answers 2026-10-12 Part A: the 38 rulings recorded (09 §3 196-233), 17 rows closed (128 -> 112), R-933 filed

- 09 §3: the decision sheet S1-S38, the operator's words quoted where they differ (S1, S2, S8, S32, S37)
- closed: R-831 R-870 R-698 R-327 R-230 R-719 R-352 R-526 R-770 R-771 R-913 R-290 R-209a R-769 R-616 R-884, and R-243 (dated check: the mail fired 2026-10-11 16:13:51Z, hub log agrees)
- R-698: the known limit written in 07 §6.6; new row R-933 (mirror supported catalog images, P3)
- R-327: capability-map row BUILT; stands claim re-titled and moved to built; page re-rendered
- R-913: the customer Cloudflare token recipe in day0-install A.1; 01 §7 points at it
- R-884: read only - ArgoCD Synced, live Deployment equals git
- R-887 dated check NOT met (4 lost jobs 10-10/11); re-dated 2026-10-19 after the S21 change
- 22 open rows carry their ruling; STATUS: the sheet is ANSWERED

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/01-topology-and-trust.md

@@ -222,7 +222,9 @@ app. Controller down → the gated app answers an error, never the app. Measured
   customer added later would be reachable). Cloudflare unreachable → the save fails and the old token stays. The token
   is never logged. **Limit:** `/zones` lists what the token can READ; a hand-built token with Zone:Read on one zone and
   DNS:Edit on all zones would pass — the token wizard's single „Specific zone" scope does not build that, and a
-  customer token cannot read its own policies. Tokens saved before this check are checked the first time each config
+  customer token cannot read its own policies. **The guard for the write side is the recipe, not a check** (operator
+  ruling 2026-10-12, S31, `09` §3 decision 226): the operator mints every customer token from the one recipe in
+  `runbooks/day0-install.md` A.1, and the hub checks nothing more. Tokens saved before this check are checked the first time each config
   is saved with a new token or domain.
 - **Tunnel placement: INSIDE the guest** (corrected 2026-10-01, R-754 — the operator's brief of that evening: the build is
   right, correct the document). `cloudflared` is a container the CONTROLLER renders and keeps up (`internal/infra`,

documentation/architecture/07-backup-architecture.md

@@ -875,7 +875,11 @@ requires a database dump written after the conversion whose recorded engine is t
 
 **[FACT] The limit — the image is not in the backup (R-698).** A unit stores image NAMES and digests; the
 image is re-pulled on restore. A version its maker has deleted cannot start. Measured 2026-09-26: the 42 ladder
-digests all resolve today (`audits/version-travel-2026-09-26/A7/`). Options are in R-698; nothing is decided.
+digests all resolve today (`audits/version-travel-2026-09-26/A7/`). **Accepted as a known limit — operator ruling
+2026-10-12 (S8, `09` §3 decision 203; R-698 closed).** What a household meets: a restore whose version the maker has
+deleted stops at the image pull, the app stays as it was, and the household uses another copy or a newer version.
+The operator's follow-up — *„will need to mirror the apps we support later, just to be sure"* — is **R-933**: mirror
+the images of every catalog app we support into our own registry, before scale. Until it is built, this limit holds.
 **Since decision 53 (`09` §3, 2026-09-30 evening):** a box keeps only the image each app service runs and the one before
 it; older images of the app are deleted. A restore that needs an older version re-pulls it — as before; the limit
 above is unchanged, and kept data (decision 40) is not touched by the image clean-up.

documentation/architecture/09-update-architecture.md

@@ -915,6 +915,70 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
      *Operator ruling 2026-10-05.* (R-861)
 
+### 2026-10-12 (13:50) — the decision sheet S1–S38 answered (recorded before the work; the „build the 38 answers" brief)
+
+The sheet: `STATUS.md` „The decision sheet (2026-10-10 afternoon)". Each line names the sheet number and the row. Where the
+operator's words differ from the sheet's pick, his words are quoted and they win. *Operator rulings 2026-10-12 13:50.*
+
+196. **S1 — R-922: the hub's registered customer address stays; only the box's notification address can be cleared.**
+     *„the customer can only delete their email address in the controller, from the notification address. If they do that,
+     they won't get any more notifications (maybe a warning popup?). However in the HUB each customer needs an email
+     address, and the user can't delete that, so the HUB can reach the user if needed (accounting, or any other reason)."*
+     So: a warning before the household clears its notification address (controller), and the privacy-notice draft says
+     why the registered address is kept.
+197. **S2 — R-831: the Hetzner storage token stays valid (option A, accept).** The sheet's pick was „rotate"; the operator
+     chose A. Row closed as accepted.
+198. **S3 — R-870: Tester 1's two leaked Cloudflare tokens are accepted;** they are rotated when Tester 1 is retired.
+199. **S4 — R-242: a hub alarm when the newest baked golden is not vouched,** before the first external install.
+200. **S5 — R-388: the household notification settings are redesigned to „only what you can act on" — designed now,
+     built in slices later.**
+201. **S6 — R-244: the hub removes a deleted customer's id from shared app-log issue rows, and sweeps once** (the count
+     is shown before the sweep).
+202. **S7 — R-264: CC owns the six owed hub readers (decided 2026-08-12) and builds them when the queue is idle.**
+203. **S8 — R-698: a restore of a version whose image the maker deleted cannot start — accepted as a known limit**
+     (`07` §6.6), row closed. *„Will need to mirror the apps we support later, just to be sure"* → new row R-933 (P3):
+     mirror the images of every catalog app we support to our own registry, before scale.
+204. **S9 — R-255: one test renders every dashboard page with planted secrets and fails if any shows.**
+205. **S10 — R-266: „disk reading failed" is carried to the hub,** so it is not read as an empty disk (hub + controller).
+206. **S11 — R-333: no heat band for NVMe;** the drive's own critical warning still alarms.
+207. **S12 — R-577: guest share pages get the language globe** (the visitor's own cookie).
+208. **S13 — R-327: the code-naming arc is „built" in the capability map;** CC rewrites the title. Row closed.
+209. **S14 — R-230: dated history entries in the memory index may keep version numbers;** (a) closed, the pilot (c)
+     dropped. Row closed.
+210. **S15 — R-719: the expired self-bind link's „Új linket kérek" shape is accepted.** Row closed.
+211. **S16 — R-352: hot data in the guest, bulk data on a drive, is by design.** Row closed.
+212. **S17 — R-526: no „release only the PBS token" operation on ep0** — the R-511 adopt path already reuses the kept
+     token. Row closed.
+213. **S18 — R-213: „see what a restore would change" is designed after the first customers.** Row stays open, P4.
+214. **S19 — R-288: one session restructures the capability map** — one status line per capability with a dated pointer
+     to its evidence. Documentation only.
+215. **S20 — R-231: DooPlex's backup scripts (`/opt/backup/scripts`) go into a repo with an install script;** the
+     operator is present for the install.
+216. **S21 — R-887: raise the act-runner's fetch timeout and rate-limit the public Gitea pages the crawler walks**
+     (DooPlex; each change after the operator's yes in chat).
+217. **S22 — R-886: `fsGroup: 65534` for Alertmanager;** a silence must be proven to survive a pod restart.
+218. **S23 — R-211: the Prometheus config-reloader sidecar** (DooPlex, after the operator's yes in chat).
+219. **S24 — R-770: no Invidious.** Row closed.
+220. **S25 — R-771: no moonlight-web.** Row closed.
+221. **S26 — R-782: Glance goes behind the family gate,** like Grimmory.
+222. **S27 — R-554: `recovery-info.txt` points at the dashboard's Restore page and the recovery code; then the obsolete
+     setup wizard is deleted.** The operator approves the Hungarian text before it ships.
+223. **S28 — R-562: Hungarian dates and numbers in Hungarian (decimal comma, `2026. 10. 10. 15:04`), ISO-like in English.**
+224. **S29 — R-250: the off-site setup scan prefers IPv4 and waits longer, and its error says „safe to press again".**
+225. **S30 — R-246: the hub's `stale_at` column is retired.**
+226. **S31 — R-913: the operator mints every customer Cloudflare token from one recipe; the hub checks nothing more**
+     (option a). The recipe: `runbooks/day0-install.md` A.1. Row closed.
+227. **S32 — R-521: one mail per lost drive to the household, in its language — *„if there is a notification option in the
+     controller settings, and enabled"*.** So the mail goes only when the household's own notification settings carry
+     that option and it is switched on (hub + controller).
+228. **S33 — R-402: one line on the hub's host page: „Last full check: OK/FAILED, depth N, date".**
+229. **S34 — R-290: folded into R-288** (the map restructure cites an evidence file for every green row). Row closed.
+230. **S35 — R-209a: accepted until a planned reboot;** the next planned DooPlex reboot checks the SSD2 move. Row closed.
+231. **S36 — R-769: no Pinchflat.** Row closed.
+232. **S37 — R-884: *„Fixes, can be closed"*** — CC reads the ArgoCD state for Prometheus once, read only; Synced → close
+     with the evidence, drift → one line for the operator and the row stays.
+233. **S38 — R-616: the Gitea admin token the catalog clone exposed was rotated (in the R-925 work).** Row closed.
+
 ### 2026-10-10 — operator ruling: the kernel approval rule (recorded before the work; the release brief)
 
 195. **„Approve kernel set" offers the NEWEST kernel version that EVERY ring-0 box has booted healthily at least once

documentation/architecture/where-felhom-stands.yaml

@@ -126,16 +126,18 @@ claims:
   - id: claim.code-naming
     band: journey
     stage: 2
-    title: "The same word is used for two different secrets across three surfaces; the email points at a page a rebuilt machine does not show"
-    status: partial
-    note: "Warning card. Cost a real code on 2026-08-09."
+    title: "Each of the two secrets has one name on every surface, and the re-enrol mail points at a page a rebuilt machine shows"
+    status: built
+    note: "Shipped (controller v0.211.0, hub v0.104.0/v0.105.0); no customer has typed the passphrase yet. Operator ruling 2026-10-12 (S13). The old defect cost a real code on 2026-08-09."
     sources:
       - register: "R-282"
-      - register: "R-283"
+      - register: "R-295"
+      - register: "R-323"
+      - register: "R-327"
     verified:
-      date: 2026-08-09
-      verdict: confirmed
-      depth: source-read
+      date: 2026-10-12
+      verdict: upgraded
+      depth: register+map
   - id: use.catalog
     band: journey
     stage: 3