CHANGELOG/README/REUSE/REPORT: the decision sheet D1, D3, D4, D8 (unreleased)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,40 @@
+## Unreleased (2026-10-08, evening) — the operator's decision sheet: operator actions (D1), sign-ins survive a restart (D4), health issues in the household's language (D3), a failed off-site restore holds the app (D8) — ships with tomorrow's release
+
+**MinAgent: 0.131.0** (unchanged — no agent change). Operator rulings 2026-10-08 14:16, `09` §3 decisions 185–194.
+New wire fields (additive, the hub of the same day carries their twins): reply `operator_actions`, report
+`operator_action_results`. **This controller needs the hub of the same day for D1** (an older hub sends no actions;
+nothing breaks).
+
+- **D1 — operator actions in the report reply (R-314, R-279; R-177 folded).** `internal/report/opactions.go`: a CLOSED
+  switch in the running process — `offsite_backup_now` (the household's four checks, then the same run),
+  `abandon_stop`, `abandon_extend` (1–30 days, never earlier than the current date, refused once the deletion is the
+  hub's), `run_job` with `fill-watch`, `offsite-integrity`, `offsite-proof`, `disk-health-check` (new
+  `scheduler.RunNow(name)`, refuses unknown or running jobs; `scheduler.OnDemand(ctx)`). Anything else answers
+  `refused` and calls nothing. Once per id (in memory; every action is safe to repeat after a restart). The result
+  rides the next report. `TestOpActions_ClosedList` fails if an action is added. **Fixed on the way (small, no row):**
+  `ExtendAbandon` could move a deletion EARLIER and could edit the box date during the hub phase (both refused now);
+  `StopAbandon` reported success while the hub's deletion stayed pending (error now); the reply read limit 4 KiB →
+  64 KiB (a larger reply dropped every field).
+- **D4 — dashboard sign-ins survive the controller's own restart (R-35, option C).** `internal/web/session_store.go`:
+  `<data>/dashboard-sessions.json` (0600, tmp+fsync+rename) holds sha256(cookie) → expiry + CSRF token, never the
+  cookie. Logout and a password change end the session on disk too. **Security review fixes:** the file carries a
+  fingerprint of the password hash in force, so rows written under another password are dropped at load (a password
+  change revokes even if its save failed); a revoking save that fails removes the file. Tests `TestR35_*` (8).
+  Small fix on the way: `TestR650_NoBareDockerExec` skipped a non-`.go` file that vanished mid-walk (a race with a
+  parallel stacks test).
+- **D3, dashboard half — the last six health producers carry their sentence (R-79 option A).** Docker unreachable,
+  protected container down, storage unavailable / not separate / usage high / almost full: a `MsgRef` each; the hub
+  wire text is unchanged byte for byte (wire golden green). Six keys `health.*` (hu+en); the four storage Hungarian
+  values equal the frozen literals. Tests `TestR79_RemainingProducersCarryTheirDashboardSentence`,
+  `TestR79_HealthBannersFollowTheHousehold`.
+- **D8, first half — a failed off-site replay that follows a moved definition or a replaced volume HOLDS the app
+  (R-893 option C).** `offbox_reconstitute.go`: the live definition is kept before the snapshot's is written and
+  written back on failure; the stack stays stopped with a new hold `restore_mixed` (operator-only to clear); the
+  household reads that it needs our help (keys `err.backup.db_restore_failed_held_mixed`, `note.reconstitute.held_mixed`);
+  the operator is told through the existing `backup_run_failures` event (leg `restore-hold-mixed`, no new hub type).
+  No version change and no volume replaced → today's behaviour (`TestR379_ScenarioA` green). Tests `TestR893_*`.
+  Known limit: placed files are not undone (the second half, „put back exactly as it was", is its own row).
+
 ## Unreleased (2026-10-08, afternoon) — three dashboard layout fixes: the Apps card header (R-909), the launcher on a phone (R-907), the empty „+5 more warnings" (R-906) — ships with tomorrow's release
 
 **MinAgent: 0.131.0** (unchanged — nothing on the wire, nothing the agent sees). Hungarian text: not one string