Review round 2: .claude/rules/unprompted-work.md aligned with its four siblings (the missing 'A version number is pushed once' fact paragraph); no code change

.claude/rules/unprompted-work.md

@@ -50,6 +50,12 @@ it **first** in the morning note. A decision you cannot write in that shape is o
    on Tester 1, demo-hp and demo-felhom through the normal update path and the box walk's checks are green
    on all three — not at night unless the night brief says so. **Agent releases still stop for the
    operator's vouch.** The golden is baked weekly and vouched by the operator; CC never vouches. **No `--no-verify`.**
+   **A version number is pushed once** — `felhom-controller/controller/build.sh` now refuses a second
+   push of a tag that exists, and a registry it cannot reach is a refusal too. This is a FACT about
+   what the build does, not a new rule: a fix for something already pushed is the next patch version,
+   and a box on a bad image is moved by the normal update path, never by re-tagging. Earned on
+   2026-10-15, when 0.315.0 was pushed three times from three different commits and a cache kept
+   serving the first one (`09-update-architecture.md` §0).
 7. **An enumerated gap becomes a row in the same session — or, if it is small, is fixed in it** (the size rule).
    Prose is not a record.
 8. **Hungarian text is searched with ASCII fragments**, with a positive and a negative control.

CHANGELOG.md

@@ -1,3 +1,10 @@
+## 2026-10-24 (review round 2, unattended) — `.claude/rules/unprompted-work.md` aligned with its four siblings
+
+- The copy lacked item 6's paragraph „A version number is pushed once …" that the felhom.eu and felhom-controller copies
+  have carried since 2026-10-15; the file's header says „change all five or none". The paragraph states a fact
+  (`felhom-controller/controller/build.sh` refuses an existing tag and an unreachable registry). Now byte-identical to
+  the other four (md5 b1891bd4). No code change. Record: felhom.eu `documentation/audits/review-round-2-2026-10-24/EDITS.md`.
+
 ## Unreleased (next: v0.165.0) — the line test for a box that seeds all day (R-1250) (2026-10-24) — committed, not released
 
 Attended brief 2026-10-24, Part 4 (commit only; the release rides the next normal train). The weekly test (v0.164.0)

REPORT.md

@@ -15,3 +15,9 @@ operator's vouch). Commits `29bcf44` (CI 2286 success) and `1e087bb` (CI 2288 su
   `not-quiet` (11.1 Mbit/s); with the controller's hold: runs 93.6 / 89.6 / 94.2 Mbit/s, the request 56.1 s. Evidence:
   felhom.eu `audits/dooplex-alarms-2026-10-24/part4-r1250-live-proof.txt`.
 - **Teardown:** the probe stopped and deleted from demo-hp; no iperf3 left running; the installed agent (0.164.0) untouched.
+
+---
+
+**Also on 2026-10-24 (review round 2, a separate unattended session):** `.claude/rules/unprompted-work.md` aligned with
+its four sibling copies (the missing „A version number is pushed once" paragraph); no code change. The report above is
+the attended session's and is kept as it was.