Decision sheet D1-D10: hub CHANGELOG, architecture notes (01, 04, 05, 07, 08, 10), register (VERIFY states, R-912), STATUS, report; decoy suite runs in a git worktree

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/CHANGELOG.md

@@ -1,3 +1,37 @@
+## Unreleased (2026-10-08, evening) — the operator's decision sheet: operator actions (D1), box presence + delete a switched-off box at once (D2), the household's health mail points to the dashboard (D3), the Cloudflare token reach check (D6), one lost off-site snapshot is an error (D7) — ships with tomorrow's hub release
+
+Operator rulings 2026-10-08 14:16, `09` §3 decisions 185–194. **Operator action on deploy: none.** The controller of the
+same day carries D1's other half; an older controller ignores `operator_actions` (rows then expire after 24 h).
+
+- **D1 — operator actions (R-314, R-279).** Table `operator_actions(id, customer_id, action, arg, requested_at,
+  requested_by, done_at, outcome, message)`; four buttons on the host page (POST `/hosts/{id}/operator-action`,
+  operator auth + CSRF); the row is carried in the report reply (`operator_actions`) until the box answers
+  (`operator_action_results`); a result naming another customer's id is ignored; unanswered after 24 h → `expired`; a
+  customer RESET → `cancelled`. CLOSED list, validated at the POST (400, no row): `offsite_backup_now`, `abandon_stop`,
+  `abandon_extend` (1–30), `run_job` (`fill-watch`, `offsite-integrity`, `offsite-proof`, `disk-health-check`)
+  (`TestOperatorActions_ClosedList`). Who pressed = the channel and address (one password, no user names), logged at
+  INFO at the press and at the result; each result is a stored `operator_action` event (never a customer mail). New
+  wire-gate root for the reply field.
+- **D2 — box presence from the wait channel (R-30, slices 1 and 2).** `intent.Hub` records wait starts/ends per
+  customer: connected / not connected since T / unknown (hub younger than 333 s). The host page shows „Box connection".
+  „Delete host" goes ahead at once when the host is online by report, the operator ticked „I checked: the box is off",
+  and presence has been „not connected" ≥ 360 s — re-checked at the POST; otherwise 409 as before. INFO audit line + one
+  `host_deleted_box_off` event (warning, hub-minted). `TestPresence_*`, `TestR30_*` (red-proved, 7 mutations).
+- **D3 — the household's health mail (R-79 option B).** `health_degraded` / `health_critical` / `health_recovered`
+  customer mails drop the raw details note and end with „A részleteket a vezérlőpultodon látod." / „You can see the
+  details on your dashboard." (`mail.customer.line.health_dashboard`). The operator's mail keeps the note; other event
+  types unchanged. 6 mail goldens regenerated. `TestR79_*`.
+- **D6 — the Cloudflare token reach check (R-138 option C).** On create/edit, a new token (or the same token on a new
+  domain) is checked with Cloudflare `GET /zones`: saved only when it sees exactly one zone and that zone IS the
+  customer's domain. Cloudflare down → refused, the old token stays. Never logged. **Security review fixes (same day):**
+  a parent zone that could hold a sibling customer is refused, order-independently (strict equality). Tests with a fake
+  Cloudflare, `TestR138_*`, `TestZoneEquals`, `TestTokenZones_*`. Limit written in `01` §7 (listing = read scope).
+- **D7 — one lost off-site snapshot is an error (R-435 option C).** Pinned tiers: any fall the hub's own clean-up
+  windows do not explain raises `offsite_snapshots_dropped` (error, „outside any clean-up window the hub opened").
+  **Security review fixes (same day):** each window explains at most its hub-set `max_remove` (a box's `count_after`
+  cannot widen it); each window explains one fall only; a window stuck open past its deadline explains nothing;
+  unreadable windows fall back to the half-rule. NAS tiers keep the half-rule. `TestR435_*` (store + monitor). `08` §6.5.
+
 ## Unreleased (2026-10-08) — an alarm when a box never backs up off-site because its escrow is pending (R-243; `09` §3 decision 179); a deleted customer's audit rows go after 1 year (R-901; decision 181); the operator's older-recovery-package mail (R-304; decision 183); no duplicate or nested customer domain (R-415, R-138 option B) — ships with tomorrow's hub release
 
 **Operator action on deploy: none.** Expect ONE `offsite_escrow_pending` mail for **Tester 2** on the first sweep after