Rulings 66 (licences) + 67 (userdata stays on remove, 07 §6.5); R-789..R-795 ruled, R-802 (lawyer review) opened; R-800 live proof on 9202 (0.288.0); floor 0.288.0; golden 0.288.0 baked + vouched

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/07-backup-architecture.md

@@ -572,6 +572,11 @@ its definition binds through `${HDD_PATH}`) in place. A reinstall over it no lon
 THIS drive's install — the app's own unit, the second-drive mirror or (since v0.277.0) the off-site copy — loaded under the kept files, then the
 template's `after_load:`, e.g. nextcloud's `occ files:scan --all`) or „Tiszta lappal kezdem" / "Start fresh".
 
+**The household's userdata stays on every remove (`09` §3 decision 67, R-800).** "Remove with data" deletes the app's
+own data — its volumes, `<drive>/appdata/<app>` (the `${HDD_PATH}` binds) and its backups. A folder the app binds through
+`${USERDATA_PATH}` (`userdata/media/grimmory`, `userdata/media/metube`, …) is the household's: it is never deleted by a
+remove, and the dialog and the result say so and name the folder (controller ≥ the release that carries R-800).
+
 **Where it lives.** "Start fresh" RENAMES the folder — same drive, never a copy, never across drives — to
 `<drive>/kept/<app>/<YYYY-MM-DD_HHMMSS>/`, together with the removed app's unit when one sits on that drive (so a later
 Load has its database). `<drive>/kept` is in `ProtectedHDDPaths`, never under `userdata/`, never bound by a live app.

documentation/architecture/09-update-architecture.md

@@ -701,6 +701,17 @@ its length, and both fixes cost something the household would notice — operato
     2026-10-02.* **Why, recorded:** the operator's model is that Felhom sells installation and care, not software; that
     holds for OSI licences, but this licence names indirect use "in any … service … resulting in … monetary
     compensation", so it needs the permission. STATUS carries it as a standing item with that trigger.
+66. **Licences (R-789 … R-795):** Tandoor is treated like SparkyFitness (decision 65): it stays offered, the operator asks
+    its authors for written permission, and **without it before the first paying customer it is hidden**. Emby, Plex and
+    n8n are KEPT — the household is the licensee/user and Felhom installs the official, unchanged image. The non-OSI list
+    (R-789 … R-795) goes to a lawyer **before the first paying customer**. recipe-importer is Felhom's own code: no action
+    unless it is shared. STATUS carries one standing section, "Before the first paying customer" — *operator ruling
+    2026-10-02 (afternoon).*
+67. **"Remove with data" keeps the household's own files (R-800, option A):** an app's folder under `userdata` (books,
+    videos, photos the household sees in the file browser) STAYS on any remove; the remove dialog and the result say so
+    and name the folder. What "with data" deletes is the app's own data: its volumes, `${HDD_PATH}/appdata/<app>` and its
+    backups — *operator ruling 2026-10-02 (afternoon).* **Why:** userdata is the household's, browsable and often shared
+    (`media/`); a remove must never take it, but it must never be silent about leaving it either. Recorded in `07` §6.5.
 
 ### 2026-09-30 (day) — operator notes, recorded before the work