# REPORT — controller, 2026-10-08 (evening): the operator's decision sheet D1, D3, D4, D8 on main, unreleased

**No release, no delivery today** (kernel night 8→9). Everything ships with tomorrow's release, together with the hub of
the same day (D1's wire fields). MinAgent unchanged (0.131.0). Rulings: `09` §3 decisions 185–194.

| Part | What | Tests | Red-proof seen |
|---|---|---|---|
| D1 (R-314, R-279) | Operator actions in the report reply — a closed list of four; anything else `refused` | `TestOpActions_*`, `TestOpActions_ClosedList`, `scheduler` `RunNow` tests | stop not applied in the running manager; same id ran 3×; unknown action called jobs; an added action fails the closed-list test |
| D4 (R-35) | Sign-ins survive a restart; only sha256(cookie) on disk; password fingerprint; a failed revoking save removes the file | `TestR35_*` (8) | restart lost the cookie; file held the cookie; password change / failed logout save revived the session |
| D3 (R-79, dashboard) | Six health producers carry a bundle key; wire text unchanged | `TestR79_*` | all 6 keys empty; one key removed → English household saw Hungarian |
| D8 (R-893, first half) | Failed off-site replay after a moved definition / replaced volume → live definition back, app held (`restore_mixed`), honest sentence, operator line | `TestR893_*` (2) | the app was started on a mixed state; definition not written back |

Small fixes without a row: `ExtendAbandon` could move a deletion earlier or edit the box date in the hub phase;
`StopAbandon` reported success while the hub's deletion stayed pending; the reply read limit 4 KiB → 64 KiB;
`TestR650_NoBareDockerExec` raced a vanishing temp file.

Security review of the session's commits (automatic): two findings on D4 (a failed save could revive an ended
session) — fixed and red-proved (`TestR35_PasswordChangeRevokesEvenIfSaveFailed`, `TestR35_FailedLogoutSaveRemovesFile`).

Gates: `go build/vet/test ./...` green; `controller_gates.py --fast` green. Machines: none touched.
Live proofs (tomorrow, scratch 9202, after the releases): see `felhom.eu/REPORT-day3-2026-10-08.md`.