CONTEXT + REPORT: v0.289.0/v0.289.1 off-site lock (floored 0.289.1, golden 0.289.1 vouched)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -7,7 +7,17 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-10-02 afternoon (v0.288.0 — the remove dialog names the household's files, decision 67, R-800)
+Last updated: 2026-10-03 evening (v0.289.1 — the off-site key cannot delete, decisions 68–69)
+
+> **2026-10-03 (evening) — v0.289.0 + v0.289.1 (floored 0.289.1, golden 0.289.1 vouched, needs hub v0.127.0):** the
+> hub-provisioned off-site tier is reached through an APPEND-ONLY key the hub's registrar pins
+> (`offsiteapply.HubRegistrar`, `PinnedProber`); the box never receives the Storage Box password; transport `rclone:`
+> over ssh 23 (`OffboxTarget.Transport = "rclone-pinned"`; the household NAS stays sftp). Retention only inside a hub
+> window behind the fake-snapshot guard (`backup/offbox_window.go`) — weekly windows are OFF; the guard is too strict
+> after manual runs (R-824, next). Move-aside is the hub's; abandonment deferred to the operator (R-823). v0.289.1: the
+> provider rclone NOTICE line is stripped from restic output, and an unreadable snapshot count is never a measured 0
+> (it caused one false `offsite_snapshots_dropped` mail, R-825). Both demo boxes migrated live with history kept.
+> Evidence `felhom.eu/documentation/audits/offsite-lock-build-2026-10-03/`.
 
 > **2026-10-02 (afternoon) — v0.288.0 (floored, golden 0.288.0 vouched):** `userdata_kept` in hdd-data and both remove
 > results; the dialog says the household's files stay and names them (decision 67). Rule for later work: a remove NEVER

REPORT.md

@@ -1,13 +1,16 @@
-# REPORT — v0.288.0: the remove dialog and result name the household's files (decision 67, R-800) — 2026-10-02
+# REPORT — v0.289.0 / v0.289.1: the off-site key cannot delete (decisions 68–69) — 2026-10-03
 
-Full session report: `felhom.eu/REPORT-persistence-sweep-2026-10-02.md`. Architecture: `07-backup-architecture.md` §6.5
-(decision 67 recorded there), `09` §3 decision 67.
+Full session report: `felhom.eu/REPORT-offsite-lock-build-2026-10-03.md`. Architecture: `07-backup-architecture.md`
+(custody block, threat rows 9/10/12), `06` §3.6, `09` §3 decisions 68–70.
 
-- `userdata_kept` (the folders the app binds through `${USERDATA_PATH}` that exist; always a list) in
-  `GET /api/stacks/{name}/hdd-data` and in the results of `POST …/remove` and `DELETE /api/stacks/{name}`. Both dialogs and
-  both results show „A fájljaid ezekben a mappákban megmaradnak — a fájlböngészőben látod őket:" / "Your files in these
-  folders stay — you see them in the file browser:". The "no data on a drive" note is no longer given when userdata exists.
-- Nothing new is deleted or kept: a remove never deleted userdata (pinned since R-442).
-- Tests `TestRemoveStack_R800_*`; red-proof RP-R800-1/2 (`felhom.eu/documentation/audits/persistence-sweep-2026-10-02/B/`);
-  parity fixtures regenerated (additions only). Live on 9202 (`B/r800-9202.txt`).
-- Floor 0.288.0 → both demo boxes in 20 s; golden 0.288.0 baked + vouched.
+- **v0.289.0:** append-only `rclone:` transport for the hub tier; the box sends only its public key to the hub
+  registrar and proves the pin before configuring; both `forget` sites, the move-aside and the abandonment leave the
+  box on that tier; retention only inside a hub window behind the fake-snapshot guard (R-822).
+- **v0.289.1 (found live):** the provider's rclone NOTICE broke every `--json` parse → the box recorded 0 snapshots as
+  measured and the hub mailed a false `offsite_snapshots_dropped`. The notice is stripped; an unreadable count keeps
+  the last value with `stats_known=false`. **Two releases this session — the second one fixes a defect the first put
+  live; the one-release rule was broken on purpose and is named here.**
+- Tests + red-proofs: `felhom.eu/documentation/audits/offsite-lock-build-2026-10-03/partC/red-proofs-controller.txt`.
+- Live: demo-felhom 11→13 snapshots, demo-hp 91→100 (history kept); a delete from each box refused (403); restore of
+  one file and `check` through the pinned key on each. Floor 0.289.1 served to both; golden 0.289.1 baked + vouched.
+- **MinAgent 0.131.0** (unchanged).