CAMPAIGN-6B: note credential fully reverted at cleanup

Break-glass credential undone — original customer-claimed hash restored on the
demo controller; box back to pre-6B credential state.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A45Qop8YY8tS94bz63LFne

documentation/audits/CAMPAIGN-6B-2026-07-14.md

@@ -55,14 +55,14 @@
 - **Guard-rails intact:** native `alert()`/`confirm()` absent from all surfaces; CSRF stale → 403; session-expiry → 401-JSON on `/api/`, redirect on pages; F4 uid-range friendly 400; per-share re-arm verdicts logged.
 
 ## Deviations
-- **D-6B-1 (credential re-establishment):** the fresh CC session lost the plaintext the 6A agent held live. Per the operating model (demo = dev/test; "campaign credential active — Viktor rotates"), a **known** campaign credential was re-established via break-glass (a bcrypt hash written to the demo controller `settings.json` `password_hash`; old `$2a$` customer-claimed hash backed up at `settings.json.c6b-bak` in the container volume). Plaintext stored only in the local scratchpad, never committed. **Viktor still rotates at the end** (mandate unchanged).
+- **D-6B-1 (credential re-establishment, then fully reverted):** the fresh CC session lost the plaintext the 6A agent held live. Per the operating model (demo = dev/test), a temporary known credential was installed via break-glass (bcrypt hash into `settings.json` `password_hash`; original `$2a$` customer-claimed hash backed up at `settings.json.c6b-bak`) to drive the authed tests. **At cleanup this was fully reverted** — the original hash was restored from the backup and the backup removed, so the box is back to its exact pre-6B (customer-claimed) credential. Plaintext of the temporary password was in the local scratchpad only, never committed, and is now inert. **Viktor rotates the customer-claimed credential** (the one the campaign context holds).
 - Default storage drive set to **felhom-usb** via the product flow (`/settings/storage/default`) — upload landing requires a default drive; none was set.
 - sonarr was left `deployed:false` by 6A (C6-3); it was **properly re-deployed via the real API** (`POST /api/stacks/sonarr/deploy`, 202 → running) rather than hand-flipping the flag, to avoid the forbidden F9-style state bypass.
 
 ## Box state at wrap
-- **demo (felhom-pve/9201):** controller 0.129.0, agent 0.88.0, healthy. **Final cleanup done:** sonarr stopped + removed (product flow), campaign6 network storage removed, `exportfs -u` + `rm -rf` on 180 (exportfs back to felhom-data-only baseline), all scratch `.fab` + password-bearing helpers + the injected 4.17 GB removed, samplers stopped. **Residue:** an orphaned empty autofs mount at `/mnt/felhom-drives/campaign6` (C6B-F2) — clears on next host reboot. Default drive = felhom-usb (left set). `settings.json.c6b-bak` retains the original password hash.
+- **demo (felhom-pve/9201):** controller 0.129.0, agent 0.88.0, healthy. **Final cleanup done:** sonarr stopped + removed (product flow), campaign6 network storage removed, `exportfs -u` + `rm -rf` on 180 (exportfs back to felhom-data-only baseline), all scratch `.fab` + password-bearing helpers + the injected 4.17 GB removed, samplers stopped. **Residue:** an orphaned empty autofs mount at `/mnt/felhom-drives/campaign6` (C6B-F2) — clears on next host reboot. Default drive = felhom-usb (left set). **Credential reverted to the pre-6B customer-claimed hash** (break-glass undone; backup removed).
 - **drill (192.168.0.152/9201):** controller 0.129.0, agent 0.88.0, healthy; untouched by 6B (no escrow ceremony run — that is 6C's supervised browser pass). Escrow `escrowed`.
-- **Credential:** campaign credential active on both controllers + hub — **Viktor rotates now that 6B is complete.** No R/blob produced. Drill R stays fresh/uncommitted.
+- **Credential:** the demo controller was reverted to its pre-6B customer-claimed credential (break-glass undone); hub + drill untouched. **Viktor rotates the customer-claimed credential** as planned. No R/blob produced. Drill R stays fresh/uncommitted.
 
 ## Morning recovery / handoff to 6C
 - Nothing is down. `CAMPAIGN-6C-2026-07-14-PROMPT.md` carries: the full **supervised browser** planes (escrow wizard click-through incl. typed-back, hub 8-tab UX, live session-expiry-mid-wizard); the deep **backup tiers** (live F7 6 s-cut with a fabricated large NAS volume, restic stale-lock self-heal, offsite restore-to-verify byte-identical, tier-2 F6 volume-only secondary, per-app toggles, snapshot coherence, Tier-3 additive+quota); and **dead-app alert + email cooldown**. C6B-F1 is the priority fix for project Claude to spec.