R-50 runbook: Part C (agent 0.95.0 -> demo-hp) + qm300 forensic

- deployed agent 0.95.0 to demo-hp via break-glass (0.93.0->0.95.0), binary
  sha-verified, caps 68/68 ok, guest 9201 untouched, hub confirms 0.95.0
- forensic: qm300 had no qmdestroy; it died with the mid-July N100 reprovision
- nodes.md: fleet agents 0.95.0; demo-hp deploy note

REPORT.md

@@ -50,6 +50,17 @@ Drill VM 300 left **running in the working island configuration** (snapshot `r50
 day-0). Scratch hub records `drill-r50` (customer + appliance #9) remain — throwaway; teardown noted in
 nodes.md. `demo-hp` host networking, guest 9201, and felhom-pve were **untouched**.
 
-## Not done here (by design / veto)
-- **Part C** (deploy agent 0.95.0 → demo-hp) — veto-able; pending after this evidence.
-- **Forensic** (qm300 disappearance on felhom-pve) — optional, read-only; pending.
+## Part C — agent 0.95.0 deployed to demo-hp (DONE)
+`0.93.0 → 0.95.0` via the sanctioned method (green gate build/vet/test pass; `configs/` unchanged since
+0.93.0 so binary-only). scp via break-glass → backup `.bak-0.93.0` → `install -m0755` → `systemctl
+restart`. Verified: deployed sha256 == local build (`b5fa7c5d…`), version 0.95.0, service active,
+**capabilities 68/68 ok, 0 degraded**, local-api listening, all watchdogs up, no ERROR/panic; **guest
+9201 untouched/running**; hub confirms demo-hp reporting 0.95.0. (Note: the hub's *vouched* Day-0
+artifact still reads 0.93.0 — the manifest vouch is a separate operator step, not needed for a running
+host; flag for follow-up if new installs should get 0.95.0.) Both fleet nodes now run 0.95.0.
+
+## Forensic — where did qm300 go? (DONE, read-only)
+On felhom-pve (demo-felhom, PVE 9.2.2): **no discrete `qmdestroy`.** No `300.conf`, no `vm-300` LVs, no
+`:300:` in any task log (incl. archives), `qm list` empty; task history only reaches back to ~2026-07-16.
+qm300 (the old drill VM) vanished when the **N100 was fully reprovisioned/reborn** mid-July — the whole
+node (task DB + LVM) was recreated from scratch, taking qm300 with it. felhom-pve left untouched.

documentation/operations/nodes.md

@@ -13,7 +13,7 @@
 | Firmware | AMI AN3PLUS-class | **AMI M42 v01.10 (11/11/2020)** |
 | PVE node name | `demo-felhom` | `felhom-host` |
 | Customer | `demo-felhom` | `demo-hp` |
-| Agent | 0.92.1 | 0.92.1 |
+| Agent | 0.95.0 | 0.95.0 |
 | SSH alias | `felhom-pve` | **`demo-hp`** |
 | Tailnet | `100.70.170.35` | **`100.76.96.79`** |
 | Loader used to install | `mkimage` (unsigned, SB **off** — firmware workaround) | **`shim`, Secure Boot ENABLED** |
@@ -57,7 +57,7 @@ that looked installed and could never call home. Repaired on the console by brid
 
 Current, post-repair: `vmbr0` static `192.168.0.87/24`, gw `192.168.0.1`, bridge-port `enp2s0f0`.
 No trace of `192.168.100.2` remains. `wg-felhom` `10.77.0.3/32` up to the hub. Guest **9201
-`demo-hp`** running. Agent **0.93.0** (behind demo-felhom's 0.95.0 — publish when convenient).
+`demo-hp`** running. Agent **0.95.0** (deployed 2026-07-25 via break-glass; `.bak-0.93.0` retained; caps 68/68 ok).
 
 ### Designated drill + build VM host (operator ruling, 2026-07-25)