D55 = 260 recorded (09 §3 decision 268); the grant set and read back; R-1299 filed (no grant button)

documentation/architecture/09-update-architecture.md

@@ -1099,6 +1099,15 @@ its length, and both fixes cost something the household would notice — operato
      `plex: security fix CVE-2026-96652,CVE-2026-96654,CVE-2026-96655,CVE-2026-96656 taken` and ended `done` in 30.1 s
      after the update's second-drive copy and undo copy. Released as controller 0.341.0, global floor 11:24 UTC.
 
+### 2026-10-26 (night brief) — D55: demo-hp's one clean-up window gets a cap of 260
+
+268. **demo-hp's one-shot clean-up window is granted with a raised cap of 260, not 220 (D55 = 260).** *Operator,
+     2026-10-26 night.* Options: A) 260 — cost: one window may remove up to 260 old copies on a test box (the box still
+     removes only what its normal keep rule selects, and the fake-copy guard still runs); B) 220 as first ruled — cost:
+     the plan grows ~14 a night (209 on 2026-10-26, ~223 at the next run), so it is refused again. Why A: the cap must sit
+     above the honest plan on the night it is used. CC's token lacks `offsite:write`, so the operator made a one-purpose
+     token `cc-d55-window` (Off-site write only); CC used it once, 2026-10-26 19:10:31Z (`max:260` stored, read back).
+
 ### 2026-10-26 (evening brief) — D53: held apps reach the operator; D54: demo-hp's stuck clean-up; R-1297 (B): a second CI runner
 
 265. **A held app reaches the OPERATOR first, never the household (D53 = operator-only reminders first).** *Operator,