CHANGELOG/README/REUSE/REPORT: the decision sheet D1, D3, D4, D8 (unreleased)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,26 +1,21 @@
-# REPORT — controller, 2026-10-08 (day + afternoon): R-899, R-304 (+ the operator mail) on main, unreleased
+# REPORT — controller, 2026-10-08 (evening): the operator's decision sheet D1, D3, D4, D8 on main, unreleased
 
-**No release, no delivery today** (kernel night 8→9; `09` §3 decision 178). Both ship with tomorrow's release.
+**No release, no delivery today** (kernel night 8→9). Everything ships with tomorrow's release, together with the hub of
+the same day (D1's wire fields). MinAgent unchanged (0.131.0). Rulings: `09` §3 decisions 185–194.
 
-| Item | Commit | Tests | Red-proof |
+| Part | What | Tests | Red-proof seen |
 |---|---|---|---|
-| R-899 — a daytime „Mentés most" press never cancels the night's whole-guest backup (decision 177) | `6d07ca2` | `TestR899_*` (6, quiesce), `TestR899_PressCarriesTriggerManual` (agentapi) | rule off → the 2026-10-07 replay started nothing on night 2 (`started=[local local]`), plus 2 more failures; without the owed-tier valve guard an owed night ran outside the window (`started=[local local]` at 15:00) |
-| R-304 — „we do not know whether your code is wrong" when earlier packages were not all checked (agent 424) | `75b3b39` | `TestR304_OlderUnchecked_IsNotAWrongCode` (hu + en), `TestR304_Classify424` | without the handler case the page fell to the safe default „A művelet nem fejeződött be…" in both languages |
+| D1 (R-314, R-279) | Operator actions in the report reply — a closed list of four; anything else `refused` | `TestOpActions_*`, `TestOpActions_ClosedList`, `scheduler` `RunNow` tests | stop not applied in the running manager; same id ran 3×; unknown action called jobs; an added action fails the closed-list test |
+| D4 (R-35) | Sign-ins survive a restart; only sha256(cookie) on disk; password fingerprint; a failed revoking save removes the file | `TestR35_*` (8) | restart lost the cookie; file held the cookie; password change / failed logout save revived the session |
+| D3 (R-79, dashboard) | Six health producers carry a bundle key; wire text unchanged | `TestR79_*` | all 6 keys empty; one key removed → English household saw Hungarian |
+| D8 (R-893, first half) | Failed off-site replay after a moved definition / replaced volume → live definition back, app held (`restore_mixed`), honest sentence, operator line | `TestR893_*` (2) | the app was started on a mixed state; definition not written back |
 
-| R-304 option C — operator mail when a code opens / may open an older package, once a day (decision 183) | `a40729a` | `TestR304_OlderPackageMail_*` | without the calls `events = []`; without the day check `sent 2 events, want still 1` |
-| R-298 side fix — no eject/format button on a backup-target drive; R-717 two stale comments | `a40729a` | parity fixtures `storage_full`/`storage_empty` regenerated (only the new JS lines differ) | — (JS; not verified in a browser) |
+Small fixes without a row: `ExtendAbandon` could move a deletion earlier or edit the box date in the hub phase;
+`StopAbandon` reported success while the hub's deletion stayed pending; the reply read limit 4 KiB → 64 KiB;
+`TestR650_NoBareDockerExec` raced a vanishing temp file.
 
-**Needs the hub of the same day:** `recovery_older_package` is allowlisted only on hub main (`5beedcce`); against an older
-hub the push is refused (400) and only logged. A contract test caught a variable severity in the first draft
-(`TestR329_EveryEmittedSeverityIsInTheHubVocabulary`) — fixed to a literal.
+Security review of the session's commits (automatic): two findings on D4 (a failed save could revive an ended
+session) — fixed and red-proved (`TestR35_PasswordChangeRevokesEvenIfSaveFailed`, `TestR35_FailedLogoutSaveRemovesFile`).
 
-**Design:** `07` §6.1 (R-899 paragraph), `09` §3 decisions 177–178. The ledger is
-`<data>/whole-guest-ledger.json`, successes only, read only to decide due-ness. **MinAgent unchanged (0.131.0).**
-
-**Gates:** `go build/vet/test ./...` rc 0; `controller_gates.py --fast` rc 0. **CI:** job 1528 (`6d07ca2`) success; job
-1531 (`75b3b39`) success; job 1544 (`a40729a`) success.
-
-**Seen, filed (not fixed):** the recovery screen's other 14 messages are Hungarian-only Go literals and show in Hungarian
-on an English page — appended to R-516.
-
-**Not done:** no live validation (no delivery today); the first night after a press is read back after tomorrow's release.
+Gates: `go build/vet/test ./...` green; `controller_gates.py --fast` green. Machines: none touched.
+Live proofs (tomorrow, scratch 9202, after the releases): see `felhom.eu/REPORT-day3-2026-10-08.md`.