v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

Red-proofs RP31-RP38. MinAgent 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,32 @@
+## v0.283.0 — apps go off-site by themselves (decision 50), with a size warning; a Stop holds during a backup (R-721); page slips (R-724, R-725) (2026-09-30)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: `backups_offsite.offer_text`,
+`backups_offsite.offer_all`, `backups_offsite.offer_no`, `backups_offsite.fit_head`, `backups_offsite.fit_total`,
+`backups_offsite.fit_quota`, `backups_offsite.fit_largest`, `backups_offsite.fit_choose`, `flash.offbox.enabled_all`
+(hu + en). Evidence: `felhom.eu/documentation/audits/evidence-fixes-first-tester-2026-09-30/`.
+
+- **Decision 50 (R-720):** a fresh install on a box whose customer has off-site switches the app's off-site copy ON
+  (`settings.DefaultOffboxOnForNewApp`, from the deploy-done hook). An app with an earlier backup choice keeps it (a
+  reinstall after a removal that kept the backups keeps the household's OFF). Apps already installed are never
+  switched by the release: both backup pages offer ONE press („Van alkalmazás, amelyről nem készül távoli mentés.
+  Bekapcsolod mindegyikre?" — `POST /backup/offbox/enable-all`, „Nem most" → `/backup/offbox/offer-dismiss`, shown
+  until answered).
+- **The size warning:** the apps' off-site size (recovery unit + mandatory files) is estimated at the start of every
+  off-site run and, in the background, when the page is opened and the estimate is older than 6 h (the page never
+  runs `du`). Over the quota the Távoli mentés page names the three largest with their sizes and asks the household
+  to choose. **Measured first:** over the quota the box already refuses NEW pushes and runs only the ruled retention
+  (`forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6`), and an app whose files would cross the quota is pushed
+  settings + database only — it deletes no history to make room. Now pinned (`TestDecision50_OverQuotaDeletesNothingExtra`).
+- **R-721 — a Stop holds:** the household's Stop pressed while a machine had the app down is honoured at that
+  machine's resume — the whole-guest backup's quiesce (`restartAll` asks `WantsStopped`), the nightly volume dump
+  (and its crash marker owes no restart), and the nightly update leg (`stopped_by_household` skip: an update would
+  bring the app up). Measured 2026-09-29: the backup's resume started a stopped app the same second.
+- **R-724 / R-725 (box half):** Beállítások shows the schedule the box really runs (window + legs) and the update
+  check in local time; the dashboard's „Utolsó mentés" is in local time (R-500); the backups card reads „az előző
+  N órája készült" instead of a „0 órája" under „Következő mentés"; the restore-test card names the tier it read
+  from; the recovery-code wizard speaks „te" (formal-form ceiling 18 → 17).
+- Tests: `TestDecision50_*`, `TestR721_*`. Red-proofs RP31–RP38, each seen failing on an assertion.
+
 ## v0.282.0 — the app's own sign-up switch after the setup (after_setup); "close sign-up now" (decision 49); probes read lists and a "done" status (R-715) (2026-09-29 evening)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: `app_info.close_signup_text`,