docs: 11 §5.7 System page, §5.8 Docker slow lane BUILT, §5.9 crash restart; 00/03/07/08; decisions 90-94 (CC unattended); runbooks docker-undo + crash-guard; register R-852 R-835 R-848 R-849 R-851 R-854 closed, R-853 R-855 R-856 opened, R-812 R-840 narrowed (334 -> 332); live evidence

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -778,6 +778,28 @@ its length, and both fixes cost something the household would notice — operato
 83. **Next: the tunnel status (R-841), the host fast lane (`11` §8 step 3), and other OS-update improvements.**
     *Operator ruling 2026-10-04 ~12:20.*
 
+### 2026-10-04 (evening) — decided by CC unattended — operator may reverse (System page / Docker / crash-restart brief)
+
+90. **How does a box tell a crash boot from a clean one?** Options: (a) `pstore` — measured on demo-hp: `efi_pstore` is on,
+    yet a real panic saved NOTHING; (b) the previous boot's journal ends without shutdown lines — readable only after
+    the journal is up, and slow; (c) a marker written by an ExecStop at every orderly shutdown. **Chosen (c):** cheap,
+    early, measured to work; cost: a power cut and a hard reset count as a crash too (they cannot be told apart on these
+    boxes). `11` §5.9.
+91. **`kernel.panic_on_oops`?** Options: set it (an oops becomes a restart, which may loop on a bad driver) or leave it
+    0 and REPORT an oops (taint bit D) to the operator. **Chosen: leave 0, report** — a box with an oops usually keeps
+    serving the household; the hub mails `host_kernel_oops`. `11` §5.9.
+92. **The guard numbers.** The brief said both "at 3 it sets panic=0 so the next crash leaves the box off" (= the 4th)
+    and "if it crashes 3 times within one hour, it stays off" (= the 3rd, the operator's own page). **Chosen: the
+    operator's words** — the 3rd unclean stop within 60 minutes leaves the box off (the guard trips at the 2nd crash
+    boot); `kernel.panic` 10 s; re-arm after 24 h of normal running. All four are `/etc/felhom/crash-guard.conf`.
+93. **Who may authorize a Docker step on the box itself?** Options: the agent's word (its config is agent-writable);
+    the wrapper verifying the signed job against ROOT-owned files. **Chosen: the wrapper verifies** — `ssh-keygen -Y
+    verify` against `/etc/felhom/operator-signers`, bound to `/etc/felhom/os-trust.json` `host_id`, a root-owned nonce
+    record; an unsigned ring-0 step only with that file's `ring0_slow_lane: true`, set by hand on the demo boxes only.
+    Cost: two more root files per box (the installer writes them; R-840 for installed boxes). `11` §5.8.
+94. **The System page colours** use the alarm thresholds themselves (red = an `08` alarm would fire; amber = worth a
+    look; `unknown` = amber with its reason). No second set of numbers. `11` §5.7.
+
 ### 2026-10-04 (~15:17) — three operator rulings (recorded before the work)
 
 87. **Docker `live-restore` is ON for every box** (`11` §5.8, option A). It is turned on once — by the golden and by a