answers 2026-10-12 Part A: the 38 rulings recorded (09 §3 196-233), 17 rows closed (128 -> 112), R-933 filed

- 09 §3: the decision sheet S1-S38, the operator's words quoted where they differ (S1, S2, S8, S32, S37)
- closed: R-831 R-870 R-698 R-327 R-230 R-719 R-352 R-526 R-770 R-771 R-913 R-290 R-209a R-769 R-616 R-884, and R-243 (dated check: the mail fired 2026-10-11 16:13:51Z, hub log agrees)
- R-698: the known limit written in 07 §6.6; new row R-933 (mirror supported catalog images, P3)
- R-327: capability-map row BUILT; stands claim re-titled and moved to built; page re-rendered
- R-913: the customer Cloudflare token recipe in day0-install A.1; 01 §7 points at it
- R-884: read only - ArgoCD Synced, live Deployment equals git
- R-887 dated check NOT met (4 lost jobs 10-10/11); re-dated 2026-10-19 after the S21 change
- 22 open rows carry their ruling; STATUS: the sheet is ANSWERED

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/runbooks/day0-install.md

@@ -54,8 +54,23 @@ Tunnels):
    everything — cloudflared logs `No ingress rules were defined` (R-505). Make sure the domain is on
    Cloudflare (nameservers active).
 
-Also have ready (optional but recommended): a **Cloudflare API token** with Zone edit rights for the
-customer's zone — the hub uses it for geo-restriction management.
+Also have ready (optional but recommended): a **Cloudflare API token** for the customer's zone — the hub and the
+box use it for geo-restriction management.
+
+**The customer token recipe — the ONLY way a customer token is minted** (operator ruling 2026-10-12, S31, `09` §3
+decision 226; R-913). The hub's save check sees what a token can READ, not what it can WRITE (`01` §7), so the guard
+is this recipe. Cloudflare → My Profile → API Tokens → Create Token → **Create Custom Token**:
+
+| Field | Value |
+|---|---|
+| Token name | `felhom-<customer-id>` |
+| Permissions | `Zone` · `Zone` · **Read** — and `Zone` · `Zone WAF` · **Edit** (nothing else: no DNS, no Account permission) |
+| Zone Resources | **Include** · **Specific zone** · the customer's domain (never „All zones", never an account) |
+| Client IP filtering, TTL | leave empty |
+
+Why these two: the hub and the controller call only `GET /zones?name=…` and the zone's `rulesets` (read 2026-10-12:
+`hub/internal/cloudflare/unblock.go`, `felhom-controller/controller/internal/cloudflare/{zone,waf}.go`). Paste the token
+once into the customer's config; the hub then checks it sees exactly that one zone. Never reuse a token across customers.
 
 **„No TLS Verify" on the public hostname (R-510, 2026-09-15).** The route sends traffic to
 `https://traefik`, and traefik answers the name `traefik` with its own default certificate. Tick