Media folder fix: B-1 (classes, export, remove), B-2/B-3 bench evidence, Part A (who runs the apps); 09 §3 decisions 242-243 (D9 = A with a limit; the N100 waits); 15 §2 ruled

documentation/architecture/09-update-architecture.md

@@ -915,6 +915,18 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
      *Operator ruling 2026-10-05.* (R-861)
 
+### 2026-10-14 (evening, ~21:20) — the media folders and the N100 (recorded before the work; the media-folder-fix brief)
+
+242. **D9 = A, with a limit.** The media apps keep today's `media` folder — nothing on a drive moves. Sonarr and Radarr
+     see the drive's whole `media` folder (they must: download and library on ONE mount, or every import is a full
+     copy); **the download clients (qBittorrent, Transmission) see only their own download folder**, so they can never
+     write into the family's photos, music or books. Every app sees a file at the same path as on the box.
+     Not chosen: B — a separate video folder (a one-time move on every box with files). *Operator ruling 2026-10-14.*
+     (`15-media-library.md` §2; R-1014)
+243. **The N100 lived-in setup waits until the all-drives build has been tested on the Tester 1 rig.** Until then the
+     N100 stays Tier 0 and is not fenced (it may host a second test rig). This replaces decision 240's timing.
+     *Operator ruling 2026-10-14.*
+
 ### 2026-10-14 (afternoon) — media apps on every drive (recorded before the work; the media-all-drives brief)
 
 237. **Media apps see every drive.** Each media app (`15-media-library.md` §3) binds every enrolled drive's media

documentation/architecture/15-media-library.md

@@ -5,7 +5,7 @@
 > learn. **No document covered this before 2026-10-14** — itself a finding: the four templates were written one by one
 > and never tested together (R-1014). Rulings: `09` §3 decisions 237–241. Measured on Tester 1:
 > `audits/media-all-drives-2026-10-14/`. Marks as in `01`: **[DESIGN]** a decision or proposal; **[FACT]** read in a
-> named file or measured. **Status: DRAFT** — measured end to end on Tester 1; the operator's layout decision (§2, STATUS D9) is open.
+> named file or measured. **Status: DRAFT** — measured end to end on Tester 1; the layout of §2 is RULED (decision 242) and live for one drive.
 
 ## 1. The problem
 
@@ -41,16 +41,23 @@ The four reasons:
 **[FACT, and a correction of the brief]** `media/` is not photo-free: the skeleton puts `photos`, `books`,
 `audiobooks`, `music`, `comics`, `podcasts` there too (`appbackup/userdata.go` + the catalog-derived set), and Immich,
 calibre-web, audiobookshelf and navidrome use them. With reason 1, a download app needs ONE mount that holds both its
-download folder and the libraries — so binding `media/tv` and `media/torrents` separately brings EXDEV back. **Open
-question for the operator (two options):**
+download folder and the libraries — so binding `media/tv` and `media/torrents` separately brings EXDEV back.
 
-- **A — bind `media/` whole, rw for the download apps.** Simple; measured working. Cost: qBittorrent, Transmission,
-  Sonarr and Radarr can write into the family's photos and music folders.
-- **B — move the video library into its own folder** (e.g. `userdata/video/{tv,movies,torrents,transmission}`) and bind
-  only that. Download apps never see photos. Cost: a one-time move on boxes that already have files there, and every
-  template and skeleton entry changes.
-- **CC recommends B** for the build: the download apps are the internet-facing ones, and „the box cannot touch your
-  photos" is a promise worth one move. A is fine for the Tester 1 rig.
+**RULED 2026-10-14 (`09` §3 decision 242, D9 = A with a limit) — this table replaces every earlier shape:**
+
+| App | Bind (rw unless noted), the SAME path inside the container as on the box | Sees |
+|---|---|---|
+| Sonarr, Radarr | `${USERDATA_PATH}/media` | the whole `media` folder — it must: download and library on ONE mount (S1) |
+| qBittorrent | `${USERDATA_PATH}/media/torrents` (+ the same folder as `/downloads`, for torrents added before 2026-10-14) | only its download folder |
+| Transmission | `${USERDATA_PATH}/media/transmission` (+ `/downloads` likewise; `/watch` = `media/transmission/watch`) | only its download folder |
+| Plex, Jellyfin, Emby | unchanged: `${USERDATA_PATH}/media:/media:ro` | they move with the all-drives build |
+
+The hardlink is made by Sonarr/Radarr in their own container, where both folders are one mount; the client reports
+`…/media/torrents/<name>` and Sonarr finds exactly that path. The download clients cannot reach `media/photos` (B-3,
+measured: the path does not exist in their containers). Sonarr/Radarr's bind is declared `excluded` in their backup
+block — unlisted it would be MANDATORY, every tier, off-site included (B-1, measured with the production classifier).
+Built in the live catalog 2026-10-14 (`audits/media-folder-fix-2026-10-14/`); the all-drives build adds one such bind
+per drive at the same paths, so nothing installed now is redone.
 
 ## 3. Which apps are „media apps" [DESIGN, proposal]