Decisions 50 (apps off-site by default, R-720) and 51 (ep0 drill archives; restore test on own archives, R-727) recorded; Tester-2 read-only checklist

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -548,6 +548,19 @@ R-636's louder repeated alarm.
     is case-insensitive (termix's router ignores case). Final trick run: 113 tries on 11 apps, 0 got in.
     Same day, operator: CC changes the admin passwords of demo-hp's installed bookstack and calibre-web and stores them
     in the operator's credentials file (not in any repo).
+50. **Every newly installed app goes off-site by itself when the customer has off-site** — *operator ruling 2026-09-30
+    (R-720, option A).* It restores the intent of the 2026-09-16 ruling (`07` §6: Tier 3 ON for every new customer),
+    which a per-app switch starting OFF had undone. If the apps will not fit the customer's quota, the page says so,
+    names the largest, and the household chooses which stay off-site. Apps already installed are not switched by a
+    release (the 2026-09-29 Part 0 rule); the backups page offers one press to switch them all on.
+    **The box never deletes off-site history to make room without the household's choice.** *(Outcome: filled in by
+    the 2026-09-30 fixes session.)*
+51. **ep0: the three whole-guest archives of deleted drill boxes in `tester-1`'s namespace are removed, and only
+    those** — *operator ruling 2026-09-30 (R-727).* With before/after controls on every other namespace. The restore
+    test is fixed to take only the current box's own archives, so an archive of an earlier box in the same namespace
+    can never be tested again. *(Outcome: filled in by the 2026-09-30 fixes session.)*
+    Same day, operator: the first real tester gets a NEW customer record (`Tester-2`, domain `sajatfelhom.hu`), not
+    `tester-1`; and CC rewrites the volunteer guide as measured (R-722).
 
 ---