Decisions 71-73 recorded before the work (ep0 copy keeps 8 weekly; tester-1 keys removed via registrar; token not rotated now) + R-831 token row, R-832 roadmap P4

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -728,6 +728,15 @@ its length, and both fixes cost something the household would notice — operato
     customer `encryption-key`). **This opens the protected-machine fence for exactly the acts of that brief's Part F** —
     one read-only token on ep0; on DooPlex a remote, a datastore, a pull-sync and a verify job — and nothing else.
     *Operator ruling 2026-10-03 (afternoon).*
+71. **The DooPlex copy of ep0 keeps the last 8 weekly copies per namespace (R-828, option A)**; `remove-vanished`
+    stays false, so a deletion on ep0 never reaches the copy by itself. For now DooPlex is ep0's backup; a second place
+    may later replace or join it (R-832, P4): a Hetzner Storage Box would share a provider with ep0 and with every
+    household's file backups, and cannot run PBS, so the copy could not be verified or restored from directly. *Operator
+    ruling 2026-10-04 (morning).*
+72. **tester-1's three unpinned Storage Box keys are removed through the hub registrar (R-826).** *Operator ruling
+    2026-10-04 (morning).*
+73. **The Hetzner storage API token shown in the 2026-10-03 session transcript is NOT rotated now — the operator's
+    choice** (R-831 holds the rotation steps). *Operator ruling 2026-10-04 (morning).*
 
 ### 2026-09-30 (day) — operator notes, recorded before the work