Evening 2026-10-18: fresh install proven (R-1148), OnlyOffice walk (R-1018), one-sign-in spike (R-1100 READY), Redis volumes (R-1117), CI rows, golden 0.331.0 baked; register 168 -> 168 (closed 6, opened R-1149..R-1154)

documentation/architecture/03-host-agent.md

@@ -544,6 +544,12 @@ nicety.
   **loses Felhom's backup guarantees** — no PBS verify / monitoring on storage we can't reach. An
   honest signup-time tradeoff, not a hidden one.
 
+**When the new package reaches the hub (R-978, agent `main` 2026-10-18, unreleased):** a ceremony started again no
+longer replaces the hub's package when it starts. The package travels with the pending ceremony and is uploaded when its
+code is claimed, before the code is handed out (an upload failure is a 502 and the code stays claimable). An abandoned
+ceremony — TTL, a new start, a restart — leaves the first code opening the hub's package. Residual: the typed-back check
+is the browser's, so a code opened and not written down still replaces the package (R-1151).
+
 #### Custody across generations — what the hub retains when a blob is superseded (hub v0.60.0; **contract corrected hub v0.93.0, R-198**)
 
 A ceremony that seals a *different* passphrase does not destroy the blob it replaces: the hub copies