# REPORT — the second night: scratch guest built, controller v0.242.0, rotation restarted (2026-09-13/14)

*Overwritten each session. Evidence: `documentation/audits/nightly-2026-09-13b-bentopdf/` (the guest
build and the bentopdf walk) and `documentation/audits/v0242-2026-09-14/` (red-proofs, floor, three
live passes). Controller detail: `felhom-controller/REPORT.md`.*

**Rules:** `.claude/rules/unprompted-work.md`. **Architecture named:** `01-topology-and-trust.md` §2
(the scratch guest is a second guest of the same customer), `07-backup-architecture.md` §6.3 and the
R-237 store-keyed list rule, `09-update-architecture.md` (holds). **Baselines:** felhom.eu `72ee053`,
controller `3e81330` (v0.241.0), catalog `6d6eec3`.

## Step 0 — R-481, operator ruling option 1 → LXC 9202 on demo-hp, persists

Restored from the vouched golden 0.236.0 onto a `dir` storage re-added at `/mnt/hdd_1`
(`nvme-scratch`), sized like 9201, unprivileged; the demo-hp customer seeded with hub OFF, tunnel OFF,
agent OFF, off-site OFF, self-update OFF; image set by hand (the one place allowed). Disposition in
the guest, on the host and on the hub side (`operations/nodes.md`, the register). Two CC decisions,
tagged in `CONTEXT.md` and `01-topology-and-trust.md`: no real-data-drive bind, no cloudflared.

## Step 1–3 — controller v0.242.0 (`d698ce3`, docs `406755f`), one release, floor-delivered

R-487 (removed app listed with its restore; the lists are keyed on the drives), R-491 (removal
clears the update hold), R-490 (`/api/system/info` reachable + fallback), R-489 (`volumes_removed`
difference — **half: a restore-recreated volume has no compose label and is missed; row kept open,
measured**), R-476 (Tier-2 copy dated by its data), R-456 (rule pinned). Red-proofs ×11, full gate
green, floor 0.242.0 with MinAgent 0.129.0: demo-hp +16 s, demo-felhom +17 s. Live on 9202 with an
opengist throwaway through the endpoints the UI invokes (no browser on DooPlex); the first pass was
refused 409 (a running app must be stopped before removal) and repeated.

## Step 2 — rotation reset to bentopdf on 9202: clean

Front door, use (browser-side tool, no data route — recorded, not faked), backup + second copy,
remove-with-data keep-backups, Tier-2 unit restore, guarded update (same pin; backed up first because
the restore rewrote `deployed_at`, R-478), remove-everything. No new rows from the walk.

## Register

210 open / 194 closed → **205 / 200**. Closed: R-481, R-487, R-491, R-490, R-476, R-456. Re-scoped:
R-489. Opened: R-492 (delete `cfg.Paths.HDDPath`). Security note: demo-hp's retrieval passphrase
appeared once in a tool output on DooPlex during the guest build (redaction list missed the key).

## Teardown, three layers

Machine: throwaways (opengist, bentopdf) removed with data and backups; 9202 persists on purpose.
Host: the `nvme-scratch` storage and 9202 stay (disposition recorded). Hub: floor raised; nothing else.