D44/D45 = all picks applied (R-1265, R-1266 closed; R-1280–R-1283 opened); R-232 dated check done; release-2026-10-26 evidence: fix A/B live on rc.6, D47 set-aside alarm on rc.7

documentation/architecture/07-backup-architecture.md

@@ -1561,7 +1561,8 @@ crosses the line — **R-158**.
 > design, **row 14** is proven and merely never stopwatched, **row 11b** is a note not a row, and
 > **row 15 was an open DEFECT (R-104) that this line did NOT cover** — *R-104 was CLOSED 2026-10-05 (controller
 v0.297.0: a lock that survives the self-heal gets the class `locked`, its own note and a retry, `offbox.go:156-162`;
-CLOSED-ITEMS.md; corrected 2026-10-24).*
+CLOSED-ITEMS.md; corrected 2026-10-24).* **Row 16** (added 2026-10-25, D44 #6, R-1265 — after this banner) has a blank RTO
+too: a registry rebuild from the ep0 release copy was never timed.
 >
 > **NO STATUS MOVED ON THE DAY THIS WAS WRITTEN, because nothing was proven that day.** A stopping
 > line that promotes a row is a stopping line that lies. Full text, and the conditions that reopen
@@ -1601,6 +1602,7 @@ CLOSED-ITEMS.md; corrected 2026-10-24).*
 | 13 | **Customer loses R** | every byte, every tier, the Recipe | **on-premises recovery is unaffected** — Tier-1/2/3 and the whole-guest tiers all work while the guest and host live. What is lost: the ability to re-establish **host identity** and to open the escrowed offsite key material after a host loss | — | | | **NONE for host-loss** | R exists in **zero** system copies by design (INV Part C, row 24). Whether the operator should be able to recover is **open** → §11-A, §11-B. **D5 narrows this further:** Tier-1/2 app recovery needs only the drive, so losing R now costs the offsite route and host identity, never local app recovery (§7.4) |
 | 14 | **Host SSH management plane dies** | everything | 3-layer break-glass: tmpfiles → 60 s watchdog → hub-vaulted `root@pam` on the PVE console | operator | | | **PROVEN** | `runbooks/break-glass.md`; the original incident and its fix |
 | 15 | **Interrupted offsite run leaves a stale lock** | everything | manual `restic unlock --remove-all` | **operator** (SSH) | | | **FIXED 2026-10-05 (R-104, v0.297.0; was DEFECT — corrected 2026-10-24)** | the self-heal exists (`offbox.go:634-648`) but the probe fails first and `classifyResticProbe` has no lock case → fail-fast, operator told *„ismeretlen okból"* → **R-104** |
+| 16 | **The container registry is lost with DooPlex** (the released images and agent packages) | the release copy on ep0 (D33): the newest 3 release tags of `felhom-controller`, `felhom-hub` and `felhom-samba`, and the newest 5 agent packages (binary + config bundle), in a plain folder outside PBS (`/srv/felhom-release-copy`) | push the copy back into a registry with the same name — `runbooks/total-loss-of-dooplex.md` „Restore the release copy” (same digests, no rebuild; `scripts/release-copy/`) | **operator** (ep0 root) | | 24 h (nightly 01:40) | **PARTIAL** | `audits/day-2026-10-23/08-release-copy-D33.txt`: the copy was pulled back, every sha256 and digest matched, and a controller image from it ran on a scratch box. Not yet walked: the push into a real new registry and the agent-package upload. Added 2026-10-25 (D44 = all picks, R-1265) |
 
 ### 8.2 The ONE exception to row 5's derived-copy rule (R-403, controller v0.230.0)
 
@@ -1740,7 +1742,7 @@ put-back leaves (§8 D20/D22), so no new retention rule. A watcher looks 30 more
 turns to success („…elindult: a visszaállítás kész.") and the copy is removed, as after any successful restore; if it
 never runs, the copy stays for support.
 
-### 8.2c Decisions in code that no document recorded [DESIGN — undocumented, found 2026-10-24, review round 2 — the operator confirms them through one register row]
+### 8.2c Decisions in code that no document recorded [DESIGN — confirmed by the operator 2026-10-25 (D44 = all picks, R-1265)]
 
 Read at `file:line` on `main` (controller `321df1f`, hub `44d19042`) by the main session:
 
@@ -1756,8 +1758,9 @@ Read at `file:line` on `main` (controller `321df1f`, hub `44d19042`) by the main
   a box that declares it waits for the household's recovery code (`awaiting_recovery_key`) is skipped — no event, no
   heal (R-1230, `:103-110`).
 - **The release copy (D33)** — nightly 01:40, the newest 3 image tags and 5 agent packages to ep0 under its own
-  limited user, capped by the sender (`felhom.eu/scripts/release-copy/`) — has no row in this matrix; its homes are
-  the poster facts and `runbooks/total-loss-of-dooplex.md`.
+  limited user, capped by the sender (`felhom.eu/scripts/release-copy/`). ~~has no row in this matrix~~ It is row
+  **16** of the matrix since 2026-10-25 (D44 = all picks, R-1265); its other homes are the poster facts and
+  `runbooks/total-loss-of-dooplex.md`.
 
 ### 8.1 The blank cells, listed explicitly
 
@@ -1776,6 +1779,7 @@ Per the rule that a blank is a finding, here they are:
 | 13 | RTO, RPO | not a timed recovery; a capability loss |
 | 14 | RTO | the break-glass path is proven but was never timed |
 | 15 | RTO | the manual unlock was performed but not timed |
+| 16 | RTO | a registry rebuild from the ep0 release copy has never been timed (row added 2026-10-25, D44 #6, R-1265) |
 
 **Also unmeasured, and not representable as a row** (INV Part F.3): any restore larger than 155.5 MB
 from restic; any restore of a customer data drive (no tier holds one whole); the weekly PBS