diff --git a/docs/decisions.md b/docs/decisions.md
index 700f2b6..8e0de2f 100644
--- a/docs/decisions.md
+++ b/docs/decisions.md
@@ -44,3 +44,4 @@ Format: date · decision · why. Add at the bottom. Never edit an old entry; sup
 - 2026-10-14 · **Receipt: temporary admin tokens for the phast/persimmons/phly work.** `teahubxyz` token 35 (`fix-phast-20261014`, minted on the Fly box for the pushes, the OAuth app and the repo archives) was deleted by id at 22:27 UTC, and the table listing shows only 25 (`time`). Token 36 (`receipt-20261014`) was minted only to push this line, then deleted the same way. Neither was printed. Why: the rule above.
 - 2026-10-14 · **One tree: lineage is the factory's shape.** The factory, its ventures and their agents are one tree, read three ways at the same path: keys (lineage), context (`AGENTS.md` · `SKILLS.md` · `DESIGN.md`, inherited down the path) and presence (pages; NIP-05/mailr names). Every org runs the same template at every depth, from its own seed (BIP-85 from its parent's root). Edges are *derived* (the parent holds the child's seed) or *adopted* (the child holds its own root and the parent vouches with a birth certificate); graduation flips derived → adopted. Belts are badges, per seat × skill, and `SKILLS.md` now tracks them per seat. Model only: minting a real root is the operator's call. Details and a spec v0.1 proposal in `docs/lineage.md`. Why: the operator saw the meta repo's nesting, lineage's key tree and the yolo portfolio as one shape, liked graduation as an edge flip, and set belts = badges (#8).
 - 2026-10-14 · **supertestnet.lol is back, and every Cloudflare domain is in the portfolio.** Cloudflare has one account with 8 zones; Boring's token and the dashboard list the same ones. All are now accounted for: macmcp.xyz, persimmons.app, phast.app, phly.cloud, supertestnet.lol, teahub.xyz and well-known.online are listed, and yolopreneur.lol is the list itself. Super Testnet, a browser-local Bitcoin lab, moved from the old Gitea with its history to org `supertestnet`, with repos `app` and `inscriboor` (the signing extension). Pages serves `supertestnet/app#pages`, which is the build that was live. Pages now reads a `_headers` file (Cloudflare Pages style), so the site keeps the CSP and frame headers its Node server used to send. The ledger has 26 entries, and the hero no longer says every venture came off the clock. unicorn.ceo is not the operator's domain; it was only an idea. Four records still point at the dead edge (66.241.124.48 / 2a09:8280:1::19c:1dd0:0): `matcha.`, `maths.`, `notplanned.` and `🫖.teahub.xyz`. That's harmless while the suspended `teahub-gitea` app holds those IPs and certs, but the records must go before that app is deleted. Of the four, only maths.teahub.xyz (the zeta-ball pictures) has its own content; its files are in hb-5 `~/sites/maths` and `matcha/maths`. Temporary token 37 (`supertestnet-20261014`, `teahubxyz`) did the org, repos, hooks and pushes, and is deleted by id right after this push; the table is checked. Why: the operator asked that every domain be in the list.
+- 2026-10-14 · **The four dead teahub.xyz names are gone.** At the operator's word, the records for `matcha.`, `maths.`, `notplanned.` and `🫖.teahub.xyz` (A + AAAA to the dead edge) and the `_acme-challenge` CNAMEs for `maths.` and `notplanned.` were deleted, 10 records in all, through the Cloudflare dashboard session on hb-5. Boring's DNS tool can upsert but not delete. teahub.xyz now holds only the apex (`green-tea`), `mcp.` (`green-tea-mcp`) and the apex ACME CNAME. No other zone points at the old edge, so `teahub-gitea` can be deleted without leaving takeover bait. maths.teahub.xyz's files stay on hb-5 (`~/sites/maths`, `matcha/maths`) for whenever it comes back. Token 38 (`dns-receipt-20261014`) was minted only to push this line and is deleted by id right after; the table is checked. Why: nothing should resolve to an address we no longer hold.