R-1299 CLOSED: the clean-up window button (hub 0.174.0/0.174.1, live grant + cancel on tester-1); R-1326 filed (hub start-up vs liveness); R-1237 updated (46 dead names removed with sec rm); 07/05 design lines; secrets runbook: sec rm

documentation/runbooks/secrets.md

@@ -61,6 +61,14 @@ sudo kubectl -n felhom-system rollout status  deploy/hub deploy/contact-mailer -
 - **hub:** trigger a notification (or the dispatcher test path) → mail arrives.
 - **Gmail:** send a test from `info@felhom.eu` → delivers.
 
+### Removing a name from the CC store
+
+`sec rm NAME` (cc-secrets ≥ 0.3.0): one name per call; an unknown name is refused; it commits `rm NAME` and pushes, and
+prints the name only. Undo = `git revert` of that commit in the cc-secrets repo. Remove a name only when its box or token
+is gone (proof: the host is gone from the hub, or the token is revoked) and the operator approved the list
+(2026-10-27: 46 dead test-box names, `audits/r1299-window-button-2026-10-27/sec-rm.txt`). Details: cc-secrets
+`ARCHITECTURE.md` §4.
+
 ### Rotating away from a compromised key (ordered — load-bearing)
 
 1. Create the **new** send-scoped key in Resend; store it out-of-band; on host 180 put it in the CC store from a 0600