asked apart, from outside).
+H=$1; V=$2; D=$3; SINCE=$4
+ssh -o BatchMode=yes -o ConnectTimeout=15 "$H" "pct exec $V -- bash -s" <<EOF
+echo "controller: \$(docker ps --filter name=^/felhom-controller\$ --format '{{.Image}} {{.Status}}')"
+echo "traefik: \$(docker inspect traefik --format '{{.Config.Image}} {{.Image}} {{.State.Status}}') version \$(docker exec traefik traefik version | head -1 | awk '{print \$2}')"
+echo "traefik repo digest: \$(docker image inspect \$(docker inspect traefik --format '{{.Image}}') --format '{{join .RepoDigests " "}}')"
+echo "containers: \$(docker ps -a --format '{{.Names}}|{{.Status}}' | wc -l) total"
+bad=\$(docker ps -a --format '{{.Names}}|{{.Status}}' | grep -E 'unhealthy|Restarting|Exited|Dead|Created' || true)
+echo "not running/unhealthy: \${bad:-none}"
+echo "refusals since \$(echo $SINCE): \$(docker logs --since $SINCE felhom-controller 2>&1 | grep -ciE 'REFUSED a catalog definition|app_definition_refused|definition refused')"
+echo "ERROR lines since: \$(docker logs --since $SINCE felhom-controller 2>&1 | grep -c '\[ERROR\]')"
+docker logs --since $SINCE felhom-controller 2>&1 | grep '\[ERROR\]' | cut -c1-220 | tail -5
+echo "login page: \$(curl -sk -o /dev/null -w '%{http_code}' -H 'Host: felhom.$D' https://127.0.0.1/login)"
+echo "file manager: \$(curl -sk -o /dev/null -w '%{http_code}' -H 'Host: files.$D' https://127.0.0.1/)"
+for c in \$(docker ps --format '{{.Names}}'); do
+  docker inspect \$c --format '{{json .Config.Labels}}' | grep -o 'Host(\`[^\`]*\`)' | sed 's/Host(\`//; s/\`)//' | sort -u | while read -r h; do
+    echo "route \$h [\$c]: \$(curl -sk -m 20 -o /dev/null -w '%{http_code}' -H "Host: \$h" https://127.0.0.1/)"
+  done
+done
+EOF
diff --git a/documentation/audits/release-2026-11-03/part1/watch-30min.txt b/documentation/audits/release-2026-11-03/part1/watch-30min.txt
new file mode 100644
index 00000000..9036e938
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part1/watch-30min.txt
@@ -0,0 +1,9 @@
+07:18:24 tester-1: traefik:v3.7.17|Up 13 minutes 0.350.0|Up 13 minutes ok  demo-hp: traefik:v3.7.17|Up 13 minutes 0.350.0|Up 13 minutes ok  demo-felhom: traefik:v3.7.17|Up 13 minutes 0.350.0|Up 13 minutes ok   hub error/held/refused lines (3m): 0
+07:21:29 tester-1: traefik:v3.7.17|Up 16 minutes 0.350.0|Up 16 minutes ok  demo-hp: traefik:v3.7.17|Up 16 minutes 0.350.0|Up 16 minutes ok  demo-felhom: traefik:v3.7.17|Up 16 minutes 0.350.0|Up 16 minutes ok   hub error/held/refused lines (3m): 0
+07:24:34 tester-1: traefik:v3.7.17|Up 19 minutes 0.350.0|Up 19 minutes ok  demo-hp: traefik:v3.7.17|Up 19 minutes 0.350.0|Up 19 minutes ok  demo-felhom: traefik:v3.7.17|Up 19 minutes 0.350.0|Up 20 minutes ok   hub error/held/refused lines (3m): 0
+07:27:39 tester-1: traefik:v3.7.17|Up 22 minutes 0.350.0|Up 23 minutes ok  demo-hp: traefik:v3.7.17|Up 22 minutes 0.350.0|Up 23 minutes ok  demo-felhom: traefik:v3.7.17|Up 23 minutes 0.350.0|Up 23 minutes ok   hub error/held/refused lines (3m): 0
+07:30:43 tester-1: traefik:v3.7.17|Up 25 minutes 0.350.0|Up 26 minutes ok  demo-hp: traefik:v3.7.17|Up 25 minutes 0.350.0|Up 26 minutes ok  demo-felhom: traefik:v3.7.17|Up 26 minutes 0.350.0|Up 26 minutes ok   hub error/held/refused lines (3m): 0
+07:33:48 tester-1: traefik:v3.7.17|Up 29 minutes 0.350.0|Up 29 minutes ok  demo-hp: traefik:v3.7.17|Up 28 minutes 0.350.0|Up 29 minutes ok  demo-felhom: traefik:v3.7.17|Up 29 minutes 0.350.0|Up 29 minutes ok   hub error/held/refused lines (3m): 0
+07:36:52 tester-1: traefik:v3.7.17|Up 32 minutes 0.350.0|Up 32 minutes ok  demo-hp: traefik:v3.7.17|Up 31 minutes 0.350.0|Up 32 minutes ok  demo-felhom: traefik:v3.7.17|Up 32 minutes 0.350.0|Up 32 minutes ok   hub error/held/refused lines (3m): 0
+07:39:57 tester-1: traefik:v3.7.17|Up 35 minutes 0.350.0|Up 35 minutes ok  demo-hp: traefik:v3.7.17|Up 35 minutes 0.350.0|Up 35 minutes ok  demo-felhom: traefik:v3.7.17|Up 35 minutes 0.350.0|Up 35 minutes ok   hub error/held/refused lines (3m): 2
+07:43:02 tester-1: traefik:v3.7.17|Up 38 minutes 0.350.0|Up 38 minutes ok  demo-hp: traefik:v3.7.17|Up 38 minutes 0.350.0|Up 38 minutes ok  demo-felhom: traefik:v3.7.17|Up 38 minutes 0.350.0|Up 38 minutes ok   hub error/held/refused lines (3m): 0
diff --git a/documentation/audits/release-2026-11-03/part2/bind.txt b/documentation/audits/release-2026-11-03/part2/bind.txt
new file mode 100644
index 00000000..dac6215a
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part2/bind.txt
@@ -0,0 +1,3 @@
+2026-11-03T07:30:55Z
+HTTP 200
+ Felhom — Doboz összekötése Felhom doboz összekötése Sikeres összekötés. A doboz kb. egy percen belül folytatja a telepítést. Ezt az oldalt bezárhatod — a beállítás a háttérben befejeződik, és a vezérlőpultod hamarosan e
diff --git a/documentation/audits/release-2026-11-03/part2/first-run-vouched-manifest-journal.txt b/documentation/audits/release-2026-11-03/part2/first-run-vouched-manifest-journal.txt
new file mode 100644
index 00000000..3b786ee7
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part2/first-run-vouched-manifest-journal.txt
@@ -0,0 +1,236 @@
+Nov 03 08:30:23 box1103 systemd[1]: Starting felhom-bootstrap.service - Felhom host bootstrap (fetch + run felhom-host-install.sh unattended, retry until success)...
+Nov 03 08:30:23 box1103 felhom-bootstrap.sh[1217]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with the Proxmox admin URL on every boot)
+Nov 03 08:30:23 box1103 felhom-bootstrap.sh[1217]: felhom-bootstrap: console: /etc/issue is the Felhom text (no admin URL)
+Nov 03 08:30:24 box1103 felhom-bootstrap.sh[1217]: felhom-bootstrap: PAIRING mode (generic ISO, no baked customer/passphrase) — hub=https://hub.felhom.eu
+Nov 03 08:30:24 box1103 felhom-bootstrap.sh[1217]: felhom-bootstrap: registering unclaimed appliance at the hub
+Nov 03 08:30:24 box1103 felhom-bootstrap.sh[1217]: felhom-bootstrap: registered — appliance token stored (0600); waiting for the operator or a customer self-bind
+Nov 03 08:30:24 box1103 felhom-bootstrap.sh[1217]: felhom-bootstrap: console font -> Lat2-Terminus16 (Latin-2, ő/ű capable)
+Nov 03 08:30:24 box1103 felhom-bootstrap.sh[1217]: felhom-bootstrap: not bound yet — polling every 30s until the operator or a customer self-bind lands (this is the normal waiting state, not an error)
+Nov 03 08:30:39 box1103 systemd[1]: felhom-bootstrap.service: Main process exited, code=killed, status=15/TERM
+Nov 03 08:30:39 box1103 systemd[1]: felhom-bootstrap.service: Failed with result 'signal'.
+Nov 03 08:30:39 box1103 systemd[1]: Stopped felhom-bootstrap.service - Felhom host bootstrap (fetch + run felhom-host-install.sh unattended, retry until success).
+Nov 03 08:30:39 box1103 systemd[1]: Starting felhom-bootstrap.service - Felhom host bootstrap (fetch + run felhom-host-install.sh unattended, retry until success)...
+Nov 03 08:30:40 box1103 felhom-bootstrap.sh[1498]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with the Proxmox admin URL on every boot)
+Nov 03 08:30:40 box1103 felhom-bootstrap.sh[1498]: felhom-bootstrap: console: /etc/issue is the Felhom text (no admin URL)
+Nov 03 08:30:40 box1103 felhom-bootstrap.sh[1498]: felhom-bootstrap: PAIRING mode (generic ISO, no baked customer/passphrase) — hub=https://hub.felhom.eu
+Nov 03 08:30:40 box1103 felhom-bootstrap.sh[1498]: felhom-bootstrap: console font -> Lat2-Terminus16 (Latin-2, ő/ű capable)
+Nov 03 08:30:40 box1103 felhom-bootstrap.sh[1498]: felhom-bootstrap: not bound yet — polling every 30s until the operator or a customer self-bind lands (this is the normal waiting state, not an error)
+Nov 03 08:31:10 box1103 felhom-bootstrap.sh[1498]: felhom-bootstrap: bind DELIVERED — writing credentials to the env and switching to direct install
+Nov 03 08:31:10 box1103 felhom-bootstrap.sh[1498]: felhom-bootstrap: fetching host-install: https://felhom.eu/scripts/felhom-host-install.sh
+Nov 03 08:31:10 box1103 felhom-bootstrap.sh[1498]: felhom-bootstrap: running host-install (customer=Tester4 mode=appliance hub=https://hub.felhom.eu)
+Nov 03 08:31:10 box1103 felhom-bootstrap.sh[1716]: [INFO]   auto-sized guest RAM: 5847 MiB (host 9943 MiB; clamp(host-4096, min 4096, max host-2048), ceiling host-1024)
+Nov 03 08:31:10 box1103 felhom-bootstrap.sh[1716]: [INFO]   auto-sized guest cores: 5 (host 6 cores; host-1, min 2)
+Nov 03 08:31:10 box1103 felhom-bootstrap.sh[1716]: [INFO] felhom-host-install v1.36.1 — mode=appliance customer=Tester4 vmid=9201
+Nov 03 08:31:10 box1103 felhom-bootstrap.sh[1716]: [STEP] 1/8 pre-flight
+Nov 03 08:31:11 box1103 felhom-bootstrap.sh[1716]: [INFO]   pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve)
+Nov 03 08:31:13 box1103 felhom-bootstrap.sh[1716]: [INFO]   node: box1103 (auto)
+Nov 03 08:31:13 box1103 felhom-bootstrap.sh[1716]: [INFO]   agent config: /etc/felhom-agent/agent.json
+Nov 03 08:31:13 box1103 felhom-bootstrap.sh[1716]: [INFO]   agent: not installed yet — will be fetched + installed in step 5/8
+Nov 03 08:31:13 box1103 felhom-bootstrap.sh[1716]: [INFO]   local-lvm free: ~19 GiB
+Nov 03 08:31:13 box1103 felhom-bootstrap.sh[1716]: [WARN] local-lvm free ~19 GiB is below the recommended 120 GiB — the install continues; proceed only if you sized the grows deliberately
+Nov 03 08:31:13 box1103 felhom-bootstrap.sh[1716]: [INFO]   free RAM: ~8277 MiB
+Nov 03 08:31:15 box1103 felhom-bootstrap.sh[1716]: [INFO]   existing guests on this host: 0 (pct+qm)
+Nov 03 08:31:16 box1103 felhom-bootstrap.sh[1716]: [INFO]   archive storage 'local' present
+Nov 03 08:31:19 box1103 felhom-bootstrap.sh[1716]: [INFO]   acl storage 'felhom-pbs' not present yet — expected: the PBS-DR tier creates it; the grant is pre-positioned deliberately
+Nov 03 08:31:19 box1103 felhom-bootstrap.sh[1716]: [INFO]   dnsmasq: not present before Felhom — recorded; uninstall will remove it again if we install it
+Nov 03 08:31:19 box1103 felhom-bootstrap.sh[1716]: [INFO]   hub reachable (https://hub.felhom.eu)
+Nov 03 08:31:19 box1103 felhom-bootstrap.sh[1716]: [OK]   customer 'Tester4' exists + passphrase valid
+Nov 03 08:31:20 box1103 felhom-bootstrap.sh[1716]: [INFO]   golden: none local — will fetch + verify from Gitea in step 7/8
+Nov 03 08:31:23 box1103 felhom-bootstrap.sh[1716]: [OK] pre-flight passed
+Nov 03 08:31:23 box1103 felhom-bootstrap.sh[1716]: [STEP] 2/8 Proxmox API token
+Nov 03 08:31:28 box1103 felhom-bootstrap.sh[1716]: [OK]   token minted (secret captured, not logged)
+Nov 03 08:31:57 box1103 felhom-bootstrap.sh[1716]: [OK]   scoped ACL applied (Base@/, Guest@/pool/felhom + /vms/990000..990009, Store@[local local-lvm felhom-pbs])
+Nov 03 08:32:00 box1103 felhom-bootstrap.sh[1716]: [SKIP]   old broad role FelhomAgent already absent
+Nov 03 08:32:01 box1103 felhom-bootstrap.sh[1716]: [STEP] 3/8 compute volume grows
+Nov 03 08:32:01 box1103 felhom-bootstrap.sh[1716]: [INFO]   auto-computed from a 19 GiB thin pool (16 §7: 50/100/130 GiB)
+Nov 03 08:32:01 box1103 felhom-bootstrap.sh[1716]: [INFO]   grows: rootfs +0G (->32G), data +26G (->50G, ONE volume)
+Nov 03 08:32:01 box1103 felhom-bootstrap.sh[1716]: [STEP] 4/8 host enrollment (POST /host-enroll)
+Nov 03 08:32:12 box1103 felhom-bootstrap.sh[1716]: [OK]   host MINTED (first enroll)
+Nov 03 08:32:12 box1103 felhom-bootstrap.sh[1716]: [INFO]   host_id: Tester4-58b20b (api_key captured, not logged)
+Nov 03 08:32:12 box1103 felhom-bootstrap.sh[1716]: [STEP] 4b/8 break-glass credential (root@pam console password → hub vault)
+Nov 03 08:32:12 box1103 felhom-bootstrap.sh[1716]: [INFO]   recovery password vaulted at the hub (stored) — now setting it on root@pam
+Nov 03 08:32:12 box1103 chpasswd[2217]: pam_unix(chpasswd:chauthtok): password changed for root
+Nov 03 08:32:13 box1103 felhom-bootstrap.sh[1716]: [OK]   root@pam password vaulted, set, and the PVE login takes it (retrieve via the operator /admin path; never logged here)
+Nov 03 08:32:13 box1103 felhom-bootstrap.sh[1716]: [WARN]   NOTE: the root@pam password just CHANGED — the old one now fails at the PVE web GUI (:8006).
+Nov 03 08:32:13 box1103 felhom-bootstrap.sh[1716]: [WARN]         Retrieve the new one at hub → host page (vaulted recovery credential).
+Nov 03 08:32:13 box1103 felhom-bootstrap.sh[1716]: [STEP] 5/8 agent install (fetch + verify + install)
+Nov 03 08:32:13 box1103 felhom-bootstrap.sh[1716]: [INFO]   disabled pve-enterprise.sources (Enabled: no)
+Nov 03 08:32:13 box1103 felhom-bootstrap.sh[1716]: [INFO]   disabled ceph.sources (Enabled: no)
+Nov 03 08:32:13 box1103 felhom-bootstrap.sh[1716]: [INFO]   added pve-no-subscription.sources (suite=trixie)
+Nov 03 08:32:14 box1103 felhom-bootstrap.sh[1716]: [OK]   apt repos aligned to no-subscription (changed; apt-get update OK)
+Nov 03 08:32:15 box1103 felhom-bootstrap.sh[1716]: [WARN]   no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged)
+Nov 03 08:32:15 box1103 felhom-bootstrap.sh[1716]: [INFO]   manifest: agent v0.171.0 (sha c888ca7ba22a1f68…), golden v0.344.0
+Nov 03 08:32:15 box1103 felhom-bootstrap.sh[1716]: [INFO]   fetching agent binary v0.171.0 from Gitea …
+Nov 03 08:32:15 box1103 felhom-bootstrap.sh[1716]: [OK]   verified sha256 c888ca7ba22a1f68… matches the hub manifest
+Nov 03 08:32:15 box1103 felhom-bootstrap.sh[1716]: [OK]   installed /usr/local/bin/felhom-agent (felhom-agent 0.171.0)
+Nov 03 08:32:15 box1103 felhom-bootstrap.sh[1716]: [INFO]   installing the 'sudo' package (required for the non-root agent model) …
+Nov 03 08:32:20 box1103 felhom-bootstrap.sh[1716]: [OK]   sudo installed (Sudo version 1.9.16p2)
+Nov 03 08:32:20 box1103 felhom-bootstrap.sh[1716]: [INFO]   installing the 'age' package (escrow ceremony identity-wrap dependency) …
+Nov 03 08:32:24 box1103 felhom-bootstrap.sh[1716]: [OK]   age installed (1.2.1)
+Nov 03 08:32:24 box1103 useradd[2507]: new group: name=felhom-agent, GID=990
+Nov 03 08:32:24 box1103 useradd[2507]: new user: name=felhom-agent, UID=999, GID=990, home=/home/felhom-agent, shell=/usr/sbin/nologin, from=none
+Nov 03 08:32:24 box1103 felhom-bootstrap.sh[1716]: [OK]   created service user felhom-agent
+Nov 03 08:32:24 box1103 usermod[2515]: add 'felhom-agent' to group 'systemd-journal'
+Nov 03 08:32:24 box1103 usermod[2515]: add 'felhom-agent' to shadow group 'systemd-journal'
+Nov 03 08:32:24 box1103 felhom-bootstrap.sh[1716]: [OK]   added felhom-agent to systemd-journal (unprivileged journal read for NAS verify)
+Nov 03 08:32:26 box1103 useradd[2532]: new group: name=felhom-op, GID=1000
+Nov 03 08:32:26 box1103 useradd[2532]: new user: name=felhom-op, UID=1000, GID=1000, home=/home/felhom-op, shell=/bin/bash, from=none
+Nov 03 08:32:26 box1103 felhom-bootstrap.sh[1716]: [OK]   verified sha256 95f977f6dc827185… matches the hub manifest
+Nov 03 08:32:27 box1103 felhom-os-apply[2570]: os-apply: BUNDLE START agent=0.171.0 sha=95f977f6dc827185 authority=installer files=32 write=31 same=1 kept=0 skipped=0
+Nov 03 08:32:27 box1103 felhom-os-apply[2571]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mkfs-guarded (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2572]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-selfupdate-guarded (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2573]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-pbs-apply (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2574]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-backup-target-apply (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2575]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-vzdump-partial-clean (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2576]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-thin-check (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2577]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-internal-place (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2578]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-crash-guard (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2579]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-priv-apply (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2580]: os-apply: BUNDLE WROTE /var/lib/vz/snippets/felhom-guest-hook.sh (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2581]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-shared-parent.sh (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2582]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-shared-parent.service (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2583]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard.service (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2584]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.service (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2585]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.timer (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2586]: os-apply: BUNDLE WROTE /etc/felhom/crash-guard.conf (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2587]: os-apply: BUNDLE WROTE /etc/grub.d/01_felhom_oneshot (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2588]: os-apply: BUNDLE WROTE /etc/grub.d/42_felhom_oneshot (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2589]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2590]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent-rollback.service (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2591]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service.d/felhom-agent-limits.conf (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2592]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mgmt-watchdog (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2593]: os-apply: BUNDLE WROTE /etc/tmpfiles.d/felhom-privsep.conf (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2594]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.service (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2595]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.timer (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2596]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-sshd.service (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2597]: os-apply: BUNDLE WROTE /etc/felhom-oob.nft (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2598]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-oob-nft.service (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2599]: os-apply: BUNDLE WROTE /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2600]: os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-op (new)
+Nov 03 08:32:27 box1103 felhom-os-apply[2601]: os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-agent (new)
+Nov 03 08:32:28 box1103 felhom-os-apply[2730]: os-apply: BUNDLE DONE agent=0.171.0 written=31 same=1 self-check=ok signers-created=False
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE START agent=0.171.0 sha=95f977f6dc827185 authority=installer files=32 write=31 same=1 kept=0 skipped=0
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mkfs-guarded (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-selfupdate-guarded (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-pbs-apply (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-backup-target-apply (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-vzdump-partial-clean (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-thin-check (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-internal-place (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-crash-guard (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-priv-apply (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /var/lib/vz/snippets/felhom-guest-hook.sh (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-shared-parent.sh (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-shared-parent.service (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard.service (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.service (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.timer (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/felhom/crash-guard.conf (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/grub.d/01_felhom_oneshot (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/grub.d/42_felhom_oneshot (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent-rollback.service (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service.d/felhom-agent-limits.conf (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mgmt-watchdog (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/tmpfiles.d/felhom-privsep.conf (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.service (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.timer (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-sshd.service (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/felhom-oob.nft (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-oob-nft.service (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-op (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-agent (new)
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[2733]:   os-apply: BUNDLE DONE agent=0.171.0 written=31 same=1 self-check=ok signers-created=False
+Nov 03 08:32:28 box1103 felhom-bootstrap.sh[1716]: [OK]   installed every root-owned file from config bundle v0.171.0 (sha 95f977f6dc827185…; checked, previous copies kept)
+Nov 03 08:32:29 box1103 felhom-bootstrap.sh[1716]: [OK]   OOB felhom-sshd instance + static belt from the bundle (agent renders config + fills sets once oob.enabled)
+Nov 03 08:32:29 box1103 felhom-bootstrap.sh[1716]: [STEP] 5b/8 internal data place (Belső tárhely)
+Nov 03 08:32:31 box1103 felhom-bootstrap.sh[1716]: [INFO]   no internal place: only -79 GiB free for it (pool 19, reserve 16, promised 0, planned 82; needs 20)
+Nov 03 08:32:31 box1103 felhom-bootstrap.sh[1716]: [STEP] 6/8 agent config + service
+Nov 03 08:32:32 box1103 felhom-bootstrap.sh[1716]: [WARN]   backup target: DEGRADED — no eligible second drive, so the whole-system backup stays on the SYSTEM drive.
+Nov 03 08:32:32 box1103 felhom-bootstrap.sh[1716]: [WARN]   It protects against file corruption but NOT against a disk failure. Attach a second drive and assign it in the dashboard.
+Nov 03 08:32:32 box1103 felhom-bootstrap.sh[1716]: [INFO]   creating island bridge vmbr9 (portless, 169.254.253.1/30)
+Nov 03 08:32:32 box1103 felhom-bootstrap.sh[1716]: [OK]   vmbr9 up: 169.254.253.1/30
+Nov 03 08:32:32 box1103 felhom-bootstrap.sh[1716]: [INFO]   R-50 island ON: local_api=169.254.253.1:8443 (vmbr9); guest net1=169.254.253.2/30; lan_resolver.host_ip=192.168.0.126
+Nov 03 08:32:32 box1103 felhom-bootstrap.sh[1716]: [INFO]   node=box1103  local_api=169.254.253.1:8443  tls_fp=DE:30:AC:4C:D2:A4…
+Nov 03 08:32:33 box1103 felhom-bootstrap.sh[1716]: [OK]   wrote /etc/felhom-agent/agent.json (0600 felhom-agent)
+Nov 03 08:32:33 box1103 felhom-bootstrap.sh[1716]: [OK]   agent --selftest (read-only) passed
+Nov 03 08:32:36 box1103 felhom-bootstrap.sh[1716]: [OK]   felhom-agent service active (non-root felhom-agent reads the config OK)
+Nov 03 08:32:36 box1103 felhom-bootstrap.sh[1716]: [OK]   wrote /etc/felhom/os-trust.json + operator-signers (felhom-op-1) — the root-owned slow-lane anchors
+Nov 03 08:32:36 box1103 felhom-bootstrap.sh[1716]: [STEP] 7/8 golden archive
+Nov 03 08:32:36 box1103 felhom-bootstrap.sh[1716]: [WARN]   no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged)
+Nov 03 08:32:37 box1103 felhom-bootstrap.sh[1716]: [INFO]   fetching golden v0.344.0 from Gitea → /var/lib/vz/dump/vzdump-lxc-9100-2026_11_03-08_32_37.tar.zst
+Nov 03 08:32:47 box1103 felhom-bootstrap.sh[1716]: [OK]   verified sha256 767a90fe07ed47c8… matches the hub manifest
+Nov 03 08:32:47 box1103 felhom-bootstrap.sh[1716]: [OK]   golden imported + verified: local:backup/vzdump-lxc-9100-2026_11_03-08_32_37.tar.zst
+Nov 03 08:32:48 box1103 felhom-bootstrap.sh[1716]: [STEP] 8/8 provision guest 9201
+Nov 03 08:32:49 box1103 felhom-bootstrap.sh[1716]: [SKIP]   pool felhom already exists
+Nov 03 08:32:49 box1103 felhom-bootstrap.sh[4074]: === felhom-agent 0.171.0 selftest=provision (vmid=9201 customer=Tester4 hostname=tester4) ===
+Nov 03 08:32:49 box1103 felhom-bootstrap.sh[4074]:   --- front half: bring-up (provision) local:backup/vzdump-lxc-9100-2026_11_03-08_32_37.tar.zst → vmid 9201 ---
+Nov 03 08:34:03 box1103 felhom-bootstrap.sh[4074]: time=2026-11-03T08:34:03.294+01:00 level=INFO msg="bring-up: pool membership re-asserted" vmid=9201 pool=felhom
+Nov 03 08:34:03 box1103 felhom-bootstrap.sh[4074]:   [OK] front half: vmid 9201 up (boot+running) in 1m14s; MAC=BC:24:11:B5:1C:21
+Nov 03 08:34:03 box1103 felhom-bootstrap.sh[4074]:   --- back half: mint per-guest token + populate bootstrap config mount ---
+Nov 03 08:34:03 box1103 sudo[5461]:     root : PWD=/ ; USER=root ; COMMAND=/usr/bin/chown --reference=/var/lib/felhom-agent /var/lib/felhom-agent/guests /var/lib/felhom-agent/guests/9201
+Nov 03 08:34:03 box1103 sudo[5461]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+Nov 03 08:34:03 box1103 sudo[5461]: pam_unix(sudo:session): session closed for user root
+Nov 03 08:34:03 box1103 sudo[5464]:     root : PWD=/ ; USER=root ; COMMAND=/usr/bin/chown -R 100000:100000 /var/lib/felhom-agent/guests/9201/bootstrap
+Nov 03 08:34:03 box1103 sudo[5464]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+Nov 03 08:34:03 box1103 sudo[5464]: pam_unix(sudo:session): session closed for user root
+Nov 03 08:34:03 box1103 sudo[5467]:     root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 -mp9 /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1
+Nov 03 08:34:03 box1103 sudo[5467]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+Nov 03 08:34:04 box1103 sudo[5467]: pam_unix(sudo:session): session closed for user root
+Nov 03 08:34:04 box1103 sudo[5514]:     root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 -onboot 1
+Nov 03 08:34:04 box1103 sudo[5514]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+Nov 03 08:34:05 box1103 sudo[5514]: pam_unix(sudo:session): session closed for user root
+Nov 03 08:34:05 box1103 sudo[5824]:     root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 --hookscript local:snippets/felhom-guest-hook.sh
+Nov 03 08:34:05 box1103 sudo[5824]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+Nov 03 08:34:06 box1103 sudo[5824]: pam_unix(sudo:session): session closed for user root
+Nov 03 08:34:06 box1103 sudo[6230]:     root : PWD=/ ; USER=root ; COMMAND=/usr/bin/mkdir -p /mnt/felhom-drives
+Nov 03 08:34:06 box1103 sudo[6230]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+Nov 03 08:34:06 box1103 sudo[6230]: pam_unix(sudo:session): session closed for user root
+Nov 03 08:34:06 box1103 sudo[6233]:     root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 -mp8 /mnt/felhom-drives,mp=/mnt/felhom-drives
+Nov 03 08:34:06 box1103 sudo[6233]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+Nov 03 08:34:08 box1103 sudo[6233]: pam_unix(sudo:session): session closed for user root
+Nov 03 08:34:08 box1103 felhom-bootstrap.sh[4074]: time=2026-11-03T08:34:08.121+01:00 level=INFO msg="provision: back-half complete" vmid=9201 mount=mp9 guest_path=/etc/felhom-bootstrap endpoint=169.254.253.1:8443
+Nov 03 08:34:08 box1103 felhom-bootstrap.sh[4074]:   [OK] back half: bootstrap mount mp9 → /etc/felhom-bootstrap on vmid 9201 (host dir /var/lib/felhom-agent/guests/9201/bootstrap)
+Nov 03 08:34:08 box1103 felhom-bootstrap.sh[4074]:   local-api endpoint 169.254.253.1:8443 · leaf fp <long> · token: minted (not printed)
+Nov 03 08:34:08 box1103 felhom-bootstrap.sh[4074]: === selftest=provision OK — guest 9201 provisioned + bootstrap-mounted (KEPT) ===
+Nov 03 08:34:08 box1103 felhom-bootstrap.sh[4074]:     next: reboot the guest → the golden's baked controller-bootstrap unit deploys the controller,
+Nov 03 08:34:08 box1103 felhom-bootstrap.sh[4074]:     which PULLS its controller.yaml from the hub (retrieval passphrase) and merges in this local_api.
+Nov 03 08:34:08 box1103 felhom-bootstrap.sh[1716]: [OK]   provision completed
+Nov 03 08:34:08 box1103 felhom-bootstrap.sh[1716]: [INFO]   rebooting guest 9201 so the baked controller-bootstrap unit picks up the mount
+Nov 03 08:34:09 box1103 pct[6392]: <root@pam> starting task UPID:box1103:000018FE:00005F56:6AE98E71:vzreboot:9201:root@pam:
+Nov 03 08:34:09 box1103 pct[6398]: requesting reboot of CT 9201: UPID:box1103:000018FE:00005F56:6AE98E71:vzreboot:9201:root@pam:
+Nov 03 08:34:19 box1103 pct[6392]: <root@pam> end task UPID:box1103:000018FE:00005F56:6AE98E71:vzreboot:9201:root@pam: OK
+Nov 03 08:34:19 box1103 felhom-bootstrap.sh[1716]: [STEP] verify
+Nov 03 08:34:20 box1103 felhom-bootstrap.sh[1716]: [OK]   pct status: running
+Nov 03 08:34:22 box1103 felhom-bootstrap.sh[1716]: [OK]   onboot: 1
+Nov 03 08:34:23 box1103 felhom-bootstrap.sh[7448]:     mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=50G
+Nov 03 08:34:23 box1103 felhom-bootstrap.sh[7448]:     mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
+Nov 03 08:34:23 box1103 felhom-bootstrap.sh[7448]:     rootfs: local-lvm:vm-9201-disk-0,size=32G
+Nov 03 08:34:25 box1103 felhom-bootstrap.sh[1716]: [OK]   pool: guest 9201 is a member of felhom
+Nov 03 08:34:26 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentBase@/ present (user+token)
+Nov 03 08:34:27 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentGuest@/pool/felhom present (user+token)
+Nov 03 08:34:28 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentStore@/storage/local present (user+token)
+Nov 03 08:34:30 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentStore@/storage/local-lvm present (user+token)
+Nov 03 08:34:31 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentStore@/storage/felhom-pbs present (user+token)
+Nov 03 08:34:33 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentGuest@/vms/990000 present (user+token)
+Nov 03 08:34:34 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentGuest@/vms/990001 present (user+token)
+Nov 03 08:34:35 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentGuest@/vms/990002 present (user+token)
+Nov 03 08:34:37 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentGuest@/vms/990003 present (user+token)
+Nov 03 08:34:40 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentGuest@/vms/990004 present (user+token)
+Nov 03 08:34:42 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentGuest@/vms/990005 present (user+token)
+Nov 03 08:34:43 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentGuest@/vms/990006 present (user+token)
+Nov 03 08:34:45 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentGuest@/vms/990007 present (user+token)
+Nov 03 08:34:46 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentGuest@/vms/990008 present (user+token)
+Nov 03 08:34:47 box1103 felhom-bootstrap.sh[1716]: [OK]   acl: FelhomAgentGuest@/vms/990009 present (user+token)
+Nov 03 08:34:47 box1103 felhom-bootstrap.sh[1716]: [OK]   authz signers: 2 (operator-signed self-update armed)
+Nov 03 08:34:48 box1103 felhom-bootstrap.sh[1716]: [OK]   controller: Up 8 seconds (healthy) (after ~0s)
+Nov 03 08:34:50 box1103 felhom-bootstrap.sh[1716]: [INFO]   controller image: gitea.dooplex.hu/admin/felhom-controller:0.350.0
+Nov 03 08:34:51 box1103 felhom-bootstrap.sh[1716]: [WARN]   cloudflared not visible yet
+Nov 03 08:34:51 box1103 felhom-bootstrap.sh[1716]: [INFO]   (confirm in the hub UI that host Tester4-58b20b reports guest 9201)
+Nov 03 08:34:51 box1103 felhom-bootstrap.sh[1716]: [OK] Day-0 provision SUCCESS — vmid=9201 host_id=Tester4-58b20b customer=Tester4 golden=local:backup/vzdump-lxc-9100-2026_11_03-08_32_37.tar.zst
+Nov 03 08:34:51 box1103 felhom-bootstrap.sh[1716]: [INFO] root@pam was rotated + vaulted at step 4b — retrieve at hub → host page (the old GUI password no longer works).
+Nov 03 08:34:51 box1103 felhom-bootstrap.sh[1498]: felhom-bootstrap: host-install SUCCESS — writing done-flag, disabling unit, scrubbing secrets
+Nov 03 08:34:51 box1103 systemd[1]: felhom-bootstrap.service: Deactivated successfully.
+Nov 03 08:34:51 box1103 systemd[1]: Finished felhom-bootstrap.service - Felhom host bootstrap (fetch + run felhom-host-install.sh unattended, retry until success).
+Nov 03 08:34:51 box1103 systemd[1]: felhom-bootstrap.service: Consumed 1min 54.782s CPU time, 887.9M memory peak.
diff --git a/documentation/audits/release-2026-11-03/part2/install/01-boot.png b/documentation/audits/release-2026-11-03/part2/install/01-boot.png
new file mode 100644
index 00000000..1447fc7b
Binary files /dev/null and b/documentation/audits/release-2026-11-03/part2/install/01-boot.png differ
diff --git a/documentation/audits/release-2026-11-03/part2/install/02-eula.png b/documentation/audits/release-2026-11-03/part2/install/02-eula.png
new file mode 100644
index 00000000..d76ff26b
Binary files /dev/null and b/documentation/audits/release-2026-11-03/part2/install/02-eula.png differ
diff --git a/documentation/audits/release-2026-11-03/part2/install/03-disk.png b/documentation/audits/release-2026-11-03/part2/install/03-disk.png
new file mode 100644
index 00000000..3e9dd12e
Binary files /dev/null and b/documentation/audits/release-2026-11-03/part2/install/03-disk.png differ
diff --git a/documentation/audits/release-2026-11-03/part2/install/04-location.png b/documentation/audits/release-2026-11-03/part2/install/04-location.png
new file mode 100644
index 00000000..ce55828d
Binary files /dev/null and b/documentation/audits/release-2026-11-03/part2/install/04-location.png differ
diff --git a/documentation/audits/release-2026-11-03/part2/install/05-password.png b/documentation/audits/release-2026-11-03/part2/install/05-password.png
new file mode 100644
index 00000000..f475cc97
Binary files /dev/null and b/documentation/audits/release-2026-11-03/part2/install/05-password.png differ
diff --git a/documentation/audits/release-2026-11-03/part2/install/06-network.png b/documentation/audits/release-2026-11-03/part2/install/06-network.png
new file mode 100644
index 00000000..5ae6bd4e
Binary files /dev/null and b/documentation/audits/release-2026-11-03/part2/install/06-network.png differ
diff --git a/documentation/audits/release-2026-11-03/part2/install/07-summary.png b/documentation/audits/release-2026-11-03/part2/install/07-summary.png
new file mode 100644
index 00000000..7b9131d6
Binary files /dev/null and b/documentation/audits/release-2026-11-03/part2/install/07-summary.png differ
diff --git a/documentation/audits/release-2026-11-03/part2/install/08-installing.png b/documentation/audits/release-2026-11-03/part2/install/08-installing.png
new file mode 100644
index 00000000..1353e819
Binary files /dev/null and b/documentation/audits/release-2026-11-03/part2/install/08-installing.png differ
diff --git a/documentation/audits/release-2026-11-03/part2/install/09-progress.png b/documentation/audits/release-2026-11-03/part2/install/09-progress.png
new file mode 100644
index 00000000..f3a1fb7f
Binary files /dev/null and b/documentation/audits/release-2026-11-03/part2/install/09-progress.png differ
diff --git a/documentation/audits/release-2026-11-03/part2/install/10-console.png b/documentation/audits/release-2026-11-03/part2/install/10-console.png
new file mode 100644
index 00000000..cb60a796
Binary files /dev/null and b/documentation/audits/release-2026-11-03/part2/install/10-console.png differ
diff --git a/documentation/audits/release-2026-11-03/part2/install/install-pressed.txt b/documentation/audits/release-2026-11-03/part2/install/install-pressed.txt
new file mode 100644
index 00000000..b0900535
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part2/install/install-pressed.txt
@@ -0,0 +1 @@
+Install pressed 07:26:33Z
diff --git a/documentation/audits/release-2026-11-03/part2/installer-the-one-line.diff.txt b/documentation/audits/release-2026-11-03/part2/installer-the-one-line.diff.txt
new file mode 100644
index 00000000..e65a51ff
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part2/installer-the-one-line.diff.txt
@@ -0,0 +1,2 @@
+479a480
+>     ART_AGENT_VER=0.172.0; ART_AGENT_SHA=2c0222cd01713f65c627d6d17c18b4a8b2b1e0c39881db0df7ccb17de48e24c7; ART_BUNDLE_SHA=cc34b0bc3346ffd6
diff --git a/documentation/audits/release-2026-11-03/part2/uninstall-first-run.txt b/documentation/audits/release-2026-11-03/part2/uninstall-first-run.txt
new file mode 100644
index 00000000..690af0bc
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part2/uninstall-first-run.txt
@@ -0,0 +1,111 @@
+
+[INFO] felhom-host-install v1.36.1 — mode=uninstall
+
+[STEP] UNINSTALL — local host teardown
+[INFO]   vmid 9201 looks like a Felhom guest (has the /etc/felhom-bootstrap mount)
+[INFO]   pct config 9201:
+    arch: amd64
+    cores: 5
+    features: nesting=1,keyctl=1
+    hookscript: local:snippets/felhom-guest-hook.sh
+    hostname: tester4
+    memory: 5847
+    mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=50G
+    mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
+    mp9: /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1
+    net0: name=eth0,bridge=vmbr0,hwaddr=BC:24:11:B5:1C:21,ip=dhcp,type=veth
+    net1: name=eth1,bridge=vmbr9,hwaddr=BC:24:11:F5:D8:D1,ip=169.254.253.2/30,type=veth
+    onboot: 1
+    ostype: debian
+    rootfs: local-lvm:vm-9201-disk-0,size=32G
+    swap: 5847
+    unprivileged: 1
+Type the vmid (9201) to confirm PERMANENT destruction: 9201
+  Logical volume "vm-9201-disk-0" successfully removed.
+  Logical volume "vm-9201-disk-1" successfully removed.
+[OK]   guest 9201 destroyed
+[STEP] host-level removal
+Removed '/etc/systemd/system/multi-user.target.wants/felhom-agent.service'.
+[OK]   removed /etc/felhom-agent (the agent config and every copy of it)
+Removed '/etc/systemd/system/multi-user.target.wants/wg-quick@wg-felhom.service'.
+[OK]   WireGuard tunnel to the Felhom off-site endpoint is down (wg-quick@wg-felhom disabled, conf removed)
+Removed '/etc/systemd/system/timers.target.wants/felhom-mgmt-watchdog.timer'.
+Removed '/etc/systemd/system/multi-user.target.wants/felhom-sshd.service'.
+Removed '/etc/systemd/system/multi-user.target.wants/felhom-oob-nft.service'.
+The unit files have no installation config (WantedBy=, RequiredBy=, UpheldBy=,
+Also=, or Alias= settings in the [Install] section, and DefaultInstance= for
+template units). This means they are not meant to be enabled or disabled using systemctl.
+ 
+Possible reasons for having these kinds of units are:
+• A unit may be statically enabled by being symlinked from another unit's
+  .wants/, .requires/, or .upholds/ directory.
+• A unit's purpose may be to act as a helper for some other unit which has
+  a requirement dependency on it.
+• A unit may be started when needed via activation (socket, path, timer,
+  D-Bus, udev, scripted systemctl call, ...).
+• In case of template units, the unit is meant to be enabled with some
+  instance name specified.
+Removed '/etc/systemd/system/pve-guests.service.wants/felhom-shared-parent.service'.
+Removed '/etc/systemd/system/multi-user.target.wants/felhom-shared-parent.service'.
+Generating grub configuration file ...
+Found linux image: /boot/vmlinuz-7.0.2-6-pve
+Found initrd image: /boot/initrd.img-7.0.2-6-pve
+Found memtest86+ 64bit EFI image: /boot/memtest86+x64.efi
+Found memtest86+ 32bit EFI image: /boot/memtest86+ia32.efi
+Found memtest86+ 64bit image: /boot/memtest86+x64.bin
+Found memtest86+ 32bit image: /boot/memtest86+ia32.bin
+Adding boot menu entry for UEFI Firmware Settings ...
+done
+[INFO]   dnsmasq was installed by Felhom (recorded at install) — stopping + disabling it
+Synchronizing state of dnsmasq.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
+Executing: /usr/lib/systemd/systemd-sysv-install disable dnsmasq
+Removed '/etc/systemd/system/multi-user.target.wants/dnsmasq.service'.
+[INFO]   dnsmasq: removing the package(s) Felhom installed: dnsmasq dnsmasq-base
+Reading package lists... 0%Reading package lists... 100%Reading package lists... Done
+Building dependency tree... 0%Building dependency tree... 0%Building dependency tree... 50%Building dependency tree... 50%Building dependency tree... Done
+Reading state information... 0% Reading state information... 48%Reading state information... Done
+The following packages will be REMOVED:
+  dnsmasq* dnsmasq-base*
+0 upgraded, 0 newly installed, 2 to remove and 194 not upgraded.
+After this operation, 1,303 kB disk space will be freed.
+(Reading database ... (Reading database ... 5%(Reading database ... 10%(Reading database ... 15%(Reading database ... 20%(Reading database ... 25%(Reading database ... 30%(Reading database ... 35%(Reading database ... 40%(Reading database ... 45%(Reading database ... 50%(Reading database ... 55%(Reading database ... 60%(Reading database ... 65%(Reading database ... 70%(Reading database ... 75%(Reading database ... 80%(Reading database ... 85%(Reading database ... 90%(Reading database ... 95%(Reading database ... 100%(Reading database ... 52606 files and directories currently installed.)
+Removing dnsmasq (2.91-1+deb13u2) ...
+Removing dnsmasq-base (2.91-1+deb13u2) ...
+Processing triggers for dbus (1.16.2-2) ...
+Processing triggers for man-db (2.13.1-1) ...
+(Reading database ... (Reading database ... 5%(Reading database ... 10%(Reading database ... 15%(Reading database ... 20%(Reading database ... 25%(Reading database ... 30%(Reading database ... 35%(Reading database ... 40%(Reading database ... 45%(Reading database ... 50%(Reading database ... 55%(Reading database ... 60%(Reading database ... 65%(Reading database ... 70%(Reading database ... 75%(Reading database ... 80%(Reading database ... 85%(Reading database ... 90%(Reading database ... 95%(Reading database ... 100%(Reading database ... 52554 files and directories currently installed.)
+Purging configuration files for dnsmasq-base (2.91-1+deb13u2) ...
+Purging configuration files for dnsmasq (2.91-1+deb13u2) ...
+[OK]   dnsmasq removed — the next install starts from a clean slate, as a first install
+[SKIP]   old broad role FelhomAgent already absent
+Removed volume 'local:backup/vzdump-lxc-9100-2026_11_03-08_32_37.tar.zst'
+[OK]   removed golden vzdump(s) from local
+
+[STEP] kept vs wiped — read before pulling drives or closing the customer out
+  WIPED (this run):
+    - guest 9201 (container + its OS/Docker/user-data volumes)
+    - the felhom-agent: binary, unit, sudoers (+ its copies), state dir, service user, and its config
+      directory with every copy of the config in it
+    - the WireGuard tunnel to the Felhom off-site endpoint (wg-quick@wg-felhom disabled, /etc/wireguard/wg-felhom.conf removed)
+    - self-update artifacts: guarded wrapper, A/B slots (.prev/.new.*), rollback unit, start-limit drop-in
+    - break-glass watchdog + OOB artifacts (where present); guest-hook snippet; dnsmasq snippets; the mkfs, pbs-apply,
+      backup-target-apply, os-apply and priv-apply wrappers; the crash guard; the config-bundle record
+    - pveum: the Felhom roles/user/token/scoped ACL; the emptied felhom pool
+    - the install state file
+    - the golden vzdump (--remove-golden)
+  KEPT (lives on deliberately — remove/rotate these out-of-band if the customer is leaving):
+    - the enrolled drives + ALL data under /mnt/felhom-drives — unmounted only, NEVER wiped;
+      the drives are physically removable now.
+    - the hub host/customer record + report history (operator UI / DB)
+    - this host's WireGuard PEER on the hub and the off-site endpoint (its /32 and public key) — the
+      tunnel is down from this side; delete the peer in the hub (operator) if the customer is leaving
+    - the vmbr9 island bridge stanza in /etc/network/interfaces (host-internal, no port; a reinstall
+      reuses it) — to remove it: delete the stanza, then ifreload -a
+    - the appliance ISO's first-boot files: /etc/felhom/.bootstrap-done, /etc/felhom/appliance-pairing-code,
+      felhom-bootstrap.service (disabled, fired once) — not this script's; remove by hand if wanted
+    - the escrow blob in the hub, if one exists (operator UI)
+    - the hub-vaulted root@pam recovery credential — the box KEEPS the password step 4b set; rotate it if the box leaves Felhom management
+
+[OK] UNINSTALL complete — removed: guest 9201, the felhom-agent (unit/sudoers/binary/state/config+baks/user + selfupdate-artifacts/shared-parent/mkfs-wrapper/pbs-apply-wrapper/hook-snippet/dnsmasq-snippets), the pveum role/user/token/ACL, the felhom pool, and /var/lib/felhom-install/state.json.
+[INFO]   golden vzdump: removed.
+[INFO]   NOTE: the 'sudo' package was left INSTALLED (a system package, never ours to remove). dnsmasq is removed only when the install-time record says Felhom installed it; a resolver that pre-dated Felhom is never touched. The host record still exists in the hub — remove it there if desired.
diff --git a/documentation/audits/release-2026-11-03/part2/vm-create.txt b/documentation/audits/release-2026-11-03/part2/vm-create.txt
new file mode 100644
index 00000000..09e913c2
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part2/vm-create.txt
@@ -0,0 +1,21 @@
+Formatting '/mnt/hdd_1/images/9383/vm-9383-disk-0.raw', fmt=raw size=68719476736 preallocation=off
+scsi0: successfully created disk 'nvme-scratch:9383/vm-9383-disk-0.raw,size=64G'
+Formatting '/mnt/hdd_1/images/9383/vm-9383-disk-1.raw', fmt=raw size=51539607552 preallocation=off
+scsi1: successfully created disk 'nvme-scratch:9383/vm-9383-disk-1.raw,size=48G'
+update VM 9383: -boot order=scsi0;ide2
+boot: order=scsi0;ide2
+cores: 6
+cpu: host
+ide2: local:iso/felhom-installer-1.30.0-pve9.2-1.iso,media=cdrom,size=1665356K
+memory: 10240
+meta: creation-qemu=11.0.3,ctime=1793690549
+name: release1103-box
+net0: virtio=BC:24:11:7F:70:56,bridge=vmbr0
+ostype: l26
+scsi0: nvme-scratch:9383/vm-9383-disk-0.raw,size=64G
+scsi1: nvme-scratch:9383/vm-9383-disk-1.raw,size=48G
+scsihw: virtio-scsi-single
+smbios1: uuid=fff0e2e4-30f3-4d2b-9adc-a52e5ff4e3a8
+vga: std
+vmgenid: b102eae9-0848-460d-8e63-e6ac7c94756f
+STARTED
diff --git a/documentation/audits/release-2026-11-03/part3/agent-rel-0172.txt b/documentation/audits/release-2026-11-03/part3/agent-rel-0172.txt
new file mode 100644
index 00000000..0ae15ef3
--- /dev/null
+++ b/documentation/audits/release-2026-11-03/part3/agent-rel-0172.txt
@@ -0,0 +1,27 @@
+[release-agent] building 0.172.0 …
+[release-agent] built ok: sha256 2c0222cd01713f65c627d6d17c18b4a8b2b1e0c39881db0df7ccb17de48e24c7
+[release-agent] config bundle built: sha256 cc34b0bc3346ffd6a4ba80fe9269852dced8c56c9503c8b14a50d9ded2961cce
+[release-agent] tagging v0.172.0 at ecbb0cc …
+[release-agent] publishing …
+[publish-agent] publishing /tmp/felhom-agent-svqoSn (16393888 bytes, sha256 2c0222cd01713f65…) → https://gitea.dooplex.hu/api/packages/admin/generic/felhom-agent/0.172.0/felhom-agent
+[publish-agent] pre-delete existing artifact: HTTP 404 (404/204 expected)
+[publish-agent] upload OK (HTTP 201)
+[publish-agent] round-trip GET verified (sha256 matches)
+[publish-agent] DONE. Record in the hub operator UI (Configs → Day-0 artifacts): agent 0.172.0 / 2c0222cd01713f65c627d6d17c18b4a8b2b1e0c39881db0df7ccb17de48e24c7
+[release-agent] config bundle published (HTTP 201)
+[release-agent] pushing v0.172.0 …
+To https://gitea.dooplex.huAGENT_VERSION=0.172.0
+AGENT_SHA256=2c0222cd01713f65c627d6d17c18b4a8b2b1e0c39881db0df7ccb17de48e24c7
+
+  RELEASED — and installable, verified by download, not by this script's own say-so.
+
+    version : 0.172.0
+    tag     : v0.172.0
+    sha256  : 2c0222cd01713f65c627d6d17c18b4a8b2b1e0c39881db0df7ccb17de48e24c7
+    bundle  : cc34b0bc3346ffd6a4ba80fe9269852dced8c56c9503c8b14a50d9ded2961cce   (felhom-config-bundle.json — vouch it with the agent)
+
+  NOT VOUCHED. Vouching is what points machines at this version and stays you/admin/felhom-agent.git
+ * [new tag]         v0.172.0 -> v0.172.0
+[release-agent] verifying by independent download …
+r deliberate act:
+  hub operator UI → Configs → Day-0 artifacts. Until then boxes keep installing the previous one.
diff --git a/documentation/tests/golden-0.350.0-2026-11-03/00-boot.txt b/documentation/tests/golden-0.350.0-2026-11-03/00-boot.txt
new file mode 100644
index 00000000..669a54d0
--- /dev/null
+++ b/documentation/tests/golden-0.350.0-2026-11-03/00-boot.txt
@@ -0,0 +1,7 @@
+## boot 2026-11-03T07:18:39Z
+drill VM reverted to virgin and cold-booted (RUNBOOK-manual-build §4.0); pve-manager/9.2.2
+pveam update: update successful; template debian-13-standard_13.6-1_amd64.tar.zst (checksum verified)
+build-golden.sh from felhom-agent ecbb0cc, sha256 645b3b65… (the same file as the 0.349.0 bake)
+token + registry user copied file->file from sec; unit properties grep for the token value: 0
+token in bake.log: 0 (control with the token appended: 1)
+registry login in the archive: tar listing for .docker/config.json = 0
diff --git a/documentation/tests/golden-0.350.0-2026-11-03/02-round-trip.txt b/documentation/tests/golden-0.350.0-2026-11-03/02-round-trip.txt
new file mode 100644
index 00000000..cca17fa6
--- /dev/null
+++ b/documentation/tests/golden-0.350.0-2026-11-03/02-round-trip.txt
@@ -0,0 +1,3 @@
+## round trip 2026-11-03T07:27:16Z
+sha256 082e2e040de5615300da3ec8bc48fe6761ee0e6375dcc732e5cba82086e5e06b bytes 639545403
+bake said 082e2e040de5615300da3ec8bc48fe6761ee0e6375dcc732e5cba82086e5e06b
diff --git a/documentation/tests/golden-0.350.0-2026-11-03/03-teardown.txt b/documentation/tests/golden-0.350.0-2026-11-03/03-teardown.txt
new file mode 100644
index 00000000..58592314
--- /dev/null
+++ b/documentation/tests/golden-0.350.0-2026-11-03/03-teardown.txt
@@ -0,0 +1,11 @@
+== teardown 2026-11-03T07:27:19Z
+purging CT 9100 from related configurations..
+0
+ls: cannot access '/root/.gitea-token': No such file or directory
+ls: cannot access '/root/.gitea-user': No such file or directory
+ls: cannot access '/root/bake-run.sh': No such file or directory
+ls: cannot access '/root/bake.log': No such file or directory
+qemu running: 0
+revert rc=0
+ID      TAG               VM_SIZE                DATE        VM_CLOCK     ICOUNT
+1       virgin                0 B 2026-07-03 14:12:15  0000:00:00.000          0
diff --git a/documentation/tests/golden-0.350.0-2026-11-03/README.md b/documentation/tests/golden-0.350.0-2026-11-03/README.md
new file mode 100644
index 00000000..0caadc03
--- /dev/null
+++ b/documentation/tests/golden-0.350.0-2026-11-03/README.md
@@ -0,0 +1,46 @@
+# Golden 0.350.0 — bake + publish, 2026-11-03 (release brief, Part 2; it replaces 0.349.0)
+
+Why: golden 0.349.0 (`../golden-0.349.0-2026-11-03/`, baked the same morning, never vouched) still holds Traefik v3.7.16,
+which has GHSA-xv5x-242w-7hf7 (R-1354). The operator: „Do not vouch 0.349.0." Procedure: 0.349.0's README, the same
+recipe. Controller 0.350.0 was already the global floor (07:18:16 UTC, MinAgent 0.158.1).
+
+| | Previous (`../golden-0.349.0-2026-11-03/`) | This bake |
+|---|---|---|
+| `build-golden.sh` | v3.2.0, `645b3b65…` | same file |
+| Controller | `felhom-controller:0.349.0` | **`felhom-controller:0.350.0`** (MinAgent **0.158.1**, image `sha256:9ee53908…`) |
+| Traefik baked | v3.7.16 | **v3.7.17** |
+| Docker engine | `os-docker-20261026-190351` | same six pairs |
+| Template | `debian-13-standard_13.6-1_amd64.tar.zst` | same |
+| Token | from `sec`, file → file | same |
+
+## Pass markers (from `bake.log`, this folder)
+
+```
+[golden] build-golden.sh v3.2.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.350.0
+[golden] Docker engine set PINNED to the approved release: containerd.io=2.4.2-3~debian.13~trixie … docker-compose-plugin=5.6.1-1~debian.13~trixie
+  docker OK (overlay2; data-root /var/lib/docker)
+[golden] baking infra images (4): traefik:v3.7.17 cloudflare/cloudflared:2026.10.4 gtstef/filebrowser:1.5.8-stable gitea.dooplex.hu/admin/felhom-samba:1.2.0 …
+INFO: including mount point rootfs ('/') in backup
+INFO: including mount point mp0 ('/var/lib/felhom') in backup
+[golden]   upload OK (HTTP 201)
+GOLDEN_VERSION=0.350.0
+GOLDEN_SHA256=082e2e040de5615300da3ec8bc48fe6761ee0e6375dcc732e5cba82086e5e06b
+```
+
+No `excluding`, no `FATAL`, no `GOLDEN_DOCKER_PKGS not set`; the unit deactivated successfully. Round trip: the registry's
+file downloaded and hashed = the bake's sha, 639,545,403 bytes (`02-round-trip.txt`). Token: the unit's properties grep = 0;
+the committed log grep = 0, with a working control (= 1). The bake's one `WARNING` is docker's own line about the login in the
+build guest; the script removes the login before it archives, and a listing of the archive for `.docker/config.json` reads 0 on
+both the bake's file and the registry's copy. Teardown: `03-teardown.txt`. No controller push after the bake.
+
+## The fresh install
+
+`../../audits/release-2026-11-03/part2/README.md`.
+
+## Vouch — the operator's act (never CC's)
+
+Three fields together (runbook §4.1 step 5), Configuration → Day-0 artifacts. **Do not vouch 0.349.0.**
+
+- golden **0.350.0**, sha256 `082e2e040de5615300da3ec8bc48fe6761ee0e6375dcc732e5cba82086e5e06b`
+- agent: **0.171.0** (`c888ca7ba22a1f689059081575814a725e2edcecbb6bcc56829e9d9de88202a5`), unless 0.172.0 is vouched first or with it
+- min_agent **0.158.1** (unchanged)
diff --git a/documentation/tests/golden-0.350.0-2026-11-03/bake.log b/documentation/tests/golden-0.350.0-2026-11-03/bake.log
new file mode 100644
index 00000000..1b72da5c
--- /dev/null
+++ b/documentation/tests/golden-0.350.0-2026-11-03/bake.log
@@ -0,0 +1,342 @@
+[golden] build-golden.sh v3.2.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.350.0
+[golden] creating build LXC 9100 (nesting=1,keyctl=1, unprivileged; rootfs 32G + ONE data volume 24G @ /var/lib/felhom, backup=1) …
+  Logical volume "vm-9100-disk-0" created.
+  Logical volume pve/vm-9100-disk-0 changed.
+Creating filesystem with 8388608 4k blocks and 2097152 inodes
+Filesystem UUID: 413c14f0-88b6-4a52-bf2d-19599d36ea9e
+Superblock backups stored on blocks: 
+	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 
+	4096000, 7962624
+  Logical volume "vm-9100-disk-1" created.
+  Logical volume pve/vm-9100-disk-1 changed.
+Creating filesystem with 6291456 4k blocks and 1572864 inodes
+Filesystem UUID: 86c833a3-3e17-445e-898c-758c59ad2639
+Superblock backups stored on blocks: 
+	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 
+extracting archive '/var/lib/vz/template/cache/debian-13-standard_13.6-1_amd64.tar.zst'
+Total bytes read: 553512960 (528MiB, 69MiB/s)
+Detected container architecture: amd64
+Creating SSH host key 'ssh_host_rsa_key' - this may take some time ...
+done: SHA256:VsTwEc0CjWdWEjmAHivAlXisZ+kgqGb+Jai/fQUxA2I root@felhom-golden
+Creating SSH host key 'ssh_host_ecdsa_key' - this may take some time ...
+done: SHA256:x32WRu/WfX1BYbxFHTOYCWc/g/2avpl+dONDathu72k root@felhom-golden
+Creating SSH host key 'ssh_host_ed25519_key' - this may take some time ...
+done: SHA256:RWXwVsb/zQ81nB7+a2MIrgEeN0Ad+F/NY2pGADa4Q9I root@felhom-golden
+[golden] starting + installing Docker (official repo, trixie channel) …
+[golden] Docker engine set PINNED to the approved release: containerd.io=2.4.2-3~debian.13~trixie docker-buildx-plugin=0.38.1-1~debian.13~trixie docker-ce=5:29.9.2-1~debian.13~trixie docker-ce-cli=5:29.9.2-1~debian.13~trixie docker-ce-rootless-extras=5:29.9.2-1~debian.13~trixie docker-compose-plugin=5.6.1-1~debian.13~trixie
+apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct!
+perl: warning: Setting locale failed.
+perl: warning: Please check that your locale settings:
+	LANGUAGE = (unset),
+	LC_ALL = (unset),
+	LC_CTYPE = (unset),
+	LC_NUMERIC = (unset),
+	LC_COLLATE = (unset),
+	LC_TIME = (unset),
+	LC_MESSAGES = (unset),
+	LC_MONETARY = (unset),
+	LC_ADDRESS = (unset),
+	LC_IDENTIFICATION = (unset),
+	LC_MEASUREMENT = (unset),
+	LC_PAPER = (unset),
+	LC_TELEPHONE = (unset),
+	LC_NAME = (unset),
+	LANG = "en_US.UTF-8"
+    are supported and installed on your system.
+perl: warning: Falling back to the standard locale ("C").
+locale: Cannot set LC_CTYPE to default locale: No such file or directory
+locale: Cannot set LC_MESSAGES to default locale: No such file or directory
+locale: Cannot set LC_ALL to default locale: No such file or directory
+apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct!
+perl: warning: Setting locale failed.
+perl: warning: Please check that your locale settings:
+	LANGUAGE = (unset),
+	LC_ALL = (unset),
+	LC_CTYPE = (unset),
+	LC_NUMERIC = (unset),
+	LC_COLLATE = (unset),
+	LC_TIME = (unset),
+	LC_MESSAGES = (unset),
+	LC_MONETARY = (unset),
+	LC_ADDRESS = (unset),
+	LC_IDENTIFICATION = (unset),
+	LC_MEASUREMENT = (unset),
+	LC_PAPER = (unset),
+	LC_TELEPHONE = (unset),
+	LC_NAME = (unset),
+	LANG = "en_US.UTF-8"
+    are supported and installed on your system.
+perl: warning: Falling back to the standard locale ("C").
+locale: Cannot set LC_CTYPE to default locale: No such file or directory
+locale: Cannot set LC_MESSAGES to default locale: No such file or directory
+locale: Cannot set LC_ALL to default locale: No such file or directory
+  installed: containerd.io	2.4.2-3~debian.13~trixie
+  installed: docker-buildx-plugin	0.38.1-1~debian.13~trixie
+  installed: docker-ce	5:29.9.2-1~debian.13~trixie
+  installed: docker-ce-cli	5:29.9.2-1~debian.13~trixie
+  installed: docker-ce-rootless-extras	5:29.9.2-1~debian.13~trixie
+  installed: docker-compose-plugin	5.6.1-1~debian.13~trixie
+[golden] no approved guest release given - the template versions stay; first-night count vs an approved release: n/a
+[golden] pending Debian upgrades in the baked guest (what a FUTURE approval may bring): 54
+[golden] baking daemon.json: classic overlay2 driver (containerd-snapshotter OFF) + log rotation …
+[golden] wiring the single data volume (R-165 variant V-c): /var/lib/felhom/{docker,sys_drive} -> binds …
+[golden] verifying Docker works in the build guest (storage driver should be overlay2 on the ext4 data volume) …
+Unable to find image 'hello-world:latest' locally
+latest: Pulling from library/hello-world
+4f55086f7dd0: Pulling fs layer
+4f55086f7dd0: Verifying Checksum
+4f55086f7dd0: Download complete
+4f55086f7dd0: Pull complete
+Digest: sha256:c567b231f65614688711a75f31518a064258a51d442117a3e771a3a8fdba78ef
+Status: Downloaded newer image for hello-world:latest
+  docker OK (overlay2; data-root /var/lib/docker)
+  live-restore: on
+  /var/lib/docker is a real mount: /dev/mapper/pve-vm--9100--disk--1[/docker] ext4
+  /mnt/sys_drive is a real mount: /dev/mapper/pve-vm--9100--disk--1[/sys_drive] ext4
+  both paths are ONE filesystem: /dev/mapper/pve-vm--9100--disk--1 23317576
+[golden] baking the in-guest controller image gitea.dooplex.hu/admin/felhom-controller:0.350.0 (no registry cred at deploy) …
+
+WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
+Configure a credential helper to remove this warning. See
+https://docs.docker.com/go/credential-store/
+
+0.350.0: Pulling from admin/felhom-controller
+ecc510c1e359: Pulling fs layer
+c3f83389ce1b: Pulling fs layer
+e81c1fce9826: Pulling fs layer
+63a1406b1961: Pulling fs layer
+d747c9b6922d: Pulling fs layer
+f566b4c9671c: Pulling fs layer
+e853ea6ba36f: Pulling fs layer
+d747c9b6922d: Waiting
+f566b4c9671c: Waiting
+e853ea6ba36f: Waiting
+63a1406b1961: Waiting
+e81c1fce9826: Verifying Checksum
+e81c1fce9826: Download complete
+c3f83389ce1b: Verifying Checksum
+c3f83389ce1b: Download complete
+d747c9b6922d: Verifying Checksum
+d747c9b6922d: Download complete
+63a1406b1961: Verifying Checksum
+63a1406b1961: Download complete
+f566b4c9671c: Verifying Checksum
+f566b4c9671c: Download complete
+e853ea6ba36f: Verifying Checksum
+e853ea6ba36f: Download complete
+ecc510c1e359: Verifying Checksum
+ecc510c1e359: Download complete
+ecc510c1e359: Pull complete
+c3f83389ce1b: Pull complete
+e81c1fce9826: Pull complete
+63a1406b1961: Pull complete
+d747c9b6922d: Pull complete
+f566b4c9671c: Pull complete
+e853ea6ba36f: Pull complete
+Digest: sha256:9ee53908e6d95f0340c41bf4eaba954280084a8e6927de59779440e3551df261
+Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-controller:0.350.0
+gitea.dooplex.hu/admin/felhom-controller:0.350.0
+[golden] asking the controller which infra images it manages …
+[golden] baking infra images (4): traefik:v3.7.17 cloudflare/cloudflared:2026.10.4 gtstef/filebrowser:1.5.8-stable gitea.dooplex.hu/admin/felhom-samba:1.2.0 …
+v3.7.17: Pulling from library/traefik
+7b229517ed22: Pulling fs layer
+e52609d2f1c3: Pulling fs layer
+55e31fcee501: Pulling fs layer
+7167651855ea: Pulling fs layer
+7167651855ea: Waiting
+7b229517ed22: Verifying Checksum
+7b229517ed22: Download complete
+e52609d2f1c3: Download complete
+7167651855ea: Verifying Checksum
+7167651855ea: Download complete
+55e31fcee501: Verifying Checksum
+55e31fcee501: Download complete
+7b229517ed22: Pull complete
+e52609d2f1c3: Pull complete
+55e31fcee501: Pull complete
+7167651855ea: Pull complete
+Digest: sha256:68ae5fe5b64ca166704b746a9e8afcd385e36b3f569a5691401bf652d57b3748
+Status: Downloaded newer image for traefik:v3.7.17
+docker.io/library/traefik:v3.7.17
+2026.10.4: Pulling from cloudflare/cloudflared
+2cc7ee286bf3: Pulling fs layer
+c172f21841df: Pulling fs layer
+218cf840d0d9: Pulling fs layer
+f6069939f718: Pulling fs layer
+d6b1b89eccac: Pulling fs layer
+2780920e5dbf: Pulling fs layer
+7c12895b777b: Pulling fs layer
+3214acf345c0: Pulling fs layer
+52630fc75a18: Pulling fs layer
+dd64bf2dd177: Pulling fs layer
+b839dfae01f6: Pulling fs layer
+ebddc55facdc: Pulling fs layer
+a0921f9d8de9: Pulling fs layer
+b96fe2995f90: Pulling fs layer
+810e2b405a08: Pulling fs layer
+bd8962e29291: Pulling fs layer
+cac2ae0193cb: Pulling fs layer
+eb8da9d09a5e: Pulling fs layer
+dd64bf2dd177: Waiting
+b839dfae01f6: Waiting
+ebddc55facdc: Waiting
+a0921f9d8de9: Waiting
+b96fe2995f90: Waiting
+810e2b405a08: Waiting
+bd8962e29291: Waiting
+cac2ae0193cb: Waiting
+eb8da9d09a5e: Waiting
+f6069939f718: Waiting
+d6b1b89eccac: Waiting
+2780920e5dbf: Waiting
+7c12895b777b: Waiting
+3214acf345c0: Waiting
+52630fc75a18: Waiting
+2cc7ee286bf3: Verifying Checksum
+2cc7ee286bf3: Download complete
+c172f21841df: Verifying Checksum
+c172f21841df: Download complete
+218cf840d0d9: Verifying Checksum
+218cf840d0d9: Download complete
+f6069939f718: Download complete
+d6b1b89eccac: Verifying Checksum
+d6b1b89eccac: Download complete
+2780920e5dbf: Verifying Checksum
+2780920e5dbf: Download complete
+7c12895b777b: Verifying Checksum
+7c12895b777b: Download complete
+3214acf345c0: Verifying Checksum
+3214acf345c0: Download complete
+52630fc75a18: Verifying Checksum
+52630fc75a18: Download complete
+2cc7ee286bf3: Pull complete
+dd64bf2dd177: Verifying Checksum
+dd64bf2dd177: Download complete
+b839dfae01f6: Verifying Checksum
+b839dfae01f6: Download complete
+ebddc55facdc: Verifying Checksum
+ebddc55facdc: Download complete
+a0921f9d8de9: Verifying Checksum
+a0921f9d8de9: Download complete
+c172f21841df: Pull complete
+810e2b405a08: Verifying Checksum
+810e2b405a08: Download complete
+bd8962e29291: Verifying Checksum
+bd8962e29291: Download complete
+b96fe2995f90: Verifying Checksum
+b96fe2995f90: Download complete
+cac2ae0193cb: Verifying Checksum
+cac2ae0193cb: Download complete
+eb8da9d09a5e: Verifying Checksum
+eb8da9d09a5e: Download complete
+218cf840d0d9: Pull complete
+f6069939f718: Pull complete
+d6b1b89eccac: Pull complete
+2780920e5dbf: Pull complete
+7c12895b777b: Pull complete
+3214acf345c0: Pull complete
+52630fc75a18: Pull complete
+dd64bf2dd177: Pull complete
+b839dfae01f6: Pull complete
+ebddc55facdc: Pull complete
+a0921f9d8de9: Pull complete
+b96fe2995f90: Pull complete
+810e2b405a08: Pull complete
+bd8962e29291: Pull complete
+cac2ae0193cb: Pull complete
+eb8da9d09a5e: Pull complete
+Digest: sha256:c6c7ae1d5dfdcb094ad344ed68ccffc26635c9c6be80965664c33baf064b0515
+Status: Downloaded newer image for cloudflare/cloudflared:2026.10.4
+docker.io/cloudflare/cloudflared:2026.10.4
+1.5.8-stable: Pulling from gtstef/filebrowser
+e2de96513ba9: Pulling fs layer
+93c39e448959: Pulling fs layer
+b7597036c324: Pulling fs layer
+c6591d351da9: Pulling fs layer
+4f4fb700ef54: Pulling fs layer
+74aec9809d97: Pulling fs layer
+9f7b5accdf20: Pulling fs layer
+19114688b75e: Pulling fs layer
+2067d5df1f91: Pulling fs layer
+5669e416ca05: Pulling fs layer
+08c322a8a1d4: Pulling fs layer
+19114688b75e: Waiting
+2067d5df1f91: Waiting
+5669e416ca05: Waiting
+08c322a8a1d4: Waiting
+c6591d351da9: Waiting
+4f4fb700ef54: Waiting
+74aec9809d97: Waiting
+9f7b5accdf20: Waiting
+e2de96513ba9: Verifying Checksum
+e2de96513ba9: Download complete
+c6591d351da9: Verifying Checksum
+c6591d351da9: Download complete
+4f4fb700ef54: Verifying Checksum
+4f4fb700ef54: Download complete
+b7597036c324: Verifying Checksum
+b7597036c324: Download complete
+93c39e448959: Verifying Checksum
+93c39e448959: Download complete
+9f7b5accdf20: Download complete
+e2de96513ba9: Pull complete
+19114688b75e: Verifying Checksum
+19114688b75e: Download complete
+2067d5df1f91: Verifying Checksum
+2067d5df1f91: Download complete
+74aec9809d97: Verifying Checksum
+74aec9809d97: Download complete
+08c322a8a1d4: Verifying Checksum
+08c322a8a1d4: Download complete
+5669e416ca05: Verifying Checksum
+5669e416ca05: Download complete
+93c39e448959: Pull complete
+b7597036c324: Pull complete
+c6591d351da9: Pull complete
+4f4fb700ef54: Pull complete
+74aec9809d97: Pull complete
+9f7b5accdf20: Pull complete
+19114688b75e: Pull complete
+2067d5df1f91: Pull complete
+5669e416ca05: Pull complete
+08c322a8a1d4: Pull complete
+Digest: sha256:68455d4953bad8e984e1bc5d112ed1e9c918a0a04f104c13c9ece50790308894
+Status: Downloaded newer image for gtstef/filebrowser:1.5.8-stable
+docker.io/gtstef/filebrowser:1.5.8-stable
+1.2.0: Pulling from admin/felhom-samba
+e2de96513ba9: Already exists
+0ddbc9f3a6b6: Pulling fs layer
+ce57a3f93416: Pulling fs layer
+fb94eeec2fe1: Pulling fs layer
+fb94eeec2fe1: Verifying Checksum
+fb94eeec2fe1: Download complete
+ce57a3f93416: Verifying Checksum
+ce57a3f93416: Download complete
+0ddbc9f3a6b6: Verifying Checksum
+0ddbc9f3a6b6: Download complete
+0ddbc9f3a6b6: Pull complete
+ce57a3f93416: Pull complete
+fb94eeec2fe1: Pull complete
+Digest: sha256:da96f25033827fbb77d0ee398e86fe5b744e2f29be9de898994533340c97acf9
+Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-samba:1.2.0
+gitea.dooplex.hu/admin/felhom-samba:1.2.0
+[golden] baking the controller-bootstrap unit (deploys the BAKED controller from the config mount) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.service' → '/etc/systemd/system/felhom-controller-bootstrap.service'.
+[golden] baking the controller-bootstrap PATH unit (starts the service on bootstrap-mount hot-plug — B1) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.path' → '/etc/systemd/system/felhom-controller-bootstrap.path'.
+[golden] baking the first-boot SSH host-key regeneration unit (F3) …
+Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-regen-hostkeys.service' → '/etc/systemd/system/felhom-regen-hostkeys.service'.
+[golden] identity-clean + minimize …
+[golden] stop + archive …
+INFO: including mount point rootfs ('/') in backup
+INFO: including mount point mp0 ('/var/lib/felhom') in backup
+INFO: archive file size: 609MB
+INFO: Finished Backup of VM 9100 (00:00:26)
+[golden] DONE. golden archive volid: local:backup/vzdump-lxc-9100-2026_11_03-08_24_17.tar.zst (rootfs 32G + ONE data volume 24G @ /var/lib/felhom, all in the archive)
+[golden] publishing golden (639545403 bytes, sha256 082e2e040de56153…) → https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.350.0/golden.tar.zst
+[golden]   pre-delete existing: HTTP 404 (404/204 expected)
+[golden]   upload OK (HTTP 201)
+GOLDEN_VERSION=0.350.0
+GOLDEN_SHA256=082e2e040de5615300da3ec8bc48fe6761ee0e6375dcc732e5cba82086e5e06b
+[golden] Record in the hub operator UI (Configs → Day-0 artifacts): golden 0.350.0 / 082e2e040de5615300da3ec8bc48fe6761ee0e6375dcc732e5cba82086e5e06b
+[golden] (the build guest 9100 is stopped; destroy it with: pct destroy 9100 --purge)
diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md
index 4255f8f8..a4b2556e 100644
--- a/hub/CHANGELOG.md
+++ b/hub/CHANGELOG.md
@@ -1,4 +1,4 @@
-## Unreleased — next hub release; commit only, 2026-11-02 night
+## v0.179.0 (2026-11-03) — no „does not answer" alarm after the restart mail of the same episode (R-1352)
 
 - **R-1352 — the „does not answer" alarm is not mailed after the restart mail of the same episode.** The alarm and the restart lie 2
   minutes apart and reports 15, so both reached the hub in one report; the operator read the restart first and then „the agent