On 2026-08-27 around 09:05, ~630 of 708 files vanished from C:\Program Files\Business Streaming on the venue body fluffy-dumpling-87 (node-11da9ea3, hydra-s-0000). This crash-looped the PICO Business Streaming app (could not load its Nodeguard-protected native module) and black-screened the headset. Surrounding events: WDAC/Code Integrity policy refresh logged 09:29, Defender quick scan 09:41. No Defender quarantine of Business Streaming files was recorded.
Resolved for now by reinstalling Business Streaming 2.2.0 from the signed local installer (see #547 and hydravenues docs/runbooks/gallo-romeins-museum.md). Root cause of the deletion is NOT yet identified and CAN RECUR.
Task: identify the management/update system that removed the files (Intune/MDM/other Windows management, or a Business Streaming auto-update), then prevent it — exclude the venue body or the app dir, or pin/disable the auto-update. This body has no direct SSH; operate via hydracluster exec.
Filed as follow-up to #547.