slice 3 docs: the ruling, the shipped mechanism, and four rows closed

09-update-architecture.md gains the fourth dated operator ruling (2026-09-06,
Option 1) and its section 5 is rewritten from a proposed shape into the shipped
one: the pin, the stored definition, the render table, the four writers, the
startup ordering, and the trap this slice set for slice 2 - the live compose file
is now the frozen one, so a badge comparing against it would answer Naprakesz on
exactly the apps that are behind.

02-controller-module-map.md said 'copy compose + .felhom.yml'. That stopped being
true today, so it is corrected, and the two sections describing the old seam now
carry a banner saying they describe v0.234.0 and below - kept because every box
under v0.235.0 still behaves that way and because they are the measured account
of why it changed.

R-447, R-441, R-438 and R-455 closed and compressed into CLOSED-ITEMS; R-458
opened for the .felhom.yml asymmetry, with what would settle it by measurement.

Live evidence: two real catalog pushes travelling the real 15-minute cycle, both
reverted, the tree byte-identical afterwards. The restart that used to take 18.3
seconds and pull a new image now takes 0.1 seconds and pulls nothing.

STATUS.md

@@ -1,8 +1,13 @@
 # STATUS — what works, what's broken, what's next
 
-**Updated 2026-09-03 — you spotted that OpenGist had no label. You were right, and it was a real gap:
+**Updated 2026-09-06 — a restart no longer changes which version an app runs. Fixes still arrive
+every 15 minutes, and a broken app definition still repairs itself. Only the Update button moves a
+version now. Live on the HP (0.235.0). NOTHING IS WAITING ON YOU — and two old items are now closed:
+the Hetzner e-mails are answered, and the Docker Hub login is in place.**
+
+**Earlier 2026-09-03 — you spotted that OpenGist had no label. You were right, and it was a real gap:
 the label only appeared on apps something had restarted. Fixed and live (0.234.0). Every app on both
-machines now carries one. NOTHING IS WAITING ON YOU.**
+machines now carries one.**
 
 **Earlier 2026-09-02 — the box now writes down which version of each app it is running, and shows one
 small label saying whether it is up to date: „Naprakész" or „Frissítés elérhető — 52 napja". No version
@@ -26,7 +31,7 @@ not an evening's work.**
 *This section is allowed to be longer than one screen, and each item says what happens if you do
 nothing.*
 
-1. **Two things are waiting on you — item 4 (send two e-mails) and item 7 (one design decision).** Item 9 is new today and needs nothing from you. Item 5's alarm mail can now be ignored for good. Otherwise: Both problems the overnight test found are fixed and proven on
+1. **Nothing is waiting on you.** Item 4 (the Hetzner e-mails) is answered and is being handled in a separate session. Item 7 — the safety-copy decision — is the one open question, and it is **not urgent any more**: the thing that made it urgent was that a restart could upgrade an app behind your back, and as of today it cannot. Item 10 is new and needs nothing from you. Item 5's alarm mail can now be ignored for good. Otherwise: Both problems the overnight test found are fixed and proven on
    the real machines:
    - the background job that could delete a live restore's lock now waits its turn — and the check
      that finds the next one like it is a test, not a comment, so it cannot come back quietly;
@@ -45,7 +50,7 @@ nothing.*
    two register lines in the hub (already live). No customer action, no data migration, no
    credential change.
 
-4. **Please send two short e-mails to Hetzner. They are written for you.**
+4. **~~Please send two short e-mails to Hetzner.~~ DONE — you sent them and Hetzner replied (2026-09-06). The reply is being worked in a separate session; nothing about it belongs to the update work.** The background below is kept because it is why the questions were asked.
    `felhom.eu/documentation/runbooks/provider-questions-2026-09-01.md` — open it, copy, send. No
    password or key is in that file, and none should be added.
 
@@ -155,6 +160,37 @@ nothing.*
 
    **If you do nothing:** nothing. This one is closed.
 
+10. **Nothing here needs you. The version of an app is now frozen, and only the Update button moves
+    it.**
+
+    **What used to happen.** The box downloaded the catalog every 15 minutes and wrote each app's new
+    definition straight over yours — including a new version. From then on, **thirteen** different
+    things could install that new version: the Update button, the Restart button, or one of eleven
+    repairs the box performs on its own. Nobody had to press anything.
+
+    **What happens now.** The version is pinned to what you have. Only a deliberate Update moves it.
+
+    **What deliberately did NOT change, because it was worth keeping.** Corrections to an app's
+    definition — a fixed health check, a memory limit, a new setting — still arrive on the same
+    15-minute cycle, and a broken definition still repairs itself. That was a real benefit of the old
+    behaviour and it is intact. In one sentence: **while the catalog offers the same version you are
+    running, its fixes reach you; the moment it moves to a newer version, you stay where you are until
+    you choose to update.**
+
+    **Proven on the real machine**, twice over: I pushed a genuine catalog change with no version in
+    it and watched it arrive on the normal cycle; then I pushed a version change and watched the app
+    refuse it.
+
+    **Two things this did NOT do, so they are not read as done.** The Update button is exactly as safe
+    as it was yesterday — no backup, no undo. That is the next piece of work, and it is item 7. And an
+    app the box could not confidently pin would have been left behaving exactly as before, loudly; on
+    the HP that was none of the nine.
+
+    **One rough edge I chose to write down rather than fix:** a frozen app still receives the small
+    metadata file that carries its health check, so it can be given a check written for a newer
+    version and look unwell when it is fine. **It cannot lose data — the worst case is a false
+    alarm.** Freezing that file too would break the „Frissítés elérhető" label, which is a worse trade.
+
 8. **`demo-hp`'s network setup does not match our own notes** (R-338) — the machine works, the page is
    wrong, or the other way round. **If you do nothing:** the page keeps misleading the next session,
    as it misled one by an hour.