09 decisions 40-41 (operator rulings 2026-09-26); A1 spike: the unit's definition and data drift apart (R-696 widened), R-697 filed

documentation/architecture/09-update-architecture.md

@@ -451,6 +451,21 @@ R-636's louder repeated alarm.
     watches (~12 000 requests each). **Why (b):** 91 % of the old limit is too close for a household box, the gate's
     rule is followed rather than bypassed, and the mark's weakness for such apps is filed (R-693). Reversible.
 
+### 2026-09-26 — two operator rulings
+
+40. **The box never deletes kept data by itself** (operator ruling 2026-09-26, D3 option A). Only the household
+    deletes it, by Delete on the „Megőrzött adatok" page with the app's name typed. No age limit, no automatic
+    clean-up with warnings. Kept data can fill a drive; the drive-full warning names the kept folders and their
+    sizes as space the household can free (as built in v0.274.0). **Why:** the household decided to keep it; a box
+    that deletes it later reverses their decision without them. Closes D3 in `STATUS.md`.
+41. **adventurelog keeps its world-data download** (operator ruling 2026-09-26, R-655 option B). The template does
+    NOT set `SKIP_WORLD_DATA=1`, so a fresh install still gets the countries/regions data. The move to v0.13.0 is
+    proven with the file already in the `adventurelog_media` volume (an update re-uses what v0.12.1 left), plus a
+    check that a truncated file is replaced (`download-countries --force` is the command's own repair). The
+    healthcheck override fix (`/usr/bin/node`) rides the image move in the same commit. **Why:** a fresh install
+    without world data is a smaller product; the internet dependence is at first start, which the update's own
+    health wait and undo already cover.
+
 ---
 
 ## 3b. ANSWERED 2026-09-23 — the seven questions Slices 6 and 7 needed