Decisions 157-158 recorded; R-892 corrected (VM 341), R-894 filed (unreadable off-site storage reads due after an agent restart); Part C/E/F evidence; nodes.md: the Tester 1 box; 11 §5.8: the memory-kill check

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -915,6 +915,17 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
      *Operator ruling 2026-10-05.* (R-861)
 
+### 2026-10-06 (18:24) — two operator rulings (recorded before the work)
+
+157. **R-528 — option A: the counter read and the „probably out of memory" text are NOT built.** The row stays open as
+     a watch. **Added:** a new Docker engine set cannot be approved until it is shown to report a memory kill correctly
+     (`OOMKilled=true` and the `oom` event) on the boxes that ran it. *Operator ruling 2026-10-06 18:24.* (It confirms
+     the measurement that stopped decision 155's build: Docker 29.8.2 reported every kill tried.)
+158. **R-892 — yes: CC may reach the Tester 1 box by SSH.** It runs as **VM 341 on the HP box** (`ssh hp`; evidence
+     `audits/catchup-2026-10-05/tester1/vm341-was-stopped.txt`). Disposable; decision 149 already allows the admin seed
+     there. *Operator ruling 2026-10-06 18:24.* **The reviewer's error, recorded:** the previous brief named „the Tester 1
+     box" without saying where it runs, although the reviewer knew; R-892 was filed because of that gap.
+
 ### 2026-10-06 (14:24) — three operator rulings and the reviewer's three design picks (recorded before the work)
 
 151. **R-469 — closed.** The engine-major gate stays as decision 35's permanent per-app check. *Operator ruling