register shrink 2026-10-10: 13 rows closed with live evidence (138 -> 125); R-903 phone menu without JS; R-910 pictures; R-912 site gate 21

Closed: R-906 R-907 R-909 R-910 R-911 R-815 R-756 R-570 R-896 R-912 R-903 R-338 R-916.
Updated: R-899 (press set up, dated check 2026-10-11), R-243 (the mail is due 2026-10-11 ~16:06Z, dated check),
R-782 (homepage live; glance question to the operator), R-904 (the TLS sentence is in 01 s7).
Website: site.css v=9 (scripting:none menu), eight dashboard pictures retaken. Evidence: audits/register-shrink-2026-10-10/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/01-topology-and-trust.md

@@ -201,7 +201,10 @@ app. Controller down → the gated app answers an error, never the app. Measured
 
 - **Cloudflare Tunnel** provides inbound access to apps and the controller UI (the CGNAT
   solution). Tunnel token lives in the hub record → **reused on new hardware during DR**, so
-  DNS/routing stay intact through an outage.
+  DNS/routing stay intact through an outage. **TLS ends at Cloudflare's edge**: the tunnel's public end is
+  Cloudflare, so Cloudflare can technically read a household's app and dashboard traffic (the FAQ says so since
+  2026-10-08, R-900). Replacing it with our own relay is deferred until after the first customers (R-904, `09` §3
+  decision 184).
 - **Outbound only** for control/report/backup (poll to hub, push to PBS). No inbound control
   endpoint exists in the chosen model.
 - **Every customer has their OWN domain — never a name under `felhom.eu`** (operator ruling