diff --git a/documentation/audits/logins-nvme-2026-09-28/G/G2-legs.txt b/documentation/audits/logins-nvme-2026-09-28/G/G2-legs.txt
new file mode 100644
index 00000000..8ff9e470
--- /dev/null
+++ b/documentation/audits/logins-nvme-2026-09-28/G/G2-legs.txt
@@ -0,0 +1,29 @@
+======== felhom-pve 9201 — legs, night 2026-09-28/29 (UTC)
+2026/09/29 00:30:00 [INFO] [backup] App-data backup completed: 0 databases (0 B total), 1 volume dump(s) (840ms)
+2026/09/29 00:30:00 [INFO] [scheduler] Job db-dump completed (took 868ms)
+2026/09/29 01:30:00 [INFO] [scheduler] Job tier2-backup completed (took 2ms)
+2026/09/29 02:15:00 [INFO] [backup] App-data backup completed: 0 databases (0 B total), 1 volume dump(s) (814ms)
+2026/09/29 02:15:47 [INFO] [offbox] backup OK: 1 app(s) backed up, 11 snapshot(s), 42s
+2026/09/29 02:15:47 [INFO] [update-leg] started (after-offsite): window 02:30, no step starts at or after 07:30
+2026/09/29 02:15:47 [INFO] [update-leg] update leg (after-offsite): done=0 undone=0 held=0 failed=0 skipped=0 in 0s [skipped: ]
+2026/09/29 02:15:47 [INFO] [scheduler] Job offbox-backup completed (took 47.523s)
+======== demo-hp 9201 — legs, night 2026-09-28/29 (UTC)
+2026/09/29 00:31:52 backup.go:662: [INFO] [backup] App-data backup completed: 6 databases (13.4 MB total), 9 volume dump(s) (1m51.999s)
+2026/09/29 00:31:52 scheduler.go:363: [INFO] [scheduler] Job db-dump completed (took 1m52.492s)
+2026/09/29 01:30:03 scheduler.go:363: [INFO] [scheduler] Job tier2-backup completed (took 3.304s)
+2026/09/29 02:16:42 backup.go:662: [INFO] [backup] App-data backup completed: 6 databases (13.4 MB total), 9 volume dump(s) (1m42.898s)
+2026/09/29 02:16:55 offbox.go:1389: [WARN] [offbox] backed up bentopdf (/mnt/sys_drive/felhom-data/backups/primary/bentopdf, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapsh
+2026/09/29 02:18:28 offbox.go:1158: [INFO] [offbox] backup OK: 9 app(s) backed up, 91 snapshot(s), 3m23s
+2026/09/29 02:18:28 unattended.go:268: [INFO] [update-leg] started (after-offsite): window 02:30, no step starts at or after 07:30
+2026/09/29 02:18:28 unattended.go:246: [INFO] [update-leg] update leg (after-offsite): done=0 undone=0 held=0 failed=0 skipped=0 in 0s [skipped: ]
+2026/09/29 02:18:28 scheduler.go:363: [INFO] [scheduler] Job offbox-backup completed (took 3m28.278s)
+Sep 29 04:50:53 demo-hp felhom-agent[2355282]: time=2026-09-29T04:50:53.815+02:00 level=INFO msg="backup: completed" vmid=9201 target=local archive=local:backup/vzdump-lxc-9201-2026_09_29-04_42_11.tar
+
+## SUMMARY — Part G, read 2026-09-29 ~05:00 CEST (read-only). Controller 0.279.0 on both boxes.
+## demo-felhom: dump 02:30 · Tier 2 03:30 · off-site 04:15 ok (1 app) · update leg 04:15, nothing due · no whole-guest
+##   backup yet in this night (its last ran 2026-09-28 07:36; it runs later in the morning window).
+## demo-hp: dump 02:30 (6 DBs, 9 volume sets) · Tier 2 03:30 · off-site 04:16–04:18 ok (9 apps) · update leg 04:18,
+##   nothing due · whole-guest local backup 04:42–04:50, AFTER the leg ended → nothing had to wait (R-687 item 4 again did
+##   not occur).
+## Part D in its first night: NO "holds no data" alarm. The one hollow snapshot line is bentopdf — it has no volumes,
+##   so it is correctly NOT flagged (the rule watches running apps WITH volumes). No false alarm.