Controller v0.314.0 released under decision 250: floor 0.314.0 raised by CC's token at 13:11 UTC after the three test boxes

- 09 §3 decision 253: a restore puts the setup gate back as it was (R-1057 P2); 07 (what a per-app backup carries); 15 §6
  (Prowlarr links itself; Plex by address).
- Evidence audits/gate-restore-2026-10-15/: 9202 live proofs (R-1057, R-1058), the release (per-customer floors, Tester 1
  rc.1 -> 0.314.0 by itself, box walk, global floor, read-back), Plex fake-code check on 9201, red-proofs.
- Register: R-1023, R-1053, R-1057, R-1058 closed; R-1061 filed (P4); R-1060 narrowed; R-1052 blocked (customer creation
  is session only). STATUS, CONTEXT, the build skill's release steps, Prowlarr's website card.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -948,6 +948,24 @@ its length, and both fixes cost something the household would notice — operato
      **Extended the same day (operator, R-1059 = A):** the off-site and PBS-DR re-issues (they mint a household
      credential for the box) are session only too; „Off-site: write" keeps the windows and freeze.
 
+### 2026-10-15 (afternoon) — a restore puts the setup gate back as it was (operator brief, R-1057 raised to P2)
+
+253. **A restore puts the setup gate back exactly as it was when the backup was taken.** *Operator brief 2026-10-15
+     („A restored app never comes back open"); R-1057 raised to P2 by the reviewer the same day, seen by the operator.*
+     Narrows decision 46's restore clause („no prior record = no gate: the data comes back with its admin"), whose
+     assumption fails for a backup made before the household's first setup (measured on 9202: a stranger's `/ping` 200
+     after the restore of a Prowlarr backed up before its setup).
+     1. The per-app backup records the gate (`setup_gate:` in the unit's `app.yaml`: closed / open, and by whom; an app
+        installed before gates existed is recorded open, as it was).
+     2. **Closed then → closed now**, also over an installed app (the data it gets back has no admin); the gate file is
+        written BEFORE anything starts (decision 46 F2); the probe or „Kész, beállítottam" opens it as at install.
+     3. **Open then → open** (the rule's intent, unchanged); an app re-gated since (a reinstall) is opened again.
+     4. **No record** (a backup made before controller 0.314.0) of a REMOVED gated app → closed; the gate's loop opens it at
+        once if the app's own probe says the setup is done; without a probe (Plex) the household's „Kész" opens it.
+        **Never open by default.** An installed app restored from a no-record backup keeps its own record.
+     Built in controller v0.314.0 (`internal/stacks/restore_gate.go`); pinned by `restore_gate_test.go` and
+     `r1057_unit_gate_test.go` (ten mutations each seen failing). Proof: `audits/gate-restore-2026-10-15/9202/`.
+
 ### 2026-10-15 (07:48–08:20) — bake first; Plex through its own key; HSTS one day (recorded before the media build)
 
 247. ~~**Bake first.** A controller version is RELEASED only when its golden is baked.~~ **REVERSED by decision 250,