Design build done: R-469, R-638 closed; R-518/R-717/R-762 narrowed, R-528 stopped by its measurement; delivery + teardown evidence; STATUS, CONTEXT, REPORT (137 -> 137; 2 opened, 2 closed); section counts recomputed

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -2,8 +2,26 @@
 
 **Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
 
-**Updated 2026-10-06 14:15: every box of ours healthy on hub 0.139.0, agent 0.149.0, controller 0.300.0. The open-items
-list is at 137. Report: `REPORT.md`.**
+**Updated 2026-10-06 16:30: demo-hp, demo-felhom and Tester 1 run controller 0.301.0 (hub 0.139.0, agent 0.149.0).
+The open-items list is at 137. Report: `REPORT.md`.**
+
+## Evening (2026-10-06): the designs built; the list at 137
+
+- **Safer restores:** measured first — restoring a copy after an app update brings back exactly the old database (docmost
+  and romm). Two rarer restore paths now load the database before the app starts.
+- **Shorter backup stop:** each backup copy now gets its own short stop, and the button makes the local copy only; the
+  off-site copy follows at night. **Not yet seen live** — the first night run on the demo boxes is the proof.
+- **Family sign-up window:** wishlist's own sign-up now closes after setup and opens for the 15-minute window (proven
+  live). Opengist cannot do this yet.
+- **wger** shows its styles and photos now (proven). It stays hidden: it still runs a development web server.
+- **Out-of-memory alarm: not built.** Today's Docker reports the memory kills correctly, so the design's reason was
+  gone. Your choice below.
+
+**Needs you (none urgent):**
+1. **R-528** — build the memory-kill alarm anyway? (A) No: keep watching for a box where Docker misses a kill (my pick).
+   (B) Yes, as insurance (about 1.6 s of work every 5 minutes on a full box). If nothing: nothing is built.
+2. **R-892** — where does the Tester 1 box run, and may CC reach it by SSH? Then the update test can run there too. If
+   nothing: the update test stays on the scratch box only.
 
 ## Afternoon (2026-10-06): your two answers built; the list at 137
 
@@ -17,7 +35,7 @@ list is at 137. Report: `REPORT.md`.**
 - **wger's two fixes are proven** on the scratch box: a stranger cannot sign up, visits make no guest accounts, and mail
   works when switched on. wger stays hidden: it still shows no styles or photos.
 
-**Needs you (none urgent):**
+**Needs you (none urgent):** *(answered 2026-10-06 14:24 and done)*
 1. **R-469** — the catalog's database-version check cannot be removed any more: it is now how decision 35's per-app
    proof is enforced. (A) close the row and keep the check (my pick), or (B) keep the row open. If nothing: the row
    stays open; the check works either way.