Answer architecture round 1: 0 🔴, 3 🟡; copy the image to Docker Hub in a job of its own, give the registries their own decision, and name the narrowest token

docs/decisions.md

@@ -903,7 +903,7 @@ By the maintainer's decision of 2026-10-09, every 0.1.0 chunk ships under the fl
 
 Shipped under that decision: item 89, the last of 0.1.0, at 52e0304. Its paired ruling against 90ffcff was better. The release's scoring run read Navigation 7.00, Locality 5.75, Shape 6.38, Self-sufficiency 6.50 and overall 6.25; its seats named places items 170 to 172 and 178 hold, and `isPath`, filed as item 251.
 
-Shipped under the floor by the maintainer's decision of 2026-10-13: item 58, prebuilt binaries and packages, which the plan had under 0.2.0, ships as 0.1.0's distribution, and so does the image on Docker Hub, decided 2026-10-14. Neither changes Go code.
+Shipped under the floor as 0.1.0's distribution, each by the maintainer's decision: item 58, prebuilt binaries and packages, which the plan had under 0.2.0, on 2026-10-13; and the image on Docker Hub, on 2026-10-14. Neither changes Go code.
 
 Shipped by the maintainer's decision of 2026-10-11 with its ratchet waived: item 182, the shipped data as Go packages, at a632a92. Its last paired ruling against bf1becb was same overall, Mid A better and Junior A worse, with Shape fallen, three seats against the namespace mount in `internal/datafiles/mount.go` and the `at` field of `datafiles.Source`; the scoring run that would rule it worse under the floor was not run. `todo.md` item 197 replaces that mount.
 
@@ -970,13 +970,20 @@ vendor-neutral option (`~/.claude/principles/technical-principles.md`). The repo
 are built here, as static files any host can serve: `release-tooling/package-repos.Dockerfile`
 signs them with a GPG key (apt, dnf) and an RSA key (apk). A hosted package service would
 only save that tooling. GitHub already hosts the code (see "GitHub is canonical, and the
-module path names it"), so Pages adds no new vendor. The image sits on GHCR for the same
-reason; being OCI, it moves to another registry by changing its path. Docker Hub carries
-the same image too, by the maintainer's decision of 2026-10-14: it is Docker's default
-registry, so `docker run larvit/fejkdata` works with no host in the name. Docker Hub limits
-anonymous pulls by IP, so CI on shared runners may pull from `ghcr.io` instead. A Pages site holds at
+module path names it"), so Pages adds no new vendor. A Pages site holds at
 most 1 GB and a release's packages take about 35 MB, so the repositories hold the latest
 release only; each GitHub release still carries its own packages, and the image keeps a tag
 per version. Leaving Pages costs
 each Linux user an edit: their apt list, `.repo` file or apk line names `larvit.github.io`.
 Valid while GitHub hosts the code.
+
+## The image is pushed to GHCR and copied to Docker Hub, whose name the README shows
+
+2026-10-14, decided by the maintainer. Serves goal 1.1; technical principle: prefer the
+vendor-neutral option (`~/.claude/principles/technical-principles.md`). Docker Hub is
+Docker's default registry, so `docker run larvit/fejkdata` works with no host in the name;
+that is a capability only Docker Hub has. GHCR stays the image's source: GoReleaser pushes
+there, and a job of its own copies the image to Docker Hub, so a Docker Hub failure holds up
+no other channel. GHCR also serves CI on shared runners, which Docker Hub's per-IP limit on
+anonymous pulls blocks. Leaving Docker Hub costs each user an edit of every `docker run` line
+and pinned script that names the bare `larvit/fejkdata`.