E-2d teardown complete: drill customer + host removed from the hub

The delete was correctly refused at four successive gates while the host still
read ONLINE (acknowledgements -> typed confirm_id -> expect_hosts stale-preview
-> "host is ONLINE"). Rather than force it, the run waited for the destroyed
host to age to DOWN; delete-impact then reported deletable:true and the
documented cascade ran:

  host deleted (escrow demoted to retained custody), tenantsync deprovisioned,
  PBS tenancy deprovisioned, claim reset to unclaimed, residue purged
  (reports=5 app_telemetry=5 notif_prefs=1 appliance_registrations=1)

Verified after: 0 occurrences of "e2d" anywhere on the hosts page; demo-felhom
and demo-hp ONLINE on agent 0.113.0; drill-r50 and peti-felhom unchanged;
demo-hp carries only guest 9201 and VM 300.

Scoping checked rather than assumed: the single purged appliance_registration
was this run's own appliance (810d10c5, bound to e2d-fresh). The unrelated stale
2026-07-25 appliance (206c8838 / QWA-WJE) was NOT touched by the cascade — the
operator removed it separately.

- OPEN-ITEMS.md: the drill-cleanup WATCHING row is removed (done, not open).
- audits/E2D-fresh-vm-2026-07-29.md §8 + REPORT-e2d.md: teardown recorded as
  complete, with the cascade output and the appliance-scoping note.

documentation/audits/E2D-fresh-vm-2026-07-29.md

@@ -241,18 +241,27 @@ the claim flow end to end (code → password → `401 "dashboard not yet claimed
 - Drill VM (golden bake) torn down per GL-1 earlier: guest 9100 purged, secrets shredded, disk restored
   to `virgin`, token-leak grep 0.
 
-**Hub records NOT yet removed — stated, not silent.** `e2d-fresh` + host `e2d-fresh-ac9f09` remain.
-The delete was attempted and **correctly refused** at four successive gates: acknowledgements → typed
-`confirm_id` → `expect_hosts` stale-preview → finally `host e2d-fresh-ac9f09 is ONLINE`. The host is
-online only because its last report is recent; the VM is destroyed, so it ages OK → WARN (30 m) → DOWN
-(>1 h) and is then deletable. **Cleanup command, once it reads DOWN:**
+**Hub records removed — teardown COMPLETE.** The delete was first attempted while the host still read
+ONLINE and was **correctly refused at four successive gates**: acknowledgements → typed `confirm_id` →
+`expect_hosts` stale-preview → `host e2d-fresh-ac9f09 is ONLINE`. Rather than force it, the run waited
+for the destroyed host to age OK → WARN → DOWN, at which point `delete-impact` reported
+`{"deletable":true,"status":"down"}` and the documented cascade ran:
 
 ```
 POST /configs/e2d-fresh/delete  ack_hosts=1 ack_reset=1 ack_purge=1 confirm_id=e2d-fresh expect_hosts=1
+→ customer DELETE cascade started (journal #4, 1 host)
+→ host e2d-fresh-ac9f09 deleted (escrow DEMOTED to retained custody)
+→ tenantsync: deprovision ok (ns=e2d-fresh, existed=false); PBS tenancy deprovisioned
+→ claim reset to unclaimed; residue purged (reports=5 app_telemetry=5 notif_prefs=1
+  appliance_registrations=1)
+→ customer DELETE cascade COMPLETE — full teardown
 ```
 
-Tracked in `OPEN-ITEMS.md`. Deleting rather than keeping is deliberate — R-93 records what a
-half-real fixture costs.
+Verified after: **0** occurrences of `e2d` anywhere on the hosts page; demo-felhom + demo-hp ONLINE on
+agent 0.113.0; `drill-r50` and `peti-felhom` unchanged; demo-hp carries only guest 9201 and VM 300.
+Deleting rather than keeping was deliberate — R-93 records what a half-real fixture costs.
 
-**Also still present:** the stale unclaimed appliance from 2026-07-25 (`206c8838…`, code `QWA-WJE`).
-Not mine; not discarded. A future run must distinguish its own appliance from it.
+**Scoping note, checked rather than assumed:** the cascade purged `appliance_registrations=1` — that
+one was **this run's own** appliance (`810d10c5…`, bound to `e2d-fresh`). The unrelated stale appliance
+from 2026-07-25 (`206c8838…`, code `QWA-WJE`) was **not** touched by the cascade; the operator removed
+it separately. A future run must still distinguish its own appliance from any pre-existing one.