D62 + D63 (operator 2026-10-29 08:17): 09 §3 decisions 281/282; 07 §6.3 [DESIGN] — restore copies 30 days + Törlés most; prove-or-revert for H4/H5

documentation/architecture/07-backup-architecture.md

@@ -835,6 +835,17 @@ app-stop marker is readable and does not name the app, and no restore runs. **De
 operator may reverse:** *How long does an unused restore copy stay?* (a) 14 days; (b) for ever (as before); (c) 3 days.
 (a) holds up to two weeks of disk per restore and gives support two weeks; (b) grows without end; (c) is shorter than a
 support reply. A held or waiting copy is never touched under any option. Tests `TestR1256_*`, each red first.
+**`[DESIGN]` 2026-10-29 — D62 replaces the age, and the household can delete a copy (operator ruling 08:17; `09` §3
+decision 281).** An unused copy stays **30 days**. The restore page's kept-copies list („Megőrzött másolatok") shows each
+restore copy: the app, the date of the restore it protects, its size and „automatikusan törlődik: <date>". „Törlés most"
+deletes one earlier after the warning („Ez a(z) <app> adatainak másolata a <dátum>-i visszaállítás előttről. Ha törlöd, a
+visszaállítás többé nem vonható vissza, és ez a másolat nem hozható vissza.") and the app's name typed. Never deletable: a
+copy a hold or a pending put-back needs (the same rule as the sweep; the button is off with the reason, and the handler
+refuses it), and any copy while a backup or restore runs or the app updates (409). The check and the removal are one step
+under the backup manager's lock. One `[WARN]` log line and one operator-only event `restore_copy_deleted` (who, app,
+restore date, size; hub `19afefab`) per delete. Controller `e3fce09`, tests `TestD62_*`. **D63** (`09` §3 decision 282):
+H4 and H5's failed stop ship only with a live proof, staged with a fault switch that exists only in a `-tags faultinject`
+test build.
 **`[FACT]` 2026-10-29 night, scratch 9202 (`audits/night-2026-10-28/r1256-restore/h5-live/`):** vikunja's first volume
 held by a created-only container, the household's restore pressed through the page: „Failed to remove volume
 vikunja_vikunja_data before the restore … (not written into)", the restore failed, the put-back poured the live copy of

documentation/architecture/09-update-architecture.md

@@ -1193,6 +1193,19 @@ a single-page app answers 200 on every path, so a „no such path" probe passed
 tool now probes port 1. `test-record-move` also refuses a `memory_tight` step whose range does not raise the limit —
 Wanderer's Meilisearch went 256 → 384 MB and was measured again (it sizes itself to its limit: 88.8 %).
 
+### 2026-10-29 (morning, attended) — D62: an unused restore copy stays 30 days, and the household may delete it; D63: prove or revert
+
+281. **D62 = an unused restore copy is kept 30 days, and the household can delete it earlier** with one button
+     („Törlés most") in the kept-copies list on the restore page (place A), after a warning that names the app and the
+     restore's date and the app's name typed. A copy a hold or a pending put-back needs is never deleted — not by the
+     sweep, not by the button (it is off, with the reason in one line); a delete while a backup or restore runs is refused.
+     One log line and one operator event (`restore_copy_deleted`: who, app, date, size) per delete. Replaces the night's
+     14 days (decided by CC unattended). *Operator, 2026-10-29 08:17.* `07` §6.3.
+282. **D63 = R-1256 H4 and H5's failed-stop branch are released only with a live proof; else they are reverted** (their
+     tests stay, skipped with the reason) before the controller tag. The proof uses a fault switch that exists only in a
+     `-tags faultinject` test build — never in the release image (`TestD63_TheReleaseBuildHasNoFaultSwitch`). *Operator,
+     2026-10-29 08:17.* `07` §6.3.
+
 ### 2026-10-28 (day, attended) — RomM kept; the runtime cache fills itself in CI
 
 277. **D61 = keep RomM offered** (R-1330) while no RomM release carries Node ≥ 24.22.1; the first one that does is taken