catch-up session 2026-10-05: design 07 §6.1.1 (a box that is not always on), 08 §6.4; rulings 109-111, CC decisions 112-118; R-871/R-873..R-877 closed, R-872 narrowed (dated check), R-878 opened; live evidence; STATUS

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -815,6 +815,44 @@ its length, and both fixes cost something the household would notice — operato
     1.30.0, agent 0.142.0 and the re-made golden; it lacks only agent 0.142.1's wrapper fix (R-858). *Operator ruling
     2026-10-04 ~18:49.*
 
+### 2026-10-05 (08:42) — three operator rulings (recorded before the work; the catch-up brief)
+
+109. **R-871, option A: a missed night runs once when the box comes back.** A box that was off during its backup time
+     makes the missed backups soon after it is switched on; updates that restart apps still wait for a real night.
+     **Rejected:** B — "the box must stay on at night", with an alarm only. *Operator ruling 2026-10-05.*
+110. **The household is told on its dashboard** (the operator's idea): a banner the household can close, shown when a
+     daily backup was missed — when the last backup was, that the box was off during the backup time, and a suggested
+     different time. It never changes the time by itself. *Operator ruling 2026-10-05.*
+111. **Tester 2: read only.** If it is online, CC re-signs its agent update (decision 97, act 1) and reads it back.
+     Nothing else. *Operator ruling 2026-10-05.*
+
+### 2026-10-05 (day, catch-up brief) — decided by CC — operator may reverse
+
+112. **When the catch-up runs (R-871).** Options: (a) at once after the box comes back — a box switched on and off
+     again starts a dump each time; (b) 15 minutes later, re-checking first. **Chosen (b)**, as the brief proposed;
+     a leg due within 30 minutes is left to its normal run. `07` §6.1.1.
+113. **What a host suspend does to the night (R-871).** Options: (a) only a controller start triggers the catch-up —
+     a suspended laptop's 02:30 timer then fires hours late (Go timers run on CLOCK_MONOTONIC) and starts the
+     app-update leg at noon; (b) skip any daily job that fires over 60 minutes late and trigger the catch-up from a
+     resume watch. **Chosen (b).** Reasoned and unit-tested with injected clocks; not measured live.
+114. **The banner's line and its suggestion (decision 110).** Options for the line: 24 h (a slow night flickers it),
+     26 h (one night + the chain's two hours, = the hub's `backupStaleAfter`), 48 h (two missed nights before a word).
+     **Chosen 26 h.** Suggestion: the latest hour H with H, H+1, H+2 usually on (on ≥ 5 of the last 7 days); none
+     when the current window is already usually on (a new time would not help).
+115. **R-872's lines for a box that is down at the deadline.** Options: (a) judge a down box like an up one — a box
+     that died last night raises a backup alarm on top of its staleness alarm; (b) 48 h without a dump / 72 h
+     without a whole-guest backup (the agent's own 48 h valve + a day). **Chosen (b).** hub v0.134.0, `08` §6.4.
+116. **R-873's rule.** Options: (a) household liveness mail only after 24 h down — a real outage reaches the household
+     a day late; (b) at most once per 7 days to the household, the operator every edge. **Chosen (b)** (the brief's
+     first example): the first outage of a week still reaches the household at once. hub v0.134.0, `08` §6.4.
+117. **R-874's first restore-test check after start.** Options: at start (a crash loop hammers a failing tier — the
+     earned restraint), 30 minutes after start, or keep one interval (6 h — a short-session box never reaches it).
+     **Chosen 30 minutes.** agent v0.145.0.
+118. **R-876's repair trigger.** Options: (a) always run `dpkg --configure -a` (R-845's speed lost on every clean
+     pass); (b) read `--audit` AND the update journal in ONE `sh -c` call, repair when either shows something, and as
+     a belt repair + retry once when apt itself says "dpkg was interrupted". **Chosen (b)**: a clean pass still costs
+     one call (pinned by a test). agent v0.145.0.
+
 ### 2026-10-05 (06:49) — four operator rulings (recorded before the work; the night-fixes brief)
 
 100. **Tester 1's Cloudflare tokens, shown in the 2026-10-04 night session's output, are NOT rotated** (option B) —