# REPORT — night shift 2026-09-24 (run in daytime from 11:07 CEST)

Full record: `documentation/audits/DRILL-night-2026-09-24.md`; step log `documentation/audits/night-2026-09-24/PROGRESS.md`.

- **Hub v0.123.0** (`99c0709`, manifest `b33a331`, live): `app_stopped_unhealthy` allow-listed, per-app cooldowns
  on both legs, app named in the mail subject, seeded once into every household (3 seeded); hu/en mail goldens;
  red-proofed (`night-2026-09-24/redproofs/A3-hub.txt`).
- **Docs:** `09` §3 decisions 26–28 (operator) and 29–30 (CC unattended); §6.4 part 6 marked shipped (both
  halves); part 7 rewritten as the measured build brief §6.4.2. `07` whole-copy table (the second drive is whole
  for a file app since v0.269.0). `08` §6.2 the stop rule. Capability map: five rows. CONTEXT and STATUS.
- **Register:** 335 → 344 rows (679,393 → 685,662 B); opened R-668…R-683, closed R-661, R-662, R-664–R-668.
- **Floor 0.269.1** (MinAgent 0.131.0), read back; N100 arrived; demo-hp 9201 did not (R-672).
- **Interventions: 1** — an agent restart on demo-hp so its own Recover removed a leaked restore-test guest that had
  filled the pool. The session's permission check refused a direct `pct destroy` and a later read of vzdump task
  logs; both said so in the findings doc.
- **Slip:** `4502af6` committed three drill test-account passwords (apps since removed, accounts gone);
  deleted + ignored in `f2234c0`, history not rewritten.
- `unproven.py --summary`: unchanged — 35 of 55 not walked.
- Teardown, three layers: machine (9202 back to live catalog + saved config, tonight's apps removed through the
  product, kept drive folders removed by name, backup window 02:30), host (demo-hp `pct list` 9201 + 9202, no
  bench), hub (floor; drill repo reset to live `c8025093d23c`, `has_actions: false`).