Release block 2026-10-27: hub 0.173.0, agent 0.167.0, controller 0.346.0 released; R-1250 fixed the same day and proven; ten rows closed, R-1312 opened

- audits/linetest-2026-10-27/: the hold failed four times as built (qBittorrent drains ~14 s), the fix 710ceac, the test
  through the hold on 0.346.0-rc.1 (94.5 Mbit/s, the limit back exactly), teardown.
- audits/release-2026-10-27/: builds, agent release + signed updates, per-box and global floors, box walk.
- 09 §3 decisions 269 (R-1250 fix the same day) and 270 (R-1218 live proof waived); D55's window result in 268.
- 08 §: the drain-wait design line. STATUS, CONTEXT, register (223 -> 214).

documentation/architecture/08-alarm-ladder.md

@@ -591,6 +591,11 @@ normal use; work it does not explain is the sign of a hacked app. Numbers and me
    start-up check puts it back; the 50 % rule waits while a record exists. Measured on demo-hp with a real seed (10
    Mbit/s to DooPlex's qBittorrent): refused `not-quiet` without the hold; with it the uplink fell to 0.02–0.16 Mbit/s,
    94.2 Mbit/s measured, the app held 56.8 s and back to 1 249 280 B/s exactly (`audits/dooplex-alarms-2026-10-24/`).
+   **[DESIGN — R-1250 drain wait, 2026-10-27; controller `710ceac`, released v0.346.0]:** between the hold and the call
+   the controller waits until every held app REPORTS its own upload ≤ 16 KiB/s on two readings 2 s apart (at most 90 s;
+   an unreadable speed waits 20 s) — qBittorrent 5.2.4 kept sending at full speed ~14 s after its limit fell, inside the
+   agent's 5–15 s quiet read, and four tries in an hour were refused; with the wait the test ran (94.5 Mbit/s, the limit
+   back exactly; `audits/linetest-2026-10-27/`; `09` §3 decision 269).
    **[DESIGN — R-1261, 2026-10-25 night; controller `a79a292`, unreleased]:** EVERY running seeder is held (qBittorrent
    and Transmission — one left seeding kept the test refused `not-quiet` every time); all records first
    (`upwatch.line_test_holds`), then the apps; a record whose app was removed while held is dropped (it used to stop the

documentation/architecture/09-update-architecture.md

@@ -1107,6 +1107,25 @@ its length, and both fixes cost something the household would notice — operato
      the plan grows ~14 a night (209 on 2026-10-26, ~223 at the next run), so it is refused again. Why A: the cap must sit
      above the honest plan on the night it is used. CC's token lacks `offsite:write`, so the operator made a one-purpose
      token `cc-d55-window` (Off-site write only); CC used it once, 2026-10-26 19:10:31Z (`max:260` stored, read back).
+     **The window ran** 2026-10-27 03:18:15–03:18:41Z (window 17): 223 of 223 planned removed, 373 → 150, closed by the
+     box, no alarm (hub row + the box's own log agree). The operator revokes the token.
+
+### 2026-10-27 (attended release block) — the line-test hold is fixed the same day; R-1218's live proof is waived
+
+269. **The line-test hold waits until the held app has really slowed down — fixed in the controller the same day.**
+     *Operator, 2026-10-27 12:30 CET.* Options: A) fix in the controller now, prove it on an rc on demo-hp's 9201 while the
+     seed runs, ride today's 0.346.0 — cost: ~1.5 h, the release later in the afternoon; B) file it and fix later — cost:
+     a box that seeds all day keeps getting no weekly test. Why A: measured four refusals in an hour (qBittorrent sends
+     ~14 s after its limit falls; the agent reads 5–15 s after the call). Built `710ceac`; live on `0.346.0-rc.1`: 94.5
+     Mbit/s, the limit back exactly (`audits/linetest-2026-10-27/`).
+
+270. **R-1218 is released without its live proof (rule 2 waived for this row).** *Operator, 2026-10-27 15:15 CET.*
+     Options: A) keep both halves, waive the live proof — cost: released key code proven by red tests only; a box that
+     lost its key file entirely now gets a 409 on its ceremony instead of a silent demotion; B) revert both halves — cost:
+     a hub 0.173.1 and a second deploy, and the demotion bug stays. Why A: no product path makes the box's saved off-site
+     target „off" on a hub box (the hub page's switch did not reach Tester 1's target; the household's clear is refused on
+     a hub tier), so no live run can tell the old code from the new; the change only widens a safety step and adds a
+     refusal. R-1312 asks what the hub switch does on the box.
 
 ### 2026-10-26 (evening brief) — D53: held apps reach the operator; D54: demo-hp's stuck clean-up; R-1297 (B): a second CI runner