Lift the freeze on new atomic-server pull requests

docs/agents/build-vps.md

@@ -203,12 +203,15 @@ when writing one:
   `docs-`) so two workers never write the same name.
 - **Rules.** The board rules in [working-model.md](working-model.md); no
   `--no-verify`; stage paths explicitly and check `git diff --cached --stat`
-  for data or secrets; no `.github/workflows/` edits; the freeze below.
+  for data or secrets; no `.github/workflows/` edits; host PRs follow the
+  current rules below.
 - **Reports back.** A worker doesn't push, open PRs, merge or comment: the
   coordinator does every GitHub write. It commits in its worktree and
   reports the branch, the commit SHAs, what changed, a PR title and body draft
   (`Closes #N` where it fully resolves an issue), the checks it ran with exact
   results, what it didn't verify, and "Question for Michiel" items.
-- **atomic-server freeze.** No atomic-server PRs and no new pin candidates
-  (#227, 2026-10-01). A host need goes in the report as an issue draft for
-  Joep, for example atomic-server#1952.
+- **atomic-server PRs.** Michiel lifted the freeze on new PRs on
+  2026-10-30. Host fixes may go through the normal PR review and CI process;
+  only Joep's agent merges into `develop`. Building new pin candidates has
+  been pre-approved since Q-104 on 2026-10-08. See
+  [working-model.md](working-model.md) and [pins.md](pins.md).

docs/agents/pins.md

@@ -53,9 +53,10 @@ git push origin <candidate-sha>:refs/heads/claude/atomic-plugins-pin
 
 That fails unless it is a fast-forward, which is the point. Pin bumps are
 pre-approved (#227 rule 4), and since 2026-10-08 so are building and tagging
-new candidates (Decision Inbox Q-104, [working-model.md](working-model.md)),
-which lifts the freeze's "no new pin candidates". A cloud session without atomic-server push access
-hands this step to the coordinator.
+new candidates (Decision Inbox Q-104, [working-model.md](working-model.md)).
+Michiel also lifted the freeze on new atomic-server PRs on 2026-10-30;
+the rule that only Joep's agent merges into `develop` still applies. A cloud
+session without atomic-server push access hands this step to the coordinator.
 
 ## Where atomic-server work branches from
 

docs/agents/working-model.md

@@ -16,19 +16,13 @@ authoritative):
   Michiel: …" on #227; don't number questions yourself.
 - **Never merge into atomic-server `develop`.** Only the trekmeester (Joep's
   agent) does, in batches.
-- **atomic-server freeze (Michiel, 2026-10-01).** No new atomic-server PRs;
-  only shepherd the open ones. (It also said no new pin candidates; Decision
-  Inbox Q-104 lifted that part on 2026-10-08.) A host need becomes an
-  **issue for Joep** on atomic-server (for example atomic-server#1952), drafted
-  in the worker's report. Atomic-plugins stays on the current pin. The
-  coordinator session can't file in ontola/atomic-server, so it collects the
-  drafts on #227 for someone with access (see
-  [Issue drafts for Joep](#issue-drafts-for-joep)).
-  One-off exception (Michiel in chat, 2026-10-08, relayed by the VPS
-  coordinator): candidate20, candidate19 plus atomic-server#2069's two
-  commits, may become the pin for user testing ("Even if we can't merge this
-  to develop, you can merge it to our pin so we can start user testing for
-  it"). The freeze otherwise stands.
+- **atomic-server PRs are allowed (Michiel, 2026-10-30).** Michiel lifted
+  the 2026-10-01 freeze on new atomic-server PRs in chat while requesting a
+  PR for the app signing-key recovery fix (atomic-server#2407). Host needs
+  may be implemented and submitted as PRs through the normal review and CI
+  process. The merge responsibility above still applies. The earlier ban
+  on new pin candidates was already lifted by Q-104 on 2026-10-08; see
+  [pins.md](pins.md).
 - **Pin bumps** (`.atomic-server-ref` → a candidate) are pre-approved. See
   [pins.md](pins.md).
 - **Standing OKs for deploys, candidates and releases** (Decision Inbox, both
@@ -44,7 +38,7 @@ authoritative):
     ([proxy-release.md](proxy-release.md)). Heroku deploys go through the
     coordinator's worker, which holds the Heroku access.
 
-  Nothing else in these rules changes, and the rest of the freeze stands.
+  These permissions do not change the review, CI or merge requirements.
 - **Never `git commit --no-verify`.** Fix or report a failing hook. This repo
   has no git hooks of its own (no `core.hooksPath`, nothing in `.git/hooks`
   as cloned). Rule 5's "Fresh Worktrees" warm-up is not in this repo's
@@ -99,9 +93,11 @@ what's next, what's blocked or needs a decision. Keep it short.
 
 ## Issue drafts for Joep
 
-Host needs found while the atomic-server freeze is in force, drafted on #227
-on 2026-10-02 for someone with ontola/atomic-server access to file as written.
-Check whether one was filed before drafting a new one.
+Historical host needs drafted on #227 on 2026-10-02, while the former
+atomic-server freeze was in force, for someone with atomic-server access to
+file as written. Check whether one was filed before drafting a duplicate.
+New host needs may be submitted as PRs since Michiel lifted the freeze on
+2026-10-30.
 
 | # | Title | Comment |
 | --- | --- | --- |