hub v0.153.0: off-site and PBS-DR re-issues session only too (R-1059 = A, operator 2026-10-15); R-1059 closed

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

STATUS.md

@@ -44,7 +44,7 @@
 
 ## Waiting on you — do
 - **Change the hub password now — CC no longer needs it.** CC uses its token „cc-releases" (tested live: the floor works; the vouch and the password-only pages are refused). Then delete the `HUB_PW` line in `~/.config/credentials` on DooPlex (CC does not delete it). Your token is wider than planned (it can also change off-site windows and approve OS updates) — revoke and re-create it narrower if you want. If you do nothing: CC still holds a password that can do everything.
-- **Hub 0.153.0 is ready (your ruling 13:20): no token can resend a claim code, create or edit a customer, or make a passphrase or a link.** May I deploy it? Say „yes". If not: on the live hub a token with „Customers: write" can still do those four. **Decide (R-1059):** a token with „Off-site: write" (yours has it) can re-issue a household's off-site password — it never sees it, but the backup can stop until the box picks the new one up. Keep, or password-only? **My pick: password-only.** If you do nothing: it stays.
+- **Hub 0.153.0 (your rulings 13:20 + R-1059 „A"): no token can resend a claim code, create or edit a customer, make a passphrase or a link, or re-issue an off-site password.** Deploying now on your „yes".
 - **Remove the test server „plex-k6” from your Plex account** (plex.tv → Settings → Authorized Devices). The claim test passed and the server is gone from Tester 1. If not: a dead server stays listed in your Plex apps.
 - System poster needs a refresh: every public name answers only over https (http → 301).
 - **Clear demo-hp's own floor** (hub → Demo HP → floor: empty → Save floor). It still reads 0.311.0. If not: the next global raise passes demo-hp by.