register: compress R-459 and R-467 to CLOSED-ITEMS (full text at ae59c31); REPORT sizes + CI

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -32,7 +32,7 @@ controller CHANGELOG header, and **the last four headers carry no such line**
 | repo | before | after (pushed to `main`) |
 |---|---|---|
 | app-catalog-felhom.eu | `b7ef0c4a09d6` | `eec1228` templates → `bd32830` gate → `3525e35` CHANGELOG/REPORT |
-| felhom.eu | `4b2e5608c227` | this push (two commits: documents + gate, then the register compression) |
+| felhom.eu | `4b2e5608c227` | `ae59c31` (documents + gate + evidence) → the compression commit on top |
 | felhom-controller | `155271672265` (v0.236.0) | **unchanged — no code.** Golden bake only. |
 
 Highest R-id before: 467. Minted: **R-468** (waiver), **R-469** (engine-major rule expiry),
@@ -203,6 +203,12 @@ the last per-release one. **No `--no-verify` anywhere in this session.**
 
 No Go code changed in any repo; `go build/vet/test` not applicable.
 
+`python3 scripts/unproven.py --summary`: 55 claims, walked 20 / partial 17 / built 14 / missing 4,
+**NOT WALKED 35 of 55 — unchanged** (nothing in this session walked a capability claim).
+
+**CI, by `head_sha`:** app-catalog job **536** for `3525e35` → `completed` / `success`. The
+felhom.eu run for this push is quoted in the follow-up commit that records it.
+
 ## 7. Register — rows opened / closed, size
 
 Closed: **R-459** (harness + live evidence), **R-467** (the bake). Narrowed: **R-242** (waiver half built;
@@ -210,7 +216,8 @@ vouch half open). Opened: **R-468** (WATCHING — the waiver; renew ≤ 14 days
 first external install), **R-469** (BLOCKED on R-448 — remove the engine-major rule), **R-470**
 (READY — MinAgent header line), **R-471** (READY — observations decoy hole, pre-existing).
 Register size: **210 open rows / 169 closed before → 212 open / 171 closed after** (R-459 and R-467
-compressed to `CLOSED-ITEMS.md`; nothing deleted). OPEN-ITEMS.md bytes: see the compression commit.
+compressed to `CLOSED-ITEMS.md` in the second commit, citing `ae59c31` for the full text; nothing deleted).
+`OPEN-ITEMS.md`: 433 845 → 434988 bytes with the four new rows and two closures written out, → 429692 bytes after compression.
 
 ## 8. Evidence off the machine before every teardown
 
@@ -250,10 +257,10 @@ Helper files on demo-hp (`ctrl_pw`, `dh_user`, `dh_pat`, `upg.tgz`, `guest-setup
    section and not an appended second one. Reproduced on a clean worktree of `4b2e560`. **FILED: R-471.**
 2. **Four consecutive controller CHANGELOG headers carry no `MinAgent:` line** while the vouch runbook
    says to read it from the header. **FILED: R-470.**
-3. **`POST /api/stacks/<app>/restart` recreated only the changed service** (`bookstack-db` got a new
-   ID; the `bookstack` app container kept its 4-hour uptime) — it is `compose up -d`, as
-   `09-update-architecture.md` §1.3 records as a chosen behaviour. **NOT-A-FINDING: documented
-   design; the message "restart completed" is accurate for a compose-level restart.**
+3. **The stack restart recreated only the changed service** — bookstack-db got a new ID, the bookstack
+   app container kept its 4-hour uptime — because the restart is compose up -d, which the update
+   architecture §1.3 records as a chosen behaviour.
+   **NOT-A-FINDING: documented design, and "restart completed" is accurate for a compose-level restart.**
 4. **`mariadb:12.3` resolved to 12.3.3 in the harness and 12.3.2 on 9201** — the floating-pin class.
    **NOT-A-FINDING: already R-446.**
 5. **`target-selection.md` names `/mnt/nvme-1tb`, which does not exist on demo-hp.** **NOT-A-FINDING: