burn-down Part B: 14 small rows fixed and closed across four repos (306 -> 292); no :latest in the hub build; gate list pinned; closed-id duplicates refused; R-262 subset pinned

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/runbooks/iso-release-gate.md

@@ -320,3 +320,8 @@ record.
 
 Record each criterion as PASS/FAIL **with the observed value and what was scanned for**, in the
 release report. A criterion with no recorded observation is a criterion that was not run.
+
+**The ONE home for a release's record is `documentation/tests/iso-release-<version>-<date>/`** (R-588,
+2026-10-05) — one directory per published ISO, so „was the gate run for this image?" is answered by looking,
+not by a full-text search for a checksum. A record made elsewhere (inside an audit) gets a directory here
+whose `README.md` points at it. Today: 1.27.0, 1.27.1, 1.28.0 (pointer), 1.29.0.

documentation/runbooks/workspace-CLAUDE.md

@@ -54,7 +54,13 @@ roles. **A file being open in the editor is NOT an instruction. If no task is st
    attempts.
 3. **An absent log line is not evidence of correct behaviour.** Verify with a POSITIVE observable —
    something that MUST appear when the system is healthy. An empty log is equally consistent with
-   "working" and "stopped entirely".
+   "working" and "stopped entirely". **And the control must come from a DIFFERENT channel than the measurement** (R-286):
+   same query, same snapshot, same API or same clock all share the defect they are meant to catch — a
+   stale hub snapshot once "confirmed" itself (2 events all day) while the operator's mailbox held eight
+   alarms. A hub-state check copies `hub.db-wal` too, or asks the running pod. **And the control must come from a DIFFERENT channel than the measurement** (R-286):
+   same query, same snapshot, same API or same clock all share the defect they are meant to catch — a
+   stale hub snapshot once "confirmed" itself (2 events all day) while the operator's mailbox held eight
+   alarms. A hub-state check copies `hub.db-wal` too, or asks the running pod.
 4. **A recommendation that is not followed gets one line saying why.** Silence reads as agreement and
    the disagreement is lost.
 5. **Evidence is copied off the machine at the end of the phase that produced it — before any revert,