diff --git a/documentation/audits/evidence-chaos-night-2026-09-17/pre-round-11-notes.txt b/documentation/audits/evidence-chaos-night-2026-09-17/pre-round-11-notes.txt
new file mode 100644
index 00000000..3ca702a2
--- /dev/null
+++ b/documentation/audits/evidence-chaos-night-2026-09-17/pre-round-11-notes.txt
@@ -0,0 +1,22 @@
+# Pre-round-11 steadiness check, 2026-09-16T23:38Z — and the seventh instrument slip
+
+## The box is steady, and the fences are clean
+  containers            26, none in a non-Up state
+  household unit        active AND enabled     (it survived the round 10 reset)
+  disk guard            active AND enabled     (now file-backed; 0 kills all night)
+  free on /             7556 MB
+  household loop        152 lines, last write 23:38:09Z
+  front doors           cloud/status/paste/wiki all 200 on the public path, 301 on the LAN
+  demo-hp FORWARD       -P ACCEPT, physdev rules: 0, bridge-nf sysctl: 0
+
+## THE SEVENTH SLIP, MINE: I probed a front door that does not exist
+My steadiness check read "docs public=404" and for a moment that looked like damage.
+It is not. The real front-door names on this box, taken from the household loop's own list, are:
+    cloud inventory media paperless paste photos recipes share status travel vault wiki
+There is no "docs". I invented the hostname while typing the check.
+Traefik answering 404 for a Host header it has no router for is CORRECT behaviour, and `cloud`
+read 200 in the same breath.
+
+The lesson is the same one as the `--data-urlencode`/`wc -c` slips earlier tonight: a probe whose
+TARGET is wrong produces a confident, well-formatted number that means nothing. The defence that
+worked here was asking the box for the authoritative list instead of trusting the name I had typed.