burndown 3: report, evidence, register (174 -> 168), 07 Redis RDB [DESIGN], 04 §6.3 the box's password doors

Closed R-1115, R-1111, R-1112, R-1113, R-1109, R-1110, R-1114, R-1096; opened R-1116 (decoy suites in the other
runners), R-1117 (Immich/Nextcloud Redis volume, deferred). Controller 0.325.0 is the floor since 08:21 UTC.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/04-control-plane-authorization.md

@@ -184,6 +184,16 @@ nothing in this document's model: a destructive op still needs the operator's si
 make. What a token narrows is the hub side: the operator actions above are `hosts:write`; the reveal of a break-glass
 credential, every delete and reset, the password and the tokens are session only.
 
+### 6.3 The box's own password doors (controller) [controller v0.324.0 / v0.325.0, R-983, R-1111, R-1112]
+
+Outside this document's signing model, but recorded here because it is where a reader looks for "who may get in": the
+controller has four password doors — the dashboard sign-in, the escrow wizard's re-auth (it shares the sign-in's
+counter), a share link's password (`/s/<token>`, its own counter) and the family gate (its own, per visitor and per
+name). **Each reserves a try BEFORE the slow password compare, in one locked step, and a right password clears it**
+(the sign-in, the re-auth and a share: 5 tries per visitor in a sliding minute, `auth.go` `loginMaxAttempts`; `REUSE.md` row `web.reserveLoginAttempt`), so parallel tries cannot all pass a check none of
+them has counted yet. **Sessions are stored as fingerprints, never as their cookie values** — dashboard (R-35) and family
+(`family.json`, R-1112) alike. A password change or reset ends every dashboard, family and setup-gate session (R-976).
+
 ## 7. Hardware readiness (Viktor's "build the foundation now")
 
 Software `ssh-ed25519` now; a FIDO2 `sk-ssh-ed25519@openssh.com` key later is a **no-op on the

documentation/architecture/07-backup-architecture.md

@@ -560,6 +560,18 @@ compose DECLARES (`backup.ResolveDockerVolumeNames`) and the drive folders it bi
 paths (`audits/burndown-apps-2026-10-16/P1/`). A survey of every running container on demo-hp found no other data path
 in an anonymous volume (PrivateBin's are temp folders).
 
+**[DESIGN, 2026-10-17, R-1096] A catalog Redis service saves snapshots (RDB), never an append-only file (AOF).** An AOF
+damaged in the MIDDLE — what the 2026-09-24 thin-pool fill left in two boxes' Redis — makes Redis refuse to start until a
+person runs `redis-check-aof --fix`, and the app stays down; a snapshot is written to a temp file and renamed only when
+complete, so a full disk leaves the old snapshot readable (measured on scratch 9202: the save fails, the old `dump.rdb`
+is byte-identical, Redis starts on it). The cost is the writes since the last snapshot — queue entries and sessions,
+which these apps rebuild or ask again for. The Redis volume still rides the nightly volume dump, taken with the stack
+stopped, so Redis writes a final snapshot first (100/100 probe keys back through dump + restore on 9202). romm, docmost,
+paperless-ngx, immich and nextcloud switched (`--appendonly no`, catalog `5d9450b`); outline and dawarich already ran
+RDB. A box applies the line at the app's next start (the nightly backup stops and starts each app); `steps/` files keep
+what they were tested with (`09` §6.4 part 5). Catalog gate `redis-persistence` refuses AOF in a template. Evidence:
+`audits/burndown-3-2026-10-17/P6/`; research `audits/night-restore-2026-10-17/P6/redis-persistence.md`.
+
 ### 6.2 Coverage per app class — and an unresolved count
 
 **[FACT]** Of 53 catalog templates, **52 keep data in Docker named volumes**; exactly **13** carry a