diff --git a/documentation/tests/teardown-2026-08-06.md b/documentation/tests/teardown-2026-08-06.md
index 5465504..6774050 100644
--- a/documentation/tests/teardown-2026-08-06.md
+++ b/documentation/tests/teardown-2026-08-06.md
@@ -70,3 +70,40 @@ should remain. Nothing on `ep0` outside the campaign's own namespaces was touche
 
 `demo-hp` itself and its guest 9201, `demo-felhom`, `drill-r50` (VM 300), DooPlex, the tester's box,
 and every `ep0` namespace that is not the campaign's own.
+
+
+## Venue 3 — `part4` "Part 4 - no hand upgrade" (destroyed after the findings were written)
+
+Kept deliberately while Parts 1 and 3 read it: it was standing in the exact failed half-B state, and
+tearing it down first would have destroyed the evidence. Destroyed only after the diagnoses were
+committed (`70b6260`).
+
+| Layer | Item | After |
+|---|---|---|
+| Machine | `demo-hp` VM **323** `part4-appliance` (**16 G on disk**) | `qm destroy 323 --purge` — absent |
+| Hub host | `part4-905bdb` | 0 occurrences |
+| Hub customer | `part4` (residue 66 rows) | 0 occurrences |
+| Off-site | Storage Box sub-account **`u629488-sub6`** | 0 occurrences |
+| Off-site | `ep0` PBS namespace **`part4`** | gone |
+| Network | WireGuard peer **10.77.0.7** | 0 occurrences |
+
+Positive control for this one: **`demo-hp-bb76ea`** must survive the same greps, and does (2 rows).
+
+## Final state
+
+- `demo-hp` guests: **VM 300 `drill-r50`** and **CT 9201** (demo-hp's own customer guest). All three
+  campaign appliances are gone.
+- `ep0` namespaces: **`demo-felhom`, `demo-hp`** — only the two real demo boxes remain.
+- `c11-scratch` used: **58,578,256 KiB → 5,184,912 KiB = 53.4 GB reclaimed** across the three venues
+  (20 G + 17 G + 16 G measured beforehand). Free 874.8 GB → 928.2 GB.
+
+## Secrets that died with the venues
+
+Each cascade purged the customer record **and all escrow ciphertext** (leg 4). The recovery codes for
+these venues therefore no longer open anything: `R_C11_REWALK` and `R_PART4` in the operator's
+credentials file are now inert and can be removed at the operator's convenience. The working copies
+under `~/.config/part4/` on DooPlex were shredded.
+
+**One operational note carried over from the walk:** the `part4` retrieval passphrase was leaked into
+a session transcript on 2026-08-06 and rotated at the time; the customer it belonged to no longer
+exists.