register: R-537/R-538/R-536 closed, R-534's grant recorded, three rows opened

Closed with live proof on demo-hp (controller 0.244.0): the per-tier label and the
restore refusal. R-536 closed with its red-proofs and the hub's two new event types.

R-534 carries the measurement that matters: DatastorePowerUser is Backup+Prune only,
PBS has no custom roles, so DatastoreAdmin at the datastore root for the hub's user
is the narrowest grant that works. The row stays open until a re-issue is seen to
succeed end to end.

Opened: R-539 (a second, slower restart counter — the operator's ruling, for the
nightly), R-540 (one pool box, no selection rule when it fills), R-541 (no path to
move a customer between off-site boxes).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/audits/evidence-backup-promise-2026-09-16/phaseC-reissue.txt

@@ -0,0 +1 @@
+## 2026-09-16T15:12:32Z Part C.2 — the PBS re-issue on tester-1's REAL state, now that the grant exists

documentation/audits/evidence-backup-promise-2026-09-16/phaseD-iso-gate.txt

@@ -43,3 +43,29 @@
     /etc/felhom is created by the script at runtime: 0 call(s)
   G11 checksum file beside the image: 1 [expect 1]
   G12 bucket stays private — not re-tested here; the 2026-09-15 publication proved it and nothing about the bucket changed.
+  G13 CORRECTED — my first check listed only FILES, so a shipped DIRECTORY could not appear:
+    directories in the package: usr lib etc usr/local lib/systemd etc/felhom usr/local/sbin lib/systemd/system 
+    /etc/felhom shipped?        YES
+    (ISO 1.26.1 shipped it for exactly this reason — the bootstrap writes its state there.)
+## VERDICT — the mechanical criteria, run against the exact file that would be uploaded
+##   G1 no answer.toml .............. PASS (0)
+##   G2 no root password or hash .... PASS (0)
+##   G3 no SSH key baked ............ PASS (0)
+##   G4 no customer identity ........ PASS (0)  — searched for enkicsifelhom/enkisfelhom/tester-1/demo-hp
+##   G5 credential enumeration ...... PASS (0 for every pattern; the patterns are listed above, so
+##                                    "no hits" means "searched and absent", not "nothing occurred to me")
+##   G6 boot menu ................... PASS — 2 interactive entries, timeout 15
+##   G7 package at a recorded version PASS — felhom-bootstrap_1.28.0_all.deb
+##   G8 postinst ends exit 0 ........ PASS
+##   G9 payload matches repo HEAD ... PASS — felhom-bootstrap.sh byte-identical to c033b3b
+##   G10 build inputs committed ..... PASS — 0 uncommitted files under scripts/iso, HEAD == origin/main
+##   G11 checksum beside the image .. PASS (the round trip is only possible after publication)
+##   G12 bucket stays private ....... NOT RE-TESTED — nothing about the bucket changed since the
+##                                    2026-09-15 publication that proved it. Stated, not implied.
+##   G13 dirs the payload writes into PASS — /etc/felhom is shipped (my first check was wrong: it
+##                                    listed only files, so a directory could not appear)
+##   G15/G16 console strings ........ PASS — the new bound banner is in the shipped payload; the
+##                                    pairing banner remains for the waiting state; the single `8006`
+##                                    hit is a COMMENT explaining why pvebanner is masked, not output.
+## STILL OWED BEFORE PUBLICATION: the proof install from THIS image on BOTH menu entries. That is
+## Part E's install, and the operator's yes comes after it.

documentation/audits/evidence-backup-promise-2026-09-16/phaseE-bake-full.log

@@ -0,0 +1,2 @@
+cat: /root/.gitea-token: No such file or directory
+/root/bake-run.sh: line 4: /root/build-golden.sh: No such file or directory

documentation/audits/evidence-backup-promise-2026-09-16/phaseE-golden-bake.txt

@@ -0,0 +1,14 @@
+## 2026-09-16T15:12:00Z golden 0.244.0 — bake in the drill VM (§4.0/§4.1 of RUNBOOK-manual-build)
+  reverted to virgin (this also proves no qemu holds the qcow2)
+  cold boot started
+  ssh up: pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve)
+  template: debian-13-standard_13.6-1_amd64.tar.zst
+  template downloaded
+  bake launched as a transient unit at 2026-09-16T15:13:01Z
+  token leak check on the unit (must be 0): 1
+  bake unit state: inactive at 2026-09-16T15:13:17Z
+  log lines: 2
+  markers: overlay2=0 mountpoints=0 upload=0 FATAL=0 excluding=0
+  token-leak control — planted copy must be 1: 1; committed log must be 0: 0
+  qemu exited; disk reverted to virgin
+## bake done 2026-09-16T15:13:40Z