close-out 2026-10-30: R-1344 and R-1346 closed, R-1228 switched (D35) and narrowed; R-1352, R-1353 filed; 01/03/05 [DESIGN], total-loss + publish-train runbooks, poster facts; instruction files: the site publishes to Cloudflare Pages

documentation/runbooks/publish-train-rules.md

@@ -110,3 +110,13 @@ one stops an ISO from carrying a golden the floor has already outrun.
 > default rotted twice. Treat these as a sanity check on what you read, never as a substitute for
 > reading it. (Floor raised to 0.216.0 by the operator on 2026-08-18 in a separate save after the
 > vouch, per rule 2 — see R-343, which records that the raise moved `demo-felhom` nine seconds later.)
+
+
+## 6. The website and the installer reach the public through Cloudflare (D35 / R-1228, 2026-10-30)
+
+`felhom.eu` (site + `/scripts/felhom-host-install.sh`) is Cloudflare Pages since 2026-10-30. A push to `main` and a
+new `installer-v…` tag change only DooPlex's copy (the way back); the public copy changes with
+`sec run CF_PAGES_TOKEN -- scripts/publish-site-cloudflare.sh` (`--dry-run` first). The script reads the installer tag
+from `manifests/webpage.yaml`, so bump both `--ref`s there FIRST, then upload — and it refuses an installer that is not
+the tag's byte for byte. Check after: `felhom.eu/scripts/felhom-host-install.sh`'s sha256 equals
+`git show installer-v<X>:scripts/felhom-host-install.sh | sha256sum`.

documentation/runbooks/total-loss-of-dooplex.md

@@ -122,7 +122,7 @@ sha256 matched, every image re-verified against its digest, and controller 0.340
 | the hub DB | S2 (or Vaultwarden) | sheet, or via S3 |
 | sign a box update | S6 | **sheet — today exists on DooPlex only** |
 | hub, controller, samba images; agent packages | the release copy on ep0 (D33, nightly since 2026-10-23) | ep0 root (S8/S9) → „Restore the release copy" — no secret, no rebuild |
-| Gitea `main` → `felhom.eu` website, ISO host | Cloudflare (S11), the build tree (lost) | S11 on the sheet; the build tree is rebuilt from code |
+| `felhom.eu` website + the installer script, ISO host | **Cloudflare** (S11): since 2026-10-30 (D35 / R-1228) the site and `/scripts/felhom-host-install.sh` are served by Cloudflare Pages, the ISO by R2 — **both keep answering with DooPlex gone**; a CHANGE to them needs the repo (Gitea copy) and `scripts/publish-site-cloudflare.sh`. **A new install still needs DooPlex for two things:** the hub (`hub.felhom.eu`: the claim, the box's config, its first report) and Gitea (`gitea.dooplex.hu`: the agent package and the golden). The contact form (`api.felhom.eu`) stops; the page's `mailto:` link works | S11 on the sheet; the build tree is rebuilt from code |
 | Authentik (S17) | not in any copy | not needed for the business; DooPlex homelab apps that use it are out of scope |
 
 **Result:** with a filled sheet (S1, S2, S4, S5, S6, S7, S8, S11 + the ep0 fingerprint) and the master password in