CHANGELOG/README/REUSE/REPORT: the decision sheet D1, D3, D4, D8 (unreleased)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -913,6 +913,13 @@ Each app can define rich metadata in `.felhom.yml`:
     `--clear-restore-hold <app>`, **which requires a controller restart**. `--single-transaction` on
     the Postgres import is a belt only; MariaDB DDL is not transactional, which is why the rollback
     is the fix.
+  - **Off-site restore of one app: a failed replay after a moved definition or a replaced volume HOLDS the app
+    (R-893 option C, `09` §3 decision 192).** The rollback puts back the database rows only; the snapshot's files,
+    volumes and older definition would stay. So when the snapshot's definition was written or a named volume was
+    replaced, the live definition is written back, the app is held stopped (`restore_mixed`, operator-cleared like
+    a restore hold), the household reads that it needs our help, and the operator gets a `backup_run_failures`
+    line (leg `restore-hold-mixed`). Otherwise the ladder above is unchanged. „Put back exactly as it was" is the
+    next slice.
   - **Where an off-site restore puts the data (v0.219.0, R-356).** `ReconstituteFromOffsite` and
     `PlaceOffsiteRestore` resolve the destination with `Manager.GetAppDrivePath` — **the same
     resolver `CaptureRecoveryUnit` wrote the snapshot with**: the app's `HDD_PATH` if it declares
@@ -2612,6 +2619,10 @@ Continuously monitors registered storage paths for disconnection/reconnection (p
 | Protected containers | — | not running |
 | Storage paths | not a mount point (data on SSD), drive disconnected | path inaccessible, disk >= 95% |
 
+Every issue and warning carries a bundle key beside its frozen wire text (R-516 item 10; the last six producers —
+Docker, protected containers, the four storage lines — since R-79, `09` §3 decision 187), so the dashboard banner shows
+it in the household's language while the hub report keeps its bytes.
+
 Backup destination validation (`CheckBackupDestination`) has tiered checks:
 - Path doesn't exist → critical/blocked
 - Not writable → critical/blocked
@@ -3231,8 +3242,25 @@ Five sections:
 
 ---
 
+#### Sign-ins survive a restart (R-35, `09` §3 decision 188)
+
+Dashboard sessions are kept in `<data>/dashboard-sessions.json` (0600, atomic write): only sha256(cookie) → expiry +
+CSRF token, never the cookie, plus a fingerprint of the password hash in force. A settings push, an update or a crash
+restart no longer signs the household out. Expiry is unchanged (7 days). Logout and a password change end the session
+on disk too; rows written under another password are dropped at load; a revoking save that fails removes the file.
+Pinned by `internal/web/session_store_test.go` (`TestR35_*`).
+
 ### 9. Central Hub Reporting
 
+#### Operator actions (`internal/report/opactions.go`, `09` §3 decision 185)
+
+The hub may ask the running controller, in the report reply (`operator_actions`), for one of a CLOSED list:
+`offsite_backup_now`, `abandon_stop`, `abandon_extend` (1–30 days; never earlier than the current date; refused once
+the deletion is the hub's), `run_job` (`fill-watch`, `offsite-integrity`, `offsite-proof`, `disk-health-check`).
+Anything else is answered `refused` and calls nothing. Each id runs once per process; the result rides the next report
+(`operator_action_results: [{id, outcome, message}]`, outcome `done` / `refused` / `failed`). No action deletes data,
+starts a countdown or shortens one (`TestOpActions_ClosedList`). The box's log records every action it receives.
+
 #### Report Push (`internal/report/`)
 
 Periodic JSON push (default every 15 min) to the central felhom-hub service: