Rulings 66 (licences) + 67 (userdata stays on remove, 07 §6.5); R-789..R-795 ruled, R-802 (lawyer review) opened; R-800 live proof on 9202 (0.288.0); floor 0.288.0; golden 0.288.0 baked + vouched

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/07-backup-architecture.md

@@ -572,6 +572,11 @@ its definition binds through `${HDD_PATH}`) in place. A reinstall over it no lon
 THIS drive's install — the app's own unit, the second-drive mirror or (since v0.277.0) the off-site copy — loaded under the kept files, then the
 template's `after_load:`, e.g. nextcloud's `occ files:scan --all`) or „Tiszta lappal kezdem" / "Start fresh".
 
+**The household's userdata stays on every remove (`09` §3 decision 67, R-800).** "Remove with data" deletes the app's
+own data — its volumes, `<drive>/appdata/<app>` (the `${HDD_PATH}` binds) and its backups. A folder the app binds through
+`${USERDATA_PATH}` (`userdata/media/grimmory`, `userdata/media/metube`, …) is the household's: it is never deleted by a
+remove, and the dialog and the result say so and name the folder (controller ≥ the release that carries R-800).
+
 **Where it lives.** "Start fresh" RENAMES the folder — same drive, never a copy, never across drives — to
 `<drive>/kept/<app>/<YYYY-MM-DD_HHMMSS>/`, together with the removed app's unit when one sits on that drive (so a later
 Load has its database). `<drive>/kept` is in `ProtectedHDDPaths`, never under `userdata/`, never bound by a live app.