hub v0.136.0: nightly VACUUM INTO snapshot, keep 2 (R-173 decision A); hub PVC 2Gi + Longhorn default group; 09 rulings 125-127; 05 §16.3

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -881,6 +881,16 @@ its length, and both fixes cost something the household would notice — operato
      `<ver>-step1` — then the release's bundle, both by signed jobs. **Chosen (b)**, `felhom-agent/scripts/build-step-bundle.py`;
      delivered to demo-hp, demo-felhom and Tester 1 on 2026-10-05. `11` §5.4.2 rule unchanged.
 
+### 2026-10-05 (14:05) — three operator rulings (recorded before the work; the hub-DB off-site brief)
+
+125. **The hub database's off-site copy goes to ep0's backup server** (option A of the hub-safety STATUS decision):
+     encrypted on DooPlex, pushed to a write-only namespace on ep0, restore-tested weekly, alarmed. Rejected: B, a separate
+     Hetzner Storage Box account (more new parts to maintain). *Operator ruling 2026-10-05.* (R-173)
+126. **R-519's live test is approved:** one controller restart on scratch 9202 in the middle of a backup. *Operator ruling
+     2026-10-05.*
+127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
+     *Operator ruling 2026-10-05.* (R-861)
+
 ### 2026-10-05 (06:49) — four operator rulings (recorded before the work; the night-fixes brief)
 
 100. **Tester 1's Cloudflare tokens, shown in the 2026-10-04 night session's output, are NOT rotated** (option B) —