diff --git a/CONTEXT.md b/CONTEXT.md
index dfeb09af..8425f9fd 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -16,6 +16,10 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
 
+> **Rulings 2026-10-02 (morning, operator) — `09` §3 decisions 64, 65, recorded before the work.** **64 (R-780):** the
+> family gate — GO, both sessions. **65 (R-784 B):** SparkyFitness stays offered; the operator asks the author; no written
+> permission before the first paying customer → `lifecycle: hidden`. The licence read (R-787) runs this session.
+
 > **2026-10-01 (late night) — the box tells visitors apart (R-753 CLOSED), controller v0.286.1 floored, golden 0.286.1
 > vouched.** cloudflared alone on `felhom-tunnel` at `172.16.253.2` (traefik `.3`; allocation confined to `.4/30`); traefik
 > trusts forwarded headers from that address only and strips client-writable host/path/address headers
diff --git a/documentation/architecture/09-update-architecture.md b/documentation/architecture/09-update-architecture.md
index 8a32add3..89f46c50 100644
--- a/documentation/architecture/09-update-architecture.md
+++ b/documentation/architecture/09-update-architecture.md
@@ -687,6 +687,19 @@ its length, and both fixes cost something the household would notice — operato
     operator's go. **Why:** one gate the box already runs and the controller already answers, against a new service with
     its own database, upgrades and failure modes on every box. Design record: `01-topology-and-trust.md` §5.
 
+### 2026-10-02 (morning) — two operator rulings (recorded before the work)
+
+64. **The permanent family gate: GO** — build per `audits/permanent-gate-2026-10-01/VERDICT.md` §"Build plan", both
+    sessions (controller, then catalog: Grimmory and MeTube published behind it) — *operator ruling 2026-10-02 (R-780).*
+    The family login never opens the dashboard; every exception is anchored (finding F1) and still needs the app's own
+    login. **Why:** the spike passed every exit item; one gate the box already runs answers Grimmory's lock (R-775) and
+    MeTube's "no login at all" (R-767) at once.
+65. **SparkyFitness stays offered (R-784, option B); the operator asks its author for written permission now; if there is
+    no written permission before the first paying customer, it is hidden** (`lifecycle: hidden`) — *operator ruling
+    2026-10-02.* **Why, recorded:** the operator's model is that Felhom sells installation and care, not software; that
+    holds for OSI licences, but this licence names indirect use "in any … service … resulting in … monetary
+    compensation", so it needs the permission. STATUS carries it as a standing item with that trigger.
+
 ### 2026-09-30 (day) — operator notes, recorded before the work
 
 - **The day brief runs by day.** Every backup and automatic-update test is started by hand — the night chain's debug