hub v0.116.0: every new customer starts WITH the off-site copy (operator ruling)

Off-site is ON by default for a new customer — shared, 100 GB soft quota prefilled,
the checkbox kept so an operator can opt a customer out. The reason is this repo's
own [FACT]: the whole-guest tiers do not carry the data drive and a Tier-1 unit has
no file leg, so with this unticked a one-drive box keeps NO copy of the household's
own files. Measured on a fresh box the same day.

The quota is prefilled because the fill warning only fires when quota_gb > 0.

Also registers controller v0.244.0's app_deploy_started / app_deploy_failed in both
allowedEventTypes and customerMessages, per the rule that the two move together.

Red-proofed: dropping the default fails the new render test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/07-backup-architecture.md

@@ -270,6 +270,16 @@ Recorded here so the encryption policy is not read as covering it. → **R-108**
 
 The tiers are **inputs to recovery**, not recovery routes. §7 and §8 say what they can actually do.
 
+**[RULING 2026-09-16, operator] Tier 3 (off-site) is ON for every new customer — shared, 100 GB soft
+quota.** Opting a customer out stays the per-customer exception, as DR-tier-by-default has been since
+2026-07-12. **The reason is this document's own [FACT] two sections down:** the whole-guest tiers do
+not carry `mp8 /mnt/felhom-drives`, and a Tier-1 unit has no file leg — so for the four class-A apps
+a one-drive box with Tier 3 off keeps the household's files in NO tier at all. That was measured on a
+fresh box the same day: five photos put into Nextcloud, deleted, restored from the box's own backup,
+and none of them opened (`audits/DRILL-prove-fixes-0243-2026-09-16.md`, R-537/R-538). Implemented in
+hub v0.116.0 (`handleConfigNewForm`). **What this ruling does NOT change: what any tier captures.**
+
+
 **The app update's safety precondition accepts ANY tier** (operator ruling 2026-09-13, controller
 v0.239.0, R-475): the first fresh copy in the order Tier 2, Tier 1, Tier 3; with none, it backs up
 first. Design: `09-update-architecture.md` §3 decision 8. **What a Tier-1 route back restores is only

documentation/runbooks/VOLUNTEER-first-hour.md

@@ -22,6 +22,7 @@
 >    operator creates the tunnel (day-0 A.1) before sending this document. R-494 is narrowed to P3.
 >
 > Operator prerequisites this document silently depends on (§ „Az üzemeltető előtte"):
+> - **a távoli másolat alapból be van kapcsolva** a new customer (shared, 100 GB) — leave it on unless the customer opts out; without it the household's own files are in no backup on a one-drive box.
 > create the customer; **hand over the Tulajdonosi jelmondat out of band**; **create the Cloudflare
 > tunnel and paste its token** (day-0 runbook A.1) — until R-494 is ruled.
 

documentation/runbooks/day0-install.md

@@ -66,6 +66,13 @@ connected).*
 
 ### A.2 Create the customer in the hub
 
+> **The off-site copy is ON by default (operator ruling 2026-09-16, hub v0.116.0).** The new-customer
+> form arrives with „Enable offsite" ticked, type **shared**, soft quota **100 GB**. Leave it unless
+> the customer is deliberately opting out: with it off, a one-drive box keeps NO copy of the
+> household's own files — the whole-guest tiers do not carry the data drive and the local app backup
+> holds no file leg (`architecture/07-backup-architecture.md` §6).
+
+
 Hub UI (`https://hub.felhom.eu`, operator password) → **Customers → New**:
 
 | Field | Value | Notes |