security watch: Docker Hub requests spaced, a 429 retried (NOT CHECKED only after the last try), tag lists cached 24 h per registry path on the runner (R-1334); W14

documentation/architecture/08-alarm-ladder.md

@@ -700,3 +700,11 @@ new image is read on the night its tag first appears; the log's `RUNTIME read=
 was read and how long it took. The DooPlex group (`documentation/security-watch/dooplex-workloads.txt`,
 from homelab-manifests) is read the same way and mailed in its own block; Felhom changes nothing on DooPlex.
 
+**Docker Hub's tag API is asked gently (2026-10-28, R-1334).** The 2026-10-28 night run was refused 15 times (HTTP 429)
+when it sent 211 tag-list requests to `hub.docker.com` in about 2 minutes from six workers; a 3.5-minute dry run that
+morning sent 224 and was refused none. So: the requests to Docker Hub are spaced (one per second across the workers);
+a 429 waits (its `Retry-After`, else 10/30/60 s) and tries again, and the image is NOT CHECKED only after the fourth
+try; a tag list is kept for 24 hours per registry path in the CI runner's cache (`~/.cache/felhom-watch-tags.json`, not
+committed), so two names of one path (`lscr.io/linuxserver/x`, `linuxserver/x`) and a same-day re-run fetch nothing.
+The log's `TAGS fetched=… from-cache=… retried-429=…` line counts it. No Docker Hub login is used.
+