docs: supervisor (03), node_* ruling (08, CONTEXT), per-tier page + tier skip (07), self-bind triggers + PBS-DR lifecycle (05), settings after install (02), park + No TLS Verify runbooks, volunteer prerequisites

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/runbooks/RUNBOOK-manual-build.md

@@ -110,6 +110,13 @@ normal route — do not hand-deploy.
 4. Verify: `sudo kubectl -n felhom-system logs deploy/hub | grep 'managed floor SERVED'` shows
    `from "declared"`, and each box logs `SetFloor: floor "…" → "<VER>"` within about a minute.
 
+### 3.1 Park the controller (stop the agent restarting it) — agent ≥ 0.131.0
+
+The agent restarts a stopped `felhom-controller` within about a minute (R-523). To keep it stopped on
+purpose, on the **Proxmox host**: `touch /var/lib/felhom-agent/guests/<vmid>/controller-parked`. The
+agent logs `controller is not running and the guest is PARKED — leaving it`. To unpark:
+`rm /var/lib/felhom-agent/guests/<vmid>/controller-parked`. A controller swap is never fought either.
+
 ## 4. Golden image (fresh Day-0 installs)
 
 The golden is a pre-baked controller-era guest image built in the **drill VM** on 180

documentation/runbooks/VOLUNTEER-first-hour.md

@@ -30,6 +30,9 @@
 ## Az üzemeltető előtte (nem az önkéntes feladata)
 
 1. Létrehozza az ügyfelet a hubon (név, e-mail, domain).
+   A kapcsolódó linket tartalmazó e-mailt a hub **magától küldi**, amikor az ügyfélnek van e-mail címe és
+   még nincs gépe (létrehozáskor, e-mail megadásakor, egy korábbi gép törlésekor). Gombot nyomni nem kell;
+   az ügyfél oldalán látszik, mikor ment ki (R-509, 2026-09-15).
 2. **Létrehozza a Cloudflare tunnelt és beírja a tokent** az ügyfél adatlapján — enélkül a
    vezérlőpult címe nem nyílik meg (R-494).
 3. **Személyesen vagy üzenetben átadja a 5 szóból álló „Tulajdonosi jelmondatot".** Ezt semmilyen

documentation/runbooks/day0-install.md

@@ -57,6 +57,13 @@ Tunnels):
 Also have ready (optional but recommended): a **Cloudflare API token** with Zone edit rights for the
 customer's zone — the hub uses it for geo-restriction management.
 
+**„No TLS Verify" on the public hostname (R-510, 2026-09-15).** The route sends traffic to
+`https://traefik`, and traefik answers the name `traefik` with its own default certificate. Tick
+**No TLS Verify** under the public hostname's TLS settings (demo-hp's working tunnel has
+`originRequest.noTLSVerify: true`). Without it a fresh box answers **502**. *Not yet proven on a
+volunteer's route: on 2026-09-15 tester-1 had no box, and three GETs returned 530 (no tunnel
+connected).*
+
 ### A.2 Create the customer in the hub
 
 Hub UI (`https://hub.felhom.eu`, operator password) → **Customers → New**: