R-415 fixed on hub main (no duplicate/nested/felhom.eu customer domain; R-138 option B); R-762 closed (9202 proven, catalog eec9a0d); R-905 opened (wger static in backups); decision sheet D10; 130 -> 129

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/CHANGELOG.md

@@ -1,9 +1,16 @@
-## Unreleased (2026-10-08) — an alarm when a box never backs up off-site because its escrow is pending (R-243; `09` §3 decision 179); a deleted customer's audit rows go after 1 year (R-901; decision 181); the operator's older-recovery-package mail (R-304; decision 183) — ships with tomorrow's hub release
+## Unreleased (2026-10-08) — an alarm when a box never backs up off-site because its escrow is pending (R-243; `09` §3 decision 179); a deleted customer's audit rows go after 1 year (R-901; decision 181); the operator's older-recovery-package mail (R-304; decision 183); no duplicate or nested customer domain (R-415, R-138 option B) — ships with tomorrow's hub release
 
 **Operator action on deploy: none.** Expect ONE `offsite_escrow_pending` mail for **Tester 2** on the first sweep after
 the deploy: its latest report (2026-10-04) says off-site ON, escrow `pending`, no successful run ever — the state the
 operator believes it is in (decision 170).
 
+- **R-415 / R-138 option B (operator ruling 2026-09-14, `01` §7 — every customer has their own domain):** the create and
+  edit paths refuse a domain that equals, contains or lies under another customer's, or is under `felhom.eu`, BEFORE
+  anything is generated or provisioned; the form re-renders with the submitted values and one sentence; a store error
+  refuses too. Label-boundary matching, case-insensitive, trailing dot ignored. `store.DomainConflict`; test
+  `TestR415_CreateAndEditRefuseConflictingDomain` (red-proved: without the create guard „b1 with example.hu was
+  created"). Live data read first (read-only DB copy, deleted): the four customers' domains are distinct and none is
+  under felhom.eu. The form's example and one old test fixture said `kovacs.felhom.eu` — corrected to `kovacs.hu`.
 - **R-304 option C (decision 183):** new event type `recovery_older_package` (sent by the controller of the same day when
   a household's code opens, or may open, an older sealed escrow package): in `allowedEventTypes` and
   `notify.operatorOnlyEvents`, no household text. Test `TestR304_RecoveryOlderPackageIsAllowlistedAndOperatorOnly`