drill 0.243.0: Phase 3 morning-after, off-site not walked (R-534), R-528 and R-511 updated

The off-site restore onto 9202 cannot be walked: this box never had an off-site
tier, because the re-issue fails on the endpoint token's missing Datastore.Modify
grant. Read-only listing of ep0 shows ns/tester-1/ct empty both before and after
the drill, with ns/demo-hp/ct as the positive control. Nothing on ep0 was written,
removed or pruned.

R-528 re-measured on a second, different box: all three OOM signals silent again.
R-511 records that its shipped fix is sound and inert until the grant is given.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/audits/DRILL-prove-fixes-0243-2026-09-16.md

@@ -88,3 +88,19 @@ tier 2 / tier 3, both unset. The design is not the defect. The defects are that
 „DB + Konfig + Adatok" and prints the drive size beside it (**R-537**), and that a restore reports
 success while leaving the app listing files it cannot open — and wipes the app's own trash, which still
 held every byte (**R-538**).
+
+## Phase 3 — the morning after
+
+**Every app healthy, labels true.** Front doors at 11:15Z: PrivateBin 200, Vaultwarden 200, Paperless
+302 (its login redirect), Nextcloud `status.php` 200, file manager 200 at `files.enkicsifelhom.hu`.
+All seven stacks read `running`. Controller **0.243.0** on the page, agent **0.131.0** on the hub, the
+customer row reads Version 0.243.0 / Floor v0.242.0 — a floor is a minimum, so that is correct, and the
+box runs the golden this drill baked.
+
+**Off-site restore onto 9202 — NOT WALKED, and not for time.** There is nothing to restore from. The
+off-site tier was never provisioned on this box: the re-issue fails on the endpoint token's missing
+`Datastore.Modify` grant (**R-534**), so no descriptor and no upload path were ever created. Read-only
+listing of ep0 confirms it: `ns/tester-1/ct` is **empty** both before (09:12Z) and after (11:14Z) the
+drill, while the neighbouring `ns/demo-hp/ct` lists group 9201 — the positive control proving the
+listing method shows groups when they exist. **Nothing on ep0 was written, removed or pruned by this
+session.**

documentation/audits/evidence-drill-0243-2026-09-16/phase2-f10.txt

@@ -83,3 +83,6 @@
 ##    therefore BY DESIGN. What is NOT by design is the page calling tier 1 "DB + Konfig + Adatok" and
 ##    printing "Adatlemez 65.1 MB" next to it, and a restore reporting plain success while leaving the
 ##    app inconsistent. Those two are the rows.
+  trash re-check at 2026-09-16T11:17:05Z, after the app restarted twice since the restore:
+    PROPFIND trash http=207
+    entries listed: 1  (1 = only the trash root itself, so the trash is EMPTY to the customer)

documentation/audits/evidence-drill-0243-2026-09-16/phase3-morning-after.txt

@@ -17,3 +17,19 @@
     traefik          running    deployed=False subdomain=
     vaultwarden      running    deployed=True  subdomain=vault
   controller version on the page: 0.243.0
+  CORRECTION to the line above: fajlok.enkicsifelhom.hu was MY guess and is not the address.
+  file manager re-checked at its real address:  -> 
+  hub host page, version facts:
+    Agent -> r-1-652049 ONLINE Host ID tester-1-652049 Customer Tester 1 Agent Version 0.131.0 PBS wrapper matches vouched 104db0a4401f… Enrolled 1h ago Last Report 9 min ago Desired Generation
+    agent -> lhom-pbs critical ok backup tier felhom-pbs readable by the agent (archive listing, restore-test candidacy) pve:store-grant:local ok backup tier local readable by the agent (archiv
+    0.131 -> INE Host ID tester-1-652049 Customer Tester 1 Agent Version 0.131.0 PBS wrapper matches vouched 104db0a4401f… Enrolled 1h ago Last Report 9 min ago Desired Generation 1 Vitals CPU
+  file manager, CORRECT route (it has no subdomain of its own; it is served by the dashboard):
+    https://felhom.enkicsifelhom.hu/files/ (logged in)  -> 404
+    https://felhom.enkicsifelhom.hu/files/ (no session) -> 302   <- negative control, must not be 200
+  version labels, measured:
+    controller on the page: 0.243.0 ; hub customer row: Version 0.243.0, Floor v0.242.0 (a floor is a minimum)
+    agent on the hub host page: 0.131.0 ; PBS wrapper matches vouched 104db0a4401f...
+  file manager, THIRD and correct attempt - the dashboard's own link says files.enkicsifelhom.hu:
+    https://files.enkicsifelhom.hu/ -> 200
+    (my two earlier lines, fajlok.enkicsifelhom.hu 404 and /files/ 404, were MY wrong guesses,
+     not product faults. The address was read from the dashboard page, not invented.)