night 2026-09-24: findings doc, decisions 29-30, STATUS/CONTEXT, register 335->344 (7 closed), teardown evidence, floor 0.269.1

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -14,6 +14,33 @@
 > language, one screen, no identifiers in the prose. Same subjects, different readers; merging them
 > would make one of the two audiences stop reading. `STATUS.md` is also a **view of `OPEN-ITEMS.md`**
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
+## 2026-09-24 (night shift, run in daytime) — the second drive brings a file app back whole; the box stops a crash loop; digests on the box; the update leg spiked
+
+**Operator rulings recorded (`09` §3 decisions 26–28).** 26 — build one action that brings a file app back WHOLE
+from the second drive. 27 — while a held app's page says support is informed, Remove offers only "keep my data".
+28 — a crash loop or an OOM storm is STOPPED by the box; household + operator told; Start = one more try.
+
+**Decisions taken by CC unattended — operator may reverse (`09` §3 decisions 29, 30).** 29 — the crash loop is
+≥ 6 restarts in 10 min from `RestartCount` (the brief's 10/10 misses a steady loop: Docker caps it at ~1/min).
+30 — an INSTALLED app keeps its image digest until a guarded Update moves it (`stacks.CarryDigests`); shipped as a
+SECOND controller release (v0.269.1) instead of taking v0.269.0's sync behaviour to the fleet.
+
+**Shipped.** Controller **v0.269.0** (`3c6b49b`): `backup.RestoreTier2Whole` (R-661), fail-closed `sameDevice`
+(R-668), keep-data-only remove (R-666), `stacks.ObserveUnhealthy` + `unhealthy_stop` hold (R-667), step
+`.felhom.yml` for probe/memory/applied (R-664/R-665), R-662 removed, digests rendered + badge from the tested digest
+(§6.4 part 6 box half). Controller **v0.269.1** (`5b1b191`): `CarryDigests`. Hub **v0.123.0**:
+`app_stopped_unhealthy` (household + operator). Catalog **`cf7cf84`**: step `.felhom.yml` files, gate rule 4b.
+**Floor 0.269.1** (MinAgent 0.131.0): N100 arrived; **demo-hp 9201 did not** (R-672).
+
+**Spiked, not built.** `09` §6.4 part 7 is now a measured build brief (§6.4.2): chain the update leg from the
+off-site job on EVERY exit path (no reliable "finished" signal exists — `offbox.go:863-897` early returns write
+nothing), gate interlock beside `WindowStartFn`, per-box switch default ON; gaps R-678/R-679/R-680.
+
+**Found.** R-672 (P1, agent): the scheduled restore-test filled demo-hp's thin pool; 9201's disks are read-only
+— **operator: stop + fsck + start 9201**. R-669 (a hold + restore leaves the failed step's probe as applied;
+proven to cause a false hold), R-670, R-671, R-673–R-677, R-681 (a lost install is silent), R-682, R-683.
+**Not done:** Part D (no bench — the session could not destroy one). Evidence: `audits/DRILL-night-2026-09-24.md`.
+
 ## 2026-09-24 (morning) — the fleet on 0.267.0 then 0.268.0; the undo after a restore; option A; the ladder on the box
 
 **Operator rulings (`09` §3 decisions 24–25).** 24 — the fleet takes 0.267.0 although the chaos hour's stop rule