diff --git a/CONTEXT.md b/CONTEXT.md
index 970ddb85..cfa45a41 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -16,6 +16,17 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
 
+> **2026-10-24 07:22 / 07:26 — operator rulings by starting the attended release brief (D40, D41, D42; the line test).**
+> **D40 (R-1243) = stop the Longhorn backup of the hub's volume**; the encrypted 6-hourly copy to ep0 stays the hub's
+> off-site copy; the operator deleted the two old plain Longhorn backups himself (UI); the Longhorn UI cannot take the
+> volume out of the backup job, so the change is in a manifest. **D41 (R-1245) = 50 %** of the measured line for
+> qBittorrent's default upload limit. **D42 (R-1246) = the family is told only about the torrent limit**;
+> `app_unexplained_upload` / `app_unexplained_cpu` are operator-only. **Line measure (R-1247) = a weekly iperf3 upload
+> test from the box's host to an iperf3 server on ep0, inside the WireGuard tunnel only** (operator 07:26; his design of
+> 2026-10-23: „during a quiet window the box measures the upload bandwidth"); the passive floor stays as a lower bound.
+> This is the one change on ep0 the run may make (Tier 2 — the operator's yes is starting the run). CC still stops
+> before each hub deploy, before the global controller floor, and for the agent vouch.
+
 > **2026-10-23 19:22 — operator rulings by starting the weekend-night brief (R-1241's Felhom half; the upload watch).**
 > **Part 1 = R-1241's Felhom half:** seal R-975 (done in hub 0.168.0, not deployed — `05` §16.2,
 > `audits/hub-token-seal-2026-10-23/`); the hub's plain Longhorn copies are decide row R-1243 (CC's pick: take the hub
diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md
index 512c48f4..b5d9a65f 100644
--- a/hub/CHANGELOG.md
+++ b/hub/CHANGELOG.md
@@ -11,7 +11,7 @@
   (dropped from operatorOnlyEvents → the household was mailed; the render call removed → no Watch line; dropped from
   the allow-list → fails).
 
-## v0.168.0 (unreleased — built 2026-10-23 night, NOT deployed; the deploy is the operator's yes) — the last plain tokens sealed (R-975, R-1241)
+## v0.168.0 (DEPLOYED 2026-10-24 on the operator's yes — built 2026-10-23 night) — the last plain tokens sealed (R-975, R-1241)
 
 - **R-975 / R-1241's Felhom half.** The Cloudflare tunnel token, the Cloudflare API token and the git token lived in
   plaintext inside `customer_configs.config_json`, so a copy of the hub database (a snapshot, a Longhorn backup of the
diff --git a/manifests/hub.yaml b/manifests/hub.yaml
index ca5921c0..0c56fb16 100644
--- a/manifests/hub.yaml
+++ b/manifests/hub.yaml
@@ -128,7 +128,7 @@ spec:
     spec:
       containers:
         - name: hub
-          image: gitea.dooplex.hu/admin/felhom-hub:0.167.0
+          image: gitea.dooplex.hu/admin/felhom-hub:0.168.0
           ports:
             - containerPort: 8080
               name: http