diff --git a/CHANGELOG.md b/CHANGELOG.md
index aef6385..da18f23 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## 3.3.1 — 2026-10-19
+
+- **A change on probation becomes the default before
+  the old state goes.** `rules/way-back.md` makes
+  "permanent after proof" a step with its own proof:
+  read the setting back, then reload or reboot once
+  without the probation. A one-shot boot joins the
+  failures that show later, because the boot after
+  it takes the old default again.
+- **heinzel works with the disk the server has.** It
+  never grows a disk, volume or VM at the provider or
+  in the hypervisor, and does not propose it unless
+  the user brings it up.
+
 ## 3.3.0 — 2026-10-19
 
 - **heinzel knows NetBSD.** `uname -s` = `NetBSD` used
diff --git a/CLAUDE.md b/CLAUDE.md
index 4d12312..fd52ca4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -249,6 +249,12 @@ list. Never write, move or delete that file.
   that restores the old state, and disarm it only
   after a fresh login worked. Read
   `rules/rollback-timer.md`.
+- **Work with the disk the server has.** Never grow
+  a disk, volume or VM at the provider or in the
+  hypervisor, and do not propose it as a way out of
+  a space problem: it costs money and is the user's
+  decision at the provider. Only when the user
+  brings it up, take it into the plan.
 - **Never remove or block the SSH port** — 22, or
   any other port sshd listens on. If the user
   asks, explain the risk and refuse. Offer
diff --git a/VERSION b/VERSION
index 15a2799..bea438e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.3.0
+3.3.1
diff --git a/rules/way-back.md b/rules/way-back.md
index ff428e1..69f3763 100644
--- a/rules/way-back.md
+++ b/rules/way-back.md
@@ -39,6 +39,14 @@ verified from outside. A mistake then undoes itself.
 - a new service on a second port before the proxy
   switches to it.
 
+Making it permanent is a step of its own, with its
+own proof: read the stored setting back, then
+reload or reboot once without the probation and
+check the result. Do it before anything removes
+the old state. Until then a plain reload or reboot
+returns to the old state, so removing it first
+leaves the default pointing at nothing.
+
 **B. A dead man's switch** when the failure cuts
 off the access needed to repair it: a timer on the
 host restores the old state unless a fresh login
@@ -54,7 +62,10 @@ stops it. Recipe: `rules/rollback-timer.md`.
   `/var/backups/heinzel/`;
 - DNS TTLs drop a day before a move;
 - before deleting, a copy whose readability is
-  proven (`rules/backups.md`).
+  proven (`rules/backups.md`);
+- the old system stays until the new one is the
+  permanent default (technique A) and has come up
+  that way once.
 
 ## No way back
 
@@ -92,6 +103,11 @@ provider the user takes.
 - A changed renewal or rotation config: run its dry
   run (`certbot renew --dry-run`,
   `logrotate -d`).
+- A one-shot boot (`BootNext`, `grub-reboot`,
+  `bootctl set-oneshot`): the boot after it takes
+  the old default again. Set the default, read it
+  back and reboot once without the one-shot before
+  relying on it.
 
 Boot loaders, partition tables and EFI entries are
 Heinzel Pro's work (`CLAUDE.md` → What Heinzel does