The evidence stays frozen; a copy of it takes the stand

Litigation hold froze the ops workstation container on March 14 as snapshot hold-0314, no expiry. Eight months later opposing counsel is entitled to inspect that machine, and nobody is handing them the original.

POST /containers/{id}/copy with source_snapshot hold-0314 into a fresh container in the litigation project. The hold is untouched; the copy has its disk. A snapshot is filesystem-only, so the copy boots fresh from that disk: files, installed software, browser profile, none of the processes. Open display-1 on the copy with ?readonly=true&printing=false&file_transfer=false and send that URL. They can look; they cannot type, print, or pull a file out.

What the screen showed before the hold is on the disk too. The display service keeps its captures under /hoody/storage/hoody-display, so GET /api/v1/display/screenshots on the copy lists every one by timestamp, each at its own URL.

Inspection ends; delete the copy. The hold remains, unopened.