felhom.eu/REPORT.md

REPORT — the second night: scratch guest built, controller v0.242.0, rotation restarted (2026-09-13/14)

Overwritten each session. Evidence: documentation/audits/nightly-2026-09-13b-bentopdf/ (the guest build and the bentopdf walk) and documentation/audits/v0242-2026-09-14/ (red-proofs, floor, three live passes). Controller detail: felhom-controller/REPORT.md.

Rules: .claude/rules/unprompted-work.md. Architecture named: 01-topology-and-trust.md §2 (the scratch guest is a second guest of the same customer), 07-backup-architecture.md §6.3 and the R-237 store-keyed list rule, 09-update-architecture.md (holds). Baselines: felhom.eu 72ee053, controller 3e81330 (v0.241.0), catalog 6d6eec3.

Step 0 — R-481, operator ruling option 1 → LXC 9202 on demo-hp, persists

Restored from the vouched golden 0.236.0 onto a dir storage re-added at /mnt/hdd_1 (nvme-scratch), sized like 9201, unprivileged; the demo-hp customer seeded with hub OFF, tunnel OFF, agent OFF, off-site OFF, self-update OFF; image set by hand (the one place allowed). Disposition in the guest, on the host and on the hub side (operations/nodes.md, the register). Two CC decisions, tagged in CONTEXT.md and 01-topology-and-trust.md: no real-data-drive bind, no cloudflared.

Step 1–3 — controller v0.242.0 (d698ce3, docs 406755f), one release, floor-delivered

R-487 (removed app listed with its restore; the lists are keyed on the drives), R-491 (removal clears the update hold), R-490 (/api/system/info reachable + fallback), R-489 (volumes_removed difference — half: a restore-recreated volume has no compose label and is missed; row kept open, measured), R-476 (Tier-2 copy dated by its data), R-456 (rule pinned). Red-proofs ×11, full gate green, floor 0.242.0 with MinAgent 0.129.0: demo-hp +16 s, demo-felhom +17 s. Live on 9202 with an opengist throwaway through the endpoints the UI invokes (no browser on DooPlex); the first pass was refused 409 (a running app must be stopped before removal) and repeated.

Step 2 — rotation reset to bentopdf on 9202: clean

Front door, use (browser-side tool, no data route — recorded, not faked), backup + second copy, remove-with-data keep-backups, Tier-2 unit restore, guarded update (same pin; backed up first because the restore rewrote deployed_at, R-478), remove-everything. No new rows from the walk.

Register

210 open / 194 closed → 205 / 200. Closed: R-481, R-487, R-491, R-490, R-476, R-456. Re-scoped: R-489. Opened: R-492 (delete cfg.Paths.HDDPath). Security note: demo-hp's retrieval passphrase appeared once in a tool output on DooPlex during the guest build (redaction list missed the key).

Teardown, three layers

Machine: throwaways (opengist, bentopdf) removed with data and backups; 9202 persists on purpose. Host: the nvme-scratch storage and 9202 stay (disposition recorded). Hub: floor raised; nothing else.