D39 = B: 09 §3 decision 255 (the security-fix step) + a dated note on decision 13; capability B23; R-1239 closed, R-1240 opened, R-1238 updated (register 186 -> 186); STATUS/CONTEXT; nodes.md (9202 password, Tester 1 DHCP); evidence security-lane-2026-10-23 (controller 0.341.0, global floor 11:24 UTC)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/operations/nodes.md

@@ -43,7 +43,7 @@ DooPlex while the boxes are away (`felhom-pve-lan` → `No route to host`, 2026-
 | What it is | **QEMU VM 341 `night1004-tester1` on demo-hp** (installed from the ISO on 2026-10-04, `audits/night-2026-10-04/tester1/`); disposable (operator) |
 | PVE node name | `felhom` (its certificate: `CN=felhom.enkicsifelhom.hu`) |
 | LAN address | **DHCP** — read 2026-10-06 as `192.168.0.154` (MAC `bc:24:11:ac:e3:f9`; find it with `ip neigh` after a ping) |
-| Customer / guest | `tester-1`; guest LXC 9201 at `192.168.0.101`, dashboard `felhom.enkicsifelhom.hu` |
+| Customer / guest | `tester-1`; guest LXC 9201 by DHCP (`192.168.0.101` until 2026-10-23, then `.148` — read it: `pct exec 9201 -- ip -4 -o addr show eth0`; `box_walk.py` reads it itself), dashboard `felhom.enkicsifelhom.hu` |
 | SSH | **`ssh root@192.168.0.154` from DooPlex works BY KEY** (measured 2026-10-09: `BatchMode=yes`, used for the release read-back); the old route `ssh -J demo-hp root@<VM address>` stays the fallback; `box_walk.py` `TARGET=tester-1` holds the route |
 | Identity checked | 2026-10-06: the agent's own report `host.node=felhom` = the VM's certificate; the guest answers its domain (200) and not demo-hp's (404) — `audits/readback-2026-10-07/E1-identity-match.txt` |
 
@@ -218,7 +218,7 @@ Details, and the two hard rules that apply to any host node, in `operations/tail
 ### demo-hp scratch guest — LXC 9202 `demo-hp-scratch` (R-481, built 2026-09-13)
 
 - **Disposition:** the nightly rotation's throwaway host. Under the **demo-hp customer** (same domain,
-  same dashboard password), **hub reporting OFF, Cloudflare tunnel OFF, agent local API OFF, off-site
+  a dashboard password of its OWN — `REHEARSAL_2026_10_20_9202_PW` in the CC secret store, named for the 2026-10-20 rehearsal; the demo-hp `PASSWORD` is refused, measured 2026-10-23), **hub reporting OFF, Cloudflare tunnel OFF, agent local API OFF, off-site
   OFF, self-update OFF** (the image is set by hand in `/etc/felhom-controller-image`). **Persists across
   nights on purpose.** Apps on it are throwaways; nothing on it is a customer promise. Not in the felhom
   pool, so the hub never sees it. Tags `scratch,r481`; the same text sits in the guest at