docs: the app page's layout, the asset tag, and a version number pushed once (controller v0.316.0)

02-controller-module-map.md "The app page" gains the layout rules [DESIGN] — one column of one
width, a section is a hairline not a card, a box means something (blue = the app is waiting for
you, amber = something is risky, nothing else), the hero is not a box, and a success is not a
banner. Plus the asset-tag rule: every shell's stylesheet address is derived from the BUILD, not
the version, because the origin sends no validator and a cached copy can therefore only expire or
be addressed differently.

09-update-architecture.md gains §0 [DESIGN]: a version number is pushed once. It belongs at the TOP
of that document because everything below it compares versions — the floor moves a box by comparing
a number, the button offers the highest tag, and a box re-pulls a tag only when the tag changes.
Two images under one number is therefore not untidiness; it is a box running the wrong code that
can never be told.

R-1080 filed and closed: 0.315.0 was pushed three times from three different commits. Closed rather
than left open because no box is stranded — exactly one guest ran it and it ran the registry's
current digest, and the floor was 0.314.0 so nothing else could have taken it.

audits/app-page-2026-10-15b/P0/ carries the measurement and its honest caveat: the stale Cloudflare
object is no longer reproducible, because the first probe of the session forced its revalidation.
What is shown is every precondition, the proof an aged entry existed (cf-cache-status EXPIRED), and
the elimination of the only other candidate. The six stylesheet bodies are reduced to their sizes,
sha256s and rule counts — one 99 KB file does not need six copies in git to make the point.

.claude/rules/unprompted-work.md item 6, all four versioned copies: a version number is pushed once,
stated as a FACT about what the build now enforces rather than as a new rule.

STATUS: the operator's one look, through the public address.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y

documentation/architecture/02-controller-module-map.md

@@ -477,6 +477,35 @@ does not get to vouch for a version, so an overlay can neither set nor clear it.
 **[DESIGN] Guide text is DATA.** Plain text through `html/template` — no markdown, no raw HTML — so
 a step containing a tag is shown as the characters its author typed.
 
+#### The app page's layout (v0.316.0, operator-approved mockup 2026-10-15)
+
+**[DESIGN]** Five rules; the first three are the mockup, the last two are what they imply.
+
+1. **One column of one width** (820px; the log tab alone is full width, because log lines are long).
+   Boxes of differing widths read as a page assembled by accident, which is what v0.315.0 looked like.
+2. **A section is a hairline, not a card** — `padding: 28px 0` with a bottom `--line-soft`, no
+   background, no border, no radius. A card says „this is a thing you act on", and most of an app
+   page is a thing you READ; a card there is a promise the content cannot keep.
+3. **A box means something, and there are exactly two.** Blue (`--blue` on `--blue-dim`) when the app
+   is WAITING for the household — an after-start value; amber (`--warn` on `--warn-dim`) when
+   something is RISKY, such as a backup sharing a disk with the data it protects. The
+   exception-colour principle, applied to shape as well as colour. Nothing informational is boxed.
+4. **The hero is not a box**: a 64px logo tile, the name, the tagline, hairline chips (state,
+   lifecycle, update) and meta text (the address, the last automatic update). The tab bar is links
+   with a 2px `--blue-bright` underline under the open one — no pills, no fills.
+5. **A success is not a banner.** The automatic-update SUCCESS line is meta text in the hero. It
+   asked nothing of the household, so it is a date. Everything that DOES need a decision — a failed
+   update, a hold, lost files, a missing drive, an interrupted install — stays a banner above the
+   tabs, which is R-571's placement rule and is unchanged.
+
+**[DESIGN] The stylesheet's address changes with every build.** Every shell links
+`/static/style.css?v={{.AssetTag}}`, where the tag hashes version + `GitCommit` + `BuildTime` and
+stays opaque (8 hex) because the stranger-facing share pages use the same value. The origin sends no
+ETag and no Last-Modified, so a cached copy cannot be revalidated — only expire, or be addressed
+differently. This is the „addressed differently", and it is the fix for a measured defect: a
+Cloudflare edge served 0.315.0's first stylesheet under the address its third build still asked for
+(`audits/app-page-2026-10-15b/P0/VERDICT.md`). `Cache-Control` is deliberately unchanged.
+
 ### `scripts/`
 | File | Class | Reason | Risk |
 |---|---|---|---|