chaos night: ep0 baseline and Phase 2 readiness, taken without touching the box

ep0 baseline (read-only, nothing removed, no prune): three namespaces, each
with ct/9201 holding 2 snapshots, six in total, 16G used of 98G. The teardown
repeats this listing so 'the backups stayed' is a comparison, not an assertion.

Phase 2 readiness: scratch guest 9202 is running with a healthy controller and
restic 0.14.0 inside the controller container, but has NO off-site target
configured - so the restore will need the box's own repository address and
password handed to it.

Recorded decision: I did NOT read those from the box while round 12 ran. Round
12 is the closing control round and its whole value is that nothing was done to
the box during it. The read costs nothing to defer; the round cannot be re-run.

Also recorded: the eighth instrument slip - perl locale warnings plus a head
that cut the output before the marker returned an empty block that looked like
'9202 has no containers'.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/audits/evidence-chaos-night-2026-09-17/ep0-baseline.txt

@@ -0,0 +1,17 @@
+# ep0 off-site store - BASELINE taken 2026-09-17T00:17:15Z, READ ONLY
+# Purpose: the teardown must show the off-site backups STAYED and nothing was removed.
+# One listing at the end cannot prove that. This is the "before" half of the pair.
+# Nothing was written, nothing pruned, and the .chunks store was deliberately not walked.
+
+host       felhom-hetzner (167.233.158.164, reached from DooPlex)
+datastore  felhom-offsite -> /mnt/pbs-datastore
+
+namespaces      demo-felhom, demo-hp, tester-1
+backup groups   ns/demo-felhom/ct/9201
+                ns/demo-hp/ct/9201
+                ns/tester-1/ct/9201        <- tonight's box (tester-1-022354)
+snapshots       2 in EACH group, 6 in total
+disk            /dev/sdb 98G total, 16G used, 83G available, 16% used
+
+At teardown this listing is repeated. The expected result is that every group and snapshot above is
+still present; the tester-1 group may have MORE snapshots if a backup ran, and must never have fewer.

documentation/audits/evidence-chaos-night-2026-09-17/phase2-readiness.txt

@@ -0,0 +1,29 @@
+# Phase 2 readiness, checked DURING round 12 without touching the box under test
+# 2026-09-17T00:15-00:16Z
+
+## Scratch guest 9202 is ready to receive an off-site restore
+  pct list          9201 demo-hp (running), 9202 demo-hp-scratch (running)
+  9202 containers   felhom-controller Up 5 hours (healthy), filebrowser Up 3 days, traefik Up 3 days
+  restic            0.14.0, INSIDE the controller container (as the design requires - every path it
+                    touches must be under /mnt)
+  off-site target   NOT configured on 9202
+
+## The constraint that follows, found before it could waste time at 05:00
+To restore one DB-backed app from off-site onto 9202, 9202 must be pointed at the BOX'S restic
+repository - which needs that repository's address and its password. The password is minted per
+guest, so 9202 cannot derive it; it has to be read from the box and handed over.
+
+## A DELIBERATE DECISION: I am not reading that from the box yet, and why
+Round 12 is the closing CONTROL round. Its entire value is that nothing was done to the box while
+it ran. Authenticated reads against the controller during it would add load and log lines to the one
+round whose meaning is "nothing happened". The read costs nothing to defer and the round cannot be
+re-run, so it waits until round 12 closes.
+Recorded here rather than left as an unstated habit, because a control round that was quietly
+touched is worth nothing and nobody could tell afterwards.
+
+## My own instrument slipped again getting this far (the eighth)
+The first version of this check drowned in perl locale warnings from `pct`, and my `head -12` cut
+the output before the real lines were ever reached. It returned an empty marker block that looked
+like "9202 has no containers". The fix was LC_ALL=C on the remote plus filtering the warning lines,
+and not truncating before the marker. Same class as every other instrument fault tonight: a probe
+that can drop its own result silently is not a measurement.