night 2026-09-13/14: first "be a customer" rotation (adventurelog) — 7 defects found, 13 rows closed

New runbooks/nightly-rotation.md; observations_gate.py reads every section
(R-471); target-selection.md names real paths (R-461); R-93 carries the
fact that drill-r50 is gone. Register: R-473/R-474/R-466/R-471/R-453/R-461
and v0.240.0's R-477/R-478/R-480/R-482/R-484/R-485/R-486 closed; R-481,
R-483, R-487, R-488, R-489 opened. 09 §6.1, 07 §6, CONTEXT, STATUS note.
Evidence: audits/nightly-2026-09-13-adventurelog/, audits/v0240-2026-09-13/.

STATUS.md

@@ -1,5 +1,45 @@
 # STATUS — what works, what's broken, what's next
 
+**Updated 2026-09-14 (the night of 13→14 — "be a customer for the night", first run). Written in
+the order the rules ask for.**
+
+**Decisions I took, so you can undo them.** (1) The rules file your brief named
+(`.claude/rules/unprompted-work.md`) exists in no repo, and its text did not reach me, so I could not
+create it; I worked to the fences written in the brief itself. (2) The nine standing apps cannot be
+the night's throwaway on the same guest (same name), so the rotation starts after them (R-481).
+(3) There is no scratch guest, so the restore was done in place: remove the app, keep its backups,
+restore, read the data back. (4) One controller release (0.240.0), two catalog changes, no hub change.
+
+**What I exercised.** AdventureLog as a family: install, sign-up, a Balaton trip with three places,
+visits, a packing note, an edit and a delete — all through the app's own API; backup now + second
+copy; remove with "delete my data"; restore; the guarded Update; remove with "delete backups".
+
+**What broke.** The second-drive restore was refused after a removal that kept the backups (the box
+had forgotten the copy existed). The PostGIS database was not treated as a database, so it had no
+proper dump. The backup card said "no backups" over 484 MB. A removed app is invisible on both
+backup pages. "Delete backups" left everything behind. The app served Django debug pages to the
+internet. Photo upload fails from any non-browser client. A glance fresh install crash-looped.
+
+**What I fixed and proved live.** Controller 0.240.0 (delivered by the floor in 16 s and 18 s):
+the forgotten copy, the PostGIS dump, the backup card, "delete backups" now deletes, the stale
+failure sentence, the slow off-site check, the old-install copy. Catalog: DEBUG off for AdventureLog;
+glance now lands healthy on a fresh install. Docs: the observations gate reads every section; the
+target-selection runbook names real paths.
+
+**What I filed.** R-481 (scratch guest, your decision), R-483 (photo upload needs a browser check),
+R-487 (removed apps invisible on the backup pages), R-488 (a 5-minute test package), R-489 (the
+removal reports null over volumes it removed).
+
+**Register.** Before: 432 156 bytes open / 120 598 closed (212 / 177 rows). After: see the top of
+`OPEN-ITEMS.md` — 207 open / 188 closed.
+
+**Needs you.** (a) The rules file text — paste it and I create it in all three repos. **If you do
+nothing:** nights run on the brief's fences, as tonight. (b) R-481: how to make a scratch guest (a
+second enrolled LXC, or an ISO appliance per night). **If you do nothing:** restores stay in-place and
+the nine standing apps are never walked. (c) R-483: open AdventureLog in a browser and add a photo
+to a place. **If you do nothing:** we do not know whether households can upload photos. (d) R-479
+from the afternoon still waits.
+
 **Updated 2026-09-13 (fourth pass) — you decided both things. New releases reach the demo machines
 by themselves again, and an app with any backup can now be updated. Both are live and proven on the
 HP. Nothing needs you.**