docs: record Seth's 2026-10-28 answers (issues 7, 8, 11, 13, 17, 18, 23, 30, 32 to 36; changes C6 to C11)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/POLICY.md

@@ -688,7 +688,7 @@ Nothing in the rule table changes in phase 8. Project Management, the find bar f
 
 ### Who reads the Project Management endpoints
 
-Every endpoint under `/api/pm` needs a signed-in session. Any role may read them, not only PS-ProjectMgmt, as every role may open every packet (open question 39). An unsigned request is 401. PM writes nothing: there is no POST, PUT, PATCH or DELETE under `/api/pm`, and the PM role passes no write action anywhere else. A packet opened from the PM screen shows "View only." The reports read PostgreSQL only. They never read VISUAL or M-Files.
+Every endpoint under `/api/pm` needs a signed-in session. Any role may read them, not only PS-ProjectMgmt, as every role may open every packet (open question 39). Changing: SethD decided on 2026-10-28 (Gitea issue 33) that only PS-ProjectMgmt and Admin may (PLAN.md change C10). An unsigned request is 401. PM writes nothing: there is no POST, PUT, PATCH or DELETE under `/api/pm`, and the PM role passes no write action anywhere else. A packet opened from the PM screen shows "View only." The reports read PostgreSQL only. They never read VISUAL or M-Files.
 
 | Endpoint | What |
 |---|---|
@@ -767,7 +767,7 @@ Mine is decided on the server from the person's AD roles and the screen they nam
 | clerical | status draft, or status complete routed to the data book |
 | warehouse | status warehouse, or an open short |
 | supervisor | the departments where the person is lead or supervisor |
-| stall | the person's shop departments and the picked station (`mine_station_id`). No station picked: nothing. |
+| stall | Changing to the packets assigned to the person, at their assigned stall (Gitea issue 36, PLAN.md change C11). Today: the person's shop departments and the picked station (`mine_station_id`). No station picked: nothing. |
 | qc | status qc |
 | pm, or admin with no other role | everything. The chip is hidden on the PM and Stall screens. |
 
@@ -891,6 +891,8 @@ The checklists, the security settings and each notification rule carry a version
 
 ### Checklists
 
+Changing: SethD decided (Gitea issue 23, PLAN.md change C8) that checklists become per department, edited by that department's supervisor or Admin, and a change applies to packets not yet started only.
+
 Both lists need at least one item and at most 40. A key is lower case letters, digits and underscores, starting with a letter, at most 30 characters, unique in its list. Group and text are not empty, at most 200 characters. The only placeholders are `{drawing}`, `{rev}` and `{wps}`. Answers on open stages are kept by key. A removed item drops out of new checklists only. An item added while a stage is open must also be ticked on that stage before submit, since the completeness check reads the live list.
 
 ### Security settings
@@ -899,6 +901,8 @@ Stored as the `security` settings row over the environment defaults. A value out
 
 ### Access log, presence and the stamp check
 
+Changing: the stamp check opens to Q.C. and Clerical as well as Admin (Gitea issue 32, PLAN.md change C9).
+
 - The access log shows every person's sign-in attempts (successful and failed) and their `auth.*`, `pin.*`, `device.*` and `sig.*` audit rows, as the Account access log shows a person their own. The address filter takes an address or a range. Request bodies and secrets are never in it.
 - Who is in shows live sessions (not revoked, not expired) seen within the idle minutes that apply to each. The screen and packet come from the event stream, matched by person.
 - The stamp check never trusts the text. It finds the 16-character signature, looks it up in `print_log`, recomputes it with the seal key from the logged row and compares the text with the logged stamp line. It answers genuine, does not verify (the signature or the text differs from the log), or not found.