R-304 option C (hub half): recovery_older_package allowlisted and operator-only; design + row updated

Unreleased; ships with tomorrow's hub release.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/audits/day-2026-10-08/design-R-304.md

@@ -1,6 +1,6 @@
 # R-304 — the household's old recovery code and the retained packages: a one-page design (2026-10-08)
 
-**Status:** design only. Nothing here is built except today's honesty fix (below). Customer data and promises are the
+**Status:** option C's first slice BUILT 2026-10-08 afternoon on the operator's ruling (09:04, `09` §3 decision 183) — see the end. Ships with the next controller + hub releases. Customer data and promises are the
 operator's: they are the two questions at the end.
 
 ## Where it stands (read in source today, not from the row)
@@ -48,3 +48,12 @@ today's fix turns from a silent „wrong code" into an honest „not all checked
    the honest route is „contact support" (A/C).
 2. **Do you want C's first slice built (an operator mail when a household's code opens — or may open — an old
    package)?** *If you do nothing:* nothing is built; you learn of such a household only when they write to you.
+
+## Built 2026-10-08 (afternoon) — option C, first slice
+
+- **Controller** (`a40729a`): on a 422 (opens an older package) or a 424 (may open one), `recovery_older_package`
+  (warning) to the hub — the class and the package's date, never the code; at most once per day per box
+  (`<data>/recovery-older-mail.day`). `TestR304_OlderPackageMail_*`.
+- **Hub** (same day): the type is allowlisted and operator-only. `TestR304_RecoveryOlderPackageIsAllowlistedAndOperatorOnly`.
+- **Not built:** the runbook „open a retained package for a household" (the drill's §4 written down) — next slice.
+- **Question 1 (the promise wording) was not answered:** the wording stays.