chaos night: the morning note and the report

STATUS.md gets the morning note in the rules' order - decisions (none under the
unattended rule), what was exercised, what broke (nothing in the product; three
fixes worth making, all filed), rows (five opened, none closed), what could not
be tested, cleanup, and what needs the operator with the cost of doing nothing.

REPORT-chaos-night-2026-09-17.md follows template section 15 and names the
prompt's wrong claims first. It is a separate file because REPORT.md holds the
earlier session's write-up and this repo's rule forbids clobbering it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -1,5 +1,63 @@
 # STATUS — what works, what's broken, what's next
 
+**Updated 2026-09-17 (morning after chaos night) — twelve rounds of a household under accidents; the box healed itself every time.**
+
+> **Ready for a volunteer: still yes.** For a night I did random household things on a fresh box
+> while random things went wrong: a power cut in the middle of a restore, the reset button four
+> seconds into another, a full disk, a dead tunnel, Docker restarting, the internet cut three times,
+> and the data drive pulled out of the running machine for twenty minutes. **No customer data was
+> lost, and the box put itself back together every time without anyone touching it.** Seventeen
+> alarms went off. All seventeen were true, none were missing, and every one reached your mailbox.
+
+**Decisions I took.** None under the unattended rule. Two judgement calls are logged in the drill
+record: one round ran „use" instead of the drawn „update" because the app catalog's own checks could
+not vouch for the update; and I did not touch the box at all during the final control round.
+
+**What I exercised.** A new golden was baked and published. A fresh box installed itself from the
+public installer image and bound itself with no press from anyone — both emergency presses I was
+allowed stayed unused, and the automatic re-issue after a deleted box was seen working live for the
+first time. Then twelve rounds, drawn in advance from a fixed seed and written down before the first
+one started.
+
+**What broke, and whether it is fixed.** Nothing in the product broke. Three things are worth
+fixing, all filed, none fixed tonight (no product code was allowed):
+- If the machine stops during a restore, **nothing ever tells the household whether it finished.**
+- The „this box has gone quiet" alarm allows exactly two report cycles, so **one missed report uses
+  the whole allowance** — tonight a healthy box came within one second of paging you.
+- A disk that fills up and empties again between the daily checks is never mentioned to anyone.
+Two smaller ones were filed earlier in the night: the first-hour guide asks for the recovery code
+about seventeen minutes before the box can accept it, and a small-disk box keeps retrying a local
+backup that can never fit (the off-site copy still worked).
+**Most of what broke tonight was my own measuring.** Eleven times a check of mine gave a confident
+wrong answer; each is written down with its fix. The worst one delayed the last cleanup step by six
+hours.
+
+**Rows.** Five opened, none closed. The register went from about 212 open rows to about 217 (my own
+count this morning reads 215; the difference is how closed rows are counted, not a missing row).
+
+**What I could not test.** Restoring a single app from the off-site copy. This box was a rebuild of
+an existing customer, so its old off-site app backups belong to a key it no longer has — correct and
+by design, and the box told you so within seconds. The whole-machine off-site copy **is** there and
+intact, but I only listed it; I did not restore from it.
+
+**Cleanup.** The test machine is gone, its space is back, both demo boxes are still running, and the
+off-site backups are untouched. The deleted box's record is gone from the hub; its key is held in
+retained custody, as designed, and the customer account is untouched.
+
+**Needs you.**
+1. **Nothing blocking.** A volunteer can start.
+2. **The quiet-box alarm margin.** Pick one: wait three report cycles instead of two, or retry a
+   failed report once straight away. If you do nothing: one network hiccup at the wrong moment pages
+   you about a box that is fine.
+3. **The restore record.** If you do nothing: a household whose power fails mid-restore is never
+   told whether their restore happened.
+4. **Single-app restore from off-site is still unproven on this release.** If you do nothing: it
+   stays unproven until a box that is not a rebuild is used for a drill.
+
+---
+
+## Previous note
+
 **Updated 2026-09-16 (late evening) — the box now asks for the recovery code, and the page stops promising a copy that has not run.**
 
 > **Ready for a volunteer: yes.** The one thing standing in the way this morning is fixed. On a new