night 2026-09-13/14: first "be a customer" rotation (adventurelog) — 7 defects found, 13 rows closed

New runbooks/nightly-rotation.md; observations_gate.py reads every section
(R-471); target-selection.md names real paths (R-461); R-93 carries the
fact that drill-r50 is gone. Register: R-473/R-474/R-466/R-471/R-453/R-461
and v0.240.0's R-477/R-478/R-480/R-482/R-484/R-485/R-486 closed; R-481,
R-483, R-487, R-488, R-489 opened. 09 §6.1, 07 §6, CONTEXT, STATUS note.
Evidence: audits/nightly-2026-09-13-adventurelog/, audits/v0240-2026-09-13/.

REPORT.md

@@ -1,40 +1,41 @@
-# REPORT — two rulings: the floor carries a release without a golden, and every backup counts (2026-09-13)
+# REPORT — the first "be a customer for the night" run: adventurelog on demo-hp (2026-09-13/14)
 
-*Overwritten each session. Nothing durable lives only here — every finding below has a register row.
-The controller report is `felhom-controller/REPORT.md`.*
+*Overwritten each session. Every finding below has a register row. The controller report is
+`felhom-controller/REPORT.md`, the catalog's `app-catalog-felhom.eu/REPORT.md`.*
 
-> **Both rulings are shipped and proven live.** Hub v0.112.0 serves a floor above the vouched golden
-> when the release's MinAgent is declared with it. Controller v0.239.0 reached both demo boxes by that
-> floor alone, in 14 s and 15 s, and lets an app update on any backup tier.
+> One app walked end to end as a household would; seven product defects found; a controller release
+> (v0.240.0) shipped the same night by the managed floor; two catalog fixes; two docs fixes. The
+> morning note is the top block of `STATUS.md`.
+
+## Step 0 — the rules file
+
+`.claude/rules/unprompted-work.md` is in none of the three repos and the brief's text block did not
+reach this session (searched the workspace, the transcript and memory). Not created — the operator's
+rules cannot be invented byte-identically. The brief's own fences were applied instead.
 
 ## What changed here
 
-- **Hub v0.112.0** (`f181efd`, deployed by `2f5d3af` + ArgoCD sync; Synced/Healthy, image 0.112.0).
-  Declared MinAgent stored beside both floors; `ResolveManagedFloor` uses it above the golden; both
-  forms refuse a floor above the golden without it (`floor_needs_min_agent`); Hosts badge and a
-  `managed floor SERVED … from <source>` log. Vouch path and R-120 gate untouched.
-- **Runbooks:** `publish-train-rules.md` rule 1; `RUNBOOK-manual-build.md` §3 "Raise the floor to a
-  release with no golden" and the §4.2 correction resolved.
-- **Architecture:** `09-update-architecture.md` §3 decisions 7 and 8, §6 and §6.1; `05-hub-architecture.md`
-  §5; `07-backup-architecture.md` §6; capability map "Update is GUARDED" row.
-- **Register:** R-470, R-472, R-475 closed and compressed; R-477..R-480 opened; R-474 re-confirmed.
-- **Evidence:** `documentation/audits/rulings-r472-r475-2026-09-13/` (live 01–10, red-proofs).
-- `STATUS.md` items 15 and 16 rewritten as done; the cadence correction line fixed. `CONTEXT.md` updated.
-
-## Numbering note
-
-§3 already held a decision 6 from this morning, so the two new rulings are numbered 7 and 8 rather than 6 and 7.
-
-## Negative control
-
-An undeclared floor above the golden no longer reaches the hold: the form refuses it first (303
-`floor_needs_min_agent`, floor still 0.236.0, hub WARN). The hold itself for that shape is proven by
-test C and its red-proof.
+- `documentation/runbooks/nightly-rotation.md` — new: the tick list (standing nine first, blocked on
+  R-481; then the catalog); `actualbudget` recorded (no non-browser front door), `adventurelog` ticked.
+- `scripts/observations_gate.py` — R-471: every observations section is read (`scripts/CHANGELOG.md`).
+- `documentation/runbooks/target-selection.md` — R-461: `/mnt/hdd_1` is the NVMe; `drill-r50` exists
+  on neither box (measured), fence kept with the fact beside it; R-93 carries the fact.
+- `09-update-architecture.md` §6.1, `07-backup-architecture.md` §6, `CONTEXT.md` — v0.240.0 notes.
+- Register: R-473, R-474, R-466, R-471, R-453, R-461, R-477, R-478, R-480, R-482, R-484, R-485, R-486
+  closed and compressed; R-481, R-482..R-489 opened (R-482 closed the same night). 212 → 207 open,
+  177 → 188 closed; 432 156 → 426 502 bytes open, 120 598 → 128 499 closed.
+- Evidence: `documentation/audits/nightly-2026-09-13-adventurelog/` (01–08), `audits/v0240-2026-09-13/`
+  (release log, floor, validation, red-proofs incl. R-471).
 
 ## Observations
 
-1. **The update's Tier-3 lookup takes its full 15 s bound and logs a misleading size WARN.** FILED: R-477
-2. **A leftover unit from a removed install counts as a reinstall's fresh Tier-1 copy.** FILED: R-478
-3. **A Tier-1 route back restores settings only for a bind-data app.** FILED: R-479
-4. **The card keeps the failure sentence after a successful restore.** FILED: R-480
-5. **Removal with `remove_backups` left units and prefs again.** FILED: R-474
+1. **The brief's rules block was not delivered; the file is absent in all repos.** NOT-A-FINDING: an input gap for the operator, recorded in STATUS "needs you", not a product defect.
+2. **No scratch guest on demo-hp; the standing nine cannot be throwaways on 9201.** FILED: R-481
+3. **adventurelog ran Django DEBUG=True on the public origin.** FILED: R-482
+4. **Photo upload fails 500 from every non-browser client (frontend proxy body-length bug).** FILED: R-483
+5. **PostGIS not recognised as a database.** FILED: R-484
+6. **The backup card reads dead paths.** FILED: R-485
+7. **Removal with backups kept forgot the Tier-2 record; the restore was refused.** FILED: R-486
+8. **A removed app is on neither backup page.** FILED: R-487
+9. **The backup test package takes 5½ minutes of real waits.** FILED: R-488
+10. **`volumes_removed: null` over removed volumes, five times.** FILED: R-489