Controller v0.314.0 released under decision 250: floor 0.314.0 raised by CC's token at 13:11 UTC after the three test boxes

- 09 §3 decision 253: a restore puts the setup gate back as it was (R-1057 P2); 07 (what a per-app backup carries); 15 §6
  (Prowlarr links itself; Plex by address).
- Evidence audits/gate-restore-2026-10-15/: 9202 live proofs (R-1057, R-1058), the release (per-customer floors, Tester 1
  rc.1 -> 0.314.0 by itself, box walk, global floor, read-back), Plex fake-code check on 9201, red-proofs.
- Register: R-1023, R-1053, R-1057, R-1058 closed; R-1061 filed (P4); R-1060 narrowed; R-1052 blocked (customer creation
  is session only). STATUS, CONTEXT, the build skill's release steps, Prowlarr's website card.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/07-backup-architecture.md

@@ -886,6 +886,8 @@ both. Files written under different pins (a failed leg) make the unit `mixed`.
 
 **[DESIGN] What a restore keeps from the app it replaces (controller v0.276.0, R-697).** The restore writes a fresh `app.yaml` from the unit — env, locked fields, and the pin from the unit's definition — but keeps the records of the app's life on this box: the household's `desired_state`, the kept pre-conversion copies (`conversion_copy`, `earlier_conversion_copies` — a restore does not remove the volume, so it must not forget it), and the ladder history (`failed_update_step`, `last_update_undone`, `last_auto_update`). Not kept: `installed_images` (what ran before, maybe another version). **A drive move is not a restore:** it changes `HDD_PATH` and nothing else (R-700 — before v0.276.0 it dropped the pin, and the syncer then gave the app the catalog's newest version at its next start). Pinned by `internal/stacks/r700_records_carried_test.go`.
 
+**[DESIGN] The setup gate travels with the backup (controller v0.314.0, R-1057, `09` §3 decision 253).** The recovery unit's `app.yaml` carries `setup_gate:` (state, and who opened it) as it stood at the backup — the only life record the unit carries, because it decides who may reach the restored data. The restore's gate step runs inside the same write, before anything starts: closed then → closed now (the traefik gate file first, also over an installed app); open then → open; a unit with no record (made before v0.314.0) of a removed gated app → closed until the app's probe or the household's „Kész" opens it. Never open by default. An ungated app's unit bytes are unchanged (the checksum-skip guard). Code: `internal/stacks/restore_gate.go`; pinned by `restore_gate_test.go` and `internal/backup/r1057_unit_gate_test.go`.
+
 **[DESIGN] The jump guard.** An installed version that matches no ladder entry's `from` jumps to the catalog's
 current definition when a PERSON presses Update (`ladder.go`, measured live on vikunja 2.5.0, `09` §6.4 part 5);
 the AUTOMATIC leg never presses it (`LegSkipOlderThanLadder`, and a template without a ladder is