rehearsal 2026-10-20: post-night scenario plan written before any result

documentation/audits/rehearsal-2026-10-20/A6-plan/order.md

@@ -49,3 +49,24 @@ the filler goes to a share with Felhőmentés OFF and is deleted before the nigh
 (shortened to one manual run + the catch-up, not a night — same reason). After the night: #7 DST, #8 wrong clock,
 #10 three days off (+#15 inside it), #1 power cut mid install, #14 kept data, #11 if an update exists (none expected —
 the catalog is frozen). Reason: the clock scenarios move the box's time and would spoil the first night's record.
+
+## Amendment 2026-10-20 20:40 UTC — before any post-night scenario ran
+
+- **#1 and #14 ran before the night** (20:00–20:14), not after it: they do not move the clock, so they could not spoil
+  the night's record, and the morning is short. Their results are in `B6-failures/s1-…` and `s14-…`. The drawn order of
+  the remaining scenarios is kept: #7, #8, #10 (+#15), #11.
+- **The morning starts when the night chain has visibly ended** (the whole-box backup on local and PBS dated tonight,
+  B5 expectation 4), not at the end of the 04:30–08:30 window.
+- **#7 DST, shortened window:** the VM starts with its clock at 2026-10-25 02:15 CEST (00:15Z), NTP blocked (UDP 123,
+  TCP 4460) at the VM's tap, and runs to 02:45 CET (01:45Z) — 90 real minutes. That holds the whole repeated hour and
+  the 02:30 database copy at BOTH occurrences. The 03:30 and 04:15 jobs are outside the window (they have a single
+  occurrence; the replay covers them). The VM starts 4 days „later" than its last backup — a catch-up that fires at
+  once is recorded as a side effect of the method, not as a DST result.
+- **#8 wrong clock at boot:** −2 years for 15 min, then +2 years for 15 min, then the real time; NTP blocked throughout,
+  then unblocked. What is watched: the box's own pages, what it sends to the hub, and — after the return to real
+  time — whether the whole-box backup becomes due again (D3/T11 is its live test).
+- **#10 three days off (+#15):** stop the VM; start it with the clock 3 days ahead (NTP blocked); during the catch-up
+  restart it once (#15); then real time.
+- **Off-site stays open during #7/#8/#10** — a real box has it. The product's own guard refuses future-dated off-site
+  snapshots in its retention; what the box writes off-site with a wrong clock is part of what is measured.
+- **#11** runs only if an update is offered; none is expected (nothing is released during the run).