night 2026-09-24: findings doc, decisions 29-30, STATUS/CONTEXT, register 335->344 (7 closed), teardown evidence, floor 0.269.1

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -345,6 +345,31 @@ builds them (`audits/update-rulings-2026-09-23/`).
 (`upgrade-test.py`, 2026-09-23); a version move checks the memory limit (gate or checklist — §6.4);
 R-636's louder repeated alarm.
 
+
+### 2026-09-24 (night) — two decisions taken by CC unattended
+
+29. **Decision 28's crash loop is ≥ 6 restarts within 10 minutes, counted from Docker's `RestartCount`** —
+    *decided by CC unattended 2026-09-24 — operator may reverse.* *One sentence:* how many restarts in
+    what window make a crash loop the box stops? **Options:** (a) the brief's 10 in 10 min; (b) 6 in
+    10 min. **Costs:** (a) misses a STEADY loop — Docker's restart back-off caps it at about one restart a
+    minute (gokapi measured 539 → 546 in 7 min), so a loop that has run for an hour can sit at 9–10 per 10
+    min forever; (b) could stop a slow first start that restarts 6 times — none in the drill evidence
+    (1,831 harness samples, 40 live containers; the one ≥ 6 case, immich's first-start import, was broken,
+    R-676 watches it), and Start always gives one more try. **Why (b):** (a) fails the ruling's own case.
+    `08` §6.2; `audits/night-2026-09-24/A3/`.
+
+30. **An INSTALLED app keeps the image digest it runs until a guarded Update moves it; the sync never moves
+    it** — *decided by CC unattended 2026-09-24 — operator may reverse.* *One sentence:* when the catalog
+    re-tests a floating tag at a new digest, does the sync write it into an installed app's compose?
+    **Options:** (a) yes, as v0.269.0 did; (b) no — the sync carries the running digest over, and only
+    the guarded Update (backup, undo copy, health check) renders the new one; a fresh install takes the
+    tested digest. **Costs:** (a) the next restart (a backup's stop/start, a power cut) pulls a new image
+    with no backup and no undo — measured live on 9202; (b) an installed app runs the older tested image
+    until someone (or the automatic leg) presses Update — the badge says so. **Why (b):** decision 17
+    wants the TESTED image pulled, and slice 3's ruling freezes the version until a deliberate Update;
+    (a) broke the second. Shipped as controller **v0.269.1** — a second release in the session, instead of
+    shipping (a) to the fleet with the floor.
+
 ---
 
 ## 3b. ANSWERED 2026-09-23 — the seven questions Slices 6 and 7 needed