SPEC v0.33: owner answers of 2026-10-24 (D-156), small-edits rule (D-157)

D-156: OQ-6 closed (no S-1 confirm step); L-10 not_found for the other
user's device (to implement: server answers forbidden, E-16 lists 403);
firewall rule on 8080 deferred; mem_limit kept as advisory; image builds
stay on the Pi runner, docker builder prune -af between builds; Samsung
Auto Blocker off for the in-app install (AC-16.3); AC-18.1 verified;
both phones on release 140; web first used from the laptop browser.
D-157: small edits by a Haiku or Sonnet agent in the main checkout.
infra/README.md owner section and HANDOFF updated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/README.md

@@ -364,6 +364,10 @@ folders `data/`, `backups/`, `import/`. Nothing outside that folder is installed
 the Kvitt Pi's LAN IPv4 address (static DHCP lease; ASUS router web UI, LAN, DHCP Server, client list), also NPM's
 Forward Hostname / IP (step 4).
 
+Between two workflow builds, run `docker builder prune -af` on the runner Pi: its 15 GB disk reached 11 GB during
+builds (SPEC §10.3, D-156). On the Samsung phones, turn Auto Blocker off before tapping "Uppdatera" for an in-app
+update and back on afterwards; with it on, the install is refused (SPEC AC-16.3, D-156).
+
 ### 1. Prerequisites (already on the Pi)
 
 * Docker Engine with the compose plugin, usable by `jacobhagstedt` without sudo: `docker compose version` prints a
@@ -733,6 +737,11 @@ or a leaked key (rotate it, step 4a).
   Encrypt certificate; the router's existing external 443 forward to the Home Assistant Pi (NPM) serves it, and there
   is no 8443 rule (D-124).
 * App gate (D-126, 2026-10-21): outside the home LAN every request needs the key built into the app (step 4a).
+* `mem_limit` (2026-10-24, D-156): the lines stay in `compose.yaml`; the Pi kernel without the memory cgroup ignores
+  them with a warning, accepted.
+* Firewall rule limiting port 8080 to `HA_HOST` (2026-10-24, D-156): not now (deferred).
+* Image builds (2026-10-24, D-156): stay on the Pi runner for now; `infra/build-images.sh` on the Mac remains the
+  fallback.
 
 ### Troubleshooting