R-1299 CLOSED: the clean-up window button (hub 0.174.0/0.174.1, live grant + cancel on tester-1); R-1326 filed (hub start-up vs liveness); R-1237 updated (46 dead names removed with sec rm); 07/05 design lines; secrets runbook: sec rm

documentation/architecture/05-hub-architecture.md

@@ -759,7 +759,7 @@ method (405), so a token gets 403.
 | `/configs/{id}/edit` | `customers:read` | **session only** | Edit can change the household's e-mail — and a new e-mail auto-mails the self-bind link (ruling 13:20). |
 | `/offsite/remove-unpinned/{id}` | — | **session only** |  |
 | `/offsite/abandon-cancel/{id}` | — | **session only** | Cancelling a pending set-aside deletion: no group names it; until the operator places it, session only. |
-| `/offsite/window-grant/{id}` | — | `offsite:write` |  |
+| `/offsite/window-grant/{id}` | — | `offsite:write` | The one-shot clean-up window: the script address AND the customer page's „Backup & DR" card (R-1299, hub v0.174.0): `from=page` + `confirm=1` from the form; `cancel=1` removes a waiting grant; a limit above the store's snapshot count is refused. |
 | `/offsite/windows-enabled` | — | `offsite:write` |  |
 | `/os/{id}` | `os:read` | `os:write` |  |
 | `/offsite/key-audit` | — | `offsite:read` | Runs the daily key check now: it reads keys and reports, it changes none. |

documentation/architecture/07-backup-architecture.md

@@ -261,6 +261,14 @@ window adds a week of snapshots and removes none, so the plan grows faster than
 (2026-10-16, 152 snapshots) aged past 7 days and the 10-26 window refused 209 > 179 — an HONEST plan (every removal 7–30
 days old, every app keeps ≥ 9 or its last copies; `audits/r1294-offsite-cap-2026-10-26/`). The existing way out is the
 operator's one-shot raised cap (R-833, `GrantOffsiteWindowOnceMax`).
+**[DESIGN — R-1299, built hub v0.174.0/v0.174.1 2026-10-27, `d85198b8` + `de57c090`] The one-shot window has a button.**
+The customer page's „Backup & DR" tab carries the „Off-site clean-up window" card: the weekly switch, the normal cap,
+a waiting grant and the last window; an optional limit, a confirm step that names the customer and the limit, then the
+same route and rule as before (`POST /offsite/window-grant/<customer>`, `offsite:write` or a session). A raised limit
+above the store's measured snapshot count is refused (a window cannot remove more than exist; the 500 ceiling stays). A
+waiting grant can be cancelled before the box uses it. Every grant and cancel is a stored operator-only info event
+`offsite_window_grant` (who, customer, limit). Live: granted and cancelled on tester-1 by the operator, nothing removed
+(`audits/r1299-window-button-2026-10-27/`).
 
 **[DESIGN, built hub 2026-10-07 — R-32 option A, `09` §3 decision 167] What RESET does to the household's off-site
 copy.** On the shared pool box a sub-account is a LOGIN, not the data: deleting it leaves its folder (measured