REPORT: v0.301.0 (2026-10-06 evening)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,10 +1,16 @@
-# REPORT — instruction files kept true (2026-10-06 afternoon)
+# REPORT — v0.301.0: one stop per backup tier, restore order, the family window reopens (2026-10-06 evening)
 
-Operator ruling 2026-10-06 13:25 (`09` §3 decision 150): a session corrects a stale fact in an instruction file
-itself and names the edit; it may not loosen a rule. No code changed in this repo. The full session report, with every
-instruction-file edit (file, before, after, why), is `felhom.eu/REPORT.md`.
+MinAgent 0.131.0 (unchanged). The full session report, with the measurements, is `felhom.eu/REPORT.md`; evidence
+`felhom.eu/documentation/audits/design-build-2026-10-06/`.
 
-Edits here:
-- `.claude/rules/unprompted-work.md`: new §5 (the standing rule, verbatim); the copies line now names felhom.eu, felhom-controller, app-catalog-felhom.eu and the workspace root (it said „all three repos").
-- `.claude/rules/gates.md`: command `python3 controller/scripts/controller_gates.py` (from `controller/`) → `python3 scripts/controller_gates.py` from `controller/`. Why: the old path does not exist from there (the runner's own usage line and CI use the new one). The list of ten local gates → a pointer to `GATES` (fourteen local + three shared + the advisory `golden-notice`). `observations_gate.py` added to the shared list. Decoy gate path gained `felhom.eu/`.
-- `CLAUDE.md`: the same command fix in the Commands table; „Protected stacks (traefik, cloudflared, felhom-controller)" → „…, and always samba" (`internal/config/config.go` `alwaysProtectedStacks`); design pointer `architecture/01/02/03-*.md` → `architecture/NN-*.md` (01–03 for this repo; 07, 09, 10).
+- **R-518** (`09` §3 decision 156, reverses R-82's one window): a window runs only the first due tier and resumes the
+  apps at its `snapshotted`; the next tier waits for a later cycle; „Mentés most" makes the local copy only (none, and no
+  stop, when the local storage is absent). Red-proved. **Not shown live** — the first night runs on the demo boxes are
+  the proof owed (R-518 stays open).
+- **R-638** (decision 154): the no-manifest fallback replays before the app starts; a failed volume leg skips the replay.
+  The main paths were measured safe on 9202 first (docmost, romm). Red-proved. Known limit: the off-site rollback's
+  reverse direction (R-893).
+- **R-717**: `after_setup` `open_command` / `open_success`; proven live on 9202 with wishlist. Six red-proofs.
+- Delivered: image `sha256:0e80f6af…`, golden 0.301.0 `96e94fed…`, floors 0.301.0 for demo-hp, demo-felhom, tester-1 —
+  all three run it. CI: `0b1b8d3` → 1439 success.
+- Not built: R-528 (its measurement contradicted the design — Docker 29.8.2 sets `OOMKilled` correctly).