security watch: seven pins it can never read are a stated GAP, so the source streaks reset; a read timeout is retried; every failed source is printed (R-1334); R-1310's rules (another package, every GHSA a release names, a word-only line, date tags)

documentation/architecture/08-alarm-ladder.md

@@ -731,3 +731,20 @@ cache, so the cache helps a same-day re-run on one runner, not the nightly; the
 dry runs 2026-10-28: 0 refused). The image reader (`image_runtime.py`) also waits out a 429 and tries again (3 tries):
 ghcr.io refused two blob reads when two dry runs read the same 14 new images 15 minutes apart.
 
+**[DESIGN — 2026-11-02, R-1334] A pin the watch can never read is a stated GAP, not a failed source; a read timeout is tried
+again.** The memory showed `registry:docker.io` and `runtime` down for a week, and the logs said otherwise: 0 Docker Hub 429
+on five real nights, on both runners. A streak is per SOURCE, so seven pins that can never be read (six of our own images in
+the private registry; `minio/minio`, which Docker Hub answers with 401) held both streaks open, and a real outage of either
+source could not have mailed. Now those seven are GAP, with their reason, in every weekly mail. Only the stated answer counts:
+`STATED_UNREADABLE` names the pin AND its one answer, so an unlisted 401 (a Docker Hub outage) or the same pin timing out stays
+NOT CHECKED. A transport failure on any source, and a ghcr.io 429, is tried again (a budget of 30 a night, so an outage cannot
+pass the job's limit). The log prints `FAILED-SOURCE …` for every failed source of every pin — the table shows one class per
+pin, so an ADVISORY pin hid its failure — and `FAILED-SOURCES n`. Evidence: `audits/security-2026-11-02/part1/DIAGNOSIS.md`.
+Tests W12, W15.
+
+**[DESIGN — 2026-11-02, R-1310] What counts as a notice.** A release that names GHSA ids gives one entry per id (the lowest
+fixing release, never twice); a release with a security line and no id gives one `release:` entry; a line where „security" is
+only a word (`WORD_ONLY`: „security announcements", „no longer receives security fixes") gives none. A notice naming only
+another program in the repo (`PACKAGE_NOT_OURS`: Gitea's runner, Home Assistant's phone apps, Uptime Kuma's rootless image) is
+not listed; a name not in the table is listed — the safe direction. A `YY.MM.YYYYMMDD` tag is not „newer". Test W16.
+