R-304 option C: operator mail when a household's code opens or may open an older package (once a day); R-298 side fix (no eject/format on a backup-target drive); R-717 comments

Unreleased; ships with tomorrow's release (needs the hub of the same day).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,4 +1,4 @@
-## Unreleased (2026-10-08) — a daytime press never cancels the night's whole-guest backup (R-899; operator ruling 2026-10-08, option A); an honest answer when older recovery packages were not checked (R-304) — ships with tomorrow's release
+## Unreleased (2026-10-08) — a daytime press never cancels the night's whole-guest backup (R-899; operator ruling 2026-10-08, option A); an honest answer when older recovery packages were not checked, and the operator's mail (R-304) — ships with tomorrow's release
 
 **MinAgent: 0.131.0** (unchanged — the new `trigger=manual` query is ignored by an older agent, which keeps running the
 OS leg after a press exactly as before; the night itself is fixed by the controller alone).
@@ -20,6 +20,19 @@ OS leg after a press exactly as before; the night itself is fixed by the control
   Hungarian and English. Not version-gated on purpose (it accuses nobody; a stray 424 lands on a neutral sentence).
   Tests `TestR304_OlderUnchecked_IsNotAWrongCode` (hu + en; red-proved: without the case the page fell to the „nem tudjuk
   biztosan, miért" default) and `TestR304_Classify424`.
+- **R-304 option C (operator ruling 2026-10-08 09:04, `09` §3 decision 183):** when a household's recovery code OPENS an
+  older sealed package (agent 422) or MAY open one (424), the controller sends the operator-only event
+  `recovery_older_package` (warning → the operator's mail): the class and the package's date, never the code. At most
+  once per day per box (`<data>/recovery-older-mail.day`, survives a restart). **Needs the hub release of the same day**
+  (the type is in its allowlist and `operatorOnlyEvents` there); against an older hub the event is refused (400) and only
+  logged. `internal/web/recovery_older_mail.go`; tests `TestR304_OlderPackageMail_*` (red-proved twice: without the calls
+  `events = []`; without the day check `sent 2 events, want still 1`).
+- **R-298 side finding:** the storage page no longer offers „Leválasztás" or „Formázás" on a user-data drive that is ALSO
+  the whole-system backup target (agent `backup_target`): the agent refuses its eject (403) and a data-bearing format needs
+  a signed job. JS in `templates/storage.html` `actions()`; the two storage parity fixtures regenerated (only these lines
+  differ). Not verified in a browser.
+- R-717: two stale comments corrected (`after_setup.go` no longer names opengist among the `command` apps;
+  `signup_block.go` shows opengist's current `PathRegexp` block).
 - The press now reaches the agent as `POST /backup?…trigger=manual` (`agentapi.StartBackupForTrigger`); an agent that
   knows it runs no OS leg after a press (agent, same day). Test `TestR899_PressCarriesTriggerManual` asserts the query the
   agent receives for each of the four shapes.