diff --git a/.claude/rules/docs.md b/.claude/rules/docs.md
index a3bdb7cc..a555ec08 100644
--- a/.claude/rules/docs.md
+++ b/.claude/rules/docs.md
@@ -11,7 +11,7 @@ repo. Sibling repos point here; this is where the pointed-at thing must actually
 
 | Fact | Home |
 |---|---|
-| the locked design | `architecture/01..05-*.md` |
+| the locked design | `architecture/01..11-*.md` |
 | capability status + its evidence | `architecture/00-capability-map.md` |
 | host addresses, routes, node names, break-glass, what is provisioned | `operations/nodes.md` |
 | Tailscale topology, accept-dns/accept-routes | `operations/tailscale.md` |
diff --git a/.claude/rules/unprompted-work.md b/.claude/rules/unprompted-work.md
index d7a83c5b..49df8ff8 100644
--- a/.claude/rules/unprompted-work.md
+++ b/.claude/rules/unprompted-work.md
@@ -6,7 +6,8 @@ unconditional: true
 > Goal sessions, nightly sessions, "work the register" sessions. **A session that starts from
 > `/goal` or a standing brief inherits these rules exactly as it inherits the gates.** They are the
 > part of `PROMPT-TEMPLATE.md` that a task file used to carry and a goal does not. Same wording lives
-> in all three repos' `.claude/rules/`; change it in all three or in none.
+> in `felhom.eu`, `felhom-controller` and `app-catalog-felhom.eu` `.claude/rules/`, and in the workspace root's
+> unversioned `.claude/rules/`; change all four or none.
 
 ## 1. What you may pick up on your own
 
@@ -56,3 +57,13 @@ One screen, plain language, in this order: **decisions you took** (§2) first; w
 what broke and whether you fixed it; rows opened and closed with the register size before and after;
 what needs the operator, each with what happens if they do nothing. No file paths, no function
 names, no row numbers as the subject of a sentence.
+
+## 5. Instruction files
+
+**Instruction files (`CLAUDE.md`, `.claude/rules/*`) are kept true by the session that finds them wrong**
+(operator ruling 2026-10-06, `09` §3 decision 150). A session MAY, without asking: correct a stale fact (a command, a
+count, a version, a path, a description of what a gate does), add a fact it proved, and remove a reference to something
+that no longer exists. Each edit is named in the report (file, line, before, after, why). A session MAY NOT, without the
+operator's word: loosen a safety rule, a fence, a „never", a protected machine, a secret rule, or a review step; or
+remove a rule. When in doubt, it is a rule change, and it goes to the operator. If Claude Code's own permission check
+asks before such an edit, wait for the operator's click; if it refuses, record that and file the exact line.
diff --git a/.claude/rules/website.md b/.claude/rules/website.md
index 789fa39c..9664e233 100644
--- a/.claude/rules/website.md
+++ b/.claude/rules/website.md
@@ -18,8 +18,8 @@ tag-based publishing is a separate mechanism — see the R-110 fence in the repo
 Website changes go through `python3 scripts/repo_gates.py`, which runs `site_gates.py`. **A new page
 must be added to that gate's `PAGES` list** or it is unchecked.
 
-`site_gates.py` asserts: BOM, emoji, nav/footer consistency, analytics, CDN, design tokens, and
-cache-busting.
+`site_gates.py` asserts: BOM, emoji, nav/footer consistency, analytics, CDN, design tokens, no
+embedded `<style>` blocks, and cache-busting.
 
 ## The encoding fences
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 8824de84..2b97ff13 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -34,7 +34,7 @@ Four surfaces in one repo, plus the design home for the whole system:
 | host addresses, break-glass, node facts | `documentation/operations/nodes.md` — never restate them |
 | which box may I break | `documentation/runbooks/target-selection.md` |
 | what version is live anywhere | ask the hub (`/hosts`, `/configs`) or the box — **never a doc** |
-| the authoritative design | `documentation/architecture/01..05-*.md` |
+| the authoritative design | `documentation/architecture/01..11-*.md` (00 = the capability map) |
 
 ## Code quality
 
@@ -81,12 +81,12 @@ box**.
 
 ## Gates — ONE entry point
 
-**Run `python3 scripts/repo_gates.py` after ANY change in this repo.** It runs every gate —
-`site_gates.py`, `hostinstall_gates.py`, `hub_confirm_gate.py`, `manifest_bearer_gate.py`,
-`reuse_refs_check.py`, `instructions_gate.py`, `golden_currency_gate.py`, `wire_contract_gate.py`,
-`hub_copy_gate.py` and `due_checks_gate.py` — streaming each gate's own output and exiting
-non-zero if any fails. `--fast` selects the gates that touch no network and no container runtime;
-today that is all of them. **A missing gate script is a FAILURE, never a skip.**
+**Run `python3 scripts/repo_gates.py` after ANY change in this repo.** It runs every gate in its
+`GATES` table — **that table is the list**; this file does not restate it (a copy here read ten
+gates while the table held nineteen) — streaming each gate's own output and exiting non-zero if any
+fails. `--fast` selects the gates that touch no network and no container runtime, and **skips the
+full-run-only gates, naming them** (today: `iso-bootstrap`, R-502 — it needs docker and an image).
+**A missing gate script is a FAILURE, never a skip.**
 
 `due_checks_gate.py` refuses the push when a dated check in `OPEN-ITEMS.md`'s `DUE-CHECKS` block has
 come due (R-341). **It is not a scheduler** — it fires on the next push, not on the date.
diff --git a/CONTEXT.md b/CONTEXT.md
index 32c3ac0c..63e5ff54 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -16,6 +16,15 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
 
+> **2026-10-06 (afternoon) — instruction files kept true; vaultwarden on the ladder (`09` §3 149–150).** Decision 150:
+> a session corrects a stale fact in `CLAUDE.md` / `.claude/rules/*` itself and names the edit (file, before, after, why);
+> it never loosens a rule, fence or „never" without the operator — rule text in `.claude/rules/unprompted-work.md` §5
+> (four identical copies: felhom.eu, controller, catalog, the workspace root) and `PROMPT-TEMPLATE.md` §9 rule 9.
+> Decision 149: the box walk may seed vaultwarden through its admin invite on scratch 9202 (`box_admin_seed_allowed`,
+> five conditions; the invite runs inside the box, the token never leaves it); the Tester 1 box is allowed but the walk
+> has no route there. Vaultwarden's first ladder step 1.36.0-alpine → 1.37.4-alpine is live in the catalog (`ecb8552`).
+> R-469 re-read: NOT removable — the engine gate is now decision 35's permanent per-app check (operator: close or keep).
+
 > **2026-10-06 (midday) — the operator's ten answers (`09` §3 139–148, „A" for all; CC's own pick differed on 140, 146,
 > 147).** Register 150 → 142 (2 opened: R-890 vaultwarden ladder, R-891 a stale CLAUDE.md line; 10 closed). Releases:
 > agent v0.149.0 (tag = `f277e61`, sha `6bcae9c2…`, bundle `e182c82d…` — new sudo rule `FELHOM_FSTRIM`; weekly
diff --git a/documentation/PROMPT-TEMPLATE.md b/documentation/PROMPT-TEMPLATE.md
index 0e83f97e..b865d927 100644
--- a/documentation/PROMPT-TEMPLATE.md
+++ b/documentation/PROMPT-TEMPLATE.md
@@ -272,6 +272,13 @@ Then:  [exact refusal — HTTP status, error, and the proven non-effect, e.g. "m
    shippable change; **overwrite** REPORT.md.
 8. **Coding standards:** follow `<repo>/CLAUDE.md` (cross-cutting) and the feature doc / README for
    domain patterns.
+9. **Instruction files (`CLAUDE.md`, `.claude/rules/*`) are kept true by the session that finds them wrong**
+   (operator ruling 2026-10-06, `09` §3 decision 150). A session MAY, without asking: correct a stale fact (a command, a
+   count, a version, a path, a description of what a gate does), add a fact it proved, and remove a reference to something
+   that no longer exists. Each edit is named in the report (file, line, before, after, why). A session MAY NOT, without the
+   operator's word: loosen a safety rule, a fence, a „never", a protected machine, a secret rule, or a review step; or
+   remove a rule. When in doubt, it is a rule change, and it goes to the operator. If Claude Code's own permission check
+   asks before such an edit, wait for the operator's click; if it refuses, record that and file the exact line.
 
 ---
 
diff --git a/documentation/architecture/09-update-architecture.md b/documentation/architecture/09-update-architecture.md
index 2d445080..8cf9cc10 100644
--- a/documentation/architecture/09-update-architecture.md
+++ b/documentation/architecture/09-update-architecture.md
@@ -905,6 +905,20 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
      *Operator ruling 2026-10-05.* (R-861)
 
+### 2026-10-06 (13:25) — two operator rulings (recorded before the work)
+
+149. **R-890 — the admin seed is allowed on the test boxes** (scratch 9202 and the disposable Tester 1 box) as well as
+     on the test bench; it widens decision 146. It is never used on a household box or on a demo box's household apps.
+     The admin secret is minted per run, never leaves that box, and is never written to a repo, log or report.
+     *Operator ruling 2026-10-06 13:25* (option A of the row).
+150. **Instruction files are kept true by the session that finds them wrong** (R-891). A session may, without asking,
+     correct a stale fact in a `CLAUDE.md` or `.claude/rules/*` file, add a fact it proved, and remove a reference to
+     something that no longer exists, naming each edit in its report. It may not, without the operator, loosen a safety
+     rule, a fence, a „never", a protected machine, a secret rule or a review step, or remove a rule. *Operator ruling
+     2026-10-06 13:25.* **The reviewer's error, recorded:** the briefs from the night of 2026-10-05 on carried „Do not
+     edit instruction files", which turned one-line factual corrections into operator rows (R-891, R-469's block). Its
+     intent was to stop a session loosening its own fences, not to stop it keeping facts true.
+
 ### 2026-10-06 (10:41) — ten operator rulings: „A" for all ten (STATUS's ten questions; recorded before the work)
 
 The operator chose option A for all ten. **That differs from CC's own pick on three: 2 (R-99, CC picked B — leave the
diff --git a/documentation/audits/r890-instructions-2026-10-06/C/R-644-9202-live.txt b/documentation/audits/r890-instructions-2026-10-06/C/R-644-9202-live.txt
new file mode 100644
index 00000000..328ce2ec
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/C/R-644-9202-live.txt
@@ -0,0 +1,11 @@
+Tue Oct  6 11:47:10 UTC 2026
+== all containers
+filebrowser Up 5 hours (healthy)
+felhom-controller Up 6 minutes (healthy)
+paperless-webserver Up 11 hours (healthy)
+paperless-postgres Up 11 hours (healthy)
+paperless-redis Up 11 hours (healthy)
+traefik Up 28 hours
+== gokapi
+0
+0
diff --git a/documentation/audits/r890-instructions-2026-10-06/README.md b/documentation/audits/r890-instructions-2026-10-06/README.md
new file mode 100644
index 00000000..b7eb019a
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/README.md
@@ -0,0 +1,23 @@
+# 2026-10-06 (afternoon) — instruction files kept true; vaultwarden on the update ladder (R-890, R-891)
+
+Rulings: `09` §3 decisions 149 (the admin seed on the test boxes) and 150 (instruction files kept true by the session).
+
+## Part B — vaultwarden 1.36.0-alpine → 1.37.4-alpine, both venues
+
+| venue | result | file |
+|---|---|---|
+| bench LXC 9401 (demo-hp), harness v5, `FELHOM_BENCH_ADMIN_SEED=1`, 600 s memory watch | **proven**: seed read back before and after, healthy in 30.9 s, anon peak 16.3 % (cgroup 22.3 %), 0 kills, 0 restarts, no file changed | `bench/R890-vw.log`, `bench/evidence/MV-vaultwarden/verdict.json` |
+| scratch guest 9202 (drill catalog), `FELHOM_BOX_ADMIN_SEED=1` | **proven**: a fresh install; self-registration 400 (closed by design); the admin sign-in and invite INSIDE the box → (200, session yes, 200); invited registration 200; seed read back; the guarded Update backing-up → pulling → copying → verifying → done in 12.3 s; seed read back; badge „Frissítés elérhető — 80 napja" before, „Naprakész" after; removed through the product (no container, no volume left) | `box/vaultwarden/step.txt`, `box/vaultwarden/box-verdict-vaultwarden.json`, `box/run.out` |
+
+Written to the live catalog by `upgrade-test.py --write-ladder` (catalog `ecb8552`). The tool: `tools/vwstep.py` (one
+process, so the install and the seed are the same run — the guard requires that). 9202 pointed at the drill:
+`box/C1-repoint-drill.txt`.
+
+**Secrets:** the admin token was never on DooPlex — the box read it from the container's environment and handed it to
+curl on stdin; only HTTP codes came back. Scan of `bench/` and `box/` for 48+ hex characters, `VW_ADMIN=` and
+`ADMIN_TOKEN=` values: 0 hits; control: a fresh 64-hex line → 1 hit. The bench's run `.env` is gone (shredded by the
+harness); the bench has 0 containers and is stopped.
+
+## Part C
+
+- R-644: `C/R-644-9202-live.txt` — no gokapi on 9202 any more.
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/R890-vw.log b/documentation/audits/r890-instructions-2026-10-06/bench/R890-vw.log
new file mode 100644
index 00000000..4dd08716
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/R890-vw.log
@@ -0,0 +1,115 @@
+[11:37:33] scratch drive folders cleared before FROM (R-656): none existed
+[11:37:33] MV-vaultwarden: deploying vaultwarden at FROM {'vaultwarden': 'vaultwarden/server:1.36.0-alpine'}
+[11:38:04] FROM settled=True in 30.9s :: {"vaultwarden": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}}
+[11:38:04] fixture: the BOX walk's own (Vaultwarden), through upgrade_boxport
+[11:38:04]     vaultwarden: self-registration http=400 (closed by design, R-512 — 400 expected)
+[11:38:04]     vaultwarden: bench admin sign-in http=200 session=yes
+[11:38:04]     vaultwarden: bench admin invite http=200
+[11:38:05]     vaultwarden: invited registration http=200
+[11:38:05]     vaultwarden: token for the seeded account http=200 ok=True
+[11:38:05] C1 (seed reads back BEFORE): True
+[11:38:05] MV-vaultwarden: swapping to TO {'vaultwarden': 'vaultwarden/server:1.37.4-alpine'}
+[11:38:12] TO up -d rc=0
+[11:38:43] TO settled=True in 30.9s :: {"vaultwarden": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}}
+[11:38:43] migration lines observed: 0
+[11:38:44]     vaultwarden: token for the seeded account http=200 ok=True
+[11:38:44] RESULT (seed reads back AFTER): True
+[11:38:44] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:80
+[11:38:59]   +   15s  vaultwarden=44M/256M peak=45M kills=0 rs=0  reqs=300
+[11:39:14]   +   30s  vaultwarden=44M/256M peak=46M kills=0 rs=0  reqs=600
+[11:39:29]   +   45s  vaultwarden=45M/256M peak=46M kills=0 rs=0  reqs=900
+[11:39:45]   +   60s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=1200
+[11:40:00]   +   76s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=1500
+[11:40:15]   +   91s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=1800
+[11:40:30]   +  106s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=2100
+[11:40:45]   +  121s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=2400
+[11:41:00]   +  136s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=2700
+[11:41:15]   +  151s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=2996
+[11:41:30]   +  166s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=3296
+[11:41:46]   +  182s  vaultwarden=47M/256M peak=50M kills=0 rs=0  reqs=3596
+[11:42:01]   +  197s  vaultwarden=47M/256M peak=50M kills=0 rs=0  reqs=3896
+[11:42:16]   +  212s  vaultwarden=48M/256M peak=51M kills=0 rs=0  reqs=4196
+[11:42:31]   +  227s  vaultwarden=49M/256M peak=51M kills=0 rs=0  reqs=4496
+[11:42:46]   +  242s  vaultwarden=50M/256M peak=51M kills=0 rs=0  reqs=4796
+[11:43:01]   +  257s  vaultwarden=49M/256M peak=51M kills=0 rs=0  reqs=5096
+[11:43:16]   +  272s  vaultwarden=50M/256M peak=51M kills=0 rs=0  reqs=5396
+[11:43:31]   +  287s  vaultwarden=49M/256M peak=51M kills=0 rs=0  reqs=5696
+[11:43:47]   +  303s  vaultwarden=52M/256M peak=54M kills=0 rs=0  reqs=5996
+[11:44:02]   +  318s  vaultwarden=51M/256M peak=54M kills=0 rs=0  reqs=6292
+[11:44:17]   +  333s  vaultwarden=51M/256M peak=54M kills=0 rs=0  reqs=6592
+[11:44:32]   +  348s  vaultwarden=52M/256M peak=54M kills=0 rs=0  reqs=6892
+[11:44:47]   +  363s  vaultwarden=53M/256M peak=55M kills=0 rs=0  reqs=7192
+[11:45:02]   +  378s  vaultwarden=53M/256M peak=55M kills=0 rs=0  reqs=7492
+[11:45:17]   +  393s  vaultwarden=53M/256M peak=55M kills=0 rs=0  reqs=7792
+[11:45:32]   +  408s  vaultwarden=53M/256M peak=55M kills=0 rs=0  reqs=8092
+[11:45:48]   +  424s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=8392
+[11:46:03]   +  439s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=8692
+[11:46:18]   +  454s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=8992
+[11:46:33]   +  469s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=9292
+[11:46:48]   +  484s  vaultwarden=55M/256M peak=56M kills=0 rs=0  reqs=9589
+[11:47:03]   +  499s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=9889
+[11:47:18]   +  514s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=10189
+[11:47:34]   +  530s  vaultwarden=55M/256M peak=56M kills=0 rs=0  reqs=10489
+[11:47:49]   +  545s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=10789
+[11:48:04]   +  560s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=11089
+[11:48:19]   +  575s  vaultwarden=55M/256M peak=56M kills=0 rs=0  reqs=11389
+[11:48:34]   +  590s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=11689
+[11:48:49]   +  605s  vaultwarden=55M/256M peak=56M kills=0 rs=0  reqs=11989
+[11:48:50] memory watch: killed=False tight=[] requests=11989 codes={'200': 11989}
+[11:48:50] MV-vaultwarden: ABORT — putting the FROM images back
+[11:49:21]     vaultwarden: token for the seeded account http=200 ok=True
+[11:49:21] ABORT: app came back in 30.9s; data present=True
+{
+  "harness_version": 5,
+  "edge": "MV-vaultwarden",
+  "app": "vaultwarden",
+  "note": "night 2026-09-23 within-a-major move: vaultwarden=vaultwarden/server:1.37.4-alpine",
+  "from": {
+    "vaultwarden": "vaultwarden/server:1.36.0-alpine"
+  },
+  "to": {
+    "vaultwarden": "vaultwarden/server:1.37.4-alpine"
+  },
+  "verdict": "proven",
+  "seed_read_before": true,
+  "seed_read_after": true,
+  "healthy_after": true,
+  "migration_observed": null,
+  "abort": "starts-and-serves",
+  "abort_detail": null,
+  "engine_state_after": null,
+  "memory": {
+    "soak_s": 605.5,
+    "requested_s": 600,
+    "requests": 11989,
+    "codes": {
+      "200": 11989
+    },
+    "first_kill": null,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "peak": 59731968,
+        "peak_pct": 0.223,
+        "anon_peak_sampled": 43720704,
+        "anon_peak_pct": 0.163,
+        "oom_kills": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "measured": true
+      }
+    },
+    "unmeasured": [],
+    "load": "reached"
+  },
+  "marks": [],
+  "bench_overrides": null,
+  "duration_s": 30.9,
+  "measured_at": "2026-10-06T11:49:21Z",
+  "evidence": "evidence/MV-vaultwarden",
+  "scratch_cleared": [],
+  "files_changed": [],
+  "files_changed_detail": [],
+  "files_ignored": [],
+  "total_s": 708.8
+}
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/abort-states.json b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/abort-states.json
new file mode 100644
index 00000000..536c8a94
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/abort-states.json
@@ -0,0 +1,8 @@
+{
+  "vaultwarden": {
+    "status": "running",
+    "health": "healthy",
+    "restarts": 0,
+    "exit": 0
+  }
+}
\ No newline at end of file
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/compose-final.log b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/compose-final.log
new file mode 100644
index 00000000..f042374d
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/compose-final.log
@@ -0,0 +1,26 @@
+vaultwarden  | /--------------------------------------------------------------------\
+vaultwarden  | |                        Starting Vaultwarden                        |
+vaultwarden  | |                           Version 1.36.0                           |
+vaultwarden  | |--------------------------------------------------------------------|
+vaultwarden  | | This is an *unofficial* Bitwarden implementation, DO NOT use the   |
+vaultwarden  | | official channels to report bugs/features, regardless of client.   |
+vaultwarden  | | Send usage/configuration questions or feature requests to:         |
+vaultwarden  | |   https://github.com/dani-garcia/vaultwarden/discussions or        |
+vaultwarden  | |   https://vaultwarden.discourse.group/                             |
+vaultwarden  | | Report suspected bugs/issues in the software itself at:            |
+vaultwarden  | |   https://github.com/dani-garcia/vaultwarden/issues/new            |
+vaultwarden  | \--------------------------------------------------------------------/
+vaultwarden  | 
+vaultwarden  | [NOTICE] You are using a plain text `ADMIN_TOKEN` which is insecure.
+vaultwarden  | Please generate a secure Argon2 PHC string by using `vaultwarden hash` or `argon2`.
+vaultwarden  | See: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token
+vaultwarden  | 
+vaultwarden  | [2026-10-06 13:48:50.671][start][INFO] Rocket has launched from http://0.0.0.0:80
+vaultwarden  | [2026-10-06 13:49:21.529][request][INFO] POST /identity/connect/token
+vaultwarden  | [2026-10-06 13:49:21.529][auth][ERROR] Unauthorized Error: No Bitwarden-Client-Version header provided
+vaultwarden  | [2026-10-06 13:49:21.689][vaultwarden::api::identity][ERROR] Username or password is incorrect. Try again. IP: 172.18.0.1. Username: drill-d12fe8d2@gate.invalid.
+vaultwarden  | [2026-10-06 13:49:21.689][response][INFO] (login) POST /identity/connect/token => 400 Bad Request
+vaultwarden  | [2026-10-06 13:49:21.724][request][INFO] POST /identity/connect/token
+vaultwarden  | [2026-10-06 13:49:21.724][auth][ERROR] Unauthorized Error: No Bitwarden-Client-Version header provided
+vaultwarden  | [2026-10-06 13:49:21.879][vaultwarden::api::identity][INFO] User drill logged in successfully. IP: 172.18.0.1
+vaultwarden  | [2026-10-06 13:49:21.879][response][INFO] (login) POST /identity/connect/token => 200 OK
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/engine-state.json b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/engine-state.json
new file mode 100644
index 00000000..ec747fa4
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/engine-state.json
@@ -0,0 +1 @@
+null
\ No newline at end of file
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-after-detail.json b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-after-detail.json
new file mode 100644
index 00000000..9e26dfee
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-after-detail.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-after.json b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-after.json
new file mode 100644
index 00000000..9e26dfee
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-after.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-before-detail.json b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-before-detail.json
new file mode 100644
index 00000000..9e26dfee
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-before-detail.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-before.json b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-before.json
new file mode 100644
index 00000000..9e26dfee
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/files-before.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/memory-samples.json b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/memory-samples.json
new file mode 100644
index 00000000..21eac5d0
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/memory-samples.json
@@ -0,0 +1,682 @@
+[
+  {
+    "t": 15.1,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 46456832,
+        "peak": 47407104,
+        "anon": 38027264,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 300
+  },
+  {
+    "t": 30.3,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 46735360,
+        "peak": 49123328,
+        "anon": 38473728,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 600
+  },
+  {
+    "t": 45.4,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 47403008,
+        "peak": 49123328,
+        "anon": 38641664,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 900
+  },
+  {
+    "t": 60.5,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 49934336,
+        "peak": 52183040,
+        "anon": 40976384,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 1200
+  },
+  {
+    "t": 75.7,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 49467392,
+        "peak": 52183040,
+        "anon": 40087552,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 1500
+  },
+  {
+    "t": 90.8,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 49885184,
+        "peak": 52183040,
+        "anon": 40316928,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 1800
+  },
+  {
+    "t": 105.9,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 49991680,
+        "peak": 52183040,
+        "anon": 40300544,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 2100
+  },
+  {
+    "t": 121.1,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 49860608,
+        "peak": 52183040,
+        "anon": 40488960,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 2400
+  },
+  {
+    "t": 136.2,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 49836032,
+        "peak": 52183040,
+        "anon": 39841792,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 2700
+  },
+  {
+    "t": 151.3,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 50278400,
+        "peak": 52183040,
+        "anon": 40030208,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 2996
+  },
+  {
+    "t": 166.4,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 49954816,
+        "peak": 52183040,
+        "anon": 39927808,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 3296
+  },
+  {
+    "t": 181.6,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 50135040,
+        "peak": 52711424,
+        "anon": 40226816,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 3596
+  },
+  {
+    "t": 196.7,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 49827840,
+        "peak": 52711424,
+        "anon": 39620608,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 3896
+  },
+  {
+    "t": 211.8,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 51314688,
+        "peak": 54259712,
+        "anon": 40148992,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 4196
+  },
+  {
+    "t": 226.9,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 51630080,
+        "peak": 54259712,
+        "anon": 40075264,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 4496
+  },
+  {
+    "t": 242.1,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 52629504,
+        "peak": 54259712,
+        "anon": 40218624,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 4796
+  },
+  {
+    "t": 257.2,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 52166656,
+        "peak": 54259712,
+        "anon": 39854080,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 5096
+  },
+  {
+    "t": 272.3,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 52514816,
+        "peak": 54259712,
+        "anon": 39993344,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 5396
+  },
+  {
+    "t": 287.4,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 51990528,
+        "peak": 54259712,
+        "anon": 40095744,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 5696
+  },
+  {
+    "t": 302.6,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 54804480,
+        "peak": 57143296,
+        "anon": 42119168,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 5996
+  },
+  {
+    "t": 317.7,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 53960704,
+        "peak": 57143296,
+        "anon": 42205184,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 6292
+  },
+  {
+    "t": 332.8,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 53817344,
+        "peak": 57143296,
+        "anon": 41398272,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 6592
+  },
+  {
+    "t": 347.9,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 54542336,
+        "peak": 57143296,
+        "anon": 41426944,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 6892
+  },
+  {
+    "t": 363.1,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 56356864,
+        "peak": 58667008,
+        "anon": 43720704,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 7192
+  },
+  {
+    "t": 378.2,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 56516608,
+        "peak": 58667008,
+        "anon": 43200512,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 7492
+  },
+  {
+    "t": 393.3,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 56545280,
+        "peak": 58667008,
+        "anon": 43233280,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 7792
+  },
+  {
+    "t": 408.4,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 56168448,
+        "peak": 58667008,
+        "anon": 42938368,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 8092
+  },
+  {
+    "t": 423.6,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 56717312,
+        "peak": 58896384,
+        "anon": 43270144,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 8392
+  },
+  {
+    "t": 438.7,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 57171968,
+        "peak": 58896384,
+        "anon": 42594304,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 8692
+  },
+  {
+    "t": 453.9,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 57262080,
+        "peak": 58896384,
+        "anon": 42614784,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 8992
+  },
+  {
+    "t": 469.0,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 57131008,
+        "peak": 58896384,
+        "anon": 42680320,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 9292
+  },
+  {
+    "t": 484.1,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 57974784,
+        "peak": 59424768,
+        "anon": 42905600,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 9589
+  },
+  {
+    "t": 499.3,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 57352192,
+        "peak": 59424768,
+        "anon": 42680320,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 9889
+  },
+  {
+    "t": 514.4,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 56872960,
+        "peak": 59424768,
+        "anon": 42700800,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 10189
+  },
+  {
+    "t": 529.5,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 57950208,
+        "peak": 59424768,
+        "anon": 42795008,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 10489
+  },
+  {
+    "t": 544.7,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 57360384,
+        "peak": 59424768,
+        "anon": 43061248,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 10789
+  },
+  {
+    "t": 559.8,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 57270272,
+        "peak": 59424768,
+        "anon": 42733568,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 11089
+  },
+  {
+    "t": 574.9,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 57892864,
+        "peak": 59731968,
+        "anon": 42790912,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 11389
+  },
+  {
+    "t": 590.1,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 56963072,
+        "peak": 59731968,
+        "anon": 42803200,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 11689
+  },
+  {
+    "t": 605.2,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "current": 58019840,
+        "peak": 59731968,
+        "anon": 43212800,
+        "oom_kill": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "status": "running",
+        "cgroup": true
+      }
+    },
+    "requests": 11989
+  }
+]
\ No newline at end of file
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/migration-lines.txt b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/migration-lines.txt
new file mode 100644
index 00000000..e69de29b
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/run.log b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/run.log
new file mode 100644
index 00000000..4a94edb0
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/run.log
@@ -0,0 +1,61 @@
+[11:37:33] scratch drive folders cleared before FROM (R-656): none existed
+[11:37:33] MV-vaultwarden: deploying vaultwarden at FROM {'vaultwarden': 'vaultwarden/server:1.36.0-alpine'}
+[11:38:04] FROM settled=True in 30.9s :: {"vaultwarden": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}}
+[11:38:04] fixture: the BOX walk's own (Vaultwarden), through upgrade_boxport
+[11:38:04]     vaultwarden: self-registration http=400 (closed by design, R-512 — 400 expected)
+[11:38:04]     vaultwarden: bench admin sign-in http=200 session=yes
+[11:38:04]     vaultwarden: bench admin invite http=200
+[11:38:05]     vaultwarden: invited registration http=200
+[11:38:05]     vaultwarden: token for the seeded account http=200 ok=True
+[11:38:05] C1 (seed reads back BEFORE): True
+[11:38:05] MV-vaultwarden: swapping to TO {'vaultwarden': 'vaultwarden/server:1.37.4-alpine'}
+[11:38:12] TO up -d rc=0
+[11:38:43] TO settled=True in 30.9s :: {"vaultwarden": {"status": "running", "health": "healthy", "restarts": 0, "exit": 0}}
+[11:38:43] migration lines observed: 0
+[11:38:44]     vaultwarden: token for the seeded account http=200 ok=True
+[11:38:44] RESULT (seed reads back AFTER): True
+[11:38:44] memory watch: 600s, 4 callers on 1 path(s) at 172.18.0.2:80
+[11:38:59]   +   15s  vaultwarden=44M/256M peak=45M kills=0 rs=0  reqs=300
+[11:39:14]   +   30s  vaultwarden=44M/256M peak=46M kills=0 rs=0  reqs=600
+[11:39:29]   +   45s  vaultwarden=45M/256M peak=46M kills=0 rs=0  reqs=900
+[11:39:45]   +   60s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=1200
+[11:40:00]   +   76s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=1500
+[11:40:15]   +   91s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=1800
+[11:40:30]   +  106s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=2100
+[11:40:45]   +  121s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=2400
+[11:41:00]   +  136s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=2700
+[11:41:15]   +  151s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=2996
+[11:41:30]   +  166s  vaultwarden=47M/256M peak=49M kills=0 rs=0  reqs=3296
+[11:41:46]   +  182s  vaultwarden=47M/256M peak=50M kills=0 rs=0  reqs=3596
+[11:42:01]   +  197s  vaultwarden=47M/256M peak=50M kills=0 rs=0  reqs=3896
+[11:42:16]   +  212s  vaultwarden=48M/256M peak=51M kills=0 rs=0  reqs=4196
+[11:42:31]   +  227s  vaultwarden=49M/256M peak=51M kills=0 rs=0  reqs=4496
+[11:42:46]   +  242s  vaultwarden=50M/256M peak=51M kills=0 rs=0  reqs=4796
+[11:43:01]   +  257s  vaultwarden=49M/256M peak=51M kills=0 rs=0  reqs=5096
+[11:43:16]   +  272s  vaultwarden=50M/256M peak=51M kills=0 rs=0  reqs=5396
+[11:43:31]   +  287s  vaultwarden=49M/256M peak=51M kills=0 rs=0  reqs=5696
+[11:43:47]   +  303s  vaultwarden=52M/256M peak=54M kills=0 rs=0  reqs=5996
+[11:44:02]   +  318s  vaultwarden=51M/256M peak=54M kills=0 rs=0  reqs=6292
+[11:44:17]   +  333s  vaultwarden=51M/256M peak=54M kills=0 rs=0  reqs=6592
+[11:44:32]   +  348s  vaultwarden=52M/256M peak=54M kills=0 rs=0  reqs=6892
+[11:44:47]   +  363s  vaultwarden=53M/256M peak=55M kills=0 rs=0  reqs=7192
+[11:45:02]   +  378s  vaultwarden=53M/256M peak=55M kills=0 rs=0  reqs=7492
+[11:45:17]   +  393s  vaultwarden=53M/256M peak=55M kills=0 rs=0  reqs=7792
+[11:45:32]   +  408s  vaultwarden=53M/256M peak=55M kills=0 rs=0  reqs=8092
+[11:45:48]   +  424s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=8392
+[11:46:03]   +  439s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=8692
+[11:46:18]   +  454s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=8992
+[11:46:33]   +  469s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=9292
+[11:46:48]   +  484s  vaultwarden=55M/256M peak=56M kills=0 rs=0  reqs=9589
+[11:47:03]   +  499s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=9889
+[11:47:18]   +  514s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=10189
+[11:47:34]   +  530s  vaultwarden=55M/256M peak=56M kills=0 rs=0  reqs=10489
+[11:47:49]   +  545s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=10789
+[11:48:04]   +  560s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=11089
+[11:48:19]   +  575s  vaultwarden=55M/256M peak=56M kills=0 rs=0  reqs=11389
+[11:48:34]   +  590s  vaultwarden=54M/256M peak=56M kills=0 rs=0  reqs=11689
+[11:48:49]   +  605s  vaultwarden=55M/256M peak=56M kills=0 rs=0  reqs=11989
+[11:48:50] memory watch: killed=False tight=[] requests=11989 codes={'200': 11989}
+[11:48:50] MV-vaultwarden: ABORT — putting the FROM images back
+[11:49:21]     vaultwarden: token for the seeded account http=200 ok=True
+[11:49:21] ABORT: app came back in 30.9s; data present=True
\ No newline at end of file
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/to-full.log b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/to-full.log
new file mode 100644
index 00000000..5a79a0f1
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/to-full.log
@@ -0,0 +1,18 @@
+vaultwarden  | /--------------------------------------------------------------------\
+vaultwarden  | |                        Starting Vaultwarden                        |
+vaultwarden  | |                           Version 1.37.4                           |
+vaultwarden  | |--------------------------------------------------------------------|
+vaultwarden  | | This is an *unofficial* Bitwarden implementation, DO NOT use the   |
+vaultwarden  | | official channels to report bugs/features, regardless of client.   |
+vaultwarden  | | Send usage/configuration questions or feature requests to:         |
+vaultwarden  | |   https://github.com/dani-garcia/vaultwarden/discussions or        |
+vaultwarden  | |   https://vaultwarden.discourse.group/                             |
+vaultwarden  | | Report suspected bugs/issues in the software itself at:            |
+vaultwarden  | |   https://github.com/dani-garcia/vaultwarden/issues/new            |
+vaultwarden  | \--------------------------------------------------------------------/
+vaultwarden  | 
+vaultwarden  | [NOTICE] You are using a plain text `ADMIN_TOKEN` which is insecure.
+vaultwarden  | Please generate a secure Argon2 PHC string by using `vaultwarden hash` or `argon2`.
+vaultwarden  | See: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token
+vaultwarden  | 
+vaultwarden  | [2026-10-06 13:38:12.635][start][INFO] Rocket has launched from http://0.0.0.0:80
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/to-states.json b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/to-states.json
new file mode 100644
index 00000000..536c8a94
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/to-states.json
@@ -0,0 +1,8 @@
+{
+  "vaultwarden": {
+    "status": "running",
+    "health": "healthy",
+    "restarts": 0,
+    "exit": 0
+  }
+}
\ No newline at end of file
diff --git a/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/verdict.json b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/verdict.json
new file mode 100644
index 00000000..7aa0ce8a
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/bench/evidence/MV-vaultwarden/verdict.json
@@ -0,0 +1,54 @@
+{
+  "harness_version": 5,
+  "edge": "MV-vaultwarden",
+  "app": "vaultwarden",
+  "note": "night 2026-09-23 within-a-major move: vaultwarden=vaultwarden/server:1.37.4-alpine",
+  "from": {
+    "vaultwarden": "vaultwarden/server:1.36.0-alpine"
+  },
+  "to": {
+    "vaultwarden": "vaultwarden/server:1.37.4-alpine"
+  },
+  "verdict": "proven",
+  "seed_read_before": true,
+  "seed_read_after": true,
+  "healthy_after": true,
+  "migration_observed": null,
+  "abort": "starts-and-serves",
+  "abort_detail": null,
+  "engine_state_after": null,
+  "memory": {
+    "soak_s": 605.5,
+    "requested_s": 600,
+    "requests": 11989,
+    "codes": {
+      "200": 11989
+    },
+    "first_kill": null,
+    "containers": {
+      "vaultwarden": {
+        "limit": 268435456,
+        "peak": 59731968,
+        "peak_pct": 0.223,
+        "anon_peak_sampled": 43720704,
+        "anon_peak_pct": 0.163,
+        "oom_kills": 0,
+        "restarts": 0,
+        "oomkilled_flag": false,
+        "measured": true
+      }
+    },
+    "unmeasured": [],
+    "load": "reached"
+  },
+  "marks": [],
+  "bench_overrides": null,
+  "duration_s": 30.9,
+  "measured_at": "2026-10-06T11:49:21Z",
+  "evidence": "evidence/MV-vaultwarden",
+  "scratch_cleared": [],
+  "files_changed": [],
+  "files_changed_detail": [],
+  "files_ignored": [],
+  "total_s": 708.8
+}
\ No newline at end of file
diff --git a/documentation/audits/r890-instructions-2026-10-06/box/C1-repoint-drill.txt b/documentation/audits/r890-instructions-2026-10-06/box/C1-repoint-drill.txt
new file mode 100644
index 00000000..5e311079
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/box/C1-repoint-drill.txt
@@ -0,0 +1,2 @@
+26:    repo_url: https://gitea.dooplex.hu/admin/app-catalog-drill.git
+
diff --git a/documentation/audits/r890-instructions-2026-10-06/box/vaultwarden/box-verdict-vaultwarden.json b/documentation/audits/r890-instructions-2026-10-06/box/vaultwarden/box-verdict-vaultwarden.json
new file mode 100644
index 00000000..e86d9bf4
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/box/vaultwarden/box-verdict-vaultwarden.json
@@ -0,0 +1,18 @@
+{
+  "app": "vaultwarden",
+  "venue": "box 9202 (drill catalog), the product's guarded Update; seeded through the admin invite inside the box (R-890)",
+  "from": {
+    "vaultwarden": "vaultwarden/server:1.36.0-alpine"
+  },
+  "to": {
+    "vaultwarden": "vaultwarden/server:1.37.4-alpine"
+  },
+  "verdict": "proven",
+  "seed_read_before": true,
+  "seed_read_after": true,
+  "healthy_after": true,
+  "duration_s": 12.3,
+  "final_phase": "done",
+  "measured_at": "2026-10-06T11:41:48Z",
+  "evidence": "felhom.eu/documentation/audits/r890-instructions-2026-10-06/box/vaultwarden/step.txt"
+}
\ No newline at end of file
diff --git a/documentation/audits/r890-instructions-2026-10-06/box/vaultwarden/step.txt b/documentation/audits/r890-instructions-2026-10-06/box/vaultwarden/step.txt
new file mode 100644
index 00000000..0c6add78
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/box/vaultwarden/step.txt
@@ -0,0 +1,37 @@
+    vaultwarden: self-registration http=400 (closed by design, R-512 — 400 expected)
+    vaultwarden: test-box admin sign-in and invite (inside the box) -> ('200', 'yes', '200')
+    vaultwarden: invited registration http=200
+    vaultwarden: token for the seeded account http=200 ok=True
+C1 seed reads back BEFORE: True
+before: pinned={'vaultwarden': 'vaultwarden/server:1.36.0-alpine'}
+drill: a603087 DRILL vaultwarden: vaultwarden/server:1.36.0-alpine -> vaultwarden/server:1.37.4-alpine (box proof, R-890)
+badge before: {'hu': [{'title': 'Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.', 'text': 'Frissítés elérhető — 80 napja'}], 'en': [{'title': 'A newer version of this app is available. Select the Update button to start it.', 'text': 'Update available — 80 days ago'}]}
+  phase +0.0s backing-up | err=None
+  phase +2.1s pulling | err=None
+  phase +6.2s copying | err=None
+  phase +7.2s verifying | err=None
+  phase +12.3s done | err=None
+    vaultwarden: token for the seeded account http=200 ok=True
+2026/10/06 11:41:50 update.go:537: [INFO] [stacks] update vaultwarden: accepted — guarded update started
+2026/10/06 11:41:50 update.go:1377: [INFO] [stacks] update vaultwarden: phase checking
+2026/10/06 11:41:50 update.go:795: [INFO] [stacks] update vaultwarden: ladder — the last step (1 of 1) — the catalog's current definition
+2026/10/06 11:41:50 update.go:825: [INFO] [stacks] update vaultwarden: no usable copy on any tier — younger than 24h0m0s and not older than this install's deploy (2026-10-06T11:41:17Z) (found: none) — backing up first
+2026/10/06 11:41:50 update.go:1377: [INFO] [stacks] update vaultwarden: phase backing-up
+2026/10/06 11:41:51 update.go:840: [INFO] [stacks] update vaultwarden: precondition met after the backup — Tier 2 (second drive) copy from 2026-10-06T11:41:50Z
+2026/10/06 11:41:51 update.go:1377: [INFO] [stacks] update vaultwarden: phase safety-dump
+2026/10/06 11:41:51 update.go:855: [INFO] [stacks] update vaultwarden: safety dump done (0 file(s)) []
+2026/10/06 11:41:52 undo.go:287: [INFO] [stacks] update vaultwarden: the undo copy will hold 1 named volume(s), 0.3 MiB
+2026/10/06 11:41:52 update.go:1377: [INFO] [stacks] update vaultwarden: phase pinning
+2026/10/06 11:41:52 pin.go:373: [INFO] [stacks] update vaultwarden: pin advanced to /opt/docker/felhom-controller/data/catalog-cache/templates/vaultwarden/docker-compose.yml (vaultwarden=vaultwarden/server:1.37.4-alpine)
+2026/10/06 11:41:52 update.go:1377: [INFO] [stacks] update vaultwarden: phase pulling
+2026/10/06 11:41:55 update.go:1377: [INFO] [stacks] update vaultwarden: phase copying
+2026/10/06 11:41:56 update.go:1377: [INFO] [stacks] update vaultwarden: phase copying
+2026/10/06 11:41:56 undo.go:437: [INFO] [stacks] update vaultwarden: copied vaultwarden_vaultwarden_data → vaultwarden_vaultwarden_data.pre-update-20261006T114156Z in 461ms
+2026/10/06 11:41:56 update.go:1377: [INFO] [stacks] update vaultwarden: phase starting
+2026/10/06 11:41:56 update.go:1377: [INFO] [stacks] update vaultwarden: phase verifying
+2026/10/06 11:42:02 update.go:1006: [INFO] [stacks] update vaultwarden: healthy after 5s (the app's health check passed)
+2026/10/06 11:42:02 update.go:1042: [INFO] [stacks] update vaultwarden: DONE in 12s
+
+badge after: {'hu': [{'title': 'Ez az alkalmazás a legfrissebb elérhető változatot futtatja.', 'text': 'Naprakész'}], 'en': [{'title': 'This app is running the newest version available.', 'text': 'Up to date'}]}
+RESULT final_phase=done after={'vaultwarden': 'vaultwarden/server:1.37.4-alpine'} seed_after=True verdict=proven (12.3 s)
+remove -> 200
diff --git a/documentation/audits/r890-instructions-2026-10-06/tools/repoint.py b/documentation/audits/r890-instructions-2026-10-06/tools/repoint.py
new file mode 100644
index 00000000..90eca88a
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/tools/repoint.py
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""Point 9202 at the drill catalog, or put the saved controller.yaml back. `09` §6.5."""
+import io, os, re, sys
+sys.path.insert(0, "/mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu/scripts")
+import box_walk as w
+VOL = "/var/lib/docker/volumes/felhom-controller-data/_data"
+SAVE = f"{VOL}/controller.yaml.pre-r890"
+DRILL = "https://gitea.dooplex.hu/admin/app-catalog-drill.git"
+def creds():
+    for l in io.open(os.path.expanduser("~/.git-credentials")).read().split("\n"):
+        m = re.match(r"https://(admin):([^@]+)@gitea\.dooplex\.hu", l)
+        if m: return m.group(1), m.group(2)
+    sys.exit("no admin credential")
+if sys.argv[1] == "drill":
+    u, t = creds()
+    out = w.guest(f"""set -e
+test -f {SAVE} || cp -p {VOL}/controller.yaml {SAVE}
+python3 - <<'PY'
+import re
+p = "{VOL}/controller.yaml"; s = open(p).read()
+s = re.sub(r'(^\\s+repo_url: ).*$', r'\\g<1>{DRILL}', s, count=1, flags=re.M)
+s = re.sub(r'(^git:(?:\\n\\s+.*)*?\\n\\s+token: ).*$', r'\\g<1>"{t}"', s, count=1, flags=re.M)
+s = re.sub(r'(^git:(?:\\n\\s+.*)*?\\n\\s+username: ).*$', r'\\g<1>"{u}"', s, count=1, flags=re.M)
+open(p, "w").write(s)
+PY
+rm -rf {VOL}/catalog-cache {VOL}/data/catalog-cache
+docker restart felhom-controller >/dev/null
+grep -n 'repo_url' {VOL}/controller.yaml
+""")
+    print(out.replace(t, "<token>"))
+elif sys.argv[1] == "restore":
+    print(w.guest(f"""set -e
+cp -p {SAVE} {VOL}/controller.yaml
+rm -rf {VOL}/catalog-cache {VOL}/data/catalog-cache
+docker restart felhom-controller >/dev/null
+grep -n 'repo_url' {VOL}/controller.yaml; grep -c 'token: ""' {VOL}/controller.yaml || true
+cmp {SAVE} {VOL}/controller.yaml && echo RESTORED-IDENTICAL"""))
diff --git a/documentation/audits/r890-instructions-2026-10-06/tools/vwstep.py b/documentation/audits/r890-instructions-2026-10-06/tools/vwstep.py
new file mode 100644
index 00000000..b6113bb2
--- /dev/null
+++ b/documentation/audits/r890-instructions-2026-10-06/tools/vwstep.py
@@ -0,0 +1,76 @@
+"""vwstep.py <to-ref> — R-890: vaultwarden's step on scratch 9202 (drill catalog), ONE process, through the product.
+
+  1 install vaultwarden fresh at the live pin (this run installs it — the admin seed refuses otherwise);
+  2 seed through the household's door, the invite through the admin page INSIDE the box
+    (FELHOM_BOX_ADMIN_SEED=1, upgrade_fixtures_box.box_admin_seed_allowed); read it back (C1);
+  3 a DRILL-only commit moves the image and adds a ladder entry; sync, rescan;
+  4 the product's guarded Update; the seed read back; box verdict JSON;
+  5 remove through the product.
+Evidence: ../box/vaultwarden/step.txt + box-verdict-vaultwarden.json. The live entry is written ONLY by
+`upgrade-test.py --write-ladder` from both verdicts."""
+import json, os, re, subprocess, sys, time
+sys.path.insert(0, "/mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu/scripts")
+import box_walk as w
+import upgrade_fixtures_box as fixtures
+
+APP, SUB, SVC = "vaultwarden", "vault", "vaultwarden"
+to = sys.argv[1]
+HERE = os.path.dirname(os.path.abspath(__file__))
+EVD = os.path.join(HERE, "..", "box", APP); os.makedirs(EVD, exist_ok=True)
+log = open(f"{EVD}/step.txt", "a", buffering=1)
+D = "/mnt/5_hdd/felhom.eu/drill/app-catalog-drill"
+
+
+def say(*a):
+    w.say(*a); log.write(" ".join(map(str, a)) + "\n")
+
+
+fx = fixtures.FIXTURES[APP]
+w.login()
+if w.stack(APP).get("deployed"):
+    say("vaultwarden already installed on 9202 — removing it first (scratch box)")
+    w.remove(APP)
+w.sync_rescan()
+if not w.deploy(APP, SUB):
+    sys.exit(say("RESULT the install did not complete") or 1)
+tok = fx.seed(w, SUB, say)
+if tok is None or not fx.verify(w, SUB, tok, say):
+    say(f"RESULT C1 failed: {getattr(fx, 'tried', '')}")
+    w.remove(APP); sys.exit(1)
+say("C1 seed reads back BEFORE: True")
+before = (w.stack(APP).get("app_config") or {}).get("pinned_images")
+say(f"before: pinned={before}")
+subprocess.run(["git", "-C", D, "pull", "-q", "--rebase", "origin", "main"], check=True)
+comp, fy = f"{D}/templates/{APP}/docker-compose.yml", f"{D}/templates/{APP}/.felhom.yml"
+s = open(comp).read()
+frm = re.search(r"^\s+image:\s*(\S+)", s, re.M).group(1)
+open(comp, "w").write(s.replace("image: " + frm, "image: " + to, 1))
+entry = {"from": {SVC: frm}, "to": {SVC: to}, "verdict": "proven", "tested_at": "DRILL", "harness_version": 5,
+         "evidence": "DRILL (box proof in progress)", "marks": {"files_may_change": False, "needs_person": None, "memory_tight": False}}
+f = open(fy).read()
+f = (f.rstrip("\n") + "\n  - " + json.dumps(entry) + "\n") if "update_ladder:" in f else (f.rstrip("\n") + "\nupdate_ladder:\n  - " + json.dumps(entry) + "\n")
+open(fy, "w").write(f)
+subprocess.run(["git", "-C", D, "commit", "-q", "-am", f"DRILL {APP}: {frm} -> {to} (box proof, R-890)"], check=True)
+subprocess.run(["git", "-C", D, "push", "-q", "origin", "main"], check=True, capture_output=True)
+say("drill:", subprocess.run(["git", "-C", D, "log", "--oneline", "-1"], capture_output=True, text=True).stdout.strip())
+w.sync_rescan(APP, to)
+say(f"badge before: {w.badges(APP)}")
+since = w.guest("date -u +%Y-%m-%dT%H:%M:%SZ").strip()
+res = w.press_update(APP, poll=1, cap_s=1800)
+for p in res.get("phases", []):
+    log.write(f"  phase +{p['t']}s {p['phase']} | err={p['error']}\n")
+time.sleep(10)
+read = fx.verify(w, SUB, tok, say)
+lines = w.guest(f"docker logs --since {since} felhom-controller 2>&1 | grep -E 'update {APP}' | grep -v DEBUG | cut -c1-400")
+log.write(lines + "\n")
+st = w.stack(APP); after = (st.get("app_config") or {}).get("pinned_images")
+verdict = {"app": APP, "venue": "box 9202 (drill catalog), the product's guarded Update; seeded through the admin invite inside the box (R-890)",
+           "from": before, "to": after,
+           "verdict": "proven" if (res.get("final_phase") == "done" and read and (after or {}).get(SVC) == to) else "failed",
+           "seed_read_before": True, "seed_read_after": read, "healthy_after": st.get("state") == "running",
+           "duration_s": res.get("duration_s"), "final_phase": res.get("final_phase"), "measured_at": since,
+           "evidence": "felhom.eu/documentation/audits/r890-instructions-2026-10-06/box/vaultwarden/step.txt"}
+json.dump(verdict, open(f"{EVD}/box-verdict-{APP}.json", "w"), indent=2)
+say(f"badge after: {w.badges(APP)}")
+say(f"RESULT final_phase={res.get('final_phase')} after={after} seed_after={read} verdict={verdict['verdict']} ({res.get('duration_s')} s)")
+say(f"remove -> {w.remove(APP)}")
diff --git a/documentation/backlog/CLOSED-ITEMS.md b/documentation/backlog/CLOSED-ITEMS.md
index b79990e8..bab2d5e5 100644
--- a/documentation/backlog/CLOSED-ITEMS.md
+++ b/documentation/backlog/CLOSED-ITEMS.md
@@ -26,6 +26,16 @@
 
 ---
 
+## 2026-10-06 (afternoon) — instruction files kept true; vaultwarden on the ladder
+
+The full text of every row below: `git show 7d0dffcf34:documentation/backlog/OPEN-ITEMS.md`.
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-644** | **[P3-LOW] `gokapi` on scratch guest 9202 is crash-looping — 329 restarts by 2026-09-23 07:51 UTC, *password does not appear to be a SHA-1 hash* — and the controller still lists it deployed.** (P4) | CLOSED 2026-10-06 — NO LONGER PRESENT (live read) | 9202 at 11:47Z: no gokapi container and no gokapi volume (control: the same listing shows the six running containers); the controller lists only paperless-ngx and privatebin deployed — `audits/r890-instructions-2026-10-06/C/R-644-9202-live.txt`. |
+| **R-890** | **A vaultwarden update step still cannot be written to the ladder: the ladder writer needs the step proven on BOTH the bench and the box, and decision 146 keeps the admin seed on the bench only.** (P4) | CLOSED 2026-10-06 — BUILT AND PROVEN (decision 149): the test box seeds vaultwarden through its admin invite inside the box; the first vaultwarden step is in the ladder | catalog `6b4877d` (box_admin_seed_allowed, five conditions; BoxAdminSeedGuard red-proved) and `ecb8552` (vaultwarden 1.36.0-alpine -> 1.37.4-alpine written by --write-ladder); bench 9401 proven (anon peak 16.3 %, seed read back), box 9202 proven (guarded Update done 12.3 s, seed read back) — `audits/r890-instructions-2026-10-06/`. The Tester 1 box is allowed by the ruling but the walk has no route to it. |
+| **R-891** | **felhom.eu `CLAUDE.md` says `--fast` selects „all of them" — no longer true since the full-run-only `iso-bootstrap` gate (R-502, 2026-10-06).** (P4) | CLOSED 2026-10-06 — FIXED (decision 150: instruction files are kept true by the session) | felhom.eu `CLAUDE.md` „Gates — ONE entry point" now says the `GATES` table is the list (nineteen gates; the old copy named ten) and that `--fast` skips the full-run-only gates, naming them (today `iso-bootstrap`); `repo_gates.py` read: 19 gates, one not fast. |
+
 ## 2026-10-06 (midday) — R-444 live
 
 The full text of every row below: `git show bfdea832:documentation/backlog/OPEN-ITEMS.md`.
diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md
index 65f5893b..c122bb8f 100644
--- a/documentation/backlog/OPEN-ITEMS.md
+++ b/documentation/backlog/OPEN-ITEMS.md
@@ -132,7 +132,6 @@ stopping line that lies.
 | **R-762** | Apps & catalog | P3 | **[P2-MEDIUM] wger serves no CSS or JavaScript and no uploaded photo: every static file and every `/media/` file answers 404.** MEASURED 2026-10-01 on 9202 (drill catalog, the live template `82fff32`, wger 2.7), found by checklist rows 1.7 and 2.8: the login page links `/static/css/workout-manager.css`, `/static/bootstrap-compiled.css` — both 404 through traefik; the static root inside the container is empty (4 KB). A progress photo posted to `/api/v2/gallery/` answered 201 and the file is on the media volume, but `GET /media/gallery/…png` answers 404 signed in, without a session, and straight at the app inside the container. **Cause, read in the image:** the entrypoint runs `collectstatic` only when `DJANGO_DEBUG == "False"` and the template sets no `DJANGO_DEBUG`; and wger serves `/media/` only in development (`urls.py:393` „served like this during development only”) — upstream's production setup puts nginx in front for `/static` and `/media`. So the household gets an unstyled app and photos that never show. The same lines stand since the template was written (the 2026-09-29 template too). Not checked: whether any box runs wger (on 2026-09-30 none reported to the hub). **Needs:** `DJANGO_DEBUG=False` (collectstatic) and something that serves `/static` + `/media` (upstream's nginx sidecar, or the gunicorn switch of R-755 plus a static server), proven on the bench and on 9202 with a page that loads its CSS and a photo read back. Owner decides together with R-755 (same server question). `audits/new-app-checklist-2026-10-01/C/C8-signup-guest-media-static.txt`, `C/C4-seed-photo-size.txt` **-- 2026-10-01 (operator):** wger is `lifecycle: hidden` until this and its twin are fixed (catalog `55b8c8a`; read back on 9202: not on the app list, mealie control present). **Merged 2026-10-05 from R-755 (duplicate):** `templates/wger/docker-compose.yml` still sets no `WGER_USE_GUNICORN` — the gunicorn switch is the same server question. | **READY — rank P2-MEDIUM; owner: CC (catalog)** **Re-ranked 2026-10-03: P2→P3: wger is hidden from installs and no box runs it; needed only before it is offered again.** | — | — | CC |
 | **R-76** | Apps & catalog | P4 | **FileBrowser-created folders break the setgid chain, and a drop-zone's mode is not stable** **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-26, size S, roadmap state `idea (surfaced by the R-75 spike, 2026-07-26)`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** | — | Two related findings from `audits/SPIKE-catalog-data-paths-2026-07-26.md` P3/P5, both **pre-existing** and deliberately left alone by that spike. **(a)** FileBrowser Quantum 1.3.3 creates files `0644` and folders `0755` and does **not** propagate the setgid bit — even though the entrypoint wrapper's `umask 002` really is in effect (`/proc/1/status` `Umask: 0002`). Group inheritance itself works (a file uploaded into a 2775 group-100 dir landed group 100, not the process gid 1000), so the convention's *group* half holds and only its *mode* half is lost. The consequence is proven with a control: inside a UI-created `0755` folder a gid-1000 process's file landed group **1000**, while the identical write into the 2775 parent landed group **100**. So **any folder a customer creates through FileBrowser breaks the shared-group chain one level down.** Latent today — every userdata-touching catalog app that declares an identity declares uid/gid **1000**, the same uid FileBrowser runs as, so owner permissions mask it; it bites the day a content app runs as a different non-root uid with gid 1000. The comment at `infra/infra.go:156` is right that the image ignores `-e UMASK` but does not say t | CC |
 | **R-577** | Apps & catalog | P4 | **[P3-LOW] A guest SHARE visitor has no way to pick a language, and the household's setting is the wrong default for them.** FOUND 2026-09-18 by localisation slice 2 release C (R-557, controller v0.254.0): every other page a person can reach now carries a language globe — the dashboard (the household's setting), and the sign-in and claim pages (the visitor's own cookie). The two guest share pages (`launcher_shared`, `launcher_share_password`) deliberately do NOT, and `TestGuestSharePagesHaveNoGlobe` pins that so it stays a decision rather than an oversight. **Why it is the operator's and not CC's:** a share visitor is a stranger the household sent a link to, and what language they are shown is a promise the SHARE FEATURE makes, not an implementation detail. The `felhom_lang` cookie already built would fit them exactly (display-only, their own browser, never the household's setting). **Fix shape, if the operator says yes:** add `{{template "lang_globe" .}}` to both shells with the anonymous form, and one render case per page per language. | **READY - rank P3-LOW; owner: operator (the decision), CC (the change)** **Re-ranked 2026-10-03: P3->P4: feature decision for the operator; Hungarian default works today.** | — | — | operator |
-| **R-644** | Apps & catalog | P4 | **[P3-LOW] `gokapi` on scratch guest 9202 is crash-looping — 329 restarts by 2026-09-23 07:51 UTC, *password does not appear to be a SHA-1 hash* — and the controller still lists it deployed.** OBSERVED at the start of the 2026-09-23 session, not caused by it. The twenty-eight walk's teardown (2026-09-22) removed a `gokapi` container left by R-633 by name; a `gokapi` is running again, recorded `deployed: true`. Not investigated (scope). Likely the R-633/R-634 shape — a restore-then-remove race leaving a record — and a scratch-box fact, not a customer one; filed so the next drill does not read it as its own. | **OPEN — P3; owner: CC; investigate before the next drill on 9202** **Re-ranked 2026-10-03: P3→P4: seen only on a scratch test guest; the row itself calls it not a customer fact.** | — | — | CC |
 | **R-707** | Apps & catalog | P4 | **[P2] 37 apps still start with a login a stranger can take (`09` §3 decision 45).** Audit of all 53 apps: `app-catalog-felhom.eu/FIRST-ADMIN.md` (class, fix route, status, measured or read). Open: **3 hard-coded defaults** — calibre-web (`admin / admin123`, measured working on demo-hp and 9202; its own `cps.py -s` route needs a generated password WITH a special character — our generator is letters+digits, a controller change), mealie (`changeme@example.com / MyPassword`), wger (`admin / adminadmin`); **34 open first-run screens** (the first visitor creates the admin: actualbudget, adventurelog, audiobookshelf, calcom, docmost, emby, ghost, gitea, gramps-web, home-assistant, homebox, immich, jellyfin, komga, n8n, navidrome, opengist, outline, papra, plant-it, radarr, rallly, recipe-importer, romm, seerr, sonarr, sparkyfitness, tandoor, termix, uptime-kuma, vikunja, wanderer, wishlist, zipline). **Stale notes:** romm's `default_creds` `admin / admin` answers 401 on demo-hp (like a wrong password) — the page now warns with a login that does not exist; zipline's looks stale too. **Measured on demo-hp 2026-09-28 (read-only):** bookstack's default still logs in on the INSTALLED app (the fix is for new installs; the page now warns). Each fix: route (a) env or (b) the app's own CLI/API via `after_install:`, proven on 9202 with the default failing and the generated password working; route (c) a page sentence. Several sessions (operator, 2026-09-28). **2026-09-29 (controller v0.280.0, catalog `d0e7e2e`):** every class-3 app fixed — mealie, wger, calibre-web by `after_install` (calibre-web with the new `password:24:special`), proven on 9202 fresh installs (`audits/login-gate-2026-09-29/D/`); the setup gate (decision 46, spike PASSED) built and live on immich, n8n, audiobookshelf (probes measured) and uptime-kuma (button) (`…/C/`); romm's and zipline's stale notes removed. **Left: 30 class-4 apps** — gate each (probe measured on 9202 where one exists — 11 upstream candidates listed in `…/B/B-VERDICT.md` §3; the button otherwise). **2026-09-29 afternoon (controller v0.281.0, catalog `6faf432`):** 28 more class-4 apps gated — 32 of 34 — each proven on 9202 (`audits/gate-rollout-2026-09-29/`B): stranger → gate page / 401, household reached the first-setup screen, the gate opened (9 by a measured probe, the rest by the press), the app answered after. seerr, outline, rallly: gated, their opening needs a media server / e-mail (not proven). **Left:** wanderer (R-714); plant-it is not installable. | **NARROWED** (2026-10-03 triage: the row's verdict was finished, but it names open work no other row carries — seerr, outline and rallly are gated, but the gate OPENING is not proven (needs a media server / e-mail)) — **CLOSED — 2026-09-29 (the rest → R-714)** | — | — | CC |
 | **R-764** | Apps & catalog | P4 | **[P3-LOW] wger sends no mail: its mail backend is the console, so a password-reset mail never leaves the box, and the template maps no SMTP.** READ 2026-10-01 inside the app on 9202 (checklist row 7.1): `EMAIL_BACKEND django.core.mail.backends.console.EmailBackend`; the settings read `ENABLE_EMAIL`, `EMAIL_HOST`, `EMAIL_PORT`, `FROM_EMAIL` …; the template carries no `smtp_mapping`. The household's admin can reset another member's password in the app; a member who forgets theirs and asks wger by e-mail gets nothing, and the page does not say so. Not measured: what wger shows after a reset request. **Needs:** an `smtp_mapping` (vaultwarden's shape, a fresh install with mail OFF booting — REUSE.md §2), or the page saying mail is not available. `audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt` | **READY — rank P3-LOW; owner: CC (catalog)** **Re-ranked 2026-10-03: P3→P4: wger is hidden and no box runs it.** **2026-10-06: PUSHED** to the live catalog (`c265b37`; wger stays hidden). | — | — | CC |
 | **R-769** | Apps & catalog | P4 | **[P3-LOW] Pinchflat is not built: upstream is paused (no release in 2026, last push 2025-12-16) and its last release has no image tag.** READ 2026-10-01: ghcr's newest version tag `v2025.6.6`, `latest` amd64 only; runs as root by default; an unanswered 30 GB yt-dlp memory report (#866); third parties call it unmaintained (community-scripts #15968). Forks with images exist (Pinchflat-NGX, MorganKryze). **Needs:** the operator's word on a fork (a new upstream), after the YouTube sentence (R-767). `audits/new-apps-2026-10-01/FIT.md` | **WAITING-ON-OPERATOR — rank P3-LOW; owner: operator** **Re-ranked 2026-10-03: P3→P4: a new-app idea waiting on a decision.** | — | — | operator |
@@ -145,10 +144,9 @@ stopping line that lies.
 |---|---|---|---|---|---|---|---|
 | **R-440** | App updates | P3 | **[P2-MEDIUM] 23 catalog image pins float, so an update is not reproducible.** `compose pull` on a moving tag fetches whatever upstream published that day. **MEASURED 2026-09-01 over `app-catalog-felhom.eu` @ `29edad9c5bf4`: 79 `image:` lines across 53 apps, 66 distinct; 23 of those lines carry a tag with no patch version.** `postgres:16-alpine` (8 apps), `redis:7-alpine` (6), `mariadb:11.6` (2), plus one each of `postgres:15-alpine`, `postgis/postgis:16-3.5-alpine`, `mariadb:11.4`, `mariadb:12.3`, `ghcr.io/claperco/claper:2.5`, `ghcr.io/thomiceli/opengist:1.13`, `wger/server:2.6`. **A 24th is arguable and is recorded rather than rounded away:** `ghcr.io/immich-app/postgres:16-vectorchord0.4.3-pgvectors0.2.0` pins both extensions exactly but leaves the PostgreSQL patch floating. A customer pressing Frissites can therefore swap their DATABASE ENGINE build with no catalog change and no record; two boxes updated on two days end up different. **Severity MEDIUM on its own; it becomes BLOCKING the moment a pre-update copy exists**, because "what did we upgrade from and to" must be recordable and today it is not — which is also why R-440 must be read next to the digest discipline in Rule 10 of the spike. **MEASURED LIVE 2026-09-01 — the floating pins have ALREADY moved, with a passing control.** Running digests on demo-hp compared against what the registry serves for the same tag today: **`mariadb:11.4` MOVED** (`sha256:4f1d8d20...` -> `sha256:611a2fcc...`) and **`mariadb:12.3` MOVED** (`sha256:a02fe89c...` -> `sha256:dd9b303a...`), while `postgres:16-alpine`, `redis:7-alpine`, `mariadb:11.6` and `opengist:1.13` were SAME — **and both fully-pinned CONTROLS (`rommapp/romm:5.0.0`, `privatebin/pdo:2.0.5`) were SAME.** So on a box with ZERO visible drift by tag, pressing Frissites today silently swaps the DATABASE ENGINE build under `romm` and `bookstack`, with no catalog change and no record. **Compounding fact found while reading:** the recovery unit records `ImagePins` but the manifest comment says *"image NOT stored - re-pulled on restore"*, so a RESTORE of a floating-pinned app also re-pulls whatever is current — the same non-reproducibility on the recovery path. **HALF OF THE ANSWER SHIPPED 2026-09-02 (controller v0.233.0, slice 1): `app.yaml.installed_images` now records, per compose SERVICE, the reference AND the repo digest each container was actually created from — so "what did we upgrade FROM" is answerable on any box that has taken one lifecycle action since the upgrade.** What is still missing is the other half: comparing that digest against what the registry serves for the same tag TODAY, which needs a network call the render path deliberately does not make (see R-446). **The row therefore stays OPEN and its rank is unchanged** — recording a digest does not make a floating pin reproducible; it makes the drift measurable after the fact. `audits/SPIKE-app-update-2026-09-01.md` **— NIGHT 2026-09-23:** every image moved tonight (and the 21 backfilled moves) carries its resolved digest in the catalog's test record; the floating pins themselves still float until the box pulls by digest (`09` §6.4 part 6). **-- MEASURED 2026-09-30 on demo-hp 9201: a fresh install or a guarded Update renders `name:tag@sha256` from the ladder (`digest.go` `RenderWithLadderDigests`) — 9 of 20 services there run such a definition (adventurelog, docmost, paperless-ngx). The other 11 run TAG-ONLY definitions: bookstack, kimai, opengist, privatebin, romm were installed before v0.269.0 and not updated since, and `CarryDigests` (`digest.go:141`) keeps only a digest the running definition already has; bentopdf and calibre-web have no ladder at all. So a re-pull of those (a restore) takes whatever the tag serves that day. `audits/pg-last-six-2026-09-30/E/E2-digests-demo-hp.txt`.** **-- 2026-09-30 (evening):** calibre-web now has a ladder entry (`53a4a1d`), so a new install or a guarded Update renders its tested digest; bentopdf still has none. `audits/more-night-apps-2026-09-30/` **Merged 2026-10-05 from R-446 (duplicate):** the household-visible consequence — for these apps the „Naprakész" badge can never turn „behind" (`felhom-controller controller/internal/stacks/updateorder.go:96` returns false with no catalog digests / no test date); R-740 (same-tag re-test) is closed, so floating-tag drift for laddered apps is handled. | **NARROWED 2026-09-30 — floating only for (1) apps with no ladder entry and (2) apps installed before v0.269.0 until their next guarded Update; owner: CC.** **Re-ranked 2026-10-03: P2→P3: narrowed to apps with no ladder entry and pre-v0.269 installs; each guarded update fixes the latter.** | — | — | CC |
 | **R-462** | App updates | P3 | **[P2-MEDIUM] Widen the upgrade harness beyond three apps — and the cost is dominated by FIXTURES, not by machine time.** The R-449 harness works and is proven by a red negative control (`audits/SPIKE-upgrade-test-2026-09-06.md` §1). **Costed with this run's REAL numbers rather than an estimate:** a successful edge takes **6.4 s – 305.1 s, median 71.8 s**; a FAILING edge takes **556 s**, roughly **8×**, because a negative is only honest if it waits out the full settle window; 3 apps / 11 images cost **5.07 GB**, so 53 apps naively extrapolate to **~90 GB** and, at the median, about an hour of harness time for one edge each. **THAT EXTRAPOLATION UNDERSTATES THE REAL COST BY AN ORDER OF MAGNITUDE, and that is the point of this row.** Two of the three apps needed a bespoke non-browser seed route; one needed two attempts and a discarded approach; one (bookstack) can only ever be half-proven (R-460). **Fixture time scales with apps and does not amortise.** **The decision this row is really asking for is scope, not schedule:** all 53, or only the apps a customer would lose data from, or only apps whose catalog transition is a MAJOR. **Recommended shape, NOT a design — the operator picks:** start with the apps that carry a database, because §3 measured that the abort question only ever bites there. Owner: **VIKTOR rules on scope, CC implements.** `audits/SPIKE-upgrade-test-2026-09-06.md` §5 **ROW CORRECTED 2026-09-21: the scope is NOT open and this row said it was.** It read *"VIKTOR rules on scope"*; the operator ruled on 2026-09-13 (`09` §3 decision 6) that the upgrade test goes to **ALL** apps through the nightly rotation, explicitly *not* "database apps first". What is open is the WORK, not the scope. An ORDER inside that ruling — the 15 database services first, because that is where a wrong answer costs data rather than uptime — is costed as a drill brief in `09` §6.4: legs A–E ≈ **21–34 CC-hours** plus ~25–30 GB on a scratch host, with legs C (a PostgreSQL `pg_upgrade` rehearsal) and E (one automatic night on a throwaway) the two that unblock a decision. **-- UPDATE NIGHT 2026-09-21:** **The count moved from 3 apps to 21 EDGES ACROSS 19 APPS.** The update night walked real within-a-major upstream edges on scratch guest 9202 through the product's own guarded Update, each app seeded and read back through its OWN front door with a negative control on every readback: **14 proven, 3 failed, 4 inconclusive**. Proven: actualbudget, audiobookshelf, bookstack, docmost, grafana, home-assistant, mealie, n8n, navidrome, papra, privatebin, romm, vikunja, and nextcloud's MariaDB engine major. **Ten of the fourteen printed a verbatim migration line**, so the database really was rewritten and the data still read back. Box-side fixtures for 20 apps now exist at `audits/update-night-2026-09-21/fixtures.py`, and four (actualbudget, navidrome, audiobookshelf, vikunja) are ported into `app-catalog-felhom.eu/scripts/upgrade_fixtures.py` with seven new EDGES (U1-U7) so the same edges can be run on the harness venue **with their ABORT step**, which the box deliberately does not offer. **OWED, stated so it is not mistaken for done:** the U1-U7 harness RUNS (the code is in, the runs are not), and fixtures for the four inconclusive apps, of which two (vaultwarden, zipline) cannot be seeded at all while the catalog rightly closes their sign-up (see R-624). **-- 2026-09-23, the RomM lesson is IN THE HARNESS:** `upgrade-test.py` v2 runs every edge that read back under light load for `--soak` seconds (default 600) and reads the kernel's `oom_kill` counter host-side; a kill or restart turns `proven` into `failed`, a peak over 80 % of the limit adds `memory_tight`. **Red-proof:** romm 5.0.0 → 5.3.0 on the template AS PROMOTED (512M, four workers) — seeded, migrated, read back, and then **OOM-killed at +76 s** under four light callers, verdict `failed` (Docker's own OOMKilled read true here; restarts stayed 0, which is why the walk never saw it). Ten minutes is ample for this failure; demo-hp's first kill came at two hours only because nothing was loading it. Evidence `audits/update-rulings-2026-09-23/harness/`. **— NIGHT 2026-09-23:** the bench and the box now share ONE fixture set — the box walk's fixtures run on the bench through `upgrade_boxport.py` (ported verbatim into the catalog), plus a new wishlist fixture and fixes for opengist 1.15, komga (`/api/v2/users/me`) and nextcloud (wait for `occ status`). 14 apps / 15 edges tried; 12 proven on both venues and published with their test records (`audits/DRILL-night-2026-09-23.md` Part C). **-- 2026-09-30 (day brief): three new front-door fixtures (sparkyfitness, rallly, outline; catalog `e6f3ec2`) and five apps moved on both venues — the three PostgreSQL conversions (R-463) plus bookstack 26.05.5 → 26.09.1 and kimai apache-2.57.0 → 2.67.0 (upstream dropped the `apache-` prefix; the plain tag's digest equals `apache`'s, measured). The catalog currency and the next-apps ranking: `audits/catalog-currency-2026-09-30.md` — 25 of 53 apps behind upstream inside a major, 19 across one (morning); after the session **31 apps can update themselves at night (+ nextcloud with a whole copy)**, 32 carry a proven step, 21 have no ladder.** **-- 2026-09-30 (evening, more-night-apps brief): ten more steps published on both venues** — first ladders for calibre-web, gitea, wger, crafty-controller, uptime-kuma, zipline (new front-door fixtures; gitea's installer form), within-major steps for emby, ghost, home-assistant, outline, rallly. **Night-updatable by the audit's method (a): 30 + 2 conditional at the session's start → 35 + 3 conditional** (calibre-web conditional: `files_may_change`). zipline got a two-step ladder 4.6.1 → 4.7.0 → 4.8.0 (the direct jump fails, R-742). Stopped: wanderer (the bench cannot run it, R-739). Fixture/harness defects fixed on the way: R-735, gitea's installer, the HTTPS backend on the bench, per-file names for `files_may_change`. `audits/more-night-apps-2026-09-30/` | **READY — rank P2-MEDIUM; owner: CC (scope already ruled, `09` §3 decision 6)** **Re-ranked 2026-10-03: P2→P3: 35+ apps already update by proven steps; an app without a ladder simply does not move, which is safe.** | — | — | CC |
-| **R-469** | App updates | P3 | **[P3-LOW] REMOVE THE ENGINE-MAJOR RULE when Slice 4 (R-448) ships — a tracked act, not a lapse.** Since 2026-09-13 `app-catalog-felhom.eu` `CLAUDE.md` rules that *until the Update button takes a verified backup as its precondition, no template may move a database-engine image across a major version* (four MariaDB, eleven PostgreSQL services), and `scripts/check-engine-major.py` (fourth row of `catalog_gates.py`, run by `.githooks/pre-push` with the push range) refuses one, naming the rule and this expiry. **Why the rule:** every `mariadb:` sidecar now carries `MARIADB_AUTO_UPGRADE=1` (R-459), so a MariaDB major move CONVERTS the customer's datadir on the next Update; PostgreSQL converts nothing and refuses to start (R-463). Either way a customer-data event with no backup in front of it. **Honest limit, not re-filed:** the gate needs a parent commit and CI fetches at `--depth 1` — the R-452 gap — so on a shallow clone the runner skips it out loud and only the hook bites. **When R-448 ships:** delete the CLAUDE.md rule, the gate's row and the gate, in one commit that cites this row; then close this. **2026-09-13 — UNBLOCKED, NOT LIFTED.** R-448 shipped in controller v0.237.0/v0.238.0 (slice 4): an update now refuses without a restorable, proven Tier-2 copy, backs up first when it is stale, takes a safety dump, and holds an app that does not come up — the precondition this rule was waiting for. **The rule stays in force until someone deliberately removes it**, which is a separate act (and is worth weighing against R-475: an app with no Tier-2 copy cannot be updated at all, so the guard does not yet cover every app a major engine move would touch). **HALF-LIFTED 2026-09-21, catalog `5ff36d098cbc`.** Slice 4 shipped 2026-09-13, so the rule's own expiry condition is met — **for MariaDB**: the four `mariadb:` sidecars have both halves they need, a verified backup in front of the Update (any tier since v0.239.0) and `MARIADB_AUTO_UPGRADE=1` whose conversion the harness WATCHED run on E3/E3b with the seeded data read back after. **PostgreSQL and MySQL stay refused** — postgres performs no `pg_upgrade` and REFUSES to start on an older major's datadir across eleven templates (R-463); a backup is a route BACK, not a conversion. The refusal text now cites R-463 instead of the shipped R-448. **R-450's second half is enforced in its place:** a MariaDB major must be the ONLY image move in its template in that commit (the bookstack `0b73e5e` shape — two migrations behind one edge). The gate now PRINTS what it allowed, by name — a lifted rule that goes quiet is a lifted rule nobody can audit. Two new decoy cases; two red-proofs, each seen to fail; 40 cases green. **What remains of this row:** the PostgreSQL half, which is R-463's to clear — see `09` §3b **Q5**. **-- NARROWED 2026-09-25 (evening), catalog `6a4a5f0`, `09` §3 decision 35:** the PostgreSQL half now passes ONE app at a time — only a template whose ladder entry for the step is proven on BOTH venues and carries `engine_conversion` (the box converts it, controller v0.273.0), as the only image move in its commit. Every other PostgreSQL app stays refused; the postgis family is judged now (it was not). CLAUDE.md rule text updated the same commit. Decoys + red-proof: `audits/night-2026-09-26/C/`. | **NARROWED** — **PARTLY CLOSED 2026-09-21 — MariaDB lifted; the PostgreSQL half stands until R-463** | — | — | CC |
+| **R-469** | App updates | P3 | **[P3-LOW] REMOVE THE ENGINE-MAJOR RULE when Slice 4 (R-448) ships — a tracked act, not a lapse.** Since 2026-09-13 `app-catalog-felhom.eu` `CLAUDE.md` rules that *until the Update button takes a verified backup as its precondition, no template may move a database-engine image across a major version* (four MariaDB, eleven PostgreSQL services), and `scripts/check-engine-major.py` (fourth row of `catalog_gates.py`, run by `.githooks/pre-push` with the push range) refuses one, naming the rule and this expiry. **Why the rule:** every `mariadb:` sidecar now carries `MARIADB_AUTO_UPGRADE=1` (R-459), so a MariaDB major move CONVERTS the customer's datadir on the next Update; PostgreSQL converts nothing and refuses to start (R-463). Either way a customer-data event with no backup in front of it. **Honest limit, not re-filed:** the gate needs a parent commit and CI fetches at `--depth 1` — the R-452 gap — so on a shallow clone the runner skips it out loud and only the hook bites. **When R-448 ships:** delete the CLAUDE.md rule, the gate's row and the gate, in one commit that cites this row; then close this. **2026-09-13 — UNBLOCKED, NOT LIFTED.** R-448 shipped in controller v0.237.0/v0.238.0 (slice 4): an update now refuses without a restorable, proven Tier-2 copy, backs up first when it is stale, takes a safety dump, and holds an app that does not come up — the precondition this rule was waiting for. **The rule stays in force until someone deliberately removes it**, which is a separate act (and is worth weighing against R-475: an app with no Tier-2 copy cannot be updated at all, so the guard does not yet cover every app a major engine move would touch). **HALF-LIFTED 2026-09-21, catalog `5ff36d098cbc`.** Slice 4 shipped 2026-09-13, so the rule's own expiry condition is met — **for MariaDB**: the four `mariadb:` sidecars have both halves they need, a verified backup in front of the Update (any tier since v0.239.0) and `MARIADB_AUTO_UPGRADE=1` whose conversion the harness WATCHED run on E3/E3b with the seeded data read back after. **PostgreSQL and MySQL stay refused** — postgres performs no `pg_upgrade` and REFUSES to start on an older major's datadir across eleven templates (R-463); a backup is a route BACK, not a conversion. The refusal text now cites R-463 instead of the shipped R-448. **R-450's second half is enforced in its place:** a MariaDB major must be the ONLY image move in its template in that commit (the bookstack `0b73e5e` shape — two migrations behind one edge). The gate now PRINTS what it allowed, by name — a lifted rule that goes quiet is a lifted rule nobody can audit. Two new decoy cases; two red-proofs, each seen to fail; 40 cases green. **What remains of this row:** the PostgreSQL half, which is R-463's to clear — see `09` §3b **Q5**. **-- NARROWED 2026-09-25 (evening), catalog `6a4a5f0`, `09` §3 decision 35:** the PostgreSQL half now passes ONE app at a time — only a template whose ladder entry for the step is proven on BOTH venues and carries `engine_conversion` (the box converts it, controller v0.273.0), as the only image move in its commit. Every other PostgreSQL app stays refused; the postgis family is judged now (it was not). CLAUDE.md rule text updated the same commit. Decoys + red-proof: `audits/night-2026-09-26/C/`. **-- RE-READ 2026-10-06 (afternoon, `09` §3 decision 150): the removal condition is NOT met, and the rule has stopped being one that expires.** R-463 closed 2026-09-30 (8 of 11 PostgreSQL apps converted by the box; zipline, adventurelog and immich stay on 16 by decision 42), but the gate is now how decision 35 is enforced: a PostgreSQL major passes only with a two-venue ladder entry carrying `engine_conversion`. Removing it would let an unproven PostgreSQL major ship (the image refuses to start on the old datadir, R-463) — a loosened fence, which needs the operator. What is still missing for removal: nothing CC can build; only a decision that decision 35's check is no longer wanted. Same edit: the catalog `CLAUDE.md` rule's stale counts corrected (five MariaDB services with grimmory; twelve PostgreSQL-family, postgis and immich counted). | **NARROWED 2026-10-06** — PARTLY CLOSED 2026-09-21 (MariaDB lifted); the PostgreSQL half is now decision 35's permanent per-app check | — | Operator: (A) close this row — the gate stays as decision 35's permanent check (CC's pick); (B) keep it open as a reminder. If nothing: the row stays open; the gate keeps working either way | operator |
 | **R-683** | App updates | P3 | **[P3-LOW] Watch: after a power cut during an update's health check, the hold named an HOUR-OLD second-drive copy, not the one the update's own backup should have just made.** 2026-09-24 chaos round 3 (nextcloud, `backup_max_age: 1m`): no `backing-up` phase was seen and the hold named Tier 2 at 13:04 for an update pressed at 14:04; the pre-cut controller log was lost with the container (the runner now saves it at arm time — R-320). Round 11, the same action without a power cut, named a fresh 14:34 copy and logged the Tier-2 copy. The sentence was TRUE (it named the copy it offered); the question is why the update did not back up first. Not reproduced; watch the next power-cut drill. `audits/night-2026-09-24/E/round-03*.json`, `E/round-11-controller-pre.log` | **OPEN — P3; owner: CC (watch)** | — | — | CC |
 | **R-785** | App updates | P3 | **[P3-LOW] SparkyFitness is pinned 11 releases and a major behind upstream (v0.17.3; upstream v1.7.3, v1.6.0 dated 2026-07-24).** READ 2026-10-01 (`audits/visitors-2026-10-01/C/bench/C1-previous-tag.txt`). **Needs:** an update walk 0.17 → 1.x through the ladder (bench + box), after R-784 is decided. | **OPEN — rank P3-LOW; owner: CC (after R-784)** | — | — | CC |
-| **R-890** | App updates | P4 | **A vaultwarden update step still cannot be written to the ladder: the ladder writer needs the step proven on BOTH the bench and the box, and decision 146 keeps the admin seed on the bench only.** Found 2026-10-06 building R-624: the bench now seeds vaultwarden through its admin invite (proven on bench 9401), so the bench answers abort and memory; the box walk (scratch 9202) still cannot seed it, so no vaultwarden step is ever written. | **OPEN — filed 2026-10-06** | — | Operator: (A) the box walk may use the admin token on scratch 9202, or (B) the writer accepts a vaultwarden entry proven on the bench alone. If nothing: vaultwarden updates stay unwritten (by hand only) | operator |
 
 ## Backup & restore — 34 rows (P2 8, P3 11, P4 15)
 
@@ -307,7 +305,6 @@ stopping line that lies.
 | **R-805** | Process & tooling | P4 | **[P3-LOW] The volume-persistence gate judges an empty NAMED volume (R-788) but not an empty BIND mount.** MEASURED 2026-10-02 (`audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md`): Grimmory's `/app/data` bind held 0 files and read CLEAN (its state is in MariaDB); komga, paperless-ngx, radarr and sonarr also carry empty binds that are not judged. **Needs:** decide whether an empty bind after the exercise is UNDETERMINED like a named volume, with a decoy. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: a test-gate rule; no household meets it.** | — | — | CC |
 | **R-806** | Process & tooling | P4 | **[P3-LOW] The gate's GET exercise speaks plain http to an HTTPS backend (crafty-controller :8443), and gramps-web did not answer on :5000.** MEASURED 2026-10-02 (`audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md`): both reached data only through their fixture seed. **Needs:** read the `loadbalancer.server.scheme` label (upgrade_boxport already does); find why gramps-web's first GET got no answer. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: a test-gate defect; no household meets it.** **NARROWED 2026-10-05 (app-catalog `4828dc7`): the harness GET now uses the traefik scheme label (https + -k for crafty-controller). LEFT: gramps-web :5000 not answering — a live look on a box.** | — | — | CC |
 | **R-807** | Process & tooling | P4 | **[P3-LOW] 13 apps stay UNDETERMINED because their seeds write only to the database, so their upload / media / cache / redis volumes stay empty.** MEASURED 2026-10-02 (`audits/persistence-sweep-2026-10-02/A/sweep/TABLE.md`): claper, crafty-controller, dawarich (redis), docmost, gramps-web, immich (ML cache), outline (+redis), sparkyfitness, tandoor, vikunja, wger, wishlist, zipline — plus plex (no seed route: a plex.tv claim token) and wanderer (no fixture; unhealthy under the gate). None is BROKEN: nothing was written outside a preserved folder. **Needs:** per app, a seed that uploads one file (or the volume named n/a with a reason: a redis cache, an ML model cache). | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: test coverage; nothing was found broken.** | — | — | CC |
-| **R-891** | Process & tooling | P4 | **felhom.eu `CLAUDE.md` says `--fast` selects „all of them" — no longer true since the full-run-only `iso-bootstrap` gate (R-502, 2026-10-06).** An instruction file; the session may not edit it. | **OPEN — filed 2026-10-06** | — | Operator: change the line in felhom.eu `CLAUDE.md` „Gates — ONE entry point" to say `--fast` skips the full-run-only gates (today: `iso-bootstrap`) | operator |
 
 <!-- DUE-CHECKS-BEGIN — machine-readable. Parsed by scripts/due_checks_gate.py.
      One row per dated check. The R-number must have a row above. Dates are UTC.
diff --git a/documentation/runbooks/workspace-CLAUDE.md b/documentation/runbooks/workspace-CLAUDE.md
index 48c4f18d..e38161f3 100644
--- a/documentation/runbooks/workspace-CLAUDE.md
+++ b/documentation/runbooks/workspace-CLAUDE.md
@@ -57,9 +57,6 @@ roles. **A file being open in the editor is NOT an instruction. If no task is st
    "working" and "stopped entirely". **And the control must come from a DIFFERENT channel than the measurement** (R-286):
    same query, same snapshot, same API or same clock all share the defect they are meant to catch — a
    stale hub snapshot once "confirmed" itself (2 events all day) while the operator's mailbox held eight
-   alarms. A hub-state check copies `hub.db-wal` too, or asks the running pod. **And the control must come from a DIFFERENT channel than the measurement** (R-286):
-   same query, same snapshot, same API or same clock all share the defect they are meant to catch — a
-   stale hub snapshot once "confirmed" itself (2 events all day) while the operator's mailbox held eight
    alarms. A hub-state check copies `hub.db-wal` too, or asks the running pod.
 4. **A recommendation that is not followed gets one line saying why.** Silence reads as agreement and
    the disagreement is lost.