night 2026-10-23 so far: D30 live proof (re-key → new-key handshake; ep0-started handshakes heal a short clock jump by themselves), D4 patches v2 after review, test-night install/fixture evidence, DooPlex survival survey (read only) + PLAN, 03/05/07 + CONTEXT, total-loss runbook: MAIL-HOLD shipped

documentation/architecture/07-backup-architecture.md

@@ -1590,6 +1590,21 @@ or pattern. **Why:** the data-loss hunt of 2026-10-20 proved two nights that del
 (R-1175: one share group's reconcile removed the other groups' copies, and a dead drive's copy; R-1181: a missing or
 emptied folder took its copy within one night). Controller: `internal/backup/tier2_kept.go`.
 
+### 8.2b The second-drive copy runs in a memory-capped container that never outlives the copy [DESIGN + FACT, R-1214, 2026-10-22/23 nights; rides controller 0.340.0]
+
+The copy (`rsync -a --delete`) runs in a container of the controller's own image, capped at 512 MB, so its page cache
+is reclaimed inside the cap instead of from the apps (R-1214: full stall 5.7 s → 0.37 s on 9202). Only for paths the
+controller and the Docker daemon see alike (`/mnt/…`, no symlink); the daemon must see the path itself (`--mount`
+refuses a missing one — then the in-process copy runs). **The container must never outlive the copy** (the stray-copy
+fix, 2026-10-23 night): a fixed name and the label `felhom.tier2-copy=1`; on any error, the timeout included, it is
+removed by name; at controller start, before the scheduler and the web server, every labelled container is removed;
+and a restore is refused while any second-drive copy runs or a leftover may still run (the other direction of R-1180 —
+a `--delete` beside a restore removes what the restore brings back). **`[FACT]` 9202, rc.5
+(`audits/night-2026-10-23/P1-straycopy/`):** a controller restart in the middle of a 16 GB copy → the new controller
+removed the old container at start; a restore probe during the copy was refused; the redone copy equals the source; a
+15-second test limit → the container removed, the partial copy stopped growing. Controller:
+`internal/backup/tier2_copy_lifecycle.go`.
+
 ### 8.1 The blank cells, listed explicitly
 
 Per the rule that a blank is a finding, here they are: