answers 2026-10-12 Parts C + E: hub 0.147.0 live and read back, Glance gated; 5 rows closed (110 -> 105)

- closed: R-242 (golden-vouch alarm live), R-244 (cascade + sweep 19 ids / 79 rows / 7 orphans, recount 0),
  R-246 (stale_at retired), R-402 (host-page integrity line, matches the box), R-782 (Glance family gate proven on 9202)
- R-250 VERIFY (next real off-site setup); R-266 + R-521 hub halves live, controller halves pending
- R-887: my rate limit refused a hub image push (home public IP); fixed at once (homelab-manifests d0767fe)
- evidence: audits/answers-2026-10-12/{hub-0.147.0-readback,s26-glance-family-gate-9202}.txt

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/CLOSED-ITEMS.md

@@ -32,6 +32,11 @@ The full text of the rows below: `git show 25ab47eeaa:documentation/backlog/OPEN
 
 | Row | What | Closed | Evidence |
 |---|---|---|---|
+| **R-242** | **A controller release that changes customer-visible behaviour is not delivered until a golden carries it — and nothing enforces that.** (P3) | CLOSED 2026-10-12 — **the vouch half is built and live** (S4, decision 199): hub 0.147.0 `GoldenVouchChecker` compares Gitea's newest `felhom-golden` with the vouched one every 15 min and raises an operator-only `golden_not_vouched` after 2 h. Live: „newest published 0.301.0, vouched 0.301.0 — ok". The bake half was already gated (`golden_currency_gate.py`). | hub `655f5f66` (`TestGoldenVouchChecker`, red-proved); `audits/answers-2026-10-12/hub-0.147.0-readback.txt` |
+| **R-244** | **The customer DELETE cascade leaves `app_log_issues` behind, and it is systematic across every venue ever torn down.** (P3) | CLOSED 2026-10-12 — **fixed and swept** (S6, decision 201): hub 0.147.0 de-references a deleted customer in `app_log_issues` on every delete (rows shared with live customers keep their history). One-time sweep, count shown to the operator first: 19 deleted ids, 79 shared rows de-referenced, 7 orphan rows deleted; a second count reads 0. `/apps/paperless-ngx` lists live boxes and no deleted name. | hub `655f5f66` (`TestDereferenceCustomerFromAppIssues`, `TestSweepDeletedAppIssueRefs`, red-proved); `audits/answers-2026-10-12/hub-0.147.0-readback.txt` |
+| **R-246** | **A leftover staleness flag has silently disabled the new recovery discriminator on `demo-hp` since 2026-08-04, and the flag is WRONG.** (P4) | CLOSED 2026-10-12 — **retired** (S30, decision 225): hub 0.147.0 no longer reads or writes `stale_at`; `MarkEscrowStale` and the config-form badge removed; an old stamp no longer withholds the escrow hash. | hub `655f5f66` (`TestStaleAtNoLongerWithholdsTheHash`, red-proved); deployed 2026-10-12 |
+| **R-402** | **The off-site integrity verdict and its depth are published to the hub and NO hub surface reads either.** (P4) | CLOSED 2026-10-12 — **built and live** (S33, decision 228): every host page shows „Last full check (off-site): OK, depth 100%, <date>" (Tester 2: „never checked"). demo-hp's line equals the box's own settings (2026-10-11T04:00:00Z, ok, 100%). The two fields left the wire gate's unread list. | hub `655f5f66` (`TestOffsiteIntegrityLine`, `TestHostPageShowsOffsiteIntegrityLine`, red-proved); `audits/answers-2026-10-12/hub-0.147.0-readback.txt` |
+| **R-782** | **[P3-LOW] Two side observations of the R-753 sweep, inferred, not measured:** (P3) | CLOSED 2026-10-12 — **Glance is behind the family gate** (S26, decision 221): catalog `d308445` (`family_gate: true`, no exceptions; check-family-gate rule 4 pins the ruled apps, red-proved by three decoys). Proven on scratch 9202: a stranger gets 302 to `/__family/start` (401 without `Accept: text/html`, 401 on POST) while Glance answers 200 inside the guest; the household passes `/__family/start` → `fcb` → 200. Test install removed through the product. The gate is recorded at install, so an older Glance install would stay public — read 2026-10-12: no box has Glance (demo-hp, demo-felhom, Tester 1, Tester 2). | `s26-glance-family-gate-9202.txt`; catalog CI run 1705 success |
 | **R-886** | **DooPlex's Alertmanager cannot write its own state since the Longhorn restart of 2026-10-05 13:20Z** (P3) | CLOSED 2026-10-12 — **fixed on DooPlex** (operator yes in chat; S22, `09` §3 decision 217): Alertmanager pod `fsGroup: 65534` (homelab-manifests `4168451`, resource-only sync). Volume now `0:65534 drwxrwsr-x`; a test silence survived a pod delete (old pod `…98z2l` → new `…28rrq`, `GET /api/v2/silences` = active), then expired by amtool; `nflog` and `silences` files now written. | `s22-alertmanager-silence.txt` |
 | **R-211** | **Prometheus has no config-reloader — a rules change reaches the pod and is never read** (P3) | CLOSED 2026-10-12 — **fixed on DooPlex** (operator yes in chat; S23, `09` §3 decision 218): `config-reloader` sidecar (configmap-reload v0.15.0, by digest; homelab-manifests `ab40c7b`). Proven twice with no manual reload: a rule-comment change (`e70e0f1`) and its removal (`78d4be4`) each reached Prometheus ~35–40 s after a ConfigMap-only sync („successfully triggered reload" + „Completed loading of configuration file"); 56 rules `ok`. | `s23-prometheus-reloader.txt` |
 | **R-243** | **A box in the R-241 state silently stops backing up off-site, and NO ALARM OF ANY KIND FIRES.** (P2) | CLOSED 2026-10-12 — **the alarm fired on time.** The `offsite_escrow_pending` mail for Tester-2 reached the operator mailbox 2026-10-11 16:13:51Z (the first sweep after the 7-day line, ~16:06Z); the running hub logged „Operator email sent for Tester-2/offsite_escrow_pending" at the same second. Two channels. | hub v0.144.0+ (`b119301c`); `r243-escrow-pending-mail.txt` |