Baselines (read at start, 14:42 CEST): felhom.eu 44d19042, felhom-controller 321df1f (v0.342.0 released; „next v0.343.0" unreleased on top), felhom-agent 5e05627 (v0.164.0; „next v0.165.0"), app-catalog 5e196e1, hub deployed 0.169.0. Register: 190 rows.

Method. Thirteen read-only reviewers (each prompt carried the brief's fences word for word — reviewers/FENCES-given-to-every-reviewer.md): seven on the documents (the brief's four groups, two of them split, plus a seventh for 02/10/11/14, which the groups did not name), four on data loss (restore and put-back; delete and retention; keys; time and concurrency), two on security (hub + controller; agent + ep0 + installer + the DooPlex→ep0 jobs). Their answers are CANDIDATES (reviewers/). The main session read every item it acted on at file:line; the edits and their evidence are in EDITS.md.

Part 1 — the documents (claims checked by the reviewers: 493; stale reported: 121)

Document	Verdict
`01` topology & trust	7 stale facts corrected; 2 product statements contradict the code → R-1266 (D45)
`03` host agent	9 corrected (shipped releases, key files, listen address, swap, cloudflared's 4th state); a note: 41 local-API routes, 24 unlisted; break-glass text → R-1266
`04` control-plane authorization	3 corrected; a note: a signed op's window has no length cap → R-1265
`05` hub	9 corrected (the 6-hourly DB copy, version literals, the fifth bind-link path, 44 event types, the retired DR record)
`06` off-site connectivity	7 dated notes (the design-of-record kept); „no inbound listener" → R-1266
`07` backup	12 corrected (portable secrets, R-104 fixed, keep-daily, D22/D20 released, a refusal row); §8.2c notes → R-1265; the kept-data load beside a copy → R-1256
`08` alarm ladder	10 corrected (per-type cooldowns, R-723, per-app grain, R-998 skip, §8.1 built, §9 released, the operator-only box alarms); one ruling line kept with a dated note (operator Q1 made `backup_integrity_failed` a default)
`09` updates	19 dated notes and corrections (the §1 measurement, slice 6 built, the undo as shipped, digests, phase table); §6.4.x notes → R-1265; three rulings the code does not do as written → R-1266
`10` localisation	7 corrected (Part B built, ceiling 0, the wizard deleted, counts)
`11` OS updates	7 corrected (cloudflared 2026.9.3, sudoers lines, the wrapper built, 32 bundle files, HOST_SLOW_RE); the System page's „Upload line" cell added
`12` agent tooling	3 corrected; the five rule copies aligned (the instruction-file edits below)
`13` threat model	11 facts corrected, every verdict cell left as it was and marked „re-check"; a note on the file manager's sign-in trust
`14` power-off	4 corrected (sudoers vectors, line-test holder, FAQ published, the table split); notes → R-1265
`15` media library	a dated note on the §10 measurement table; R-1019's fix; notes → R-1265
`16` storage identity	4 corrected; notes → R-1265
`02` controller module map	8 dated notes (markers, holders, banner alerts, cloudflare still wired, updater live, LockedFields, 22 packages with no row)
`_hub-review.md` / `_recovery-inventory-2026-07-28.md`	a HISTORICAL banner / a „what has moved since" banner — both dated records kept as they were
`00` capability map	20 PROVEN-LIVE rows marked „re-check" with the commit that changed their mechanism (no status lowered); G15's „nightly" corrected
`felhom-system-poster` facts + html	the timeline's hub-DB push (text only; no drawing needed)

Rules, fences and promises were not edited. Seven items that need the operator are in R-1266 (D45); about 30 behaviours with no document are written as [DESIGN — undocumented, found 2026-10-24] notes for the operator to confirm (R-1265, D44).

Instruction files edited (unprompted-work §5 — facts only): the workspace root, felhom-agent and app-catalog copies of .claude/rules/unprompted-work.md got the missing „A version number is pushed once" paragraph (now byte-identical to the other two); felhom.eu/.claude/rules/live-probes.md:41 — the stack path /opt/felhom/stacks/<name> → /opt/docker/ stacks/<name>/app.yaml. Details: EDITS.md.

Parts 2 and 3 — findings, ranked

#	Sev	Finding	What was proven	Row
1	P1	A power cut during a restore of a drive-backed app: the app runs on the cut restore's data, and a later controller restart pours the pre-restore copy back over newer writes	the real `Recover` code in a lean clone: boot 1 „copy gone → refused → marker kept", boot 2 put-back after the app ran (`proofs/H1-drive-cut-restore/`); the boot recreate's missing check read at `intermediary.go:470-476`	R-1251
2	P2	One rejected backup block makes the night's second-drive copy delete the app's household-file copies	reproduced on 9202: control kept the copy twice; one bogus path → „removed stale dest dir userdata/media" (`proofs/H2-bad-backup-block/`)	R-1252
3	P2	An export with „stop first" overwrites another app's restore marker	static, read at `file:line`	R-1253
4	P2	The hub saves the escrow package in two writes; a lost answer tells the household „the previous code still works"	static	R-1254
5	P2	D4's sshd drop-in reaches BYO hosts (against `11` §1); the in-force check and the all-or-nothing `sshd -t`	static	R-1257 (D43)
6	P3	Escrow carry / set-aside name edges	static	R-1255
7	P3	Four restore edges (definition write, merge, a mirror race, the unused copy)	static	R-1256
8	P3	ep0's iperf3 takes any tunnel peer's test	static (no ep0 change)	R-1258
9	P3	The DooPlex→ep0 copies: the vouched agent can drop out; deletions mid-transfer; no future bound; 2026-10-25: the 02:30 push re-sends the 20:00 snapshot	DST timing verified on DooPlex (`systemd-analyze`, Go)	R-1259
10	P3	Spring 2027: the leg's deadline vs the gate's clock; two legs at one instant	Go's mapping verified	R-1260
11	P3	The unreleased R-1250 line hold: two seeders, a removed app, alt-speed	static	R-1261
12	P3	Any viewer explains any upload (the upload watch)	static; `08`'s limits list now names it	R-1262
13	P4	Small items (a mislabelled operator mail, undeclared volumes on Remove, mount views, stale comments, a DNS-name password, rrsync)	static	R-1263
14	P4	Skills tooling (no size cap on the grandfathered skill; a new skill not installed)	read	R-1264
15	P4	Immich leaves an empty anonymous volume per recreate (296 on 9202); photos unaffected	read in the running image	R-1267

Fixed in this session (small, not recovery code, red-proved, commit only — controller b01bb4b, CI 2294 / #480 success): a media restart („Újraindítás most", „Később", the safe removal) no longer starts an app the household stopped (R-721; two tests, each seen failing with the rule off); the file manager's header name file appears whole (a race the existing test caught 44 times in 300 runs on clean main; 0 in 300 after, 0 in 50 under -race).

NOT-A-FINDING: SEC-1 X2 (a passphrase enroll after the operator's host delete gets ciphertext — the window D19 accepts); SEC-1 X3 (the refused-passphrase mail is operator-only with a one-hour cooldown); DOC-D1 U4 (the fit check that passes on a statfs error — the copy then fails and the app restarts untouched, restore_unit.go:502-512); HUNT-3 D31's comment wording (no data effect); Immich's /data volume for data placement (R-1267 holds the leak); the stack folder left after a clean removal (it is every catalog app's template folder).

Machines

9202 (Tier 0): as found at 12:46 UTC (9202/as-found-2026-10-24.txt); at the end (9202/at-end-…) the same containers and images, healthy (restarted by the test night chains), the catalog on the live repo, the controller 0.342.0. The only difference: Immich's running container uses a new empty anonymous volume (R-1267); the two others my test runs made were removed by name. audiobookshelf installed and removed through the product; my marker file removed; its second-drive copy removed by the product's remove.
DooPlex: reads, lean clones in the scratchpad, the gates; no service changed. ep0, household boxes, the hub: not touched (hub reads only, none needed in the end).

Teardown (three layers)

Machine: 9202 as above. Host (demo-hp): nothing provisioned. Hub: nothing changed.