Decision sheet D1-D10: hub CHANGELOG, architecture notes (01, 04, 05, 07, 08, 10), register (VERIFY states, R-912), STATUS, report; decoy suite runs in a git worktree

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/04-control-plane-authorization.md

@@ -162,6 +162,16 @@ op the agent verifies** (same pipeline, §2.3) — never unauthenticated config.
   queue — then the agent polls, verifies, executes, and audits. One command + passphrase, from the
   desk. **Never** a site visit.
 
+### 6.1 Operator actions in the report reply [DESIGN, R-314/R-279 — `09` §3 decision 185, controller + hub main 2026-10-08, unreleased]
+
+Routine, non-destructive operator requests need no signature (`03` §4 asks for one only to destroy or overwrite the
+only copy). The hub stores a row, bumps the box's intent, and the report reply carries `operator_actions:[{id,action,arg}]`
+until the next report answers `operator_action_results:[{id,outcome,message}]`. The list is CLOSED on both sides:
+`offsite_backup_now`, `abandon_stop`, `abandon_extend` (1–30 days; never earlier than the current date; refused once
+the deletion is the hub's), `run_job` (`fill-watch`, `offsite-integrity`, `offsite-proof`, `disk-health-check`).
+Anything else is refused at the hub's POST and again on the box. No action deletes data, starts a countdown or
+shortens one (`TestOpActions_ClosedList`, `TestOperatorActions_ClosedList`). Unanswered after 24 h: expired.
+
 ## 7. Hardware readiness (Viktor's "build the foundation now")
 
 Software `ssh-ed25519` now; a FIDO2 `sk-ssh-ed25519@openssh.com` key later is a **no-op on the