Part A: operator rulings 162-170 recorded; R-822 closed by ruling; R-836 P2; shared rule: no hub build/deploy without the operator

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -915,6 +915,28 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
      *Operator ruling 2026-10-05.* (R-861)
 
+### 2026-10-07 (07:58) — operator rulings on the night designs (recorded before the work)
+
+162. **Hub releases at night: NO.** A hub image build or hub deploy happens only in a session the operator attends.
+     Added to the shared rule file §1 (a limit, not a loosening). *Operator ruling 2026-10-07 07:58.*
+163. **R-812 option A: yes.** Proxmox's own userspace packages update in the night leg after the operator approves
+     each set on the System page, like the Docker engine set. No kernel, boot, firmware or microcode package in this
+     lane. *Operator ruling 2026-10-07 07:58.*
+164. **R-812 option B: yes, before the first paying customer** — the operator overrode CC's pick C: *"We should test
+     those too, reboots should be no issue (if yes, then that's a finding). If we start testing when we already have a
+     customer, it is late."* Start with a spike; R-836 carries it, raised to P2. *Operator ruling 2026-10-07 07:58.*
+165. **R-861: (a) A1 yes, before the first paying customer; (b) B3 accept, with B2 as hygiene in the same bundle;
+     (c) C2 accept.** *Operator ruling 2026-10-07 07:58.*
+166. **R-822: accept the residual and close it** as a stated limit of decision 68; option B (the hub counts the
+     snapshots itself) is R-895, open for later. *Operator ruling 2026-10-07 07:58.*
+167. **R-32 option A: yes** (RESET purges through the sub-account's own login before removing it), and **delete the old
+     RESET leftovers once.** *Operator ruling 2026-10-07 07:58.*
+168. **R-366: keep the old key after a reinstall (hub 0.141.0) — yes; option C (the recovery code at reinstall) — no.**
+     Build slice 2: tell the operator when old copies use another key. *Operator ruling 2026-10-07 07:58.*
+169. **R-105 option A: yes** — remove the two never-built fields and correct `05` §9. *Operator ruling 2026-10-07 07:58.*
+170. **Tester 2 (R-105 question 2):** the operator believes Tester 2 never set up the off-site backup, so it has no
+     escrow. The laptop is off and may stay off for days; the tester plans to add an HDD. *Operator 2026-10-07 07:58.*
+
 ### 2026-10-07 (morning) — operator rulings (recorded before the work)
 
 160. **Every helper prompt carries the brief's fences in full.** A helper session (subagent, fork, workflow agent)