answers 2026-10-12 Part A: the 38 rulings recorded (09 §3 196-233), 17 rows closed (128 -> 112), R-933 filed

- 09 §3: the decision sheet S1-S38, the operator's words quoted where they differ (S1, S2, S8, S32, S37)
- closed: R-831 R-870 R-698 R-327 R-230 R-719 R-352 R-526 R-770 R-771 R-913 R-290 R-209a R-769 R-616 R-884, and R-243 (dated check: the mail fired 2026-10-11 16:13:51Z, hub log agrees)
- R-698: the known limit written in 07 §6.6; new row R-933 (mirror supported catalog images, P3)
- R-327: capability-map row BUILT; stands claim re-titled and moved to built; page re-rendered
- R-913: the customer Cloudflare token recipe in day0-install A.1; 01 §7 points at it
- R-884: read only - ArgoCD Synced, live Deployment equals git
- R-887 dated check NOT met (4 lost jobs 10-10/11); re-dated 2026-10-19 after the S21 change
- 22 open rows carry their ruling; STATUS: the sheet is ANSWERED

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/CLOSED-ITEMS.md

@@ -26,6 +26,30 @@
 
 ---
 
+## 2026-10-12 (afternoon) — the operator's 38 answers (sheet S1–S38): the rows that need no code
+
+The full text of the rows below: `git show 25ab47eeaa:documentation/backlog/OPEN-ITEMS.md`. Evidence: `documentation/audits/answers-2026-10-12/` unless a row names another place.
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-243** | **A box in the R-241 state silently stops backing up off-site, and NO ALARM OF ANY KIND FIRES.** (P2) | CLOSED 2026-10-12 — **the alarm fired on time.** The `offsite_escrow_pending` mail for Tester-2 reached the operator mailbox 2026-10-11 16:13:51Z (the first sweep after the 7-day line, ~16:06Z); the running hub logged „Operator email sent for Tester-2/offsite_escrow_pending" at the same second. Two channels. | hub v0.144.0+ (`b119301c`); `r243-escrow-pending-mail.txt` |
+| **R-831** | **The Hetzner storage API token (`HETZNER_TOKEN`, the storage project's token in `Secret/storagebox`) was printed into the 2026-10-03 session transcript** (P3) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S2, `09` §3 decision 197): **A — accept.** The Hetzner storage token stays valid. | the ruling |
+| **R-870** | **Tester 1's two Cloudflare credentials — the zone API token (`infrastructure.cf_api_token`) and the tunnel token (`infrastructure.cf_tunnel_token`) of the hub's `customer_configs` row `tester-1` — were printed into the 2026-10-04 night session's transcript** (P3) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S3, `09` §3 decision 198): **accepted**; rotate when Tester 1 is retired. | the ruling |
+| **R-698** | **[P3-LOW] A backup stores the image's NAME, not the image — a restore of a version its maker has deleted cannot start.** (P3) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S8, `09` §3 decision 203): **accepted as a known limit**, written in `07` §6.6. The operator's follow-up (mirror the images of every supported catalog app) is the new row R-933. | `architecture/07-backup-architecture.md` §6.6 |
+| **R-327** | **The standing picture still describes a defect that has been fixed twice over.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S13, `09` §3 decision 208): **„built"**: a capability-map row added (status BUILT), the standing-picture claim `claim.code-naming` re-titled as a capability and moved to `built`, the page re-rendered. | `00-capability-map.md`, `where-felhom-stands.yaml`/`.html` |
+| **R-230** | **Three instruction/memory follow-ups deliberately left by the part-2 session (2026-08-06), each needing a decision rather than an implementation.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S14, `09` §3 decision 209): (a) **ruled: dated history entries in the memory index may keep version numbers**; (b) was closed 2026-08-06; (c) **the pilot is dropped**. | the ruling |
+| **R-719** | **[P2-MEDIUM] A customer who already exists never gets a fresh self-bind link when their new box registers: the last link expires in 7 days and nothing re-sends it.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S15, `09` §3 decision 210): **the „Új linket kérek" shape is accepted.** | the ruling; the shape shipped earlier (row text) |
+| **R-352** | **Four screens state something untrue about where an app's data goes, and the configured default is consulted by nothing that places data.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S16, `09` §3 decision 211): **by design**: hot data in the guest, bulk on a drive. The visibility fix shipped; R-368 fixed the comment. | the ruling |
+| **R-526** | **[P3-LOW] A host delete cannot release only the customer's ep0 PBS token: the endpoint's one removal op destroys every backup group too.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S17, `09` §3 decision 212): **no** — the R-511 adopt path already reuses the kept token. | the ruling |
+| **R-770** | **[P3-LOW] Invidious — fit check only; the recommendation is not to build it.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S24, `09` §3 decision 219): **no Invidious.** | the ruling |
+| **R-771** | **[P3-LOW] moonlight-web — fit check only; not buildable through an HTTP-only tunnel at usable latency.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S25, `09` §3 decision 220): **no moonlight-web.** | the ruling |
+| **R-913** | **The Cloudflare token check (R-138, decision 190) reads what a token can SEE, not what it can WRITE.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S31, `09` §3 decision 226): **(a)** — the operator mints every customer token from one recipe; the hub checks nothing more. Recipe written: `runbooks/day0-install.md` A.1; `01` §7 points at it. | `runbooks/day0-install.md` A.1 (recipe read from the hub and controller Cloudflare calls 2026-10-12) |
+| **R-290** | **Most capability-map rows that back a green dot cite no evidence document at all — measured, 20 of 28 probed.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S34, `09` §3 decision 229): **folded into R-288** (the map restructure cites an evidence file for every green row). | R-288 |
+| **R-209a** | **The SSD2 move has NOT survived a reboot, so by this project's own standard it is not fully validated** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S35, `09` §3 decision 230): **accepted until a planned reboot**; the next planned DooPlex reboot checks the SSD2 move (the mechanism is proven). | the ruling |
+| **R-769** | **[P3-LOW] Pinchflat is not built: upstream is paused (no release in 2026, last push 2025-12-16) and its last release has no image tag.** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S36, `09` §3 decision 231): **no Pinchflat.** | the ruling |
+| **R-616** | **[P3-LOW] The catalog credentials are stored in PLAINTEXT in the box's catalog clone and are printed by an ordinary `git remote -v`.** (P3) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S38, `09` §3 decision 233): **the Gitea admin token the clone exposed was rotated** (operator's word, the R-925 work). The leak itself was fixed and read on every box 2026-10-10. | the operator's word 2026-10-12; `audits/register-shrink-2026-10-10/` (the 2026-10-10 clone read) |
+| **R-884** | **ArgoCD app `monitoring` shows `Deployment/prometheus` OutOfSync** (P4) | CLOSED 2026-10-12 — operator ruling 2026-10-12 (S37, `09` §3 decision 232): *„Fixes, can be closed"* — read once, read only: ArgoCD app `monitoring` Synced/Healthy, 29 resources, none OutOfSync, `Deployment/prometheus` Synced; the live Deployment's image and six args equal git (homelab-manifests `eeb009f`). Two channels. | `r884-prometheus-sync.txt` |
+
 ## 2026-10-10 (afternoon) — the register-shrink session: delivered rows read back, small fixes, the decision sheet
 
 The full text of the rows below: `git show 7413e0dfab:documentation/backlog/OPEN-ITEMS.md`. Evidence: `documentation/audits/register-shrink-2026-10-10/` unless a row names another place.