# REPORT — UPDATE NIGHT, 2026-09-21

**The full record is `documentation/audits/DRILL-update-night-2026-09-21.md`.** This file is the
session report: what ran, what shipped, what is owed.


## Not done, or changed from the brief

**Nothing in the brief was skipped.** Five things were changed, re-run or measured on a different
venue, each named with its reason in the audit's own first section. In short: the PostgreSQL
rehearsal ran on guest 9202 rather than a separate harness LXC; the `pg_upgrade` route was not run
(it needs an image that does not exist here); B5's `safety-dump` cut MISSED first and was recorded
as a miss before being retried and hit; B8 and the rehearsal were re-run after B1's own precondition
swept the app they needed; and the harness RUNS of the new catalog edges are owed although the code
is shipped.

**One thing the brief asked for that this venue cannot produce at all:** every event and every
customer mail. Guest 9202 runs `hub.enabled: false` and the notifier returns before it logs
(**R-620**). Stated on every row of the alarm truth table rather than left blank.

## What ran

- **Phase 0** — the fleet floor to **0.261.0** (both demo boxes in **13 s**, hub `SERVED … from
  declared`); a private **drill catalog** with a positive and two negative controls; a throwaway
  **image store** on the scratch guest; capacity measured; the upstream drift re-run.
- **Phase 1** — 21 edges across 19 apps walked on guest 9202 through the product's
  own guarded Update, each seeded and read back through the app's own front door.
- **Phase 2** — the two database engines across a major, through the real Update button.
- **Phase 3** — the bad days, B1–B9.
- **Phase 4** — the morning after.
- **Phase 5** — teardown, three layers, plus Gitea.

## What shipped

- `app-catalog-felhom.eu` **@4463243f2e09** — TEST CODE ONLY: four new harness fixtures and seven
  new edges (U1–U7). No template changed; no `image:` line moved. Gates green; CI job **830 =
  success**.
- `felhom.eu` — this report, the audit, the evidence, the register rows, the architecture updates,
  and one correction to `update-arc-gaps-2026-09-21/00-api-recipe.md` (the app page is `/apps/<n>`,
  not `/app/<n>`) and one FIX to `unattended-caller.py` (R-623).
- **No controller, agent or hub code was written.** The brief forbade it and none was needed.

## What is owed

- **The harness RUNS of edges U1–U7.** The code is in the catalog repo and the gates are green; the
  runs, and with them the per-app ABORT answers, have not been performed.
- **A cut inside `starting` itself.** Both EARLY phases were cut tonight; `starting` lasts well under
  a second and still needs an in-process fault injector rather than a faster shell.
- **The mail half of Q4**, and every event: structurally unmeasurable on this venue (R-620).
- **Fixtures for the four inconclusive apps** — and for two of them (vaultwarden, zipline) the honest
  maximum is `inconclusive` while the catalog rightly closes their sign-up (R-624).
- **What re-created the removed `navidrome` container** (R-626): observed, not diagnosed, because the
  controller had restarted and its log no longer reached that moment.
- **`wger`'s own edge** — it was deployed only to measure its probe and was then removed.

## The live catalog

**Never touched with a broken, dummy, cross-repo or engine-major reference — not once, not for
thirteen minutes.** Its `main` moved only for the harness commit above, which changes `scripts/`
and zero `image:` lines; the teardown diff proves every `image:` line identical to the drill copy.