hub v0.123.0: app_stopped_unhealthy (decision 28); 09 decisions 26-28 recorded

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -329,6 +329,18 @@ builds them (`audits/update-rulings-2026-09-23/`).
     operator-only). The operator's English was used with one word dropped („please" — the house rule,
     `i18n_missing_gate.py`); the Hungarian verbatim, its formal register recorded against R-516.
 
+### 2026-09-24 (afternoon) — three more operator rulings
+
+26. **R-661, option A: one action brings a file app back WHOLE from the second drive** — the unit (settings +
+    database) and the drive files together. The second drive then counts as a whole copy in decision 25's
+    truth table. R-538's guard stays: this is a new action beside it, not its removal.
+27. **R-666, option B: while a held app's page says support is informed, Remove offers only „remove the app,
+    keep my data".** The household keeps control; the data stays. The no-whole-copy sentence moves to the
+    informal voice, like every other screen.
+28. **An app in a crash loop, or in an out-of-memory storm, is STOPPED by the box, and the household and the
+    operator are told. A press on Start gives it one more try.** Operator's words: *"if it is in a crashloop,
+    or consuming resources, then yes, definitely stopped at least."*
+
 **RomM follow-ups, operator-agreed the same day:** the test bench watches memory after an update
 (`upgrade-test.py`, 2026-09-23); a version move checks the memory limit (gate or checklist — §6.4);
 R-636's louder repeated alarm.