Decision sheet D1-D10: hub CHANGELOG, architecture notes (01, 04, 05, 07, 08, 10), register (VERIFY states, R-912), STATUS, report; decoy suite runs in a git worktree

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -16,6 +16,14 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
 
+> **2026-10-08 (evening) — the decision sheet D1–D10 built on main, unreleased (`09` §3 185–194).** Controller (`3f84f82`):
+> operator actions (`internal/report/opactions.go`, closed list), dashboard sessions on disk as sha256 + password
+> fingerprint (`internal/web/session_store.go`), six health keys, the R-893 hold (`restore_mixed`) on every failure after
+> a definition/volume moved. Hub: `operator_actions` table + reply field, wait-channel presence + the ticked fast delete
+> (`intent/presence.go`), health mail without the raw note, Cloudflare `/zones` reach check (zone == domain), R-435
+> window credits (capped, spent once). Catalog `31e9651` (wger 256M). Ship hub + controller the same day; live proofs
+> listed in `REPORT-day3-2026-10-08.md`. Register 132 → 136 (+4 another session's).
+
 > **2026-10-08 (morning) — the first real kernel night read back.** demo-felhom: staged exactly the told 7.0.14-20 at
 > 04:39:04, healthy 04:40:38, default now 7.0.14-20, apps ~1.5 min away, no alarm. demo-hp: no whole-guest backup that
 > night (yesterday's 08:49 press + 24 h cadence > window end) → no step; R-899 filed. Reply-To proven by the operator's