docs: the app page's layout, the asset tag, and a version number pushed once (controller v0.316.0)

02-controller-module-map.md "The app page" gains the layout rules [DESIGN] — one column of one
width, a section is a hairline not a card, a box means something (blue = the app is waiting for
you, amber = something is risky, nothing else), the hero is not a box, and a success is not a
banner. Plus the asset-tag rule: every shell's stylesheet address is derived from the BUILD, not
the version, because the origin sends no validator and a cached copy can therefore only expire or
be addressed differently.

09-update-architecture.md gains §0 [DESIGN]: a version number is pushed once. It belongs at the TOP
of that document because everything below it compares versions — the floor moves a box by comparing
a number, the button offers the highest tag, and a box re-pulls a tag only when the tag changes.
Two images under one number is therefore not untidiness; it is a box running the wrong code that
can never be told.

R-1080 filed and closed: 0.315.0 was pushed three times from three different commits. Closed rather
than left open because no box is stranded — exactly one guest ran it and it ran the registry's
current digest, and the floor was 0.314.0 so nothing else could have taken it.

audits/app-page-2026-10-15b/P0/ carries the measurement and its honest caveat: the stale Cloudflare
object is no longer reproducible, because the first probe of the session forced its revalidation.
What is shown is every precondition, the proof an aged entry existed (cf-cache-status EXPIRED), and
the elimination of the only other candidate. The six stylesheet bodies are reduced to their sizes,
sha256s and rule counts — one 99 KB file does not need six copies in git to make the point.

.claude/rules/unprompted-work.md item 6, all four versioned copies: a version number is pushed once,
stated as a FACT about what the build now enforces rather than as a new rule.

STATUS: the operator's one look, through the public address.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y

documentation/backlog/CLOSED-ITEMS.md

@@ -26,6 +26,12 @@
 
 ---
 
+## 2026-10-15 (evening) — controller v0.316.0, one column and one image per version
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-1080** | **v0.315.0 was built and pushed THREE times from three different commits, and nothing stopped it.** (P2) Every build asked the browser for `/static/style.css?v=0.315.0`, so a cache holding the first build's stylesheet — which had no `.app-tabs` rules at all — kept serving it under the address the third build still asked for. Worse in principle than the symptom: the floor and the household's button both compare VERSIONS, so a box that pulled between the first and the last runs different code under a number that is already current, and can never be told. | CLOSED 2026-10-15 — **controller v0.316.0**, in two halves. (1) `build.sh` refuses `--push`/`--multiarch` for a tag already in the registry, before building; a registry it cannot reach is a refusal too. Six cases in `scripts/test_build_push_once.sh` against the real script with a fake docker; red-proved twice. (2) every shell's stylesheet URL is a per-build tag (version + GitCommit + BuildTime), so two builds of one version cannot share a cache entry. **No box is left on a bad image:** exactly one guest ran 0.315.0 (demo-hp 9201) and it ran the registry's current digest `8887343011d6`; the floor was 0.314.0, so nothing else could have taken it. | `audits/app-page-2026-10-15b/P0/VERDICT.md`, `felhom-controller/REPORT.md` |
+
 ## 2026-10-15 (evening) — controller v0.315.0, the app page
 
 | Row | What | Closed | Evidence |