09 decisions 40-41 (operator rulings 2026-09-26); A1 spike: the unit's definition and data drift apart (R-696 widened), R-697 filed

documentation/architecture/07-backup-architecture.md

@@ -575,9 +575,8 @@ so („Erről nem készül mentés." / "This is not backed up."). What brings it
 (or the app's own unit on the drive), listed per row as „Visszatölthető innen" / "Can be loaded from".
 
 **Who deletes it.** Only the household, by Delete on that page with the app's name typed (a wrong name, or a path that
-is not a listed item, is refused — proven live 2026-09-25). **The box never deletes kept data by itself** — whether it
-ever should (e.g. after 90 days with warnings) is operator decision **D3, open** (`STATUS.md`). Until then kept data
-can fill a drive; the drive-full warning names the kept folders and their sizes as space the household can free.
+is not a listed item, is refused — proven live 2026-09-25). **The box never deletes kept data by itself** — operator ruling
+2026-09-26 (`09` §3 decision 40, D3 option A): no age limit, no automatic clean-up. So kept data can fill a drive; the drive-full warning names the kept folders and their sizes as space the household can free.
 
 **Read-only view.** The file browser shows each kept item under „Megőrzött adatok", one `:ro` bind per item, and
 follows the list at the next sync (a write is refused: `Read-only file system`, proven live). Not yet readable there:

documentation/architecture/09-update-architecture.md

@@ -451,6 +451,21 @@ R-636's louder repeated alarm.
     watches (~12 000 requests each). **Why (b):** 91 % of the old limit is too close for a household box, the gate's
     rule is followed rather than bypassed, and the mark's weakness for such apps is filed (R-693). Reversible.
 
+### 2026-09-26 — two operator rulings
+
+40. **The box never deletes kept data by itself** (operator ruling 2026-09-26, D3 option A). Only the household
+    deletes it, by Delete on the „Megőrzött adatok" page with the app's name typed. No age limit, no automatic
+    clean-up with warnings. Kept data can fill a drive; the drive-full warning names the kept folders and their
+    sizes as space the household can free (as built in v0.274.0). **Why:** the household decided to keep it; a box
+    that deletes it later reverses their decision without them. Closes D3 in `STATUS.md`.
+41. **adventurelog keeps its world-data download** (operator ruling 2026-09-26, R-655 option B). The template does
+    NOT set `SKIP_WORLD_DATA=1`, so a fresh install still gets the countries/regions data. The move to v0.13.0 is
+    proven with the file already in the `adventurelog_media` volume (an update re-uses what v0.12.1 left), plus a
+    check that a truncated file is replaced (`download-countries --force` is the command's own repair). The
+    healthcheck override fix (`/usr/bin/node`) rides the image move in the same commit. **Why:** a fresh install
+    without world data is a smaller product; the internet dependence is at first start, which the update's own
+    health wait and undo already cover.
+
 ---
 
 ## 3b. ANSWERED 2026-09-23 — the seven questions Slices 6 and 7 needed