Decisions 50 (apps off-site by default, R-720) and 51 (ep0 drill archives; restore test on own archives, R-727) recorded; Tester-2 read-only checklist

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-30 09:49:41 +02:00
parent cdf974d186
commit 4951fc2283
8 changed files with 87 additions and 0 deletions
@@ -191,6 +191,10 @@ the same way.

 ## 8. Storage & backup

+> **2026-09-30 (operator, `09` §3 decisions 50–51):** a new box's apps are in the off-site copy by default (07 §6);
+> the whole-guest restore test takes only the box's OWN archives — an earlier box's archive left in the customer's
+> ep0 namespace is never this box's proof, and the three drill archives found there are removed.
+
 **Tiers** (escalating failure scope):

 | Layer | Mechanism | Survives | Note |
@@ -297,6 +297,13 @@ fresh box the same day: five photos put into Nextcloud, deleted, restored from t
 and none of them opened (`audits/DRILL-prove-fixes-0243-2026-09-16.md`, R-537/R-538). Implemented in
 hub v0.116.0 (`handleConfigNewForm`). **What this ruling does NOT change: what any tier captures.**

+**[RULING 2026-09-30, operator — `09` §3 decision 50] …and every app on such a box is IN the off-site copy by
+default.** The 2026-09-16 ruling turned the tier on per customer; a per-app switch that started OFF left a new
+household's apps out of it (measured on a fresh box, `audits/DRILL-new-household-2026-09-30.md`, R-720). A newly
+installed app on a box whose customer has off-site is switched on at install. Over the customer's quota the page names
+the largest apps and the household chooses; **the box never deletes off-site history to make room without that
+choice.** Apps installed before the release are offered one press, never switched by the release itself.
+

 **The app update's safety precondition accepts ANY tier** (operator ruling 2026-09-13, controller
 v0.239.0, R-475): the first fresh copy in the order Tier 2, Tier 1, Tier 3; with none, it backs up
@@ -548,6 +548,19 @@ R-636's louder repeated alarm.
    is case-insensitive (termix's router ignores case). Final trick run: 113 tries on 11 apps, 0 got in.
    Same day, operator: CC changes the admin passwords of demo-hp's installed bookstack and calibre-web and stores them
    in the operator's credentials file (not in any repo).
+50. **Every newly installed app goes off-site by itself when the customer has off-site** — *operator ruling 2026-09-30
+    (R-720, option A).* It restores the intent of the 2026-09-16 ruling (`07` §6: Tier 3 ON for every new customer),
+    which a per-app switch starting OFF had undone. If the apps will not fit the customer's quota, the page says so,
+    names the largest, and the household chooses which stay off-site. Apps already installed are not switched by a
+    release (the 2026-09-29 Part 0 rule); the backups page offers one press to switch them all on.
+    **The box never deletes off-site history to make room without the household's choice.** *(Outcome: filled in by
+    the 2026-09-30 fixes session.)*
+51. **ep0: the three whole-guest archives of deleted drill boxes in `tester-1`'s namespace are removed, and only
+    those** — *operator ruling 2026-09-30 (R-727).* With before/after controls on every other namespace. The restore
+    test is fixed to take only the current box's own archives, so an archive of an earlier box in the same namespace
+    can never be tested again. *(Outcome: filled in by the 2026-09-30 fixes session.)*
+    Same day, operator: the first real tester gets a NEW customer record (`Tester-2`, domain `sajatfelhom.hu`), not
+    `tester-1`; and CC rewrites the volunteer guide as measured (R-722).

 ---