diff --git a/documentation/audits/night-2026-10-04/PREDICTION.md b/documentation/audits/night-2026-10-04/PREDICTION.md
new file mode 100644
index 00000000..b8425e37
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/PREDICTION.md
@@ -0,0 +1,48 @@
+# Prediction table — written 2026-10-04 ~21:45 CEST, BEFORE anything ran
+
+All times CEST (the controller's scheduler is Europe/Budapest). Sources: each controller's "Daily job … scheduled for"
+lines (`baseline/schedule-*.txt`), the agent journals of the last 7 nights, `11` §5.5 / §8.1, `07` §6.1.
+
+## The 20-hour gap
+
+The marker `/var/lib/felhom-agent/os/last-night-run` is written only by a `night`-trigger leg. **It does not exist on
+either demo box** (both: `No such file`): every OS run today was `debug` or signed, and the hub has no `night` report from
+either demo box (`os_reports`: only Tester 2's two). **Prediction: the gap skips nothing tonight on either box.** No
+marker to clear on demo-felhom — §1.2's "clear the marker" step is not needed (and no documented route exists to clear
+it; none was invented).
+
+## Per box
+
+| Box | Leg | Expected | Why |
+|---|---|---|---|
+| demo-hp | db-dump | 02:30 | scheduler |
+| demo-hp | tier-2 copy + fill-watch | 03:30 | scheduler |
+| demo-hp | metrics-prune | 04:00 | scheduler |
+| demo-hp | off-site | 04:15 | scheduler |
+| demo-hp | whole-guest backup (`local`) | ~04:35 → ~04:40 | last nights: 04:34:55 → 04:39:41 |
+| demo-hp | OS leg guest → host → Docker (ring 0) | ~04:40 → ~04:45, right after the backup | `AfterPrimaryBackup`; no gap marker. Guest: pending Debian fixes if any appeared since today; host: same; Docker: `select pending-docker` = nothing newer than 29.8.2 expected → "nothing". The root-owned `ring0_slow_lane` mark is ON on both demo boxes (read 21:47: `os-trust.json`), so the Docker step runs unsigned and should report "nothing". |
+| demo-hp | controller 04:30 self-update | no action | current 0.293.0 = floor 0.293.0 |
+| demo-hp | offsite-abandon-sweep / offsite-proof / offsite-integrity | 05:10 / 05:30 / 06:00 | scheduler |
+| demo-felhom | db-dump / tier-2 / off-site | 02:30 / 03:30 / 04:15 | scheduler |
+| demo-felhom | whole-guest backup (`felhom-backup`) | **~07:45–07:55** — after the 06:30 stop | last 7 nights 07:37 → 07:49, drifting +2–3 min a night |
+| demo-felhom | OS leg | after ~07:50 — **not watched** | follows the backup |
+| Tester 1 (new box) | first whole-guest backup + OS leg | **minutes after enrolment**, not at night | Tester 2 (2026-10-04): backup 14 min after enrolment, `night`-trigger OS leg right after (49 + 106 packages) |
+| Tester 1 | its first OS leg's package count | **0 guest, 0 host** — ring 1 installs only an approved release, and none is in force; it reports the pending ones (~49 guest from the golden) as "not covered" | `11` §5.3, golden 0.293.0 |
+| Tester 1 | night db-dump / tier-2 / off-site | 02:30 / 03:30 (no 2nd drive → skipped) / 04:15 | scheduler |
+| Tester 1 | off-site night one — decision 78 | 04:15: the orphaned old repository (earlier tester-1 boxes) is SET ASIDE, never deleted; a new repository started; one household line | decision 78 (controller v0.291.0) |
+| Tester 1 | whole-guest at night | not due (the install-time one is < 24 h old) | cadence |
+| Tester 1 | OS leg at night | none — the install-time leg wrote the marker < 20 h before | the gap |
+| Tester 2 | anything | offline since 18:06 UTC — nothing | hub `STALE` |
+
+## Approvals
+
+No guest or host release is in force (today's test approvals were cancelled at 18:20 UTC). The ruled rule: 24 h since
+the set was first seen AND one `night` run on EVERY ring-0 box since then. Guest set first seen 11:07 UTC, host 12:24 UTC
+(if tonight's leg installs something, the set changes and the clock restarts). demo-felhom's night run comes ~07:50, so
+**the earliest real approval is after ~11:07 UTC tomorrow**, only if neither box's set changes tonight. Docker: the
+operator's release stays; no new set expected.
+
+## Mails expected tonight
+
+None to a household from the demo boxes (a normal night). Tester 1: the household line for the off-site set-aside; the
+operator mail for it. Operator: `host_stale` / `node_stale` for Tester 2 already sent; nothing more unless it returns.
diff --git a/documentation/audits/night-2026-10-04/accidents/a2-after.txt b/documentation/audits/night-2026-10-04/accidents/a2-after.txt
new file mode 100644
index 00000000..7f5fc77c
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a2-after.txt
@@ -0,0 +1,34 @@
+cloudflared bdbd524f10b0 Up 7 minutes (healthy)
+felhom-controller 6fed831a7b6b Up 3 minutes (healthy)
+filebrowser 6bda22106919 Up 7 minutes (healthy)
+opengist 17fc57389b52 Up 3 minutes (healthy)
+traefik ddc8abb0ce45 Up 3 minutes
+2026/10/04 20:16:14 [INFO] [web] manual whole-guest backup triggered (quiesce loop)
+2026/10/04 20:16:14 [INFO] [quiesce] manual backup requested — quiescing now
+2026/10/04 20:16:16 [INFO] [quiesce] backup due on 2 tier(s) — quiescing 1 stack(s): [opengist]
+2026/10/04 20:16:16 [INFO] [stacks] Stopping stack: opengist
+2026/10/04 20:16:16 [INFO] [quiesce] tier felhom-backup: backup job backup-9201-1791144976590222481 started — polling
+2026/10/04 20:16:33 [WARN] [sockheal] Docker refuses the socket (dial unix /var/run/docker.sock: connect: connection refused) — exiting after 1m0s of refusals so Docker restarts this controller on the current socket (R-860)
+2026/10/04 20:16:46 [INFO] [quiesce] tier felhom-backup: backup job backup-9201-1791144976590222481 done — next tier may start (app still quiesced)
+2026/10/04 20:16:46 [INFO] [quiesce] tier felhom-pbs is BUSY — the agent refused the backup because a concurrent heavy operation holds it. This is contention, NOT a failure: the tier stays due and retries in 15m0s (contended for
+2026/10/04 20:16:46 [INFO] [quiesce] unquiescing (last tier is busy — deferring to a later cycle): restarting 1 stack(s)
+2026/10/04 20:16:46 [INFO] [stacks] Starting stack: opengist
+2026/10/04 20:16:46 [ERROR] [quiesce] restart opengist: starting stack opengist: exit code 1
+2026/10/04 20:17:33 [ERROR] [sockheal] Docker has refused the socket for 1m0s (dial unix /var/run/docker.sock: connect: connection refused) — the socket file was re-created and this container holds the old one; EXITING (code 75)
+2026/10/04 20:17:35 [INFO] [quiesce] loop started (poll 5m0s, max-quiesce 30m0s)
+2026/10/04 20:17:35 [INFO] [scheduler] Daily job tier2-backup scheduled for 2026-10-05 03:30 CEST
+2026/10/04 20:17:50 [INFO] [bootrecon] boot window: fleet settled after 10s (3 identical samples 5s apart) — sweeping
+2026/10/04 20:17:50 [INFO] [bootrecon] Boot reconciliation: 1 boot-orphaned app(s) found: [opengist] — up to 2 attempt(s)
+2026/10/04 20:17:50 [INFO] [stacks] Starting stack: opengist
+2026/10/04 20:17:50 [INFO] [bootrecon] Boot reconciliation attempt 1/2: started "opengist" (took 0.5s)
+2026/10/04 20:17:50 [INFO] [bootrecon] Boot reconciliation complete: 1 app(s) recovered in 1 attempt(s): [opengist]
+2026/10/04 20:18:05 [WARN] [sockheal] traefik holds an old docker socket (inode 151, current 646) — restarting it (R-860)
+2026/10/04 20:18:05 [INFO] [sockheal] traefik restarted onto the current docker socket
+Oct 04 22:16:43 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:16:43.062+02:00 level=INFO msg="backup: completed" vmid=9201 target=felhom-backup archive=felhom-backup:backup/vzdump-lxc-9201-202
+Oct 04 22:16:43 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:16:43.062+02:00 level=INFO msg="local-api: backup job complete" vmid=9201 target=felhom-backup job=backup-9201-1791144976590222481
+Oct 04 22:18:13 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:13.063+02:00 level=INFO msg="osupdate: START" run=20261004T201813Z layer=guest vmid=9201 ring=0 trigger=night enabled=true rele
+Oct 04 22:18:26 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:26.519+02:00 level=INFO msg="osupdate: DONE" run=20261004T201813Z layer=guest vmid=9201 ring=0 trigger=night outcome=nothing he
+Oct 04 22:18:26 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:26.609+02:00 level=INFO msg="osupdate: START" run=20261004T201813Z layer=host vmid=9201 ring=0 trigger=night enabled=true relea
+Oct 04 22:18:39 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:39.682+02:00 level=INFO msg="osupdate: DONE" run=20261004T201813Z layer=host vmid=9201 ring=0 trigger=night outcome=nothing hea
+Oct 04 22:18:41 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:41.341+02:00 level=INFO msg="osupdate: START" run=20261004T201813Z layer=docker vmid=9201 ring=0 trigger=night enabled=true rel
+Oct 04 22:18:56 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:18:56.175+02:00 level=INFO msg="osupdate: DONE" run=20261004T201813Z layer=docker vmid=9201 ring=0 trigger=night outcome=nothing h
diff --git a/documentation/audits/night-2026-10-04/accidents/a2-ps-before.txt b/documentation/audits/night-2026-10-04/accidents/a2-ps-before.txt
new file mode 100644
index 00000000..b6386324
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a2-ps-before.txt
@@ -0,0 +1,5 @@
+cloudflared bdbd524f10b0 Up 2 minutes (healthy)
+felhom-controller 6fed831a7b6b Up 2 minutes (healthy)
+filebrowser 6bda22106919 Up 2 minutes (healthy)
+opengist 2b84350e01a3 Up 2 minutes (healthy)
+traefik ddc8abb0ce45 Up 2 minutes
diff --git a/documentation/audits/night-2026-10-04/accidents/a2-timeline.txt b/documentation/audits/night-2026-10-04/accidents/a2-timeline.txt
new file mode 100644
index 00000000..d1a8d7b8
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a2-timeline.txt
@@ -0,0 +1,30 @@
+20:16:12
+{"data":{"started":true},"ok":true}
+
+HTTP 200
+app-stop seen 20:16:17
+docker.socket restarted 20:16:23 inode=646
+20:16:41 controller_started=20:13:31 running=4
+20:16:53 controller_started=20:13:31 running=4
+20:17:04 controller_started=20:13:31 running=4
+20:17:16 controller_started=20:13:31 running=4
+20:17:27 controller_started=20:13:31 running=4
+20:17:39 controller_started=20:17:33 running=4
+20:17:51 controller_started=20:17:33 running=5
+20:18:02 controller_started=20:17:33 running=5
+20:18:14 controller_started=20:17:33 running=5
+20:18:25 controller_started=20:17:33 running=5
+20:18:37 controller_started=20:17:33 running=5
+20:18:49 controller_started=20:17:33 running=5
+20:19:00 controller_started=20:17:33 running=5
+20:19:12 controller_started=20:17:33 running=5
+20:19:23 controller_started=20:17:33 running=5
+20:19:35 controller_started=20:17:33 running=5
+20:19:46 controller_started=20:17:33 running=5
+20:19:58 controller_started=20:17:33 running=5
+20:20:09 controller_started=20:17:33 running=5
+20:20:21 controller_started=20:17:33 running=5
+20:20:32 controller_started=20:17:33 running=5
+20:20:44 controller_started=20:17:33 running=5
+20:20:55 controller_started=20:17:33 running=5
+20:21:07 controller_started=20:17:33 running=5
diff --git a/documentation/audits/night-2026-10-04/accidents/a4-diskfull.txt b/documentation/audits/night-2026-10-04/accidents/a4-diskfull.txt
new file mode 100644
index 00000000..b1664b82
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a4-diskfull.txt
@@ -0,0 +1,9 @@
+20:24:20
+/dev/mapper/pve-vm--9201--disk--0   32G   30G  400M  99% /
+os-apply: START release=a4-diskfull layer=guest:9201 lane=fast mode=apply select=listed packages=3
+os-apply: REPAIR configured=0 fixed=0
+os-apply: PLAN upgrade=3 already=0 not-installed=0 from-snapshot=0
+os-apply: REFUSED: R8 free space 419430400 B is below max(500 MB, 3 x download 0 B)
+OSAPPLY-REPORT {"health_before": {"containers": {"bookstack": {"health": "healthy", "id": "b2c5a47cecf243d921f300f2d61b634f8fab5b9f84bf0f43b7de9255c10c174f", "state": "running"}, "bookstack-db": {"health": "healthy", "id": "7ed4dde2643bf9834b33bdb4696c22604faf045bbbba67666acdb282138b7ea3", "state": 
+rc=2
+bind9-libs:amd64	1:9.20.23-1~deb13u1
diff --git a/documentation/audits/night-2026-10-04/accidents/a4-download-size-probe.txt b/documentation/audits/night-2026-10-04/accidents/a4-download-size-probe.txt
new file mode 100644
index 00000000..8df6ad48
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a4-download-size-probe.txt
@@ -0,0 +1,4 @@
+--- as the wrapper (with -s):
+0
+--- without -s:
+3 uris, 1471812 bytes
diff --git a/documentation/audits/night-2026-10-04/accidents/a5-diff-vs-baseline.txt b/documentation/audits/night-2026-10-04/accidents/a5-diff-vs-baseline.txt
new file mode 100644
index 00000000..3884c11c
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a5-diff-vs-baseline.txt
@@ -0,0 +1,4 @@
+66a67
+> iso-codes=4.18.0-1
+211a213
+> lsb-release=12.1-1
diff --git a/documentation/audits/night-2026-10-04/accidents/a5-pkgs-after-repair.txt b/documentation/audits/night-2026-10-04/accidents/a5-pkgs-after-repair.txt
new file mode 100644
index 00000000..db3940b3
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a5-pkgs-after-repair.txt
@@ -0,0 +1,281 @@
+adduser=3.152
+apparmor=4.1.0-1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+bzip2=1.0.8-6
+ca-certificates=20250419
+containerd.io=2.3.6-1~debian.13~trixie
+coreutils=9.7-3
+cpio=2.15+dfsg-2
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus-user-session=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+distro-info-data=0.66+deb13u2
+dmidecode=3.6-2
+doc-debian=11.3+nmu1
+docker-buildx-plugin=0.37.1-1~debian.13~trixie
+docker-ce-cli=5:29.8.2-1~debian.13~trixie
+docker-ce-rootless-extras=5:29.8.2-1~debian.13~trixie
+docker-ce=5:29.8.2-1~debian.13~trixie
+docker-compose-plugin=5.6.0-1~debian.13~trixie
+dpkg=1.22.22
+e2fsprogs=1.47.2-3+b12
+fdisk=2.41.5-0+deb13u1
+file=1:5.46-5
+findutils=4.10.0-3
+gcc-14-base=14.2.0-19
+gettext-base=0.23.1-2
+git-man=1:2.47.3-0+deb13u1
+git=1:2.47.3-0+deb13u1
+grep=3.11-4
+groff-base=1.23.0-9
+gzip=1.13-1+deb13u1
+hostname=3.25
+ifupdown2=3.0.0-1.3
+ifupdown=0.8.44+deb13u1
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+iproute2=6.15.0-1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+iso-codes=4.18.0-1
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+less=668-1
+libacl1=2.3.2-2+b1
+libapparmor1=4.1.0-1
+libapt-pkg7.0=3.0.3
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcbor0.10=0.10.2-2
+libcom-err2=1.47.2-3+b12
+libcrypt1=1:4.4.38-1
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdb5.3t64=5.3.28+dfsg2-9
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libedit2=3.1-20250104-1
+libelf1t64=0.192-4
+liberror-perl=0.17030-1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfdisk1=2.41.5-0+deb13u1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfstrm0=0.6.1-1+b3
+libgcc-s1=14.2.0-19
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libgmp10=2:6.3.0+dfsg-3
+libgnutls30t64=3.8.9-3+deb13u4
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libhogweed6t64=3.10.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjson-c5=0.18+ds-1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libkmod2=34.2-2
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap-common=2.6.10+dfsg-1
+libldap2=2.6.10+dfsg-1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libncursesw6=6.5+20250216-2
+libnetfilter-conntrack3=1.1.0-1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnsl2=1.3.0-3+b3
+libnss-systemd=257.13-1~deb13u1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpcre2-8-0=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpopt0=1.19+dfsg-2
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libpsl5t64=0.21.2-1.1+b1
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libreadline8t64=8.2-6
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsepol2=3.8.1-1
+libslang2=2.3.3-5+b2
+libsmartcols1=2.41.5-0+deb13u1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstdc++6=14.2.0-19
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunistring5=1.3-2
+liburcu8t64=0.15.2-2
+libuuid1=2.41.5-0+deb13u1
+libuv1t64=1.50.0-2
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libzstd1=1.5.7+dfsg-1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsb-release=12.1-1
+lsof=4.99.4+dfsg-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netbase=6.5
+netcat-traditional=1.10-50
+nftables=1.1.3-1
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+patch=2.8-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl=5.40.1-6+deb13u1
+pigz=2.8-1
+postfix=3.10.13-0+deb13u1
+procps=2:4.0.4-9
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-certifi=2025.1.31+ds-1
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-minimal=3.13.5-1
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-urllib3=2.3.0-3+deb13u2
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+readline-common=8.2-6
+reportbug=13.2.0
+runit-helper=2.16.4
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+systemd-sysv=257.13-1~deb13u1
+systemd-timesyncd=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tar=1.35+dfsg-3.1
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wtmpdb=0.73.0-3+deb13u1
+xz-utils=5.8.1-1+deb13u1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1
diff --git a/documentation/audits/night-2026-10-04/accidents/a5-pkgs-final.txt b/documentation/audits/night-2026-10-04/accidents/a5-pkgs-final.txt
new file mode 100644
index 00000000..5df33950
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a5-pkgs-final.txt
@@ -0,0 +1,279 @@
+adduser=3.152
+apparmor=4.1.0-1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+bzip2=1.0.8-6
+ca-certificates=20250419
+containerd.io=2.3.6-1~debian.13~trixie
+coreutils=9.7-3
+cpio=2.15+dfsg-2
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus-user-session=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+distro-info-data=0.66+deb13u2
+dmidecode=3.6-2
+doc-debian=11.3+nmu1
+docker-buildx-plugin=0.37.1-1~debian.13~trixie
+docker-ce-cli=5:29.8.2-1~debian.13~trixie
+docker-ce-rootless-extras=5:29.8.2-1~debian.13~trixie
+docker-ce=5:29.8.2-1~debian.13~trixie
+docker-compose-plugin=5.6.0-1~debian.13~trixie
+dpkg=1.22.22
+e2fsprogs=1.47.2-3+b12
+fdisk=2.41.5-0+deb13u1
+file=1:5.46-5
+findutils=4.10.0-3
+gcc-14-base=14.2.0-19
+gettext-base=0.23.1-2
+git-man=1:2.47.3-0+deb13u1
+git=1:2.47.3-0+deb13u1
+grep=3.11-4
+groff-base=1.23.0-9
+gzip=1.13-1+deb13u1
+hostname=3.25
+ifupdown2=3.0.0-1.3
+ifupdown=0.8.44+deb13u1
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+iproute2=6.15.0-1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+less=668-1
+libacl1=2.3.2-2+b1
+libapparmor1=4.1.0-1
+libapt-pkg7.0=3.0.3
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcbor0.10=0.10.2-2
+libcom-err2=1.47.2-3+b12
+libcrypt1=1:4.4.38-1
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdb5.3t64=5.3.28+dfsg2-9
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libedit2=3.1-20250104-1
+libelf1t64=0.192-4
+liberror-perl=0.17030-1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfdisk1=2.41.5-0+deb13u1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfstrm0=0.6.1-1+b3
+libgcc-s1=14.2.0-19
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libgmp10=2:6.3.0+dfsg-3
+libgnutls30t64=3.8.9-3+deb13u4
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libhogweed6t64=3.10.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjson-c5=0.18+ds-1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libkmod2=34.2-2
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap-common=2.6.10+dfsg-1
+libldap2=2.6.10+dfsg-1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libncursesw6=6.5+20250216-2
+libnetfilter-conntrack3=1.1.0-1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnsl2=1.3.0-3+b3
+libnss-systemd=257.13-1~deb13u1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpcre2-8-0=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpopt0=1.19+dfsg-2
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libpsl5t64=0.21.2-1.1+b1
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libreadline8t64=8.2-6
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsepol2=3.8.1-1
+libslang2=2.3.3-5+b2
+libsmartcols1=2.41.5-0+deb13u1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstdc++6=14.2.0-19
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunistring5=1.3-2
+liburcu8t64=0.15.2-2
+libuuid1=2.41.5-0+deb13u1
+libuv1t64=1.50.0-2
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libzstd1=1.5.7+dfsg-1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsof=4.99.4+dfsg-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netbase=6.5
+netcat-traditional=1.10-50
+nftables=1.1.3-1
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+patch=2.8-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl=5.40.1-6+deb13u1
+pigz=2.8-1
+postfix=3.10.13-0+deb13u1
+procps=2:4.0.4-9
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-certifi=2025.1.31+ds-1
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-minimal=3.13.5-1
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-urllib3=2.3.0-3+deb13u2
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+readline-common=8.2-6
+reportbug=13.2.0
+runit-helper=2.16.4
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+systemd-sysv=257.13-1~deb13u1
+systemd-timesyncd=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tar=1.35+dfsg-3.1
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wtmpdb=0.73.0-3+deb13u1
+xz-utils=5.8.1-1+deb13u1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1
diff --git a/documentation/audits/night-2026-10-04/accidents/a5-removed-by-my-rollback.txt b/documentation/audits/night-2026-10-04/accidents/a5-removed-by-my-rollback.txt
new file mode 100644
index 00000000..5b216f5d
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a5-removed-by-my-rollback.txt
@@ -0,0 +1,18 @@
+2026-10-04 20:22:16 remove apt-listchanges:all 4.8 <none>
+2026-10-04 20:22:16 remove ifupdown2:all 3.0.0-1.3 <none>
+2026-10-04 20:22:16 remove reportbug:all 13.2.0 <none>
+2026-10-04 20:22:16 remove python3-reportbug:all 13.2.0 <none>
+2026-10-04 20:22:17 remove python3-requests:all 2.32.3+dfsg-5+deb13u1 <none>
+2026-10-04 20:22:17 remove python3-debian:all 1.0.1 <none>
+2026-10-04 20:22:17 remove python3-charset-normalizer:amd64 3.4.2-1 <none>
+2026-10-04 20:22:17 remove python3-idna:all 3.10-1+deb13u1 <none>
+2026-10-04 20:22:17 remove python3-apt:amd64 3.0.0 <none>
+2026-10-04 20:22:17 remove python3-debianbts:all 4.1.1 <none>
+2026-10-04 20:22:17 remove python3-certifi:all 2025.1.31+ds-1 <none>
+2026-10-04 20:22:17 remove python3-chardet:all 5.2.0+dfsg-2 <none>
+2026-10-04 20:22:17 remove python3-debconf:all 1.5.91 <none>
+2026-10-04 20:22:17 remove python3-urllib3:all 2.3.0-3+deb13u2 <none>
+2026-10-04 20:22:18 remove python3:amd64 3.13.5-1 <none>
+2026-10-04 20:22:18 remove python3-minimal:amd64 3.13.5-1 <none>
+2026-10-04 20:22:18 remove python3.13:amd64 3.13.5-2+deb13u5 <none>
+2026-10-04 20:22:18 remove python3.13-minimal:amd64 3.13.5-2+deb13u5 <none>
diff --git a/documentation/audits/night-2026-10-04/accidents/a5-repair-my-mistake.txt b/documentation/audits/night-2026-10-04/accidents/a5-repair-my-mistake.txt
new file mode 100644
index 00000000..6555c7aa
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a5-repair-my-mistake.txt
@@ -0,0 +1,7 @@
+20:22:46
+The following packages will be upgraded:
+8 upgraded, 20 newly installed, 0 to remove and 0 not upgraded.
+20:22:56
+280
+Reading state information...
+IDENTICAL to the 21:47 baseline
diff --git a/documentation/audits/night-2026-10-04/accidents/a5-rollback.txt b/documentation/audits/night-2026-10-04/accidents/a5-rollback.txt
new file mode 100644
index 00000000..b654b674
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/a5-rollback.txt
@@ -0,0 +1 @@
+0 upgraded, 0 newly installed, 8 downgraded, 18 to remove and 0 not upgraded.
diff --git a/documentation/audits/night-2026-10-04/accidents/hub-events-2005-2022.txt b/documentation/audits/night-2026-10-04/accidents/hub-events-2005-2022.txt
new file mode 100644
index 00000000..6460ce46
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/accidents/hub-events-2005-2022.txt
@@ -0,0 +1,4 @@
+(4616, 'demo-felhom', 'os_update_applied', 'info', 'System security fixes installed on the box (3 package(s)).', 'hub', '2026-10-04 20:12:09')
+(4617, 'demo-felhom', 'controller_started', 'info', 'Controller elindult (0.293.0)', 'controller', '2026-10-04 20:13:38')
+(4618, 'demo-felhom', 'os_update_applied', 'info', 'System security fixes installed on the box (3 package(s)).', 'hub', '2026-10-04 20:14:18')
+(4619, 'demo-felhom', 'controller_started', 'info', 'Controller elindult (0.293.0)', 'controller', '2026-10-04 20:17:40')
diff --git a/documentation/audits/night-2026-10-04/accidents/hub-notifications-2005-2022.txt b/documentation/audits/night-2026-10-04/accidents/hub-notifications-2005-2022.txt
new file mode 100644
index 00000000..e69de29b
diff --git a/documentation/audits/night-2026-10-04/baseline/os-releases.txt b/documentation/audits/night-2026-10-04/baseline/os-releases.txt
new file mode 100644
index 00000000..4ab8443d
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/baseline/os-releases.txt
@@ -0,0 +1,11 @@
+('os-20261004-091417', 'guest', '2026-10-04 09:14:17', 'auto', 1, '2026-10-04 18:20:02')
+('os-guest-20261004-123933', 'guest', '2026-10-04 12:39:33', 'auto', 1, '2026-10-04 18:20:02')
+('os-host-20261004-124034', 'host', '2026-10-04 12:40:34', 'auto', 1, '2026-10-04 18:20:02')
+('os-host-20261004-124133', 'host', '2026-10-04 12:41:33', 'auto', 1, '2026-10-04 18:20:02')
+('os-docker-20261004-142842', 'docker', '2026-10-04 14:28:42', 'operator', 0, '')
+('e196eb8652b9b11e', '2026-10-04 14:28:42')
+('1bdef9bcf1bd39e3', '2026-10-04 14:14:57')
+('777f842b71239d88', '2026-10-04 12:38:19')
+('7708d5e0f37a2796', '2026-10-04 12:24:19')
+('6c18a3e193e79f5b', '2026-10-04 11:07:23')
+('e0c5dac127834c78', '2026-10-04 09:12:07')
diff --git a/documentation/audits/night-2026-10-04/baseline/pkgs-guest-demo-hp.txt b/documentation/audits/night-2026-10-04/baseline/pkgs-guest-demo-hp.txt
new file mode 100644
index 00000000..5df33950
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/baseline/pkgs-guest-demo-hp.txt
@@ -0,0 +1,279 @@
+adduser=3.152
+apparmor=4.1.0-1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+bzip2=1.0.8-6
+ca-certificates=20250419
+containerd.io=2.3.6-1~debian.13~trixie
+coreutils=9.7-3
+cpio=2.15+dfsg-2
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus-user-session=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+distro-info-data=0.66+deb13u2
+dmidecode=3.6-2
+doc-debian=11.3+nmu1
+docker-buildx-plugin=0.37.1-1~debian.13~trixie
+docker-ce-cli=5:29.8.2-1~debian.13~trixie
+docker-ce-rootless-extras=5:29.8.2-1~debian.13~trixie
+docker-ce=5:29.8.2-1~debian.13~trixie
+docker-compose-plugin=5.6.0-1~debian.13~trixie
+dpkg=1.22.22
+e2fsprogs=1.47.2-3+b12
+fdisk=2.41.5-0+deb13u1
+file=1:5.46-5
+findutils=4.10.0-3
+gcc-14-base=14.2.0-19
+gettext-base=0.23.1-2
+git-man=1:2.47.3-0+deb13u1
+git=1:2.47.3-0+deb13u1
+grep=3.11-4
+groff-base=1.23.0-9
+gzip=1.13-1+deb13u1
+hostname=3.25
+ifupdown2=3.0.0-1.3
+ifupdown=0.8.44+deb13u1
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+iproute2=6.15.0-1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+less=668-1
+libacl1=2.3.2-2+b1
+libapparmor1=4.1.0-1
+libapt-pkg7.0=3.0.3
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcbor0.10=0.10.2-2
+libcom-err2=1.47.2-3+b12
+libcrypt1=1:4.4.38-1
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdb5.3t64=5.3.28+dfsg2-9
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libedit2=3.1-20250104-1
+libelf1t64=0.192-4
+liberror-perl=0.17030-1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfdisk1=2.41.5-0+deb13u1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfstrm0=0.6.1-1+b3
+libgcc-s1=14.2.0-19
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libgmp10=2:6.3.0+dfsg-3
+libgnutls30t64=3.8.9-3+deb13u4
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libhogweed6t64=3.10.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjson-c5=0.18+ds-1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libkmod2=34.2-2
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap-common=2.6.10+dfsg-1
+libldap2=2.6.10+dfsg-1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libncursesw6=6.5+20250216-2
+libnetfilter-conntrack3=1.1.0-1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnsl2=1.3.0-3+b3
+libnss-systemd=257.13-1~deb13u1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpcre2-8-0=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpopt0=1.19+dfsg-2
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libpsl5t64=0.21.2-1.1+b1
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libreadline8t64=8.2-6
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsepol2=3.8.1-1
+libslang2=2.3.3-5+b2
+libsmartcols1=2.41.5-0+deb13u1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstdc++6=14.2.0-19
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunistring5=1.3-2
+liburcu8t64=0.15.2-2
+libuuid1=2.41.5-0+deb13u1
+libuv1t64=1.50.0-2
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libzstd1=1.5.7+dfsg-1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsof=4.99.4+dfsg-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netbase=6.5
+netcat-traditional=1.10-50
+nftables=1.1.3-1
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+patch=2.8-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl=5.40.1-6+deb13u1
+pigz=2.8-1
+postfix=3.10.13-0+deb13u1
+procps=2:4.0.4-9
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-certifi=2025.1.31+ds-1
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-minimal=3.13.5-1
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-urllib3=2.3.0-3+deb13u2
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+readline-common=8.2-6
+reportbug=13.2.0
+runit-helper=2.16.4
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+systemd-sysv=257.13-1~deb13u1
+systemd-timesyncd=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tar=1.35+dfsg-3.1
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wtmpdb=0.73.0-3+deb13u1
+xz-utils=5.8.1-1+deb13u1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1
diff --git a/documentation/audits/night-2026-10-04/baseline/pkgs-guest-felhom-pve.txt b/documentation/audits/night-2026-10-04/baseline/pkgs-guest-felhom-pve.txt
new file mode 100644
index 00000000..5df33950
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/baseline/pkgs-guest-felhom-pve.txt
@@ -0,0 +1,279 @@
+adduser=3.152
+apparmor=4.1.0-1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+bzip2=1.0.8-6
+ca-certificates=20250419
+containerd.io=2.3.6-1~debian.13~trixie
+coreutils=9.7-3
+cpio=2.15+dfsg-2
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus-user-session=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+distro-info-data=0.66+deb13u2
+dmidecode=3.6-2
+doc-debian=11.3+nmu1
+docker-buildx-plugin=0.37.1-1~debian.13~trixie
+docker-ce-cli=5:29.8.2-1~debian.13~trixie
+docker-ce-rootless-extras=5:29.8.2-1~debian.13~trixie
+docker-ce=5:29.8.2-1~debian.13~trixie
+docker-compose-plugin=5.6.0-1~debian.13~trixie
+dpkg=1.22.22
+e2fsprogs=1.47.2-3+b12
+fdisk=2.41.5-0+deb13u1
+file=1:5.46-5
+findutils=4.10.0-3
+gcc-14-base=14.2.0-19
+gettext-base=0.23.1-2
+git-man=1:2.47.3-0+deb13u1
+git=1:2.47.3-0+deb13u1
+grep=3.11-4
+groff-base=1.23.0-9
+gzip=1.13-1+deb13u1
+hostname=3.25
+ifupdown2=3.0.0-1.3
+ifupdown=0.8.44+deb13u1
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+iproute2=6.15.0-1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+less=668-1
+libacl1=2.3.2-2+b1
+libapparmor1=4.1.0-1
+libapt-pkg7.0=3.0.3
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcbor0.10=0.10.2-2
+libcom-err2=1.47.2-3+b12
+libcrypt1=1:4.4.38-1
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdb5.3t64=5.3.28+dfsg2-9
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libedit2=3.1-20250104-1
+libelf1t64=0.192-4
+liberror-perl=0.17030-1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfdisk1=2.41.5-0+deb13u1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfstrm0=0.6.1-1+b3
+libgcc-s1=14.2.0-19
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libgmp10=2:6.3.0+dfsg-3
+libgnutls30t64=3.8.9-3+deb13u4
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libhogweed6t64=3.10.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjson-c5=0.18+ds-1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libkmod2=34.2-2
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap-common=2.6.10+dfsg-1
+libldap2=2.6.10+dfsg-1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libncursesw6=6.5+20250216-2
+libnetfilter-conntrack3=1.1.0-1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnsl2=1.3.0-3+b3
+libnss-systemd=257.13-1~deb13u1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpcre2-8-0=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpopt0=1.19+dfsg-2
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libpsl5t64=0.21.2-1.1+b1
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libreadline8t64=8.2-6
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsepol2=3.8.1-1
+libslang2=2.3.3-5+b2
+libsmartcols1=2.41.5-0+deb13u1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstdc++6=14.2.0-19
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunistring5=1.3-2
+liburcu8t64=0.15.2-2
+libuuid1=2.41.5-0+deb13u1
+libuv1t64=1.50.0-2
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libzstd1=1.5.7+dfsg-1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsof=4.99.4+dfsg-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netbase=6.5
+netcat-traditional=1.10-50
+nftables=1.1.3-1
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+patch=2.8-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl=5.40.1-6+deb13u1
+pigz=2.8-1
+postfix=3.10.13-0+deb13u1
+procps=2:4.0.4-9
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-certifi=2025.1.31+ds-1
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-minimal=3.13.5-1
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-urllib3=2.3.0-3+deb13u2
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+readline-common=8.2-6
+reportbug=13.2.0
+runit-helper=2.16.4
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+systemd-sysv=257.13-1~deb13u1
+systemd-timesyncd=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tar=1.35+dfsg-3.1
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wtmpdb=0.73.0-3+deb13u1
+xz-utils=5.8.1-1+deb13u1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1
diff --git a/documentation/audits/night-2026-10-04/baseline/pkgs-host-demo-hp.txt b/documentation/audits/night-2026-10-04/baseline/pkgs-host-demo-hp.txt
new file mode 100644
index 00000000..bc7d1b46
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/baseline/pkgs-host-demo-hp.txt
@@ -0,0 +1,747 @@
+adduser=3.152
+age=1.2.1-1+b5
+amd64-microcode=3.20250311.1
+apparmor=4.1.1-pmx1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bc=1.07.1-4
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+binutils-common=2.44-3
+binutils-x86-64-linux-gnu=2.44-3
+binutils=2.44-3
+bridge-utils=1.7.1-4+b1
+bsd-mailx=8.1.2-0.20220412cvs-1.1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+btrfs-progs=6.14-1
+busybox=1:1.37.0-6+b9
+bzip2=1.0.8-6
+ca-certificates=20250419
+ceph-common=19.2.3-pve4
+ceph-fuse=19.2.3-pve4
+chrony=4.6.1-3+deb13u1
+cifs-utils=2:7.4-1
+conntrack=1:1.4.8-2
+console-setup-linux=1.242~deb13u1
+console-setup=1.242~deb13u1
+coreutils=9.7-3
+corosync=3.1.10-pve2
+cpio=2.15+dfsg-2
+criu=4.1.1-1
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+cstream=4.0.0-1
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+dirmngr=2.4.7-21+deb13u1+b5
+distro-info-data=0.66+deb13u2
+dmeventd=2:1.02.205-2+pmx1
+dmidecode=3.6-2
+dmsetup=2:1.02.205-2+pmx1
+dns-root-data=2025080400~deb13u1
+dnsmasq-base=2.91-1+deb13u2
+dnsmasq=2.91-1+deb13u2
+doc-debian=11.3+nmu1
+dosfstools=4.2-1.2
+dpkg=1.22.22
+dracut-install=106-6
+dtach=0.9-7
+e2fsprogs=1.47.2-3+b12
+ebtables=2.0.11-6
+efibootmgr=18-2
+eject=2.41.5-0+deb13u1
+ethtool=1:6.14.2-1
+faketime=0.9.10+2024-06-05+gba9ed5b2-0.6
+fdisk=2.41.5-0+deb13u1
+fdutils=5.6-4+b1
+felhom-bootstrap=1.26.1
+file=1:5.46-5
+findutils=4.10.0-3
+fontconfig-config=2.15.0-2.3
+fontconfig=2.15.0-2.3
+fonts-dejavu-core=2.37-8
+fonts-dejavu-mono=2.37-8
+fonts-font-awesome=5.0.10+really4.7.0~dfsg-4.1
+fonts-font-logos=1.0.1-3
+frr-pythontools=10.6.1-1+pve2
+frr=10.6.1-1+pve2
+fuse3=3.17.2-3
+fuse=3.17.2-3
+gcc-14-base=14.2.0-19
+gdisk=1.0.10-2
+genisoimage=9:1.1.11-4
+gettext-base=0.23.1-2
+gnupg-l10n=2.4.7-21+deb13u1
+gnupg=2.4.7-21+deb13u1
+gnutls-bin=3.8.9-3+deb13u4
+golang-github-containers-common=0.62.2+ds1-2
+golang-github-containers-image=5.34.2-1
+gpg-agent=2.4.7-21+deb13u1+b5
+gpg=2.4.7-21+deb13u1+b5
+gpgconf=2.4.7-21+deb13u1+b5
+gpgsm=2.4.7-21+deb13u1+b5
+grep=3.11-4
+groff-base=1.23.0-9
+grub-common=2.12-9+pmx2
+grub-efi-amd64-bin=2.12-9+pmx2
+grub-efi-amd64-signed=1+2.12+9+pmx2
+grub-efi-amd64-unsigned=2.12-9+pmx2
+grub-efi-amd64=2.12-9+pmx2
+grub-pc-bin=2.12-9+pmx2
+grub2-common=2.12-9+pmx2
+gzip=1.13-1+deb13u1
+hdparm=9.65+ds-1.1
+hostname=3.25
+ifupdown2=3.3.0-1+pmx12
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+initramfs-tools-bin=0.148.4
+initramfs-tools-core=0.148.4
+initramfs-tools=0.148.4
+iproute2=6.15.0-1
+ipset=7.22-1+b1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+iso-codes=4.18.0-1
+iucode-tool=2.3.1-3
+kbd=2.7.1-2
+keyboard-configuration=1.242~deb13u1
+keyutils=1.6.3-6
+klibc-utils=2.0.14-1
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+ksm-control-daemon=1.5-1
+less=668-1
+libacl1=2.3.2-2+b1
+libaio1t64=0.3.113-8+b1
+libanyevent-http-perl=2.25-2
+libanyevent-perl=7.170-2+b7
+libapparmor1=4.1.1-pmx1
+libappconfig-perl=1.71-2.3
+libapt-pkg-perl=0.1.42
+libapt-pkg7.0=3.0.3
+libarchive13t64=3.7.4-4+deb13u1
+libasound2-data=1.2.14-1+deb13u1
+libasound2t64=1.2.14-1+deb13u1
+libassuan9=3.0.2-2
+libasyncns0=0.8-6+b5
+libatomic1=14.2.0-19
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libauthen-pam-perl=0.16-6+b4
+libavahi-client3=0.8-16
+libavahi-common-data=0.8-16
+libavahi-common3=0.8-16
+libbabeltrace1=1.5.11-4+b2
+libbinutils=2.44-3
+libblas3=3.12.1-6
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbytes-random-secure-perl=0.29-4~deb13u1
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcairo2=1.18.4-1+b1
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcares2=1.34.5-1+deb13u1
+libcbor0.10=0.10.2-2
+libcephfs2=19.2.3-pve4
+libcfg7=3.1.10-pve2
+libclass-methodmaker-perl=2.25-1
+libclone-perl=0.47-1+b1
+libcmap4=3.1.10-pve2
+libcom-err2=1.47.2-3+b12
+libcommon-sense-perl=3.75-3+b5
+libcompel1=4.1.1-1
+libconvert-asn1-perl=0.34-1
+libcorosync-common4=3.1.10-pve2
+libcpg4=3.1.10-pve2
+libcrypt-openssl-bignum-perl=0.09-2+b4
+libcrypt-openssl-random-perl=0.17-1+b1
+libcrypt-openssl-rsa-perl=0.35-1.1
+libcrypt-random-seed-perl=0.03-3
+libcrypt-ssleay-perl=0.73.06-2+b4
+libcrypt1=1:4.4.38-1
+libcryptsetup12=2:2.7.5-2
+libctf-nobfd0=2.44-3
+libctf0=2.44-3
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdatrie1=0.2.13-3+b1
+libdb5.3t64=5.3.28+dfsg2-9
+libdbi1t64=0.9.0-6.1+b1
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libdevel-cycle-perl=1.12-2
+libdevmapper-event1.02.1=2:1.02.205-2+pmx1
+libdevmapper1.02.1=2:1.02.205-2+pmx1
+libdigest-hmac-perl=1.05+dfsg-1
+libdouble-conversion3=3.3.1-1
+libdpkg-perl=1.22.22
+libdrm-amdgpu1=2.4.124-2
+libdrm-common=2.4.124-2
+libdrm-intel1=2.4.124-2
+libdrm2=2.4.124-2
+libdw1t64=0.192-4
+libedit2=3.1-20250104-1
+libefiboot1t64=38-3.1+b1
+libefivar1t64=38-3.1+b1
+libelf1t64=0.192-4
+libencode-locale-perl=1.05-3
+libepoxy0=1.5.10-2
+libevent-2.1-7t64=2.1.13-stable-1~deb13u1
+libevent-core-2.1-7t64=2.1.13-stable-1~deb13u1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfaketime=0.9.10+2024-06-05+gba9ed5b2-0.6
+libfdisk1=2.41.5-0+deb13u1
+libfdt1=1.7.2-2+b1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfile-chdir-perl=0.1008-1.2
+libfile-listing-perl=6.16-1
+libfile-readbackwards-perl=1.06-2
+libfilesys-df-perl=0.92-7+b4
+libflac14=1.5.0+ds-2
+libfontconfig1=2.15.0-2.3
+libfreetype6=2.13.3+dfsg-1+deb13u1
+libfribidi0=1.0.16-1
+libfstrm0=0.6.1-1+b3
+libfuse2t64=2.9.9-9
+libfuse3-4=3.17.2-3
+libgbm1=25.0.7-2+deb13u1
+libgcc-s1=14.2.0-19
+libgcrypt20=1.11.0-7+deb13u1
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libglib2.0-0t64=2.84.4-3~deb13u5
+libgmp10=2:6.3.0+dfsg-3
+libgnutls-dane0t64=3.8.9-3+deb13u4
+libgnutls30t64=3.8.9-3+deb13u4
+libgoogle-perftools4t64=2.16-1
+libgpg-error0=1.51-4
+libgpgme11t64=1.24.2-3
+libgprofng0=2.44-3
+libgraphite2-3=1.3.14-2+deb13u1
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libgstreamer-plugins-base1.0-0=1.26.2-1+deb13u2
+libgstreamer1.0-0=1.26.2-2
+libharfbuzz0b=10.2.0-1+deb13u1
+libhogweed6t64=3.10.1-1
+libhtml-parser-perl=3.83-2~deb13u1
+libhtml-tagset-perl=3.24-1
+libhtml-tree-perl=5.07-3
+libhttp-cookies-perl=6.11-1
+libhttp-daemon-perl=6.16-1+deb13u1
+libhttp-date-perl=6.06-1
+libhttp-message-perl=7.00-2
+libhttp-negotiate-perl=6.01-2
+libibverbs1=56.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libinih1=59-1
+libio-html-perl=1.004-3
+libio-multiplex-perl=1.16-3
+libio-socket-ssl-perl=2.089-1
+libio-stringy-perl=2.113-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libipset13t64=7.22-1+b1
+libiscsi7=1.20.0-4
+libisns0t64=0.101-1+b1
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjpeg62-turbo=1:2.1.5-4
+libjs-bootstrap5=5.3.5+dfsg-4
+libjs-extjs=7.0.0-5
+libjs-qrcodejs=1.20230525-pve1
+libjson-c5=0.18+ds-1
+libjson-glib-1.0-0=1.10.6+ds-2
+libjson-glib-1.0-common=1.10.6+ds-2
+libjson-perl=4.10000-1
+libjson-xs-perl=4.040-1~deb13u1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libklibc=2.0.14-1
+libkmod2=34.2-2
+libknet1t64=1.31-pve1
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+libksba8=1.6.7-2+b1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap2=2.6.10+dfsg-1
+libldb2=2:2.11.0+samba4.22.11+dfsg-0+deb13u1
+liblinear4=2.3.0+dfsg-5+b2
+liblinux-inotify2-perl=1:2.3-2+b3
+libllvm19=1:19.1.7-3+b1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblockfile1=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblttng-ust-common1t64=2.13.9-1
+liblttng-ust-ctl5t64=2.13.9-1
+liblttng-ust1t64=2.13.9-1
+liblua5.3-0=5.3.6-2+b4
+liblua5.4-0=5.4.7-1+b2
+liblvm2cmd2.03=2.03.31-2+pmx1
+liblwp-mediatypes-perl=6.04-2
+liblwp-protocol-https-perl=6.14-1
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+liblzo2-2=2.10-3+b1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmath-random-isaac-perl=1.004-2
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmime-base32-perl=1.303-3
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libmp3lame0=3.100-6+b3
+libmpg123-0t64=1.32.10-1+deb13u1
+libnbd0=1.22.2-1+b1
+libncurses6=6.5+20250216-2
+libncursesw6=6.5+20250216-2
+libnet-dbus-perl=1.2.0-2+b3
+libnet-dns-perl=1.56-0+deb13u1
+libnet-http-perl=6.23-1
+libnet-ip-perl=1.26-4
+libnet-ldap-perl=1:0.6800+dfsg-1
+libnet-ssleay-perl=1.94-3
+libnet-subnet-perl=1.03-2
+libnet1=1.3+dfsg-2
+libnetaddr-ip-perl=4.079+dfsg-2+b5
+libnetfilter-conntrack3=1.1.0-1
+libnetfilter-log1=1.0.2-4+b1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnfsidmap1=1:2.8.3-1
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnl-3-200=3.7.0-2
+libnl-route-3-200=3.7.0-2
+libnozzle1t64=1.31-pve1
+libnpth0t64=1.8-3
+libnsl2=1.3.0-3+b3
+libnspr4=2:4.36-1
+libnss-systemd=257.13-1~deb13u1
+libnss3=2:3.110-1+deb13u4
+libnuma1=2.0.19-1
+libnvpair3linux=2.4.2-pve1
+liboath0t64=2.6.12-1
+libogg0=1.3.5-3+b2
+libopeniscsiusr=2.1.11-1+deb13u2
+libopus0=1.5.2-2
+liborc-0.4-0t64=1:0.4.41-1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpango-1.0-0=1.56.3-1
+libpangocairo-1.0-0=1.56.3-1
+libpangoft2-1.0-0=1.56.3-1
+libpcap0.8t64=1.10.5-2
+libpci3=1:3.13.0-2
+libpciaccess0=0.17-3+b3
+libpcre2-16-0=10.46-1~deb13u3
+libpcre2-8-0=10.46-1~deb13u3
+libpcre2-posix3=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpixman-1-0=0.44.0-3
+libpng16-16t64=1.6.48-1+deb13u6
+libpopt0=1.19+dfsg-2
+libposix-strptime-perl=0.13-2+b4
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libproxmox-acme-perl=1.7.1
+libproxmox-acme-plugins=1.7.1
+libproxmox-backup-qemu0=2.0.2
+libproxmox-rs-perl=0.4.1
+libpsl5t64=0.21.2-1.1+b1
+libpulse0=17.0+dfsg1-2+b1
+libpve-access-control=9.1.1
+libpve-apiclient-perl=3.4.2
+libpve-cluster-api-perl=9.1.5
+libpve-cluster-perl=9.1.5
+libpve-common-perl=9.1.12
+libpve-guest-common-perl=6.0.3
+libpve-http-server-perl=6.0.5
+libpve-network-api-perl=1.6.5
+libpve-network-perl=1.6.5
+libpve-notify-perl=9.1.5
+libpve-rs-perl=0.15.3
+libpve-storage-perl=9.1.5
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libqb-tools=2.0.8-2+b1
+libqb100=2.0.8-2+b1
+libqrencode4=4.1.1-2
+libqt5core5t64=5.15.15+dfsg-6+deb13u1
+libqt5dbus5t64=5.15.15+dfsg-6+deb13u1
+libqt5network5t64=5.15.15+dfsg-6+deb13u1
+libquorum5=3.1.10-pve2
+librabbitmq4=0.15.0-1+deb13u2
+librados2-perl=1.5.0
+librados2=19.2.3-pve4
+libradosstriper1=19.2.3-pve4
+librbd1=19.2.3-pve4
+librdkafka1=2.8.0-1
+librdmacm1t64=56.1-1
+libreadline8t64=8.2-6
+libreiserfscore0t64=1:3.6.27-9
+librgw2=19.2.3-pve4
+librrd8t64=1.7.2-4.2+pve4
+librrds-perl=1.7.2-4.2+pve4
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsensors-config=1:3.6.2-2
+libsensors5=1:3.6.2-2
+libsepol2=3.8.1-1
+libsframe1=2.44-3
+libslang2=2.3.3-5+b2
+libslirp0=4.8.0-1+deb13u1
+libsmartcols1=2.41.5-0+deb13u1
+libsmbclient0=2:4.22.11+dfsg-0+deb13u1
+libsnappy1v5=1.2.2-1
+libsndfile1=1.2.2-2+deb13u1
+libsndio7.0=1.10.0-0.1
+libsocket6-perl=0.29-3+b4
+libspice-server1=0.15.2-1+b1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstatgrab10t64=0.92.1-1.2
+libstdc++6=14.2.0-19
+libstring-shellquote-perl=1.04-3
+libsubid5=1:4.17.4-2
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtalloc2=2:2.4.3+samba4.22.11+dfsg-0+deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtcmalloc-minimal4t64=2.16-1
+libtdb1=2:1.4.13+samba4.22.11+dfsg-0+deb13u1
+libtemplate-perl=2.27-1+b8
+libterm-readline-gnu-perl=1.46-1+b3
+libtevent0t64=2:0.16.2+samba4.22.11+dfsg-0+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libthai-data=0.1.29-2
+libthai0=0.1.29-2+b1
+libthrift-0.19.0t64=0.19.0-4+b1
+libtimedate-perl=2.3300-2
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libtpms0=0.9.7+pve2
+libtry-tiny-perl=0.32-1
+libtypes-serialiser-perl=1.01-1
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunbound8=1.26.1-0+deb13u1
+libunistring5=1.3-2
+libunwind8=1.8.1-0.1
+liburcu8t64=0.15.2-2
+liburi-perl=5.30-1
+liburing2=2.9-1
+libusb-1.0-0=2:1.0.28-1
+libusbredirparser1t64=0.15.0-1
+libuuid-perl=0.37-1
+libuuid1=2.41.5-0+deb13u1
+libuutil3linux=2.4.2-pve1
+libuv1t64=1.50.0-2
+libva-drm2=2.22.0-3
+libva2=2.22.0-3
+libvirglrenderer1=1.1.0-2
+libvorbis0a=1.3.7-3
+libvorbisenc2=1.3.7-3
+libvotequorum8=3.1.10-pve2
+libvulkan1=1.4.309.0-1
+libwayland-server0=1.23.1-3
+libwbclient0=2:4.22.11+dfsg-0+deb13u1
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libwww-perl=6.78-1
+libwww-robotrules-perl=6.02-1
+libx11-6=2:1.8.12-1
+libx11-data=2:1.8.12-1
+libx11-xcb1=2:1.8.12-1
+libxau6=1:1.0.11-1
+libxcb-dri3-0=1.17.0-2+b1
+libxcb-present0=1.17.0-2+b1
+libxcb-randr0=1.17.0-2+b1
+libxcb-render0=1.17.0-2+b1
+libxcb-shm0=1.17.0-2+b1
+libxcb-sync1=1.17.0-2+b1
+libxcb-xfixes0=1.17.0-2+b1
+libxcb1=1.17.0-2+b1
+libxdmcp6=1:1.1.5-1
+libxext6=2:1.3.4-1+b3
+libxkbcommon0=1.7.0-2
+libxml-libxml-perl=2.0207+dfsg+really+2.0134-5+deb13u1
+libxml-namespacesupport-perl=1.12-2
+libxml-parser-perl=2.47-2~deb13u1
+libxml-sax-base-perl=1.09-3
+libxml-sax-perl=1.02+dfsg-4
+libxml-twig-perl=1:3.52-3
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxrender1=1:0.9.12-1
+libxshmfence1=1.3.3-1
+libxslt1.1=1.1.35-1.2+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libyaml-0-2=0.2.5-2
+libyaml-libyaml-perl=0.903.0+ds-1
+libyang3=3.12.2-1
+libz3-4=4.13.3-1
+libzfs7linux=2.4.2-pve1
+libzpool7linux=2.4.2-pve1
+libzstd1=1.5.7+dfsg-1
+linux-base=4.12.1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsof=4.99.4+dfsg-2
+lvm2=2.03.31-2+pmx1
+lxc-pve=7.0.0-2
+lxcfs=7.0.0-pve1
+lzop=1.04-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+memtest86+=7.20-1
+mesa-libgallium=25.0.7-2+deb13u1
+mokutil=0.7.2-1
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netavark=1.14.0-2
+netbase=6.5
+netcat-traditional=1.10-50
+nfs-common=1:2.8.3-1
+nftables=1.1.3-1
+nmap-common=7.95+dfsg-3
+nmap=7.95+dfsg-3
+node-popper2=2.11.2-8
+novnc-pve=1.7.0-1
+numactl=2.0.19-1
+open-iscsi=2.1.11-1+deb13u2
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+pci.ids=0.0~2025.06.09-1
+pciutils=1:3.13.0-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl-openssl-defaults=7+b2
+perl=5.40.1-6+deb13u1
+pinentry-curses=1.3.1-2
+postfix=3.10.13-0+deb13u1
+procmail=3.24+really3.22-4
+procps=2:4.0.4-9
+proxmox-archive-keyring=4.0
+proxmox-backup-client=4.2.0-1
+proxmox-backup-file-restore=4.2.0-1
+proxmox-backup-restore-image=1.0.0
+proxmox-default-kernel=2.1.0
+proxmox-enterprise-support-keyring=1.0
+proxmox-firewall=1.2.3
+proxmox-grub=2.12-9+pmx2
+proxmox-kernel-7.0.14-20-pve-signed=7.0.14-20
+proxmox-kernel-7.0.2-6-pve-signed=7.0.2-6
+proxmox-kernel-7.0=7.0.14-20
+proxmox-kernel-helper=9.1.0+fde2
+proxmox-mail-forward=1.0.3
+proxmox-mini-journalreader=1.6
+proxmox-offline-mirror-docs=0.7.4
+proxmox-offline-mirror-helper=0.7.4
+proxmox-secure-boot-support=2.0.6
+proxmox-termproxy=2.1.0
+proxmox-ve=9.2.0
+proxmox-websocket-tunnel=1.0.0
+proxmox-widget-toolkit=5.2.2
+psmisc=23.7-2
+pve-cluster=9.1.5
+pve-container=6.1.10
+pve-docs=9.2.1
+pve-edk2-firmware-aarch64=4.2025.05-2
+pve-edk2-firmware-legacy=4.2025.05-2
+pve-edk2-firmware-ovmf=4.2025.05-2
+pve-edk2-firmware=4.2025.05-2
+pve-esxi-import-tools=1.0.1
+pve-firewall=6.0.4
+pve-firmware=3.18-3
+pve-ha-manager=5.2.4
+pve-i18n=3.7.4
+pve-lxc-syscalld=2.0.2
+pve-manager=9.2.2
+pve-nvidia-vgpu-helper=0.3.1
+pve-qemu-kvm=11.0.0-3
+pve-xtermjs=6.0.0-1
+pve-yew-mobile-gui=0.7.0
+pve-yew-mobile-i18n=3.7.4
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-autocommand=2.2.2-3
+python3-bcrypt=4.2.0-2.1+b1
+python3-ceph-argparse=19.2.3-pve4
+python3-ceph-common=19.2.3-pve4
+python3-cephfs=19.2.3-pve4
+python3-certifi=2025.1.31+ds-1
+python3-cffi-backend=1.17.1-3
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-cryptography=43.0.0-3+deb13u1
+python3-dbus=1.4.0-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-importlib-resources=6.5.2-1
+python3-inflect=7.3.1-2
+python3-jaraco.context=6.0.1-1+deb13u1
+python3-jaraco.functools=4.1.0-1
+python3-jaraco.text=4.0.0-1
+python3-minimal=3.13.5-1
+python3-more-itertools=10.7.0-1
+python3-pefile=2024.8.26-2.1
+python3-pkg-resources=78.1.1-0.1
+python3-prettytable=3.15.1-1
+python3-pyvmomi=8.0.3.0.1-1
+python3-rados=19.2.3-pve4
+python3-rbd=19.2.3-pve4
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-rgw=19.2.3-pve4
+python3-setuptools=78.1.1-0.1
+python3-six=1.17.0-1
+python3-systemd=235-1+b6
+python3-typeguard=4.4.2-1
+python3-typing-extensions=4.13.2-1
+python3-urllib3=2.3.0-3+deb13u2
+python3-virt-firmware=24.11-2
+python3-wcwidth=0.2.13+dfsg1-1
+python3-yaml=6.0.2-1+b2
+python3-zipp=3.21.0-1
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+qemu-server=9.1.15
+qrencode=4.1.1-2
+readline-common=8.2-6
+reportbug=13.2.0
+rpcbind=1.2.7-1
+rrdcached=1.7.2-4.2+pve4
+rsync=3.5.0+ds1-0+deb13u1
+runit-helper=2.16.4
+samba-common=2:4.22.11+dfsg-0+deb13u1
+samba-libs=2:4.22.11+dfsg-0+deb13u1
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+shared-mime-info=2.4-5+b2
+shim-helpers-amd64-signed=1+16.1+1+pmx1
+shim-signed-common=1.48+pmx1+16.1-1+pmx1
+shim-signed=1.48+pmx1+16.1-1+pmx1
+shim-unsigned=16.1-1+pmx1
+skopeo=1.18.0+ds1-1+b5
+smartmontools=7.5-pve2
+smbclient=2:4.22.11+dfsg-0+deb13u1
+socat=1.8.0.3-1+deb13u1
+spiceterm=3.4.2
+sqlite3=3.46.1-7+deb13u2
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+strace=6.13+ds-1
+sudo=1.9.16p2-3+deb13u2
+swtpm-libs=0.8.0+pve3
+swtpm-tools=0.8.0+pve3
+swtpm=0.8.0+pve3
+systemd-boot-efi=257.13-1~deb13u1
+systemd-boot-tools=257.13-1~deb13u1
+systemd-sysv=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tar=1.35+dfsg-3.1
+tcpdump=4.99.5-2
+thin-provisioning-tools=1.1.0-4+b1
+time=1.9-0.2
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+uidmap=1:4.17.4-2
+usbutils=1:018-2
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+virtiofsd=1.13.2-1+deb13u1
+vncterm=1.9.2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wireguard-tools=1.0.20210914-3
+wtmpdb=0.73.0-3+deb13u1
+xfsprogs=6.13.0-2+deb13u1
+xkb-data=2.42-1
+xsltproc=1.1.35-1.2+deb13u3
+xz-utils=5.8.1-1+deb13u1
+zfs-initramfs=2.4.2-pve1
+zfs-zed=2.4.2-pve1
+zfsutils-linux=2.4.2-pve1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1
+zstd=1.5.7+dfsg-1
diff --git a/documentation/audits/night-2026-10-04/baseline/pkgs-host-felhom-pve.txt b/documentation/audits/night-2026-10-04/baseline/pkgs-host-felhom-pve.txt
new file mode 100644
index 00000000..b52dd439
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/baseline/pkgs-host-felhom-pve.txt
@@ -0,0 +1,747 @@
+adduser=3.152
+age=1.2.1-1+b5
+apparmor=4.1.1-pmx1
+apt-listchanges=4.8
+apt-utils=3.0.3
+apt=3.0.3
+base-files=13.8+deb13u7
+base-passwd=3.6.7
+bash-completion=1:2.16.0-7
+bash=5.2.37-2+b10
+bc=1.07.1-4
+bind9-dnsutils=1:9.20.29-1~deb13u1
+bind9-host=1:9.20.29-1~deb13u1
+bind9-libs=1:9.20.29-1~deb13u1
+binutils-common=2.44-3
+binutils-x86-64-linux-gnu=2.44-3
+binutils=2.44-3
+bridge-utils=1.7.1-4+b1
+bsd-mailx=8.1.2-0.20220412cvs-1.1
+bsdextrautils=2.41.5-0+deb13u1
+bsdutils=1:2.41.5-0+deb13u1
+btrfs-progs=6.14-1
+busybox=1:1.37.0-6+b9
+bzip2=1.0.8-6
+ca-certificates=20250419
+ceph-common=19.2.3-pve4
+ceph-fuse=19.2.3-pve4
+chrony=4.6.1-3+deb13u1
+cifs-utils=2:7.4-1
+conntrack=1:1.4.8-2
+console-setup-linux=1.242~deb13u1
+console-setup=1.242~deb13u1
+coreutils=9.7-3
+corosync=3.1.10-pve2
+cpio=2.15+dfsg-2
+criu=4.1.1-1
+cron-daemon-common=3.0pl1-197
+cron=3.0pl1-197
+cstream=4.0.0-1
+curl=8.14.1-2+deb13u5
+dash=0.5.12-12
+dbus-bin=1.16.2-2
+dbus-daemon=1.16.2-2
+dbus-session-bus-common=1.16.2-2
+dbus-system-bus-common=1.16.2-2
+dbus=1.16.2-2
+debconf-i18n=1.5.91
+debconf=1.5.91
+debian-archive-keyring=2025.1
+debian-faq=12.2
+debianutils=5.23.2
+dhcpcd-base=1:10.1.0-11+deb13u4
+diffutils=1:3.10-4
+dirmngr=2.4.7-21+deb13u1+b5
+distro-info-data=0.66+deb13u2
+dmeventd=2:1.02.205-2+pmx1
+dmidecode=3.6-2
+dmsetup=2:1.02.205-2+pmx1
+dns-root-data=2025080400~deb13u1
+dnsmasq-base=2.91-1+deb13u2
+dnsmasq=2.91-1+deb13u2
+doc-debian=11.3+nmu1
+dosfstools=4.2-1.2
+dpkg=1.22.22
+dracut-install=106-6
+dtach=0.9-7
+e2fsprogs=1.47.2-3+b12
+ebtables=2.0.11-6
+efibootmgr=18-2
+eject=2.41.5-0+deb13u1
+ethtool=1:6.14.2-1
+faketime=0.9.10+2024-06-05+gba9ed5b2-0.6
+fdisk=2.41.5-0+deb13u1
+fdutils=5.6-4+b1
+file=1:5.46-5
+findutils=4.10.0-3
+fontconfig-config=2.15.0-2.3
+fontconfig=2.15.0-2.3
+fonts-dejavu-core=2.37-8
+fonts-dejavu-mono=2.37-8
+fonts-font-awesome=5.0.10+really4.7.0~dfsg-4.1
+fonts-font-logos=1.0.1-3
+frr-pythontools=10.6.1-1+pve2
+frr=10.6.1-1+pve2
+fuse3=3.17.2-3
+fuse=3.17.2-3
+gcc-14-base=14.2.0-19
+gdisk=1.0.10-2
+genisoimage=9:1.1.11-4
+gettext-base=0.23.1-2
+gnupg-l10n=2.4.7-21+deb13u1
+gnupg=2.4.7-21+deb13u1
+gnutls-bin=3.8.9-3+deb13u4
+golang-github-containers-common=0.62.2+ds1-2
+golang-github-containers-image=5.34.2-1
+gpg-agent=2.4.7-21+deb13u1+b5
+gpg=2.4.7-21+deb13u1+b5
+gpgconf=2.4.7-21+deb13u1+b5
+gpgsm=2.4.7-21+deb13u1+b5
+grep=3.11-4
+groff-base=1.23.0-9
+grub-common=2.12-9+pmx2
+grub-efi-amd64-bin=2.12-9+pmx2
+grub-efi-amd64-signed=1+2.12+9+pmx2
+grub-efi-amd64-unsigned=2.12-9+pmx2
+grub-efi-amd64=2.12-9+pmx2
+grub-pc-bin=2.12-9+pmx2
+grub2-common=2.12-9+pmx2
+gzip=1.13-1+deb13u1
+hdparm=9.65+ds-1.1
+hostname=3.25
+ifupdown2=3.3.0-1+pmx12
+inetutils-telnet=2:2.6-3+deb13u3
+init-system-helpers=1.69~deb13u1
+init=1.69~deb13u1
+initramfs-tools-bin=0.148.4
+initramfs-tools-core=0.148.4
+initramfs-tools=0.148.4
+intel-microcode=3.20251111.1~deb13u1
+iproute2=6.15.0-1
+ipset=7.22-1+b1
+iptables=1.8.11-2
+iputils-ping=3:20240905-3
+isc-dhcp-client=4.4.3-P1-8
+iso-codes=4.18.0-1
+iucode-tool=2.3.1-3
+kbd=2.7.1-2
+keyboard-configuration=1.242~deb13u1
+keyutils=1.6.3-6
+klibc-utils=2.0.14-1
+kmod=34.2-2
+krb5-locales=1.21.3-5+deb13u1
+ksm-control-daemon=1.5-1
+less=668-1
+libacl1=2.3.2-2+b1
+libaio1t64=0.3.113-8+b1
+libanyevent-http-perl=2.25-2
+libanyevent-perl=7.170-2+b7
+libapparmor1=4.1.1-pmx1
+libappconfig-perl=1.71-2.3
+libapt-pkg-perl=0.1.42
+libapt-pkg7.0=3.0.3
+libarchive13t64=3.7.4-4+deb13u1
+libasound2-data=1.2.14-1+deb13u1
+libasound2t64=1.2.14-1+deb13u1
+libassuan9=3.0.2-2
+libasyncns0=0.8-6+b5
+libatomic1=14.2.0-19
+libattr1=1:2.5.2-3
+libaudit-common=1:4.0.2-2+deb13u1
+libaudit1=1:4.0.2-2+deb13u1
+libauthen-pam-perl=0.16-6+b4
+libavahi-client3=0.8-16
+libavahi-common-data=0.8-16
+libavahi-common3=0.8-16
+libbabeltrace1=1.5.11-4+b2
+libbinutils=2.44-3
+libblas3=3.12.1-6
+libblkid1=2.41.5-0+deb13u1
+libbpf1=1:1.5.0-3
+libbrotli1=1.1.0-2+b7
+libbsd0=0.12.2-2
+libbytes-random-secure-perl=0.29-4~deb13u1
+libbz2-1.0=1.0.8-6
+libc-bin=2.41-12+deb13u4
+libc-l10n=2.41-12+deb13u4
+libc6=2.41-12+deb13u4
+libcairo2=1.18.4-1+b1
+libcap-ng0=0.8.5-4+b1
+libcap2-bin=1:2.75-10+deb13u1+b3
+libcap2=1:2.75-10+deb13u1+b3
+libcares2=1.34.5-1+deb13u1
+libcbor0.10=0.10.2-2
+libcephfs2=19.2.3-pve4
+libcfg7=3.1.10-pve2
+libclass-methodmaker-perl=2.25-1
+libclone-perl=0.47-1+b1
+libcmap4=3.1.10-pve2
+libcom-err2=1.47.2-3+b12
+libcommon-sense-perl=3.75-3+b5
+libcompel1=4.1.1-1
+libconvert-asn1-perl=0.34-1
+libcorosync-common4=3.1.10-pve2
+libcpg4=3.1.10-pve2
+libcrypt-openssl-bignum-perl=0.09-2+b4
+libcrypt-openssl-random-perl=0.17-1+b1
+libcrypt-openssl-rsa-perl=0.35-1.1
+libcrypt-random-seed-perl=0.03-3
+libcrypt-ssleay-perl=0.73.06-2+b4
+libcrypt1=1:4.4.38-1
+libcryptsetup12=2:2.7.5-2
+libctf-nobfd0=2.44-3
+libctf0=2.44-3
+libcurl3t64-gnutls=8.14.1-2+deb13u5
+libcurl4t64=8.14.1-2+deb13u5
+libdatrie1=0.2.13-3+b1
+libdb5.3t64=5.3.28+dfsg2-9
+libdbi1t64=0.9.0-6.1+b1
+libdbus-1-3=1.16.2-2
+libdebconfclient0=0.280
+libdevel-cycle-perl=1.12-2
+libdevmapper-event1.02.1=2:1.02.205-2+pmx1
+libdevmapper1.02.1=2:1.02.205-2+pmx1
+libdigest-hmac-perl=1.05+dfsg-1
+libdouble-conversion3=3.3.1-1
+libdpkg-perl=1.22.22
+libdrm-amdgpu1=2.4.124-2
+libdrm-common=2.4.124-2
+libdrm-intel1=2.4.124-2
+libdrm2=2.4.124-2
+libdw1t64=0.192-4
+libedit2=3.1-20250104-1
+libefiboot1t64=38-3.1+b1
+libefivar1t64=38-3.1+b1
+libelf1t64=0.192-4
+libencode-locale-perl=1.05-3
+libepoxy0=1.5.10-2
+libevent-2.1-7t64=2.1.13-stable-1~deb13u1
+libevent-core-2.1-7t64=2.1.13-stable-1~deb13u1
+libexpat1=2.8.3-1~deb13u1
+libext2fs2t64=1.47.2-3+b12
+libfaketime=0.9.10+2024-06-05+gba9ed5b2-0.6
+libfdisk1=2.41.5-0+deb13u1
+libfdt1=1.7.2-2+b1
+libffi8=3.4.8-2
+libfido2-1=1.15.0-1+b1
+libfile-chdir-perl=0.1008-1.2
+libfile-listing-perl=6.16-1
+libfile-readbackwards-perl=1.06-2
+libfilesys-df-perl=0.92-7+b4
+libflac14=1.5.0+ds-2
+libfontconfig1=2.15.0-2.3
+libfreetype6=2.13.3+dfsg-1+deb13u1
+libfribidi0=1.0.16-1
+libfstrm0=0.6.1-1+b3
+libfuse2t64=2.9.9-9
+libfuse3-4=3.17.2-3
+libgbm1=25.0.7-2+deb13u1
+libgcc-s1=14.2.0-19
+libgcrypt20=1.11.0-7+deb13u1
+libgdbm-compat4t64=1.24-2
+libgdbm6t64=1.24-2
+libglib2.0-0t64=2.84.4-3~deb13u5
+libgmp10=2:6.3.0+dfsg-3
+libgnutls-dane0t64=3.8.9-3+deb13u4
+libgnutls30t64=3.8.9-3+deb13u4
+libgoogle-perftools4t64=2.16-1
+libgpg-error0=1.51-4
+libgpgme11t64=1.24.2-3
+libgprofng0=2.44-3
+libgraphite2-3=1.3.14-2+deb13u1
+libgssapi-krb5-2=1.21.3-5+deb13u1
+libgstreamer-plugins-base1.0-0=1.26.2-1+deb13u2
+libgstreamer1.0-0=1.26.2-2
+libharfbuzz0b=10.2.0-1+deb13u1
+libhogweed6t64=3.10.1-1
+libhtml-parser-perl=3.83-2~deb13u1
+libhtml-tagset-perl=3.24-1
+libhtml-tree-perl=5.07-3
+libhttp-cookies-perl=6.11-1
+libhttp-daemon-perl=6.16-1+deb13u1
+libhttp-date-perl=6.06-1
+libhttp-message-perl=7.00-2
+libhttp-negotiate-perl=6.01-2
+libibverbs1=56.1-1
+libicu76=76.1-4
+libidn2-0=2.3.8-2
+libinih1=59-1
+libio-html-perl=1.004-3
+libio-multiplex-perl=1.16-3
+libio-socket-ssl-perl=2.089-1
+libio-stringy-perl=2.113-2
+libip4tc2=1.8.11-2
+libip6tc2=1.8.11-2
+libipset13t64=7.22-1+b1
+libiscsi7=1.20.0-4
+libisns0t64=0.101-1+b1
+libjansson4=2.14-2+b3
+libjemalloc2=5.3.0-3
+libjpeg62-turbo=1:2.1.5-4
+libjs-bootstrap5=5.3.5+dfsg-4
+libjs-extjs=7.0.0-5
+libjs-qrcodejs=1.20230525-pve1
+libjson-c5=0.18+ds-1
+libjson-glib-1.0-0=1.10.6+ds-2
+libjson-glib-1.0-common=1.10.6+ds-2
+libjson-perl=4.10000-1
+libjson-xs-perl=4.040-1~deb13u1
+libk5crypto3=1.21.3-5+deb13u1
+libkeyutils1=1.6.3-6
+libklibc=2.0.14-1
+libkmod2=34.2-2
+libknet1t64=1.31-pve1
+libkrb5-3=1.21.3-5+deb13u1
+libkrb5support0=1.21.3-5+deb13u1
+libksba8=1.6.7-2+b1
+liblastlog2-2=2.41.5-0+deb13u1
+libldap2=2.6.10+dfsg-1
+libldb2=2:2.11.0+samba4.22.11+dfsg-0+deb13u1
+liblinear4=2.3.0+dfsg-5+b2
+liblinux-inotify2-perl=1:2.3-2+b3
+libllvm19=1:19.1.7-3+b1
+liblmdb0=0.9.31-1+b2
+liblocale-gettext-perl=1.07-7+b1
+liblockfile-bin=1.17-2
+liblockfile1=1.17-2
+liblsof0=4.99.4+dfsg-2
+liblttng-ust-common1t64=2.13.9-1
+liblttng-ust-ctl5t64=2.13.9-1
+liblttng-ust1t64=2.13.9-1
+liblua5.3-0=5.3.6-2+b4
+liblua5.4-0=5.4.7-1+b2
+liblvm2cmd2.03=2.03.31-2+pmx1
+liblwp-mediatypes-perl=6.04-2
+liblwp-protocol-https-perl=6.14-1
+liblz4-1=1.10.0-4
+liblzma5=5.8.1-1+deb13u1
+liblzo2-2=2.10-3+b1
+libmagic-mgc=1:5.46-5
+libmagic1t64=1:5.46-5
+libmath-random-isaac-perl=1.004-2
+libmaxminddb0=1.12.2-1
+libmd0=1.1.0-2+b1
+libmime-base32-perl=1.303-3
+libmnl0=1.0.5-3
+libmount1=2.41.5-0+deb13u1
+libmp3lame0=3.100-6+b3
+libmpg123-0t64=1.32.10-1+deb13u1
+libnbd0=1.22.2-1+b1
+libncurses6=6.5+20250216-2
+libncursesw6=6.5+20250216-2
+libnet-dbus-perl=1.2.0-2+b3
+libnet-dns-perl=1.56-0+deb13u1
+libnet-http-perl=6.23-1
+libnet-ip-perl=1.26-4
+libnet-ldap-perl=1:0.6800+dfsg-1
+libnet-ssleay-perl=1.94-3
+libnet-subnet-perl=1.03-2
+libnet1=1.3+dfsg-2
+libnetaddr-ip-perl=4.079+dfsg-2+b5
+libnetfilter-conntrack3=1.1.0-1
+libnetfilter-log1=1.0.2-4+b1
+libnettle8t64=3.10.1-1
+libnewt0.52=0.52.25-1
+libnfnetlink0=1.0.2-3
+libnfsidmap1=1:2.8.3-1
+libnftables1=1.1.3-1
+libnftnl11=1.2.9-1
+libnghttp2-14=1.64.0-1.1+deb13u1
+libnghttp3-9=1.8.0-1
+libngtcp2-16=1.11.0-1+deb13u1
+libngtcp2-crypto-gnutls8=1.11.0-1+deb13u1
+libnl-3-200=3.7.0-2
+libnl-route-3-200=3.7.0-2
+libnozzle1t64=1.31-pve1
+libnpth0t64=1.8-3
+libnsl2=1.3.0-3+b3
+libnspr4=2:4.36-1
+libnss-systemd=257.13-1~deb13u1
+libnss3=2:3.110-1+deb13u4
+libnuma1=2.0.19-1
+libnvpair3linux=2.4.2-pve1
+liboath0t64=2.6.12-1
+libogg0=1.3.5-3+b2
+libopeniscsiusr=2.1.11-1+deb13u2
+libopus0=1.5.2-2
+liborc-0.4-0t64=1:0.4.41-1
+libp11-kit0=0.25.5-3
+libpam-modules-bin=1.7.0-5
+libpam-modules=1.7.0-5
+libpam-runtime=1.7.0-5
+libpam-systemd=257.13-1~deb13u1
+libpam-wtmpdb=0.73.0-3+deb13u1
+libpam0g=1.7.0-5
+libpango-1.0-0=1.56.3-1
+libpangocairo-1.0-0=1.56.3-1
+libpangoft2-1.0-0=1.56.3-1
+libpcap0.8t64=1.10.5-2
+libpci3=1:3.13.0-2
+libpciaccess0=0.17-3+b3
+libpcre2-16-0=10.46-1~deb13u3
+libpcre2-8-0=10.46-1~deb13u3
+libpcre2-posix3=10.46-1~deb13u3
+libperl5.40=5.40.1-6+deb13u1
+libpipeline1=1.5.8-1
+libpixman-1-0=0.44.0-3
+libpng16-16t64=1.6.48-1+deb13u6
+libpopt0=1.19+dfsg-2
+libposix-strptime-perl=0.13-2+b4
+libproc2-0=2:4.0.4-9
+libprotobuf-c1=1.5.1-1
+libproxmox-acme-perl=1.7.1
+libproxmox-acme-plugins=1.7.1
+libproxmox-backup-qemu0=2.0.2
+libproxmox-rs-perl=0.4.1
+libpsl5t64=0.21.2-1.1+b1
+libpulse0=17.0+dfsg1-2+b1
+libpve-access-control=9.1.1
+libpve-apiclient-perl=3.4.2
+libpve-cluster-api-perl=9.1.5
+libpve-cluster-perl=9.1.5
+libpve-common-perl=9.1.12
+libpve-guest-common-perl=6.0.3
+libpve-http-server-perl=6.0.5
+libpve-network-api-perl=1.6.5
+libpve-network-perl=1.6.5
+libpve-notify-perl=9.1.5
+libpve-rs-perl=0.15.3
+libpve-storage-perl=9.1.5
+libpython3-stdlib=3.13.5-1
+libpython3.13-minimal=3.13.5-2+deb13u5
+libpython3.13-stdlib=3.13.5-2+deb13u5
+libqb-tools=2.0.8-2+b1
+libqb100=2.0.8-2+b1
+libqrencode4=4.1.1-2
+libqt5core5t64=5.15.15+dfsg-6+deb13u1
+libqt5dbus5t64=5.15.15+dfsg-6+deb13u1
+libqt5network5t64=5.15.15+dfsg-6+deb13u1
+libquorum5=3.1.10-pve2
+librabbitmq4=0.15.0-1+deb13u2
+librados2-perl=1.5.0
+librados2=19.2.3-pve4
+libradosstriper1=19.2.3-pve4
+librbd1=19.2.3-pve4
+librdkafka1=2.8.0-1
+librdmacm1t64=56.1-1
+libreadline8t64=8.2-6
+libreiserfscore0t64=1:3.6.27-9
+librgw2=19.2.3-pve4
+librrd8t64=1.7.2-4.2+pve4
+librrds-perl=1.7.2-4.2+pve4
+librtmp1=2.4+20151223.gitfa8646d.1-2+b5
+libsasl2-2=2.1.28+dfsg1-9
+libsasl2-modules-db=2.1.28+dfsg1-9
+libseccomp2=2.6.0-2
+libselinux1=3.8.1-1
+libsemanage-common=3.8.1-1
+libsemanage2=3.8.1-1
+libsensors-config=1:3.6.2-2
+libsensors5=1:3.6.2-2
+libsepol2=3.8.1-1
+libsframe1=2.44-3
+libslang2=2.3.3-5+b2
+libslirp0=4.8.0-1+deb13u1
+libsmartcols1=2.41.5-0+deb13u1
+libsmbclient0=2:4.22.11+dfsg-0+deb13u1
+libsnappy1v5=1.2.2-1
+libsndfile1=1.2.2-2+deb13u1
+libsndio7.0=1.10.0-0.1
+libsocket6-perl=0.29-3+b4
+libspice-server1=0.15.2-1+b1
+libsqlite3-0=3.46.1-7+deb13u2
+libss2=1.47.2-3+b12
+libssh2-1t64=1.11.1-1+deb13u2
+libssl3t64=3.5.7-1~deb13u3
+libstatgrab10t64=0.92.1-1.2
+libstdc++6=14.2.0-19
+libstring-shellquote-perl=1.04-3
+libsubid5=1:4.17.4-2
+libsystemd-shared=257.13-1~deb13u1
+libsystemd0=257.13-1~deb13u1
+libtalloc2=2:2.4.3+samba4.22.11+dfsg-0+deb13u1
+libtasn1-6=4.20.0-2+deb13u1
+libtcmalloc-minimal4t64=2.16-1
+libtdb1=2:1.4.13+samba4.22.11+dfsg-0+deb13u1
+libtemplate-perl=2.27-1+b8
+libterm-readline-gnu-perl=1.46-1+b3
+libtevent0t64=2:0.16.2+samba4.22.11+dfsg-0+deb13u1
+libtext-charwidth-perl=0.04-11+b4
+libtext-iconv-perl=1.7-8+b4
+libtext-wrapi18n-perl=0.06-10
+libthai-data=0.1.29-2
+libthai0=0.1.29-2+b1
+libthrift-0.19.0t64=0.19.0-4+b1
+libtimedate-perl=2.3300-2
+libtinfo6=6.5+20250216-2
+libtirpc-common=1.3.6+ds-1
+libtirpc3t64=1.3.6+ds-1
+libtlsrpt0=0.5.0rc1-2
+libtpms0=0.9.7+pve2
+libtry-tiny-perl=0.32-1
+libtypes-serialiser-perl=1.01-1
+libuchardet0=0.0.8-1+b2
+libudev1=257.13-1~deb13u1
+libunbound8=1.26.1-0+deb13u1
+libunistring5=1.3-2
+libunwind8=1.8.1-0.1
+liburcu8t64=0.15.2-2
+liburi-perl=5.30-1
+liburing2=2.9-1
+libusb-1.0-0=2:1.0.28-1
+libusbredirparser1t64=0.15.0-1
+libuuid-perl=0.37-1
+libuuid1=2.41.5-0+deb13u1
+libuutil3linux=2.4.2-pve1
+libuv1t64=1.50.0-2
+libva-drm2=2.22.0-3
+libva2=2.22.0-3
+libvirglrenderer1=1.1.0-2
+libvorbis0a=1.3.7-3
+libvorbisenc2=1.3.7-3
+libvotequorum8=3.1.10-pve2
+libvulkan1=1.4.309.0-1
+libwayland-server0=1.23.1-3
+libwbclient0=2:4.22.11+dfsg-0+deb13u1
+libwrap0=7.6.q-36
+libwtmpdb0=0.73.0-3+deb13u1
+libwww-perl=6.78-1
+libwww-robotrules-perl=6.02-1
+libx11-6=2:1.8.12-1
+libx11-data=2:1.8.12-1
+libx11-xcb1=2:1.8.12-1
+libxau6=1:1.0.11-1
+libxcb-dri3-0=1.17.0-2+b1
+libxcb-present0=1.17.0-2+b1
+libxcb-randr0=1.17.0-2+b1
+libxcb-render0=1.17.0-2+b1
+libxcb-shm0=1.17.0-2+b1
+libxcb-sync1=1.17.0-2+b1
+libxcb-xfixes0=1.17.0-2+b1
+libxcb1=1.17.0-2+b1
+libxdmcp6=1:1.1.5-1
+libxext6=2:1.3.4-1+b3
+libxkbcommon0=1.7.0-2
+libxml-libxml-perl=2.0207+dfsg+really+2.0134-5+deb13u1
+libxml-namespacesupport-perl=1.12-2
+libxml-parser-perl=2.47-2~deb13u1
+libxml-sax-base-perl=1.09-3
+libxml-sax-perl=1.02+dfsg-4
+libxml-twig-perl=1:3.52-3
+libxml2=2.12.7+dfsg+really2.9.14-2.1+deb13u3
+libxrender1=1:0.9.12-1
+libxshmfence1=1.3.3-1
+libxslt1.1=1.1.35-1.2+deb13u3
+libxtables12=1.8.11-2
+libxxhash0=0.8.3-2
+libyaml-0-2=0.2.5-2
+libyaml-libyaml-perl=0.903.0+ds-1
+libyang3=3.12.2-1
+libz3-4=4.13.3-1
+libzfs7linux=2.4.2-pve1
+libzpool7linux=2.4.2-pve1
+libzstd1=1.5.7+dfsg-1
+linux-base=4.12.1
+linux-sysctl-defaults=4.12.1
+locales=2.41-12+deb13u4
+login.defs=1:4.17.4-2
+login=1:4.16.0-2+really2.41.5-0+deb13u1
+logrotate=3.22.0-1
+logsave=1.47.2-3+b12
+lsof=4.99.4+dfsg-2
+lvm2=2.03.31-2+pmx1
+lxc-pve=7.0.0-2
+lxcfs=7.0.0-pve1
+lzop=1.04-2
+man-db=2.13.1-1
+manpages=6.9.1-1
+mawk=1.3.4.20250131-1
+media-types=13.0.0
+memtest86+=7.20-1
+mesa-libgallium=25.0.7-2+deb13u1
+mokutil=0.7.2-1
+mount=2.41.5-0+deb13u1
+nano=8.4-1+deb13u1
+ncurses-base=6.5+20250216-2
+ncurses-bin=6.5+20250216-2
+ncurses-term=6.5+20250216-2
+netavark=1.14.0-2
+netbase=6.5
+netcat-traditional=1.10-50
+nfs-common=1:2.8.3-1
+nftables=1.1.3-1
+nmap-common=7.95+dfsg-3
+nmap=7.95+dfsg-3
+node-popper2=2.11.2-8
+novnc-pve=1.7.0-1
+numactl=2.0.19-1
+open-iscsi=2.1.11-1+deb13u2
+openssh-client=1:10.0p1-7+deb13u4
+openssh-server=1:10.0p1-7+deb13u4
+openssh-sftp-server=1:10.0p1-7+deb13u4
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
+passwd=1:4.17.4-2
+pci.ids=0.0~2025.06.09-1
+pciutils=1:3.13.0-2
+perl-base=5.40.1-6+deb13u1
+perl-modules-5.40=5.40.1-6+deb13u1
+perl-openssl-defaults=7+b2
+perl=5.40.1-6+deb13u1
+pinentry-curses=1.3.1-2
+postfix=3.10.13-0+deb13u1
+procmail=3.24+really3.22-4
+procps=2:4.0.4-9
+proxmox-archive-keyring=4.0
+proxmox-backup-client=4.2.0-1
+proxmox-backup-file-restore=4.2.0-1
+proxmox-backup-restore-image=1.0.0
+proxmox-default-kernel=2.1.0
+proxmox-enterprise-support-keyring=1.0
+proxmox-firewall=1.2.3
+proxmox-first-boot=9.2.5
+proxmox-grub=2.12-9+pmx2
+proxmox-kernel-7.0.2-6-pve-signed=7.0.2-6
+proxmox-kernel-7.0=7.0.2-6
+proxmox-kernel-helper=9.1.0+fde2
+proxmox-mail-forward=1.0.3
+proxmox-mini-journalreader=1.6
+proxmox-offline-mirror-docs=0.7.4
+proxmox-offline-mirror-helper=0.7.4
+proxmox-termproxy=2.1.0
+proxmox-ve=9.2.0
+proxmox-websocket-tunnel=1.0.0
+proxmox-widget-toolkit=5.2.2
+psmisc=23.7-2
+pve-cluster=9.1.5
+pve-container=6.1.10
+pve-docs=9.2.1
+pve-edk2-firmware-aarch64=4.2025.05-2
+pve-edk2-firmware-legacy=4.2025.05-2
+pve-edk2-firmware-ovmf=4.2025.05-2
+pve-edk2-firmware=4.2025.05-2
+pve-esxi-import-tools=1.0.1
+pve-firewall=6.0.4
+pve-firmware=3.18-3
+pve-ha-manager=5.2.4
+pve-i18n=3.7.4
+pve-lxc-syscalld=2.0.2
+pve-manager=9.2.2
+pve-nvidia-vgpu-helper=0.3.1
+pve-qemu-kvm=11.0.0-3
+pve-xtermjs=6.0.0-1
+pve-yew-mobile-gui=0.7.0
+pve-yew-mobile-i18n=3.7.4
+python-apt-common=3.0.0
+python3-apt=3.0.0
+python3-autocommand=2.2.2-3
+python3-bcrypt=4.2.0-2.1+b1
+python3-ceph-argparse=19.2.3-pve4
+python3-ceph-common=19.2.3-pve4
+python3-cephfs=19.2.3-pve4
+python3-certifi=2025.1.31+ds-1
+python3-cffi-backend=1.17.1-3
+python3-chardet=5.2.0+dfsg-2
+python3-charset-normalizer=3.4.2-1
+python3-cryptography=43.0.0-3+deb13u1
+python3-dbus=1.4.0-1
+python3-debconf=1.5.91
+python3-debian=1.0.1
+python3-debianbts=4.1.1
+python3-idna=3.10-1+deb13u1
+python3-importlib-resources=6.5.2-1
+python3-inflect=7.3.1-2
+python3-jaraco.context=6.0.1-1+deb13u1
+python3-jaraco.functools=4.1.0-1
+python3-jaraco.text=4.0.0-1
+python3-minimal=3.13.5-1
+python3-more-itertools=10.7.0-1
+python3-pefile=2024.8.26-2.1
+python3-pkg-resources=78.1.1-0.1
+python3-prettytable=3.15.1-1
+python3-pyvmomi=8.0.3.0.1-1
+python3-rados=19.2.3-pve4
+python3-rbd=19.2.3-pve4
+python3-reportbug=13.2.0
+python3-requests=2.32.3+dfsg-5+deb13u1
+python3-rgw=19.2.3-pve4
+python3-setuptools=78.1.1-0.1
+python3-six=1.17.0-1
+python3-systemd=235-1+b6
+python3-typeguard=4.4.2-1
+python3-typing-extensions=4.13.2-1
+python3-urllib3=2.3.0-3+deb13u2
+python3-virt-firmware=24.11-2
+python3-wcwidth=0.2.13+dfsg1-1
+python3-yaml=6.0.2-1+b2
+python3-zipp=3.21.0-1
+python3.13-minimal=3.13.5-2+deb13u5
+python3.13=3.13.5-2+deb13u5
+python3=3.13.5-1
+qemu-server=9.1.15
+qrencode=4.1.1-2
+readline-common=8.2-6
+reportbug=13.2.0
+rpcbind=1.2.7-1
+rrdcached=1.7.2-4.2+pve4
+rsync=3.5.0+ds1-0+deb13u1
+runit-helper=2.16.4
+samba-common=2:4.22.11+dfsg-0+deb13u1
+samba-libs=2:4.22.11+dfsg-0+deb13u1
+sed=4.9-2+deb13u1
+sensible-utils=0.0.25
+shared-mime-info=2.4-5+b2
+shim-helpers-amd64-signed=1+16.1+1+pmx1
+shim-signed-common=1.48+pmx1+16.1-1+pmx1
+shim-signed=1.48+pmx1+16.1-1+pmx1
+shim-unsigned=16.1-1+pmx1
+skopeo=1.18.0+ds1-1+b5
+smartmontools=7.5-pve2
+smbclient=2:4.22.11+dfsg-0+deb13u1
+socat=1.8.0.3-1+deb13u1
+spiceterm=3.4.2
+sqlite3=3.46.1-7+deb13u2
+sqv=1.3.0-3+b2
+ssh=1:10.0p1-7+deb13u4
+strace=6.13+ds-1
+sudo=1.9.16p2-3+deb13u2
+swtpm-libs=0.8.0+pve3
+swtpm-tools=0.8.0+pve3
+swtpm=0.8.0+pve3
+systemd-boot-efi=257.13-1~deb13u1
+systemd-boot-tools=257.13-1~deb13u1
+systemd-sysv=257.13-1~deb13u1
+systemd=257.13-1~deb13u1
+sysvinit-utils=3.14-4
+tailscale-archive-keyring=1.35.181
+tailscale=1.102.2
+tar=1.35+dfsg-3.1
+tcpdump=4.99.5-2
+thin-provisioning-tools=1.1.0-4+b1
+time=1.9-0.2
+traceroute=1:2.1.6-1
+tzdata=2026c-0+deb13u1
+ucf=3.0052
+udev=257.13-1~deb13u1
+uidmap=1:4.17.4-2
+usbutils=1:018-2
+util-linux-extra=2.41.5-0+deb13u1
+util-linux=2.41.5-0+deb13u1
+vim-common=2:9.1.1230-2
+vim-tiny=2:9.1.1230-2
+virtiofsd=1.13.2-1+deb13u1
+vncterm=1.9.2
+wamerican=2020.12.07-4
+wget=1.25.0-2
+whiptail=0.52.25-1
+wireguard-tools=1.0.20210914-3
+wtmpdb=0.73.0-3+deb13u1
+xfsprogs=6.13.0-2+deb13u1
+xkb-data=2.42-1
+xsltproc=1.1.35-1.2+deb13u3
+xz-utils=5.8.1-1+deb13u1
+zfs-initramfs=2.4.2-pve1
+zfs-zed=2.4.2-pve1
+zfsutils-linux=2.4.2-pve1
+zlib1g=1:1.3.dfsg+really1.3.1-1+b1
+zstd=1.5.7+dfsg-1
diff --git a/documentation/audits/night-2026-10-04/baseline/schedule-demo-hp.txt b/documentation/audits/night-2026-10-04/baseline/schedule-demo-hp.txt
new file mode 100644
index 00000000..fb679910
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/baseline/schedule-demo-hp.txt
@@ -0,0 +1,24 @@
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job db-dump scheduled for 2026-10-05 02:30 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job tier2-backup scheduled for 2026-10-05 03:30 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job offbox-backup scheduled for 2026-10-05 04:15 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job offsite-abandon-sweep scheduled for 2026-10-05 05:10 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job offsite-integrity scheduled for 2026-10-05 06:00 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job offsite-proof scheduled for 2026-10-05 05:30 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job metrics-prune scheduled for 2026-10-05 04:00 CEST
+2026/10/04 17:52:28 scheduler.go:132: [INFO] [scheduler] Daily job fill-watch scheduled for 2026-10-05 03:30 CEST
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for adventurelog → /mnt/sys_drive/felhom-data/backups/primary/adventurelog (images=3, secrets-referenced=2, data_keys=1, portable-carried=2/2, withheld=0)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for bentopdf → /mnt/sys_drive/felhom-data/backups/primary/bentopdf (images=1, secrets-referenced=0, data_keys=0, portable-carried=0/0, withheld=0)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for bookstack → /mnt/sys_drive/felhom-data/backups/primary/bookstack (images=2, secrets-referenced=3, data_keys=0, portable-carried=2/2, withheld=1)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for calibre-web → /mnt/felhom-drives/hdd_1/backups/primary/calibre-web (images=1, secrets-referenced=2, data_keys=0, portable-carried=1/1, withheld=1)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for docmost → /mnt/sys_drive/felhom-data/backups/primary/docmost (images=3, secrets-referenced=2, data_keys=0, portable-carried=2/2, withheld=0)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for kimai → /mnt/sys_drive/felhom-data/backups/primary/kimai (images=2, secrets-referenced=2, data_keys=0, portable-carried=1/1, withheld=1)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for opengist → /mnt/sys_drive/felhom-data/backups/primary/opengist (images=1, secrets-referenced=0, data_keys=0, portable-carried=0/0, withheld=0)
+2026/10/04 17:52:28 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for privatebin → /mnt/sys_drive/felhom-data/backups/primary/privatebin (images=1, secrets-referenced=0, data_keys=0, portable-carried=0/0, withheld=0)
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job db-dump scheduled for 2026-10-05 02:30 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job tier2-backup scheduled for 2026-10-05 03:30 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job offbox-backup scheduled for 2026-10-05 04:15 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job offsite-abandon-sweep scheduled for 2026-10-05 05:10 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job offsite-integrity scheduled for 2026-10-05 06:00 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job offsite-proof scheduled for 2026-10-05 05:30 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job metrics-prune scheduled for 2026-10-05 04:00 CEST
+2026/10/04 18:24:59 scheduler.go:132: [INFO] [scheduler] Daily job fill-watch scheduled for 2026-10-05 03:30 CEST
diff --git a/documentation/audits/night-2026-10-04/baseline/schedule-felhom-pve.txt b/documentation/audits/night-2026-10-04/baseline/schedule-felhom-pve.txt
new file mode 100644
index 00000000..b6dad372
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/baseline/schedule-felhom-pve.txt
@@ -0,0 +1,9 @@
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job db-dump scheduled for 2026-10-05 02:30 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job tier2-backup scheduled for 2026-10-05 03:30 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job offbox-backup scheduled for 2026-10-05 04:15 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job offsite-abandon-sweep scheduled for 2026-10-05 05:10 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job offsite-integrity scheduled for 2026-10-05 06:00 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job offsite-proof scheduled for 2026-10-05 05:30 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job metrics-prune scheduled for 2026-10-05 04:00 CEST
+2026/10/04 17:52:26 [INFO] [scheduler] Daily job fill-watch scheduled for 2026-10-05 03:30 CEST
+2026/10/04 17:52:26 [INFO] [backup] Recovery unit captured for opengist → /mnt/sys_drive/felhom-data/backups/primary/opengist (images=1, secrets-referenced=0, data_keys=0, portable-carried=0/0, withheld=0)
diff --git a/documentation/audits/night-2026-10-04/baseline/state-demo-hp.txt b/documentation/audits/night-2026-10-04/baseline/state-demo-hp.txt
new file mode 100644
index 00000000..3ef02e94
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/baseline/state-demo-hp.txt
@@ -0,0 +1,2 @@
+0.143.0 signed
+guard armed True panic 10
diff --git a/documentation/audits/night-2026-10-04/baseline/state-felhom-pve.txt b/documentation/audits/night-2026-10-04/baseline/state-felhom-pve.txt
new file mode 100644
index 00000000..53d28913
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/baseline/state-felhom-pve.txt
@@ -0,0 +1,2 @@
+0.143.0 installer
+guard armed True panic 10
diff --git a/documentation/audits/night-2026-10-04/baseline/system-page-1924Z.html b/documentation/audits/night-2026-10-04/baseline/system-page-1924Z.html
new file mode 100644
index 00000000..8f78cb0a
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/baseline/system-page-1924Z.html
@@ -0,0 +1,254 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>System — Felhom Hub</title>
+    <link rel="stylesheet" href="/style.css?v=0.133.0">
+    <style>
+        .sys td, .sys th { white-space: nowrap; font-size: 0.82em; vertical-align: top; }
+        .sys .grp { border-left: 2px solid var(--border, #444); }
+        .c-warn { color: var(--warn); font-weight: 600; }
+        .c-bad { color: var(--danger, #e5534b); font-weight: 700; }
+        .sys form { display: inline; }
+        .rel-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(16rem, 1fr)); gap: 0.75rem; }
+    </style>
+</head>
+<body>
+    <svg xmlns="http://www.w3.org/2000/svg" style="display:none" aria-hidden="true">
+<symbol id="i-triangle-alert" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3" /> <path d="M12 9v4" /> <path d="M12 17h.01" /></symbol>
+<symbol id="i-check" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 6 9 17l-5-5" /></symbol>
+<symbol id="i-server" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="20" height="8" x="2" y="2" rx="2" ry="2" /> <rect width="20" height="8" x="2" y="14" rx="2" ry="2" /> <line x1="6" x2="6.01" y1="6" y2="6" /> <line x1="6" x2="6.01" y1="18" y2="18" /></symbol>
+<symbol id="i-settings" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9.671 4.136a2.34 2.34 0 0 1 4.659 0 2.34 2.34 0 0 0 3.319 1.915 2.34 2.34 0 0 1 2.33 4.033 2.34 2.34 0 0 0 0 3.831 2.34 2.34 0 0 1-2.33 4.033 2.34 2.34 0 0 0-3.319 1.915 2.34 2.34 0 0 1-4.659 0 2.34 2.34 0 0 0-3.32-1.915 2.34 2.34 0 0 1-2.33-4.033 2.34 2.34 0 0 0 0-3.831A2.34 2.34 0 0 1 6.35 6.051a2.34 2.34 0 0 0 3.319-1.915" /> <circle cx="12" cy="12" r="3" /></symbol>
+<symbol id="i-x" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 6 6 18" /> <path d="m6 6 12 12" /></symbol>
+<symbol id="i-info" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10" /> <path d="M12 16v-4" /> <path d="M12 8h.01" /></symbol>
+<symbol id="i-hard-drive" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 16h.01" /> <path d="M2.212 11.577a2 2 0 0 0-.212.896V18a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-5.527a2 2 0 0 0-.212-.896L18.55 5.11A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z" /> <path d="M21.946 12.013H2.054" /> <path d="M6 16h.01" /></symbol>
+<symbol id="i-cpu" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 20v2" /> <path d="M12 2v2" /> <path d="M17 20v2" /> <path d="M17 2v2" /> <path d="M2 12h2" /> <path d="M2 17h2" /> <path d="M2 7h2" /> <path d="M20 12h2" /> <path d="M20 17h2" /> <path d="M20 7h2" /> <path d="M7 20v2" /> <path d="M7 2v2" /> <rect x="4" y="4" width="16" height="16" rx="2" /> <rect x="8" y="8" width="8" height="8" rx="1" /></symbol>
+<symbol id="i-clock" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10" /> <path d="M12 6v6l4 2" /></symbol>
+<symbol id="i-boxes" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M2.97 12.92A2 2 0 0 0 2 14.63v3.24a2 2 0 0 0 .97 1.71l3 1.8a2 2 0 0 0 2.06 0L12 19v-5.5l-5-3-4.03 2.42Z" /> <path d="m7 16.5-4.74-2.85" /> <path d="m7 16.5 5-3" /> <path d="M7 16.5v5.17" /> <path d="M12 13.5V19l3.97 2.38a2 2 0 0 0 2.06 0l3-1.8a2 2 0 0 0 .97-1.71v-3.24a2 2 0 0 0-.97-1.71L17 10.5l-5 3Z" /> <path d="m17 16.5-5-3" /> <path d="m17 16.5 4.74-2.85" /> <path d="M17 16.5v5.17" /> <path d="M7.97 4.42A2 2 0 0 0 7 6.13v4.37l5 3 5-3V6.13a2 2 0 0 0-.97-1.71l-3-1.8a2 2 0 0 0-2.06 0l-3 1.8Z" /> <path d="M12 8 7.26 5.15" /> <path d="m12 8 4.74-2.85" /> <path d="M12 13.5V8" /></symbol>
+<symbol id="i-users" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2" /> <path d="M16 3.128a4 4 0 0 1 0 7.744" /> <path d="M22 21v-2a4 4 0 0 0-3-3.87" /> <circle cx="9" cy="7" r="4" /></symbol>
+</svg>
+    
+<script>
+
+
+function felhomConfirm(el,question,onYes){
+    if(!el||el.dataset.fcOpen)return;
+    el.dataset.fcOpen='1';
+    var wrap=document.createElement('span');wrap.className='inline-confirm';
+    var q=document.createElement('span');q.className='inline-confirm-q';q.textContent=question;
+    var yes=document.createElement('button');yes.type='button';yes.className='btn btn-sm btn-danger';yes.textContent='Igen';
+    var no=document.createElement('button');no.type='button';no.className='btn btn-sm btn-outline';no.textContent='Mégse';
+    wrap.appendChild(q);wrap.appendChild(yes);wrap.appendChild(no);
+    el.style.display='none';el.parentNode.insertBefore(wrap,el.nextSibling);
+    function close(){wrap.remove();el.style.display='';delete el.dataset.fcOpen;}
+    no.addEventListener('click',close);
+    yes.addEventListener('click',function(){close();onYes();});
+}
+document.addEventListener('click',function(e){
+    var btn=e.target.closest?e.target.closest('[data-confirm]'):null;
+    if(!btn)return;
+    e.preventDefault();
+    felhomConfirm(btn,btn.getAttribute('data-confirm'),function(){
+        var form=btn.closest('form');
+        if(form){if(form.requestSubmit)form.requestSubmit(btn);else form.submit();}
+    });
+});
+</script>
+
+    <div class="container">
+        <header>
+            <h1>Felhom <span>Hub</span></h1>
+            <nav class="nav-links">
+                <a href="/" class="nav-link">Dashboard</a>
+                <a href="/configs" class="nav-link">Customers</a>
+                <a href="/apps" class="nav-link">Apps</a>
+                <a href="/hosts" class="nav-link">Hosts</a>
+                <a href="/system" class="nav-link active">System</a>
+                <a href="/offsite" class="nav-link">Offsite</a>
+                <a href="/configuration" class="nav-link">Configuration</a>
+            </nav>
+        </header>
+
+        <h2 style="margin-bottom: 1rem;">System — versions and OS updates</h2>
+
+        
+        
+
+        <section class="card" style="margin-bottom: 1.5rem;">
+            <h3 style="margin-top: 0;">Approved releases</h3>
+            <div class="rel-grid">
+                
+                <div><strong>docker</strong>: <code>os-docker-20261004-142842</code><br>
+                    <span class="text-muted">6 packages · 2026-10-04 14:28 UTC · by operator</span>
+                    </div>
+                
+            </div>
+            
+            <h3>Cancelled approvals (last 7 days)</h3>
+            <div class="rel-grid">
+                
+                <div><strong>host</strong>: <code>os-host-20261004-124133</code><br>
+                    <span class="c-warn">cancelled 2026-10-04 18:20:02 UTC — a TEST approval</span><br>
+                    <span class="text-muted">no further box installs it; boxes that installed it keep it</span></div>
+                
+                <div><strong>host</strong>: <code>os-host-20261004-124034</code><br>
+                    <span class="c-warn">cancelled 2026-10-04 18:20:02 UTC — a TEST approval</span><br>
+                    <span class="text-muted">no further box installs it; boxes that installed it keep it</span></div>
+                
+                <div><strong>guest</strong>: <code>os-guest-20261004-123933</code><br>
+                    <span class="c-warn">cancelled 2026-10-04 18:20:02 UTC — a TEST approval</span><br>
+                    <span class="text-muted">no further box installs it; boxes that installed it keep it</span></div>
+                
+                <div><strong>guest</strong>: <code>os-20261004-091417</code><br>
+                    <span class="c-warn">cancelled 2026-10-04 18:20:02 UTC — a TEST approval</span><br>
+                    <span class="text-muted">no further box installs it; boxes that installed it keep it</span></div>
+                
+            </div>
+            
+            <h3>What ring 0 runs now</h3>
+            <div class="rel-grid">
+                
+                <div><strong>guest</strong>:
+                    272 packages, first seen 2026-10-04 11:07 UTC<br>
+                    <span class="text-muted">healthy for 8h17m0s of 24h0m0s</span>
+                    
+                </div>
+                
+                <div><strong>host</strong>:
+                    607 packages, first seen 2026-10-04 12:24 UTC<br>
+                    <span class="text-muted">healthy for 7h0m0s of 24h0m0s</span>
+                    
+                </div>
+                
+                <div><strong>docker</strong>:
+                    6 packages, first seen 2026-10-04 14:28 UTC<br>
+                    <span class="text-muted">approved as os-docker-20261004-142842</span>
+                    
+                    
+                </div>
+                
+            </div>
+            <form method="POST" action="/os/approve-now" style="margin-top: 0.8rem;">
+                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                <button type="submit" class="btn btn-sm btn-danger" data-confirm="Approve the guest and host sets ring 0 runs NOW, without the 24 h + 1 night wait? Every ring-1 box installs them at its next night run.">Approve now (guest + host)</button>
+                <span class="text-muted" style="font-size: 0.85em;">An urgent fix only — normally the hub approves after 24 h and one night.</span>
+            </form>
+        </section>
+
+        
+        <section class="card" style="padding: 0; overflow-x: auto;">
+            <table class="data-table sys">
+                <thead>
+                    <tr>
+                        <th>Box</th><th>Ring / updates</th><th>Tunnel</th>
+                        <th class="grp">Proxmox</th><th>Kernel (running)</th><th>Kernel (next boot)</th><th>Debian</th><th>Felhom release</th><th>Pending</th><th>Not covered</th><th>Held</th><th>Reboot needed</th><th>kernel.panic</th><th>Oops</th><th>Crash restarts 24 h</th><th>Crash guard</th><th title="The root-owned config bundle: sudoers, wrappers, units (R-840)">Root files</th>
+                        <th class="grp">Guest Debian</th><th>Felhom release</th><th>Pending</th><th>Restart needed</th>
+                        <th class="grp">Docker</th><th>containerd</th><th>live-restore</th><th>Docker release</th>
+                        <th class="grp">Last OS leg</th>
+                    </tr>
+                    <tr class="text-muted"><th></th><th></th><th></th><th class="grp" colspan="14">host</th><th class="grp" colspan="4">guest</th><th class="grp" colspan="4">Docker engine</th><th class="grp"></th></tr>
+                </thead>
+                <tbody>
+                    
+                    <tr>
+                        <td><a href="/hosts/Tester-2-be8404">Tester-2-be8404</a><br><span class="text-muted">Tester 2</span>
+                            </td>
+                        <td>
+                            ring 1
+                            <form method="POST" action="/os/ring/Tester-2-be8404">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="ring" value="0"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Make Tester-2-be8404 a DEMO (ring 0) box? It then installs every new fix first and takes unsigned Docker steps if its root-owned ring-0 mark allows.">→ demo</button>
+                            </form><br>
+                            updates <strong>ON</strong>
+                            <form method="POST" action="/os/enabled/Tester-2-be8404">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="on" value="0"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Switch OS updates OFF for Tester-2-be8404? It keeps reporting and installs nothing.">switch off</button>
+                                
+                            </form>
+                        </td>
+                        <td>running</td>
+                        <td class="grp ">9.2.2</td>
+                        <td>7.0.2-6-pve</td><td>7.0.2-6-pve</td><td>13.7</td>
+                        <td>os-host-20261004-124133</td><td>78</td><td>0</td>
+                        <td>none</td><td class="c-warn">since 2026-10-04</td><td>10 s</td><td>no</td>
+                        <td>0</td><td>armed</td><td class="c-warn" title="the box could not read it (agent older than v0.142.0, or the guest is down)">unknown</td>
+                        <td class="grp ">13.7</td>
+                        <td>os-guest-20261004-123933</td><td>0</td><td>7</td>
+                        <td class="grp ">29.8.2</td>
+                        <td>2.3.6-1~debian.13~trixie</td><td>on</td><td>—</td>
+                        <td class="grp " title="last successful leg: 2 h ago">2 h ago · applied · 44 s</td>
+                    </tr>
+                    
+                    <tr>
+                        <td><a href="/hosts/demo-felhom-8363b5">demo-felhom-8363b5</a><br><span class="text-muted">Demo Ügyfél</span>
+                            </td>
+                        <td>
+                            ring 0
+                            <form method="POST" action="/os/ring/demo-felhom-8363b5">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="ring" value="1"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Make demo-felhom-8363b5 a normal (ring 1) box? It then installs only approved releases.">→ normal</button>
+                                
+                            </form><br>
+                            updates <strong>ON</strong>
+                            <form method="POST" action="/os/enabled/demo-felhom-8363b5">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="on" value="0"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Switch OS updates OFF for demo-felhom-8363b5? It keeps reporting and installs nothing.">switch off</button>
+                                
+                            </form>
+                        </td>
+                        <td>running</td>
+                        <td class="grp ">9.2.2</td>
+                        <td>7.0.2-6-pve</td><td>7.0.2-6-pve</td><td>13.7</td>
+                        <td>os-host-20261004-124133</td><td>80</td><td>0</td>
+                        <td>none</td><td class="c-warn">since 2026-10-04</td><td>10 s</td><td>no</td>
+                        <td>0</td><td>armed</td><td>0.143.0</td>
+                        <td class="grp ">13.7</td>
+                        <td>os-guest-20261004-123933</td><td>0</td><td>10</td>
+                        <td class="grp ">29.8.2</td>
+                        <td>2.3.6-1~debian.13~trixie</td><td>on</td><td>os-docker-20261004-142842</td>
+                        <td class="grp " title="last successful leg: 4 h ago">4 h ago · nothing · 12 s</td>
+                    </tr>
+                    
+                    <tr>
+                        <td><a href="/hosts/demo-hp-bb76ea">demo-hp-bb76ea</a><br><span class="text-muted">Demo HP</span>
+                            </td>
+                        <td>
+                            ring 0
+                            <form method="POST" action="/os/ring/demo-hp-bb76ea">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="ring" value="1"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Make demo-hp-bb76ea a normal (ring 1) box? It then installs only approved releases.">→ normal</button>
+                                
+                            </form><br>
+                            updates <strong>ON</strong>
+                            <form method="POST" action="/os/enabled/demo-hp-bb76ea">
+                                <input type="hidden" name="_csrf" value=""><input type="hidden" name="return" value="/system">
+                                <input type="hidden" name="on" value="0"><button type="submit" class="btn btn-sm btn-outline" data-confirm="Switch OS updates OFF for demo-hp-bb76ea? It keeps reporting and installs nothing.">switch off</button>
+                                
+                            </form>
+                        </td>
+                        <td>running</td>
+                        <td class="grp ">9.2.2</td>
+                        <td>7.0.14-20-pve</td><td>7.0.14-20-pve</td><td>13.7</td>
+                        <td>ring0-20261004T144238Z</td><td>78</td><td>0</td>
+                        <td>none</td><td>no</td><td>10 s</td><td>no</td>
+                        <td class="c-warn">3</td><td>armed</td><td>0.143.0</td>
+                        <td class="grp ">13.7</td>
+                        <td>ring0-20261004T144238Z</td><td>6</td><td>1</td>
+                        <td class="grp ">29.8.2</td>
+                        <td>2.3.6-1~debian.13~trixie</td><td>on</td><td>r858-proof-forward</td>
+                        <td class="grp " title="last successful leg: 4 h ago">2 h ago · applied · 69 s</td>
+                    </tr>
+                    
+                </tbody>
+            </table>
+        </section>
+        <p class="text-muted" style="font-size: 0.85em;">Amber: worth a look. Red: an operator alarm fires (`08` §6.3). "unknown": the box could not read the value — never a guess.</p>
+        
+
+        <footer style="margin-top: 2rem; color: var(--text-muted); font-size: 0.8rem; text-align: center;">
+            Felhom Hub <span style="font-family: var(--font-mono)">0.133.0</span>
+        </footer>
+    </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/documentation/audits/night-2026-10-04/baseline/system-page.txt b/documentation/audits/night-2026-10-04/baseline/system-page.txt
new file mode 100644
index 00000000..b6c0bc09
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/baseline/system-page.txt
@@ -0,0 +1,96 @@
+ 
+ System — Felhom Hub 
+ Felhom Hub 
+ Dashboard 
+ Customers 
+ Apps 
+ Hosts 
+ System 
+ Offsite 
+ Configuration 
+ System — versions and OS updates 
+ Approved releases 
+ docker : os-docker-20261004-142842 
+ 6 packages · 2026-10-04 14:28 UTC · by operator 
+ Cancelled approvals (last 7 days) 
+ host : os-host-20261004-124133 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ host : os-host-20261004-124034 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ guest : os-guest-20261004-123933 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ guest : os-20261004-091417 
+ cancelled 2026-10-04 18:20:02 UTC — a TEST approval 
+ no further box installs it; boxes that installed it keep it 
+ What ring 0 runs now 
+ guest :
+ 272 packages, first seen 2026-10-04 11:07 UTC 
+ healthy for 8h17m0s of 24h0m0s 
+ host :
+ 607 packages, first seen 2026-10-04 12:24 UTC 
+ healthy for 7h0m0s of 24h0m0s 
+ docker :
+ 6 packages, first seen 2026-10-04 14:28 UTC 
+ approved as os-docker-20261004-142842 
+ Approve now (guest + host) 
+ An urgent fix only — normally the hub approves after 24 h and one night. 
+ Box Ring / updates Tunnel 
+ Proxmox Kernel (running) Kernel (next boot) Debian Felhom release Pending Not covered Held Reboot needed kernel.panic Oops Crash restarts 24 h Crash guard Root files 
+ Guest Debian Felhom release Pending Restart needed 
+ Docker containerd live-restore Docker release 
+ Last OS leg 
+ host guest Docker engine 
+ Tester-2-be8404 Tester 2 
+ ring 1
+ → demo 
+ updates ON 
+ switch off 
+ running 
+ 9.2.2 
+ 7.0.2-6-pve 7.0.2-6-pve 13.7 
+ os-host-20261004-124133 78 0 
+ none since 2026-10-04 10 s no 
+ 0 armed unknown 
+ 13.7 
+ os-guest-20261004-123933 0 7 
+ 29.8.2 
+ 2.3.6-1~debian.13~trixie on — 
+ 2 h ago · applied · 44 s 
+ demo-felhom-8363b5 Demo Ügyfél 
+ ring 0
+ → normal 
+ updates ON 
+ switch off 
+ running 
+ 9.2.2 
+ 7.0.2-6-pve 7.0.2-6-pve 13.7 
+ os-host-20261004-124133 80 0 
+ none since 2026-10-04 10 s no 
+ 0 armed 0.143.0 
+ 13.7 
+ os-guest-20261004-123933 0 10 
+ 29.8.2 
+ 2.3.6-1~debian.13~trixie on os-docker-20261004-142842 
+ 4 h ago · nothing · 12 s 
+ demo-hp-bb76ea Demo HP 
+ ring 0
+ → normal 
+ updates ON 
+ switch off 
+ running 
+ 9.2.2 
+ 7.0.14-20-pve 7.0.14-20-pve 13.7 
+ ring0-20261004T144238Z 78 0 
+ none no 10 s no 
+ 3 armed 0.143.0 
+ 13.7 
+ ring0-20261004T144238Z 6 1 
+ 29.8.2 
+ 2.3.6-1~debian.13~trixie on r858-proof-forward 
+ 2 h ago · applied · 69 s 
+ Amber: worth a look. Red: an operator alarm fires (`08` §6.3). "unknown": the box could not read the value — never a guess. 
+ Felhom Hub 0.133.0 
+ 
diff --git a/documentation/audits/night-2026-10-04/tester1/screens/shot-02.png b/documentation/audits/night-2026-10-04/tester1/screens/shot-02.png
new file mode 100644
index 00000000..9b0387f3
Binary files /dev/null and b/documentation/audits/night-2026-10-04/tester1/screens/shot-02.png differ
diff --git a/documentation/audits/night-2026-10-04/tester1/screens/shot-03.png b/documentation/audits/night-2026-10-04/tester1/screens/shot-03.png
new file mode 100644
index 00000000..e997db93
Binary files /dev/null and b/documentation/audits/night-2026-10-04/tester1/screens/shot-03.png differ
diff --git a/documentation/audits/night-2026-10-04/tester1/screens/shot-04.png b/documentation/audits/night-2026-10-04/tester1/screens/shot-04.png
new file mode 100644
index 00000000..a828abc8
Binary files /dev/null and b/documentation/audits/night-2026-10-04/tester1/screens/shot-04.png differ
diff --git a/documentation/audits/night-2026-10-04/tester1/screens/shot-05.png b/documentation/audits/night-2026-10-04/tester1/screens/shot-05.png
new file mode 100644
index 00000000..7195087b
Binary files /dev/null and b/documentation/audits/night-2026-10-04/tester1/screens/shot-05.png differ
diff --git a/documentation/audits/night-2026-10-04/tester1/screens/shot-06.png b/documentation/audits/night-2026-10-04/tester1/screens/shot-06.png
new file mode 100644
index 00000000..6e13c77d
Binary files /dev/null and b/documentation/audits/night-2026-10-04/tester1/screens/shot-06.png differ
diff --git a/documentation/audits/night-2026-10-04/tester1/screens/shot-07.png b/documentation/audits/night-2026-10-04/tester1/screens/shot-07.png
new file mode 100644
index 00000000..b87a8621
Binary files /dev/null and b/documentation/audits/night-2026-10-04/tester1/screens/shot-07.png differ
diff --git a/documentation/audits/night-2026-10-04/tester1/screens/shot-08.png b/documentation/audits/night-2026-10-04/tester1/screens/shot-08.png
new file mode 100644
index 00000000..fffc8cf9
Binary files /dev/null and b/documentation/audits/night-2026-10-04/tester1/screens/shot-08.png differ
diff --git a/documentation/audits/night-2026-10-04/tester1/screens/shot-09.png b/documentation/audits/night-2026-10-04/tester1/screens/shot-09.png
new file mode 100644
index 00000000..16383e05
Binary files /dev/null and b/documentation/audits/night-2026-10-04/tester1/screens/shot-09.png differ
diff --git a/documentation/audits/night-2026-10-04/tester1/screens/shot-10.png b/documentation/audits/night-2026-10-04/tester1/screens/shot-10.png
new file mode 100644
index 00000000..0f21c944
Binary files /dev/null and b/documentation/audits/night-2026-10-04/tester1/screens/shot-10.png differ
diff --git a/documentation/audits/night-2026-10-04/tester1/screens/shot-12.png b/documentation/audits/night-2026-10-04/tester1/screens/shot-12.png
new file mode 100644
index 00000000..9b0387f3
Binary files /dev/null and b/documentation/audits/night-2026-10-04/tester1/screens/shot-12.png differ
diff --git a/documentation/audits/night-2026-10-04/tester1/t0-operator-selfbind.txt b/documentation/audits/night-2026-10-04/tester1/t0-operator-selfbind.txt
new file mode 100644
index 00000000..1fcf1a2d
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t0-operator-selfbind.txt
@@ -0,0 +1,3 @@
+2026-10-04T19:26:07Z
+HTTP/1.1 303 See Other
+Location: /customers/tester-1?flash=selfbind-sent#tab=setup
diff --git a/documentation/audits/night-2026-10-04/tester1/t1-vm-config.txt b/documentation/audits/night-2026-10-04/tester1/t1-vm-config.txt
new file mode 100644
index 00000000..21fb5e58
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t1-vm-config.txt
@@ -0,0 +1,28 @@
+Formatting '/mnt/hdd_1/images/341/vm-341-disk-0.raw', fmt=raw size=540672 preallocation=off
+transferred 0.0 B of 528.0 KiB (0.00%)
+transferred 528.0 KiB of 528.0 KiB (100.00%)
+transferred 528.0 KiB of 528.0 KiB (100.00%)
+efidisk0: successfully created disk 'nvme-scratch:341/vm-341-disk-0.raw,efitype=4m,pre-enrolled-keys=0,size=528K'
+Formatting '/mnt/hdd_1/images/341/vm-341-disk-1.raw', fmt=raw size=214748364800 preallocation=off
+scsi0: successfully created disk 'nvme-scratch:341/vm-341-disk-1.raw,size=200G'
+Formatting '/mnt/hdd_1/images/341/vm-341-disk-2.raw', fmt=raw size=53687091200 preallocation=off
+scsi1: successfully created disk 'nvme-scratch:341/vm-341-disk-2.raw,size=50G'
+update VM 341: -boot order=ide2;scsi0
+bios: ovmf
+boot: order=ide2;scsi0
+cores: 4
+cpu: host
+efidisk0: nvme-scratch:341/vm-341-disk-0.raw,efitype=4m,pre-enrolled-keys=0,size=528K
+ide2: local:iso/felhom-installer-1.29.0-pve9.2-1.iso,media=cdrom,size=1665356K
+machine: q35
+memory: 8192
+meta: creation-qemu=11.0.0,ctime=1791141969
+name: night1004-tester1
+net0: virtio=BC:24:11:AC:E3:F9,bridge=vmbr0
+ostype: l26
+scsi0: nvme-scratch:341/vm-341-disk-1.raw,size=200G
+scsi1: nvme-scratch:341/vm-341-disk-2.raw,size=50G
+scsihw: virtio-scsi-single
+smbios1: uuid=451c8d94-abf2-46e4-a278-b579a9f315b5
+vga: std
+vmgenid: acdf89db-a810-445c-9d88-7bccd688d3c1
diff --git a/documentation/audits/night-2026-10-04/tester1/t10-install-time-chain.txt b/documentation/audits/night-2026-10-04/tester1/t10-install-time-chain.txt
new file mode 100644
index 00000000..d1b1c640
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t10-install-time-chain.txt
@@ -0,0 +1,7 @@
+Oct 04 21:48:28 felhom felhom-agent[2492]: time=2026-10-04T21:48:28.339+02:00 level=INFO msg="backup: completed" vmid=9201 target=local archive=local:backup/vzdump-lxc-9201-2026_10_04-21_47_12.tar.zst size_bytes=1378818894 uncovered_volumes=2
+Oct 04 21:49:58 felhom felhom-agent[2492]: time=2026-10-04T21:49:58.341+02:00 level=INFO msg="osupdate: START" run=20261004T194958Z layer=guest vmid=9201 ring=1 trigger=night enabled=true release=""
+Oct 04 21:50:19 felhom felhom-agent[2492]: time=2026-10-04T21:50:19.590+02:00 level=INFO msg="osupdate: DONE" run=20261004T194958Z layer=guest vmid=9201 ring=1 trigger=night outcome=nothing healthy=true reason="" upgraded=0 pending=49 not_covered=49 restart_needed=0 reboot_needed=false wrapper_seconds=21.2
+Oct 04 21:50:19 felhom felhom-agent[2492]: time=2026-10-04T21:50:19.629+02:00 level=INFO msg="osupdate: START" run=20261004T194958Z layer=host vmid=9201 ring=1 trigger=night enabled=true release=""
+Oct 04 21:50:36 felhom felhom-agent[2492]: time=2026-10-04T21:50:36.213+02:00 level=INFO msg="osupdate: DONE" run=20261004T194958Z layer=host vmid=9201 ring=1 trigger=night outcome=nothing healthy=true reason="" upgraded=0 pending=185 not_covered=185 restart_needed=0 reboot_needed=false wrapper_seconds=15.5
+Oct 04 21:50:36 felhom felhom-agent[2492]: time=2026-10-04T21:50:36.239+02:00 level=INFO msg="osupdate: docker step skipped — ring 1 takes an engine set only inside a signed operator job (`11` §5.8)" run=20261004T194958Z vmid=9201 trigger=night ring=1 enabled=true
+Oct 04 22:00:05 felhom felhom-agent[2492]: time=2026-10-04T22:00:05.529+02:00 level=INFO msg="backup: completed" vmid=9201 target=felhom-pbs archive=felhom-pbs:backup/ct/9201/2026-10-04T19:57:18Z size_bytes=4913374023 uncovered_volumes=2
diff --git a/documentation/audits/night-2026-10-04/tester1/t11-system-line.txt b/documentation/audits/night-2026-10-04/tester1/t11-system-line.txt
new file mode 100644
index 00000000..5ea2d734
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t11-system-line.txt
@@ -0,0 +1 @@
+ tester-1-d70be4 Tester 1 ring 1 → demo updates ON switch off running 9.2.2 7.0.2-6-pve 7.0.2-6-pve 13.5 — 185 106 none no 10 s no 0 armed 0.143.0 13.6 — 49 0 29.8.2 2.3.6-1~debian.13~trixie on — 18 min ago · nothing · 16 s Amber: worth a look. Red: an operator alarm fires (`08` §6.3). "unknown": the box could not read the value — never a guess. Felhom Hub 0.133.0 
\ No newline at end of file
diff --git a/documentation/audits/night-2026-10-04/tester1/t12-box-facts.txt b/documentation/audits/night-2026-10-04/tester1/t12-box-facts.txt
new file mode 100644
index 00000000..d45139ec
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t12-box-facts.txt
@@ -0,0 +1,4 @@
+10
+armed True
+live-restore=true engine=29.8.2
+gitea.dooplex.hu/admin/felhom-controller:0.293.0
diff --git a/documentation/audits/night-2026-10-04/tester1/t2-install-pressed.txt b/documentation/audits/night-2026-10-04/tester1/t2-install-pressed.txt
new file mode 100644
index 00000000..4f51f453
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t2-install-pressed.txt
@@ -0,0 +1 @@
+19:31:30
diff --git a/documentation/audits/night-2026-10-04/tester1/t3-firstboot-poweron.txt b/documentation/audits/night-2026-10-04/tester1/t3-firstboot-poweron.txt
new file mode 100644
index 00000000..d27300b4
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t3-firstboot-poweron.txt
@@ -0,0 +1 @@
+19:37:42
diff --git a/documentation/audits/night-2026-10-04/tester1/t4-bind-result.txt b/documentation/audits/night-2026-10-04/tester1/t4-bind-result.txt
new file mode 100644
index 00000000..a74137a3
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t4-bind-result.txt
@@ -0,0 +1 @@
+ Felhom — Doboz összekötése Felhom doboz összekötése Sikeres összekötés. A doboz kb. egy percen belül folytatja a telepítést. Ezt az oldalt bezárhatod — a beállítás a háttérben befejeződik, és a vezérlőpultod hamarosan elérhető lesz. Felhom.eu 
diff --git a/documentation/audits/night-2026-10-04/tester1/t5-claim.txt b/documentation/audits/night-2026-10-04/tester1/t5-claim.txt
new file mode 100644
index 00000000..e35f7c7b
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t5-claim.txt
@@ -0,0 +1,4 @@
+19:42:15
+HTTP/2 302 
+location: /
+launcher 200
diff --git a/documentation/audits/night-2026-10-04/tester1/t6-drive.txt b/documentation/audits/night-2026-10-04/tester1/t6-drive.txt
new file mode 100644
index 00000000..f3872c55
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t6-drive.txt
@@ -0,0 +1,3 @@
+19:44:08
+{"data":{"phase":"formatting","started":true},"ok":true}
+{"data":{"device":"/dev/sdb","durable_id":"","error":"","opsign":"","phase":"done","reason":"","started_at":"2026-10-04T19:44:08.674482321Z","updated_at":"2026-10-04T19:44:10.414201508Z","where":"/mnt/felhom-drives/adatlemez"},"ok":true}
diff --git a/documentation/audits/night-2026-10-04/tester1/t7-deploy.txt b/documentation/audits/night-2026-10-04/tester1/t7-deploy.txt
new file mode 100644
index 00000000..915a4c1a
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t7-deploy.txt
@@ -0,0 +1,18 @@
+19:44:38
+privatebin fields sent: ['DOMAIN', 'SUBDOMAIN'] {"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
+
+HTTP 202
+bookstack fields sent: ['ADMIN_PASSWORD', 'APP_KEY', 'DB_PASSWORD', 'DOMAIN', 'SUBDOMAIN'] {"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
+
+HTTP 202
+paperless-ngx fields sent: ['DB_PASSWORD', 'DOMAIN', 'HDD_PATH', 'PAPERLESS_ADMIN_PASSWORD', 'PAPERLESS_ADMIN_USER', 'PAPERLESS_OCR_LANGUAGE', 'PAPERLESS_SECRET_KEY', 'SUBDOMAIN'] {"ok":false,"error":"path \"/mnt/felhom-drives/adatlemez/appdata/paperless-ngx\" does not exist for field \"Adattárolási útvonal\""}
+
+HTTP 400
+paperless-ngx fields sent: ['DB_PASSWORD', 'DOMAIN', 'HDD_PATH', 'PAPERLESS_ADMIN_PASSWORD', 'PAPERLESS_ADMIN_USER', 'PAPERLESS_OCR_LANGUAGE', 'PAPERLESS_SECRET_KEY', 'SUBDOMAIN'] {"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
+
+HTTP 202
+19:55:59
+bookstack fields sent: ['ADMIN_PASSWORD', 'APP_KEY', 'DB_PASSWORD', 'DOMAIN', 'SUBDOMAIN'] {"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
+
+HTTP 202
+bookstack running True
diff --git a/documentation/audits/night-2026-10-04/tester1/t8-bookstack-failed-image-retention.txt b/documentation/audits/night-2026-10-04/tester1/t8-bookstack-failed-image-retention.txt
new file mode 100644
index 00000000..7252a1b9
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t8-bookstack-failed-image-retention.txt
@@ -0,0 +1,20 @@
+2026/10/04 19:44:39 [INFO] [api] Deploy requested for stack: bookstack
+2026/10/04 19:44:39 [INFO] [stacks] bookstack: install HOLD before the first start — only the household reaches [wiki.enkicsifelhom.hu] until the known first login is replaced
+2026/10/04 19:44:39 [DEBUG] [stacks] SaveAppConfig: saving /opt/docker/stacks/bookstack — 5 env vars, 3 encrypted, 3 sensitive fields
+2026/10/04 19:44:39 [INFO] [stacks] Deploying stack bookstack with 5 env vars: [DOMAIN, SUBDOMAIN, APP_KEY, DB_PASSWORD, ADMIN_PASSWORD]
+2026/10/04 19:44:39 [INFO] [stacks] SaveAppConfig: saved config for bookstack
+2026/10/04 19:44:44 [INFO] [stacks] Stack privatebin deployed successfully (took 5.3s)
+2026/10/04 19:45:04 [INFO] [stacks] image retention (one-time clean-up): deleted [mariadb:<none>] (dfff46ef3f9d, 334MB) — no container, installed app or undo names it (decision 53)
+2026/10/04 19:45:04 [INFO] [stacks] image retention (one-time clean-up): pass over 8 image(s) of [actualbudget/actual-server calcom/cal.com codewithcj/sparkyfitness codewithcj/sparkyfitness_server crocodilestick/calibre-web-automated deluan/navidrome docmost/docmost emby/embyserver f0rc3/gokapi fallenbagel/jellyseerr flomp/wanderer-db flomp/wanderer-web freikin/dawarich getmeili/meilisearch ghcr.io/advplyr/audiobookshelf ghcr.io/alam00000/bentopdf ghcr.io/alexta69/metube ghcr.io/claperco/claper ghcr.io/cmintey/wishlist ghcr.io/diced/zipline ghcr.io/gethomepage/homepage ghcr.io/gramps-project/grampsweb ghcr.io/grimmory-tools/grimmory ghcr.io/home-assistant/home-assistant ghcr.io/immich-app/immich-machine-learning ghcr.io/immich-app/immich-server ghcr.io/immich-app/postgres ghcr.io/karakeep-app/karakeep ghcr.io/karakeep-app/karakeep-chrome ghcr.io/kozea/radicale ghcr.io/lukegus/termix ghcr.io/mealie-recipes/mealie ghcr.io/paperless-ngx/paperless-ngx ghcr.io/papra-hq/papra ghcr.io/seanmorley15/adventurelog-backend ghcr.io/seanmorley15/adventurelog-frontend ghcr.io/sysadminsmedia/homebox ghcr.io/tandoorrecipes/recipes ghcr.io/thomiceli/opengist ghost gitea.dooplex.hu/admin/recipe-importer gitea/gitea glanceapp/glance gotson/komga grafana/grafana jellyfin/jellyfin kimai/kimai2 louislam/uptime-kuma lscr.io/linuxserver/bookstack lscr.io/linuxserver/code-server lscr.io/linuxserver/radarr lscr.io/linuxserver/sonarr lukevella/rallly mariadb msdeluise/plant-it n8nio/n8n nextcloud onlyoffice/documentserver outlinewiki/outline plexinc/pms-docker postgis/postgis postgres privatebin/pdo redis registry.gitlab.com/crafty-controller/crafty-4 rommapp/romm vaultwarden/server vikunja/vikunja wger/server] — 1 candidate(s), 1 deleted, the rest kept
+2026/10/04 19:45:04 [INFO] [stacks] image retention (one-time): deleted 1 image(s). docker disk before: Images 1.364GB 436.4MB (31%) | after: Images 1.031GB 102.6MB (9%)
+2026/10/04 19:45:05 [INFO] [stacks] controller image retention: pass over 1 controller image(s) — running 0.293.0, previous "" (), 0 candidate(s), 0 deleted, the rest kept
+2026/10/04 19:45:05 [ERROR] [stacks] Command failed: docker compose up -d (in /opt/docker/stacks/bookstack) — exit code 1 (took 25.6s)
+2026/10/04 19:45:05 [ERROR] [stacks] stderr: Image lscr.io/linuxserver/bookstack:26.09.1@sha256:99cd1f5707c1911afad213adec5c9739763b76f843d1477142231834ecdcb6f7 Pulling 
+2026/10/04 19:45:05 [ERROR] [stacks] Stack bookstack deploy failed after 25.6s: exit code 1
+stderr: Image lscr.io/linuxserver/bookstack:26.09.1@sha256:99cd1f5707c1911afad213adec5c9739763b76f843d1477142231834ecdcb6f7 Pulling 
+2026/10/04 19:45:05 [INFO] [stacks] Stack bookstack: the failed deploy's containers were removed (volumes kept) — R-649
+2026/10/04 19:45:05 [DEBUG] [stacks] SaveAppConfig: saving /opt/docker/stacks/bookstack — 5 env vars, 3 encrypted, 3 sensitive fields
+2026/10/04 19:45:05 [INFO] [stacks] SaveAppConfig: saved config for bookstack
+stderr: Image lscr.io/linuxserver/bookstack:26.09.1@sha256:99cd1f5707c1911afad213adec5c9739763b76f843d1477142231834ecdcb6f7 Pulling 
+2026/10/04 19:45:24 [INFO] [stacks] bookstack: removed an install-hold file for an app that is not held
+2026/10/04 19:45:36 [INFO] [stacks] Stack paperless-ngx deployed successfully (took 47.3s)
diff --git a/documentation/audits/night-2026-10-04/tester1/t9-data-bookstack.txt b/documentation/audits/night-2026-10-04/tester1/t9-data-bookstack.txt
new file mode 100644
index 00000000..4100a8ce
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t9-data-bookstack.txt
@@ -0,0 +1,2 @@
+book: https://wiki.enkicsifelhom.hu/books/csaladi-receptek
+page: location: https://wiki.enkicsifelhom.hu/books/csaladi-receptek/page/turos-csusza
diff --git a/documentation/audits/night-2026-10-04/tester1/t9-data-paperless.txt b/documentation/audits/night-2026-10-04/tester1/t9-data-paperless.txt
new file mode 100644
index 00000000..4c34abe7
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t9-data-paperless.txt
@@ -0,0 +1,2 @@
+upload: "5cb7a425-a645-4822-bbec-d31f3aaea6f9"
+HTTP 200
diff --git a/documentation/audits/night-2026-10-04/tester1/t9-data-privatebin.txt b/documentation/audits/night-2026-10-04/tester1/t9-data-privatebin.txt
new file mode 100644
index 00000000..68c4379a
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/tester1/t9-data-privatebin.txt
@@ -0,0 +1 @@
+status 0 id 3f5172ad798b9377 url /?3f5172ad798b9377
diff --git a/documentation/audits/night-2026-10-04/undo/u0-before.txt b/documentation/audits/night-2026-10-04/undo/u0-before.txt
new file mode 100644
index 00000000..25614bab
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/undo/u0-before.txt
@@ -0,0 +1,15 @@
+2026-10-04T20:10:41Z
+cores: 3
+hookscript: local:snippets/felhom-guest-hook.sh
+memory: 12288
+mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=250G
+mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
+mp9: /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1
+onboot: 1
+rootfs: local-lvm:vm-9201-disk-0,size=32G
+felhom-backup:backup/vzdump-lxc-9201-2026_10_02-07_45_20.tar.zst tar.zst backup    734719733 9201
+felhom-backup:backup/vzdump-lxc-9201-2026_10_03-07_48_06.tar.zst tar.zst backup    736103026 9201
+felhom-backup:backup/vzdump-lxc-9201-2026_10_04-07_49_00.tar.zst tar.zst backup    735936533 9201
+libpcre2-8-0:amd64	10.46-1~deb13u3
+libssh2-1t64:amd64	1.11.1-1+deb13u2
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u3
diff --git a/documentation/audits/night-2026-10-04/undo/u1-rolled-back.txt b/documentation/audits/night-2026-10-04/undo/u1-rolled-back.txt
new file mode 100644
index 00000000..f568268b
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/undo/u1-rolled-back.txt
@@ -0,0 +1,11 @@
+local                 dir     active        98497780        28882564        64565668   29.32%
+0 upgraded, 0 newly installed, 3 downgraded, 0 to remove and 0 not upgraded.
+Unpacking libpcre2-8-0:amd64 (10.46-1~deb13u2) over (10.46-1~deb13u3) ...
+Setting up libpcre2-8-0:amd64 (10.46-1~deb13u2) ...
+Unpacking libssh2-1t64:amd64 (1.11.1-1+deb13u1) over (1.11.1-1+deb13u2) ...
+Unpacking libxml2:amd64 (2.12.7+dfsg+really2.9.14-2.1+deb13u1) over (2.12.7+dfsg+really2.9.14-2.1+deb13u3) ...
+Setting up libssh2-1t64:amd64 (1.11.1-1+deb13u1) ...
+Setting up libxml2:amd64 (2.12.7+dfsg+really2.9.14-2.1+deb13u1) ...
+libpcre2-8-0:amd64	10.46-1~deb13u2
+libssh2-1t64:amd64	1.11.1-1+deb13u1
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u1
diff --git a/documentation/audits/night-2026-10-04/undo/u2-backup-before.txt b/documentation/audits/night-2026-10-04/undo/u2-backup-before.txt
new file mode 100644
index 00000000..6f7be1f5
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/undo/u2-backup-before.txt
@@ -0,0 +1,11 @@
+20:11:04
+INFO: Starting Backup of VM 9201 (lxc)
+INFO: including mount point rootfs ('/') in backup
+INFO: including mount point mp0 ('/var/lib/felhom') in backup
+INFO: excluding bind mount point mp8 ('/mnt/felhom-drives') from backup (not a volume)
+INFO: excluding bind mount point mp9 ('/etc/felhom-bootstrap') from backup (not a volume)
+INFO: creating vzdump archive '/var/lib/vz/dump/vzdump-lxc-9201-2026_10_04-22_11_05.tar.zst'
+INFO: archive file size: 899MB
+INFO: Finished Backup of VM 9201 (00:00:31)
+20:11:36
+/var/lib/vz/dump/vzdump-lxc-9201-2026_10_04-22_11_05.log
diff --git a/documentation/audits/night-2026-10-04/undo/u3-debug-pass-forward.txt b/documentation/audits/night-2026-10-04/undo/u3-debug-pass-forward.txt
new file mode 100644
index 00000000..b3dea059
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/undo/u3-debug-pass-forward.txt
@@ -0,0 +1,27 @@
+20:11:43
+=== felhom-agent 0.143.0 selftest=os-update vmid=9201 ring=0 enabled=true guest-release=false host-release=false appliance=true ===
+    "health_reason": "",
+    "healthy": true,
+    "outcome": "applied",
+    "refused": null,
+    "upgraded": [
+        "name": "libpcre2-8-0",
+        "version": "10.46-1~deb13u3",
+        "name": "libssh2-1t64",
+        "version": "1.11.1-1+deb13u2",
+        "name": "libxml2",
+        "version": "2.12.7+dfsg+really2.9.14-2.1+deb13u3",
+    "health_reason": "",
+    "healthy": true,
+    "outcome": "nothing",
+    "refused": null,
+    "upgraded": [],
+    "health_reason": "",
+    "healthy": true,
+    "outcome": "nothing",
+    "refused": null,
+    "upgraded": [],
+20:12:39
+libpcre2-8-0:amd64	10.46-1~deb13u3
+libssh2-1t64:amd64	1.11.1-1+deb13u2
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u3
diff --git a/documentation/audits/night-2026-10-04/undo/u4-restore.txt b/documentation/audits/night-2026-10-04/undo/u4-restore.txt
new file mode 100644
index 00000000..c49dbf65
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/undo/u4-restore.txt
@@ -0,0 +1,25 @@
+cloudflared Up 9 hours (healthy)
+felhom-controller Up 2 hours (healthy)
+filebrowser Up 11 hours (healthy)
+opengist Up 14 hours (healthy)
+traefik Up 4 hours
+DOWN-FROM 20:12:54
+stopped 20:13:07
+  Logical volume "vm-9201-disk-2" created.
+  Logical volume pve/vm-9201-disk-2 changed.
+  WARNING: You have not turned on protection against thin pools running out of space.
+  WARNING: Set activation/thin_pool_autoextend_threshold below 100 to trigger automatic extension of thin pools before they get full.
+  Logical volume "vm-9201-disk-3" created.
+  WARNING: Sum of all thin volume sizes (564.00 GiB) exceeds the size of thin pool pve/data and the size of whole volume group (<475.94 GiB).
+  Logical volume pve/vm-9201-disk-3 changed.
+  Logical volume "vm-9201-disk-0" successfully removed.
+  Logical volume "vm-9201-disk-1" successfully removed.
+extracting archive '/var/lib/vz/dump/vzdump-lxc-9201-2026_10_04-22_11_05.tar.zst'
+restored 20:13:23
+hookscript: local:snippets/felhom-guest-hook.sh
+mp0: local-lvm:vm-9201-disk-3,mp=/var/lib/felhom,backup=1,size=250G
+mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
+mp9: /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1
+onboot: 1
+rootfs: local-lvm:vm-9201-disk-2,size=32G
+started 20:13:27
diff --git a/documentation/audits/night-2026-10-04/undo/u5-healthy-and-versions.txt b/documentation/audits/night-2026-10-04/undo/u5-healthy-and-versions.txt
new file mode 100644
index 00000000..3ea3ee99
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/undo/u5-healthy-and-versions.txt
@@ -0,0 +1,9 @@
+ALL-HEALTHY 20:13:42
+cloudflared Up 11 seconds (healthy)
+felhom-controller Up 10 seconds (healthy)
+filebrowser Up 11 seconds (healthy)
+opengist Up 11 seconds (healthy)
+traefik Up 11 seconds
+libpcre2-8-0:amd64	10.46-1~deb13u2
+libssh2-1t64:amd64	1.11.1-1+deb13u1
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u1
diff --git a/documentation/audits/night-2026-10-04/undo/u6-forward-again.txt b/documentation/audits/night-2026-10-04/undo/u6-forward-again.txt
new file mode 100644
index 00000000..4847d583
--- /dev/null
+++ b/documentation/audits/night-2026-10-04/undo/u6-forward-again.txt
@@ -0,0 +1,11 @@
+20:13:55
+    "healthy": true,
+    "outcome": "applied",
+    "healthy": true,
+    "outcome": "nothing",
+    "healthy": true,
+    "outcome": "nothing",
+libpcre2-8-0:amd64	10.46-1~deb13u3
+libssh2-1t64:amd64	1.11.1-1+deb13u2
+libxml2:amd64	2.12.7+dfsg+really2.9.14-2.1+deb13u3
+Oct 04 22:13:10 demo-felhom felhom-agent[3166444]: time=2026-10-04T22:13:10.553+02:00 level=INFO msg="guest-power: guest is stopped but LOCKED — leaving it to the stale-lock path" vmid=9201 lock=create
diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md
index bbd7189b..c80c42af 100644
--- a/documentation/backlog/OPEN-ITEMS.md
+++ b/documentation/backlog/OPEN-ITEMS.md
@@ -130,6 +130,7 @@ stopping line that lies.
 
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
+| **R-863** | Apps & catalog | P2 | **A brand-new box's first app install can fail because the controller's one-time image clean-up deletes the image the install is downloading.** MEASURED 2026-10-04 night drill on the fresh Tester 1 box (controller v0.293.0): BookStack deploy requested 19:44:39 UTC; `RunImageRetentionOnce` (3 min after the controller's first start, `cmd/controller/main.go` ~1730) deleted `mariadb:<none>` (dfff46ef3f9d, 334 MB, "no container, installed app or undo names it") at 19:45:04; `docker compose up -d` failed at 19:45:05 (exit 1); the household got „Alkalmazás telepítése nem sikerült: BookStack". A second press at 19:55:59 ran in 50 s. The window is exactly when a new household installs its first apps. Fix direction: the clean-up skips every image an install, update or restore in flight names (or waits for them), and a pull-by-digest image is not "unnamed". `audits/night-2026-10-04/tester1/t8-bookstack-failed-image-retention.txt` | **READY — owner: CC** | — | a fix + a test that runs the clean-up during a deploy | CC |
 | **R-489** | Apps & catalog | P3 | **[P3-LOW] `POST /api/stacks/{name}/remove` reports `volumes_removed: null` over named volumes it DID remove.** MEASURED 2026-09-13 on demo-hp five times (gokapi, actualbudget, adventurelog ×2, glance): `docker compose down --volumes` removed the app's named volumes (`docker volume ls` count 2 → 0) and the response carried `"volumes_removed":null`. The customer's confirmation dialog therefore cannot say what it deleted. Split out of R-474 (closed in v0.240.0 for the backups half). **Fix shape:** list the volumes before `down --volumes`, diff after, and report the difference (`[]` when none, never `null`).  **PARTLY SHIPPED in v0.242.0 (`d698ce3`), measured live on 9202 the same night:** the difference is computed and a fresh compose-created volume IS reported (`["opengist_opengist_data"]`), but the listing filters on the compose project LABEL and a volume recreated by a unit restore (`docker volume create <name>`, `restore.go:154`) carries no labels — compose still removes it and the response says `[]` (`audits/v0242-2026-09-14/19-R489-cause.txt`). **Remaining fix:** list by the `<project>_` name prefix as well (union), or label the recreated volume as compose would. | **READY — rank P3-LOW; owner: CC (residual)** | — | — | CC |
 | **R-498** | Apps & catalog | P3 | **[P3-LOW] The „Első lépések" on 52 of 53 app pages tell a customer to open a literal `wiki.DOMAIN` — the placeholder is never filled in.** MEASURED 2026-09-14 on a fresh 0.242.0 box (drill step 5): BookStack's app page renders „Nyisd meg a **wiki.DOMAIN** címet a böngészőben", PrivateBin's „Nyisd meg a **paste.DOMAIN** címet". `grep -rl '\.DOMAIN c[íi]m' app-catalog-felhom.eu/templates/*/.felhom.yml` → **52 of 53** templates carry it in `first_steps`; the controller renders the string as text (`internal/stacks/metadata.go`). A stranger reading their first instruction meets a word that is not an address. **Fix shape:** substitute the stack's real `SUBDOMAIN.DOMAIN` at render time (one place in the controller), with a render test per template that fails on a literal `DOMAIN`. | **READY — rank P3-LOW; owner: CC** | — | — | CC |
 | **R-562** | Apps & catalog | P3 | **[P3-LOW] Dates and sizes are not formatted for any locale — and the Hungarian pages disagree with themselves.** FOUND 2026-09-17 by the i18n inventory §2.8: the two template date layouts differ (`2006. 01. 02. 15:04` Hungarian vs `2006-01-02 15:04` ISO); 10 layout literals in `internal/web` Go and 25 elsewhere pick formats ad hoc; sizes print a decimal POINT (`%.1f GB`, 4 helpers) where Hungarian uses a comma; `timeAgo`/`nextRunLabel`/`pruneLabel` produce Hungarian words outside the three converted pages. Not changed by v0.247.0 (Hungarian bytes are frozen by the parity rule). **Fix shape:** one date and one size formatter per language in `internal/i18n`, the Hungarian output deliberately changed in ONE reviewed release with the parity fixtures re-captured for that release only and the change named in its CHANGELOG. Needs an operator word on the Hungarian format (comma, date style). | **READY - rank P3-LOW; owner: CC** | — | — | CC |
@@ -145,6 +146,7 @@ stopping line that lies.
 | **R-758** | Apps & catalog | P3 | **[P3-LOW] Eight templates declare a `mem_limit` that is not the sum of their compose limits, and no gate checks it.** FOUND 2026-10-01 by `scripts/onboarding_gaps.py` (the new-app checklist's gap page, row 5.3): adventurelog 384M vs 896M, bookstack 512M vs 768M, calcom 768M vs 1792M, claper 384M vs 640M, kimai 384M vs 640M, nextcloud 1024M vs 1664M, outline 768M vs 1152M, zipline 512M vs 768M — every one UNDER the sum, so the deploy screen and the box's capacity figure (`09` decision 22) read less memory than the app may take. REUSE.md §2 says `mem_limit` = the sum. The compose limits are what Docker enforces, so no app is starved by this; the figure the household and the capacity check read is wrong. **Needs:** the eight figures corrected (a template change: needs its own session, no image move), and a static gate (`--fast`) with a decoy, so a new app cannot repeat it. `app-catalog-felhom.eu/onboarding/EXISTING-APPS-GAPS.md` | **READY — rank P3-LOW; owner: CC (catalog)** | — | — | CC |
 | **R-762** | Apps & catalog | P3 | **[P2-MEDIUM] wger serves no CSS or JavaScript and no uploaded photo: every static file and every `/media/` file answers 404.** MEASURED 2026-10-01 on 9202 (drill catalog, the live template `82fff32`, wger 2.7), found by checklist rows 1.7 and 2.8: the login page links `/static/css/workout-manager.css`, `/static/bootstrap-compiled.css` — both 404 through traefik; the static root inside the container is empty (4 KB). A progress photo posted to `/api/v2/gallery/` answered 201 and the file is on the media volume, but `GET /media/gallery/…png` answers 404 signed in, without a session, and straight at the app inside the container. **Cause, read in the image:** the entrypoint runs `collectstatic` only when `DJANGO_DEBUG == "False"` and the template sets no `DJANGO_DEBUG`; and wger serves `/media/` only in development (`urls.py:393` „served like this during development only”) — upstream's production setup puts nginx in front for `/static` and `/media`. So the household gets an unstyled app and photos that never show. The same lines stand since the template was written (the 2026-09-29 template too). Not checked: whether any box runs wger (on 2026-09-30 none reported to the hub). **Needs:** `DJANGO_DEBUG=False` (collectstatic) and something that serves `/static` + `/media` (upstream's nginx sidecar, or the gunicorn switch of R-755 plus a static server), proven on the bench and on 9202 with a page that loads its CSS and a photo read back. Owner decides together with R-755 (same server question). `audits/new-app-checklist-2026-10-01/C/C8-signup-guest-media-static.txt`, `C/C4-seed-photo-size.txt` **-- 2026-10-01 (operator):** wger is `lifecycle: hidden` until this and its twin are fixed (catalog `55b8c8a`; read back on 9202: not on the app list, mealie control present). | **READY — rank P2-MEDIUM; owner: CC (catalog)** **Re-ranked 2026-10-03: P2→P3: wger is hidden from installs and no box runs it; needed only before it is offered again.** | — | — | CC |
 | **R-774** | Apps & catalog | P3 | **[P3-LOW] Two things the new apps' pages do not show yet: Karakeep's mail-ON path is unproven, and its official phone app reports crashes to its makers.** READ/MEASURED 2026-10-01: Karakeep's `smtp_mapping` (plaintext :2526, as Cal.com) was proven only with mail OFF (a fresh install boots) — 9202 has no hub, so the relay cannot be exercised there; the official mobile app ships Sentry crash reporting with a hard-coded DSN (`apps/mobile/app/_layout.tsx`, FIT.md). **Needs:** one password-reset mail from Karakeep on a hub-enabled box (demo-hp 9201, a throwaway install); and a sentence on the page about the phone app (copy, freeze). `audits/new-apps-2026-10-01/bench/karakeep-mail-off-boot.txt` | **READY — rank P3-LOW; owner: CC (catalog)** | — | — | CC |
+| **R-864** | Apps & catalog | P4 | **A failed `docker compose up` logs the FIRST lines of stderr (pull progress) and cuts the actual error.** 2026-10-04 night drill: BookStack's failure logged `stderr: Image … Pulling` + layer lines, then `5...` — the reason itself was lost; it had to be reconstructed from the image clean-up's log (R-863). Fix direction: keep the TAIL of stderr (the error is last). | **READY — owner: CC** | — | — | CC |
 | **R-76** | Apps & catalog | P4 | **FileBrowser-created folders break the setgid chain, and a drop-zone's mode is not stable** **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-26, size S, roadmap state `idea (surfaced by the R-75 spike, 2026-07-26)`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** | — | Two related findings from `audits/SPIKE-catalog-data-paths-2026-07-26.md` P3/P5, both **pre-existing** and deliberately left alone by that spike. **(a)** FileBrowser Quantum 1.3.3 creates files `0644` and folders `0755` and does **not** propagate the setgid bit — even though the entrypoint wrapper's `umask 002` really is in effect (`/proc/1/status` `Umask: 0002`). Group inheritance itself works (a file uploaded into a 2775 group-100 dir landed group 100, not the process gid 1000), so the convention's *group* half holds and only its *mode* half is lost. The consequence is proven with a control: inside a UI-created `0755` folder a gid-1000 process's file landed group **1000**, while the identical write into the 2775 parent landed group **100**. So **any folder a customer creates through FileBrowser breaks the shared-group chain one level down.** Latent today — every userdata-touching catalog app that declares an identity declares uid/gid **1000**, the same uid FileBrowser runs as, so owner permissions mask it; it bites the day a content app runs as a different non-root uid with gid 1000. The comment at `infra/infra.go:156` is right that the image ignores `-e UMASK` but does not say t | CC |
 | **R-284** | Apps & catalog | P4 | **„A kiválasztott tárhely majdnem megtelt." on a store that is 93 % FREE — an apparent inverted threshold.** Calibre-Web's deploy page rendered `<option value="/mnt/sys_drive" data-free-percent="93">` alongside „Tárhely (sys_drive) — **64.2 GB szabad**" and the warning „A kiválasztott tárhely majdnem megtelt." 93 % free read as 93 % used is the obvious candidate, and `checkStorageSpace(this)` is the function to look at. **Not confirmed by reading the code** — reported as measured output only. A capacity warning that cries wolf on an empty disk is one a customer learns to click past | **VERIFY** (2026-10-03 triage: Probably not a defect: the warning is hidden by default and shown only when free space is below 20%; the measurement likely read raw HTML without running scripts — felhom-controller/controller/internal/web/templates/deploy.html:622,808) — **READY (XS) — NEW 2026-08-09** | — | Check `checkStorageSpace`'s comparison against `data-free-percent`; add a render test per branch | CC |
 | **R-527** | Apps & catalog | P4 | **[P3-LOW] The catalog flag `locked_after_deploy` is read by no controller code — every setting is read-only after install whatever the catalog says.** FOUND 2026-09-15: `stacks/metadata.go` parses it; `grep -rn LockedAfterDeploy` finds no reader; `deploy.html` renders „Az alábbi beállítások csak olvashatók" for every field. Recorded as the design in `02-controller-module-map.md`; the flag is a seam never wired. **Fix shape:** remove the flag from the catalog, or wire an editable-after-install allow-list (a bigger change). | **VERIFY** (2026-10-03 triage: the row says nothing reads the flag, but deploy.go reads LockedAfterDeploy into LockedFields; the row may be stale or describe only the page — felhom-controller/controller/internal/stacks/deploy.go:400,1348-1371) — **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3->P4: every field is already read-only; no harm.** | — | — | CC |
@@ -310,6 +312,7 @@ stopping line that lies.
 | **R-530** | Box system & updates | P2 | **[P2-MEDIUM] A floor does not deliver an agent: agents update only by an operator-signed `agent_update` job per box, and nothing records which boxes still run 0.130.0.** MEASURED 2026-09-15: the hub HOLDS a floor whose declared MinAgent is above the box's agent (`api/handler.go` ResolveManagedFloor); the agent's only update path is `signedjobs` + `selfupdate.Executor`. demo-hp reached 0.131.0 by `felhom-opsign -op agent_update` (key `felhom-op-1`) at 08:44:16Z and its controller floor was then SERVED in 3 s. **demo-felhom (N100) and Peti's box still run 0.130.0** — not touched (Peti fenced; N100 not asked). **What it needs:** the operator signs per box, or rules a fleet rollout step. **NARROWED 2026-09-16 (operator ruling 1):** the keys stay on DooPlex owner-only and CC may sign `agent_update` until the first PAYING customer (testers excluded) — recorded in `CONTEXT.md` + `04-control-plane-authorization.md` §3.1. Both demo boxes now run agent 0.131.0 (demo-hp 2026-09-15, demo-felhom 2026-09-16, each by a per-box signed job; Peti's box untouched, still 0.130.0). **What remains:** a fleet rollout step — signing per box does not scale past a handful, and nothing lists which boxes are behind. **2026-09-25:** Peti's box was RETIRED (operator ruling) — it no longer counts as a box behind. | **WAITING-ON-OPERATOR — rank P2-MEDIUM; owner: operator (signing)** | — | — | operator |
 | **R-604** | Box system & updates | P2 | **[P2-MEDIUM] A per-customer controller floor silently excludes that box from every global floor raise, and NOTHING says so — demo-hp missed four of them.** FOUND 2026-09-21 while raising the global floor to 0.259.0 at the operator's request. The raise logged `Global controller-version floor set to "0.259.0"` and then `managed floor SERVED for demo-felhom` — **and nothing at all for demo-hp**, which went on reporting every few minutes and stayed on 0.258.0. Cause: `customer_configs.min_controller_version` for demo-hp held **`0.243.0`**, a per-customer override that wins over the global. It is a **leftover from the 2026-09-16 drill**, whose golden was 0.243.0; **R-343 measured on 2026-08-18 that all five rows were EMPTY and recorded that as a safety property** — it stopped being true and nothing surfaced the change. demo-hp had therefore silently missed the raises to 0.253.0, 0.254.0, 0.257.0 and 0.259.0. **Why it is invisible rather than merely quiet:** `managed floor SERVED` fires **once per CHANGE** (`h.floorNotes`, `api/handler.go:600`), deliberately, because a box reports every few minutes — so a box whose override never changes is silent for ever, and its silence is indistinguishable from the silence of a box that already had the line. A session that raises the floor reads one SERVED line and reasonably concludes the fleet took it. **CLEARED** for demo-hp the same session (rollback line: POST `/customers/demo-hp/floor` with `min_controller_version=0.243.0`, `min_agent=0.131.0`); it then self-updated 0.258.0 → 0.259.0 in **under four minutes**, healthy, `settle-gate: GO — at/above floor 0.259.0`, and its claim page answers **"Wrong or expired code"** in English — the floor delivered the FIX, not a version string, to a box nobody hand-deployed. All five overrides are now empty. **Fix shape (smallest first):** the floor-raise page shows which customers carry an override and would NOT be moved, before the save; or the raise logs one line per customer naming the ones it skipped and why. A raise that quietly reaches half the fleet is worse than one that refuses. | **READY — rank P2-MEDIUM; owner: CC (hub)** | — | — | CC |
 | **R-812** | Box system & updates | P2 | **[P2] A box never receives operating-system security updates — not the Proxmox host, not the guest's Debian, not its Docker engine.** SEARCHED 2026-10-03 (read-only): `felhom-controller`, `felhom-agent`, `app-catalog-felhom.eu` and `felhom.eu` hold no `apt-get upgrade`, `apt full-upgrade`, `unattended-upgrades`, `pveupgrade` or `needrestart` that runs on a box. The installer aligns the host's Proxmox repositories to no-subscription *"so the box can pull security updates"* and then says plainly *"No upgrades are run"* (`scripts/felhom-host-install.sh:2133-2136`). The guest's Docker engine is installed when the golden is BAKED (`felhom-agent/configs/build-golden.sh:124-125`), so a fresh install gets that week's engine and an installed box keeps it forever. The only `apt full-upgrade` in the project is a by-hand step for the off-site endpoint ep0 (`documentation/runbooks/offsite-endpoint.md:41`), not a box. App images ARE updated (the update arc); the layer under them is not. The intention, with its scope, is **R-808** in `ROADMAP.md`. | **NARROWED 2026-10-04 (evening) — the guest's DOCKER engine slow lane is BUILT and proven live (agent v0.142.0, hub v0.132.0; `11` §5.8): live-restore on everywhere, ring 0 steps under a root-owned mark, ring 1 and undo only by a signed job the wrapper re-verifies; the operator approves each engine set on the System page. LEFT: the kernel lane (R-836); existing boxes (R-840).** Earlier: NARROWED 2026-10-04 (afternoon) — the HOST's Debian fast lane is BUILT and proven live too (agent v0.141.1, hub v0.131.1; `11` §8.2, `audits/os-host-lane-2026-10-04/`): appliances only, never kernel/boot/firmware, after a healthy guest step; fleet view and four alarms (§8.3). LEFT: the Docker and kernel slow lanes (R-836); existing boxes (R-840).** Earlier: NARROWED AGAIN 2026-10-04 (day) — the GUEST's Debian fast lane is BUILT and proven live (agent v0.140.0, hub v0.130.0, installer 1.29.0; `11` §8.1, `audits/os-guest-lane-2026-10-04/`). LEFT: the host, Docker and kernel lanes; the undo (R-842); existing boxes (R-840).** Earlier: NARROWED 2026-10-04 — the SPIKE is done (`11` §7.1, corrections C1–C12, `audits/os-updates-spike-2026-10-04/`); no product code yet. LEFT: the build steps of `11` §8, each with the operator's go; the §5.3 snapshot question is in STATUS; preconditions R-835, R-836, R-837.** | — | — | CC + operator |
+| **R-865** | Box system & updates | P3 | **The OS wrapper's free-space rule (R8) always measures the download as 0 bytes, so only its 500 MB floor ever applies.** MEASURED 2026-10-04 night drill (A4, Tester 1 box): with the guest's `/` at 400 MB free the wrapper refused correctly — `R8 free space 419430400 B is below max(500 MB, 3 x download 0 B)` — but the download was `0 B`. `download_bytes` runs `apt-get -s … --print-uris`; with `-s` apt prints no URI list (measured: 0 URIs with `-s`, 3 URIs / 1 471 812 B without). So a large update (a Docker set, a Proxmox minor) is checked only against 500 MB, not 3× its size as `11` §5.4.1 R8 says. Fix direction: drop `-s` from the `--print-uris` call (it downloads nothing by itself) and pin it with a test on real apt output. `audits/night-2026-10-04/accidents/a4-*.txt` | **READY — owner: CC** | — | fix + a test | CC |
 | **R-862** | Box system & updates | P3 | **Tester 2 cannot take the config bundle until one by-hand bootstrap is done: its `felhom-os-apply` (agent 0.142.0) predates the bundle mode, and no signed job can write a root file on it.** FOUND 2026-10-04 (R-840 build, Part C): the route reaches every box installed from installer 1.31.0 on, and the demo boxes (bootstrapped by CC); Tester 2 has every root file of agent 0.142.0 (installer 1.30.0) and lacks only the R-858 wrapper fix, which matters only for a Docker step it gets solely from a signed job. CC has no route to Tester 2 (its door admits only the operator's WireGuard peer; `felhom-op` cannot become root). The steps: `runbooks/config-bundle.md` "Tester 2". Then CC signs the bundle and reads it back. | **WAITING-ON-OPERATOR** — the operator said (2026-10-04 ~19:05) he will try through his tunnel | the operator's WireGuard tunnel | the operator runs the three bootstrap commands; CC sends the bundle | operator |
 | **R-35** | Box system & updates | P3 | **Config-apply should not end the customer's session.** The offsite config push bumped `config_version` 10→11 at 16:54:58 and the controller self-restarted (container `StartedAt` 16:54:59Z, back up 16:55:02); in-memory sessions died with it and **customer zero was force-logged-out mid-flow**. **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-21, size S, roadmap state `idea`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** | — | Direction: **hot-apply the offbox target** (no restart for a config the running process can adopt), or **persist sessions** across restart. The restart itself is by design — the collateral is not. Evidence `controller-log-full.txt` | CC |
 | **R-50b** | Box system & updates | P3 | **[P2] A root-owned privileged host artifact is delivered unversioned from `main` — "which wrapper is on this host?" is unanswerable.** `configs/felhom-pbs-apply` installs to `/usr/local/sbin/felhom-pbs-apply` (0755 root:root) and is the pinned sudoers vector for `create\ |reconcile\|grant` against `/etc/pve/priv/storage`. It is fetched by `felhom-host-install.sh:1914` via `fetch_raw`, which hits `raw/branch/main/<path>` — **no tag, no pin, no checksum, and no record in the Day-0 artifact manifest**, unlike the agent binary (sha256-vouched) and the golden image. Three consequences: (1) two hosts installed a week apart can carry different privileged wrapper code while both reporting the same agent version; (2) a host hotfixed in place (felhom-pve, 2026-07-18) is indistinguishable from one that fetched the same content — the fleet has no inventory of it; (3) an accidental push to `main` reaches the next install of every host with no review gate between commit and root-owned deployment. | **NARROWED** — **(a) SHIPPED 2026-07-21; (b)/(c) open** — moved from `ROADMAP.md` 2026-10-03: it states a checkable fact about the shipped product, so it is a FINDING (the sorting rule). **Re-ranked 2026-10-03: [P2] → P3 — operator-only; leg (a) shipped.** | — | **Surfaced 2026-07-21 while stopping the R-39 v0.90.1 publish** (`felhom-controller/REPORT.md` §5): the publish was cancelled precisely because the version number would have claimed to carry a fix that in fact rides this unversioned channel. Candidate shapes, in increasing cost: (a) record the wrapper's sha256 in the Day-0 artifact manifest beside the agent binary and have the agent report the installed file's hash, so drift is at least *visible*; (b) `fetch_raw` takes a pinned ref (tag or commit) supplied by the manifest rather than `main`; (c) the wrapper becomes a published generic-registry artifact with the same gate ladder as the agent binary. **(a) is the cheap honest first step and would have caught this class already.** Pairs with R-39 (whose remaining fleet half is specced separately)  **(a) SHIPPED 2026-07-21 — hub v0.68.0 + agent v0.91.2.** `ArtifactManifest.WrapperSHA256` + an operator field; agents report the installed wrapper's sha256 each cycle and the host page surfaces a mismatch. **An unknown on EITHER side reads as quiet, never as drift** — lighting every host amber on rollout day is how a warning becomes background noise. Live confirmation of exactly the problem: felhom-pve's July-18 in-place hotfix hashed `2888f2ea…`, matching **no commit anyone could name**; it now reports `104db0a4…` against a vouchable manifest value. **(b)/(c) REMAIN OPEN:** the wrapper is still fetched unversioned from `raw/branch/main` — this makes drift *visible*, it does not fix the channel. Also recorded: the 0440 sudoers file is not agent-readable, so its drift stays invisible. **Flips (2026-10-03):** `00` §A "The installer is PUBLISHED, not pushed" — the same discipline for the privileged wrappers. **Re-ranked 2026-10-03:** [P2] → P3: operator-only; (a) shipped 2026-07-21 (the report carries the wrapper sha256), (b)/(c) open. **Finding-shaped** — an R-424 instance; check against today's product before building. | CC |