Decisions 149-150 recorded; instruction files kept true; R-890, R-891, R-644 closed, R-469 narrowed (142 -> 139)

Decision 150 (operator 13:25): sessions correct stale facts in instruction files themselves,
naming each edit; never loosen a rule. Added to unprompted-work.md §5 (all copies) and
PROMPT-TEMPLATE.md §9. CLAUDE.md gates paragraph (R-891), architecture pointer, docs/website
rules, the doubled R-286 sentence in the workspace CLAUDE.md.
Decision 149: vaultwarden's step proven on bench 9401 and box 9202 (evidence here).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/CLOSED-ITEMS.md

@@ -26,6 +26,16 @@
 
 ---
 
+## 2026-10-06 (afternoon) — instruction files kept true; vaultwarden on the ladder
+
+The full text of every row below: `git show 7d0dffcf34:documentation/backlog/OPEN-ITEMS.md`.
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-644** | **[P3-LOW] `gokapi` on scratch guest 9202 is crash-looping — 329 restarts by 2026-09-23 07:51 UTC, *password does not appear to be a SHA-1 hash* — and the controller still lists it deployed.** (P4) | CLOSED 2026-10-06 — NO LONGER PRESENT (live read) | 9202 at 11:47Z: no gokapi container and no gokapi volume (control: the same listing shows the six running containers); the controller lists only paperless-ngx and privatebin deployed — `audits/r890-instructions-2026-10-06/C/R-644-9202-live.txt`. |
+| **R-890** | **A vaultwarden update step still cannot be written to the ladder: the ladder writer needs the step proven on BOTH the bench and the box, and decision 146 keeps the admin seed on the bench only.** (P4) | CLOSED 2026-10-06 — BUILT AND PROVEN (decision 149): the test box seeds vaultwarden through its admin invite inside the box; the first vaultwarden step is in the ladder | catalog `6b4877d` (box_admin_seed_allowed, five conditions; BoxAdminSeedGuard red-proved) and `ecb8552` (vaultwarden 1.36.0-alpine -> 1.37.4-alpine written by --write-ladder); bench 9401 proven (anon peak 16.3 %, seed read back), box 9202 proven (guarded Update done 12.3 s, seed read back) — `audits/r890-instructions-2026-10-06/`. The Tester 1 box is allowed by the ruling but the walk has no route to it. |
+| **R-891** | **felhom.eu `CLAUDE.md` says `--fast` selects „all of them" — no longer true since the full-run-only `iso-bootstrap` gate (R-502, 2026-10-06).** (P4) | CLOSED 2026-10-06 — FIXED (decision 150: instruction files are kept true by the session) | felhom.eu `CLAUDE.md` „Gates — ONE entry point" now says the `GATES` table is the list (nineteen gates; the old copy named ten) and that `--fast` skips the full-run-only gates, naming them (today `iso-bootstrap`); `repo_gates.py` read: 19 gates, one not fast. |
+
 ## 2026-10-06 (midday) — R-444 live
 
 The full text of every row below: `git show bfdea832:documentation/backlog/OPEN-ITEMS.md`.