Off-site safety finished: Parts A-F evidence, decision 74, golden 0.290.0 recorded (vouched, floor 0.290.0), restore walked from the DooPlex copy, register 330 -> 328 (R-823/824/826/827/828/830 closed; R-833, R-834 opened)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -2,8 +2,27 @@
 
 **Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
 
-**Updated 2026-10-03 (evening): off-site backups a box cannot delete — built and live. Both demo boxes run controller
-0.289.1 and host agent 0.138.0. Hub 0.127.0. New installs get golden 0.289.1 with agent 0.138.0; every box's floor is 0.289.1.**
+**Updated 2026-10-04: off-site safety finished. Both demo boxes run controller 0.290.0 and host agent 0.138.0. Hub
+0.128.0. New installs get golden 0.290.0 with agent 0.138.0; every box's floor is 0.290.0.**
+
+## Today (2026-10-04): off-site safety finished
+
+- **The weekly clean-up is ON and no longer stops itself.** The fake-backup check now skips young copies that a manual
+  backup replaced the same day, instead of refusing. I ran one window on demo-hp: no refusal, nothing removed
+  (127 → 127), because every candidate was still young. The first real removals come when those copies are older than
+  8 days — around 11 October. demo-felhom gets its first window at its next night run.
+- **DooPlex keeps 8 weekly copies of ep0** (your choice). Old copies go weekly; anything ep0 deletes still never reaches
+  the copy by itself. Today's nightly copy ran fine.
+- **tester-1's 3 old keys are gone.** The daily alarm for tester-1 stopped. (You got one last alarm mail this morning,
+  sent just before I removed them.)
+- **A restore from the DooPlex copy works.** I restored demo-hp's whole box onto a scratch machine in about 3 minutes,
+  read its data, then deleted it. **One trap found:** a restored box starts automatically and points at the real
+  drives. Run beside the original, that would be two copies of the same box. I switched it off in time; the runbook
+  now warns, and a row asks to make it safe by default.
+- **"Delete my old set-aside backups" works again.** The hub does it, 7 days after the household's request; the
+  household or you can cancel in that time. Tested on tester-1 with a planted test folder.
+- **Your answers are recorded**, including that you keep the current Hetzner key for now (a row holds the 3 steps).
+- **Rows:** 6 closed, 4 opened. The list went from 330 to 328.
 
 ## Today (2026-10-03, evening): your choices A and A — built
 
@@ -87,14 +106,8 @@ Your licence decisions are recorded: Emby, Plex and n8n stay. recipe-importer ne
 
 ## What needs you
 
-0. **Off-site clean-up window: nothing to decide now.** It stays OFF until the next session fixes the too-strict check.
-   **If you do nothing:** no old off-site backup is deleted; storage grows slowly (each household uses under 1 GB).
-0b. **How much history should DooPlex's ep0 copy keep?** Today it keeps everything and grows every night.
-   - **A — keep the last 8 weekly copies** (recommended): undo up to 2 months; about 4 times ep0's size (ep0 keeps 2).
-   - **B — keep everything:** never loses anything; DooPlex's disk slowly fills (5.5 TB free today).
-   - **If you do nothing:** B — it grows; nothing breaks for months.
-0c. **tester-1's old keys:** say "remove them" and I clean that storage account's key file through the hub. **If you do
-   nothing:** one alarm mail a day for tester-1.
+0. **Nothing new from the off-site work.** The Hetzner key change stays your call whenever you want it (3 steps, in
+   the list).
 1. **plant-it:** keep the hidden template as it is, or remove it entirely (its image no longer exists). **If you say
    nothing:** it stays hidden; nothing runs it.
 2. **Send the SparkyFitness request, and ask the Tandoor authors** (the "Before the first paying customer" list).