Off-site safety finished: Parts A-F evidence, decision 74, golden 0.290.0 recorded (vouched, floor 0.290.0), restore walked from the DooPlex copy, register 330 -> 328 (R-823/824/826/827/828/830 closed; R-833, R-834 opened)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/CLOSED-ITEMS.md

@@ -26,6 +26,21 @@
 
 ---
 
+## 2026-10-04 — off-site safety finished (hub v0.128.0, controller v0.290.0, decisions 71–74)
+
+> Evidence: `audits/offsite-finish-2026-10-04/`.
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-824** | **The fake-snapshot guard refused every window after a manual run.** Fixed controller v0.290.0: a young snapshot superseded the same day in its group is EXCLUDED (removed later, once old); any other young removal, a future date or a plan above the week's cap still refuses. Live: window 2 on demo-hp ran without refusal (outcome `nothing`, 127→127, the only candidates were young same-day copies). Weekly windows ON. **Reasoning kept: a guard that refuses the honest case is switched off within a fortnight — exclude the benign shape, keep refusing the poisoning shape.** | CLOSED 2026-10-04 — FIXED controller v0.290.0, live window without refusal; a window that removes something not yet observed (R-95) | `partA-live-window.txt`, `red-proofs-controller.txt` RPC1–2 |
+| **R-823** | **The household's set-aside deletion stopped happening on the append-only tier.** Built (decision 74): the box hands the due request to the hub; the hub deletes only `<repo>.orphaned-*` after 7 days unless the household or operator cancels; the page keeps a dated, cancellable deletion. Live on tester-1: the live repo named → refused; a planted set-aside dir deleted after the (test-shortened, logged, reverted) delay, read back absent. **Reasoning kept: the only deletion a broken-into box can trigger now waits a week under operator mails.** | CLOSED 2026-10-04 — BUILT hub v0.128.0 + controller v0.290.0, proven live | `partE-live-tester1.txt`, `red-proofs-hub.txt` RPH1–2, `red-proofs-controller.txt` RPC3 |
+| **R-826** | **Sub-accounts kept every earlier box's key unpinned.** tester-1's 3 lines removed through the hub registrar (decision 72, `POST /offsite/remove-unpinned`); the daily check reads 0 lines, no alarm. Demo boxes' stale lines went on 2026-10-03. | CLOSED 2026-10-04 | `partC-tester1-keys.txt` |
+| **R-827** | **The daily key check created `.ssh` when absent.** Fixed hub v0.128.0: only the write path creates it. | CLOSED 2026-10-04 — FIXED hub v0.128.0 (red-proved) | `red-proofs-hub.txt` RPH3 |
+| **R-828** | **The ep0 copy grew without bound.** Decision 71: prune job `prune-ep0-copy` keep-weekly 8 (all namespaces) daily 07:30 after the 05:00 pull; GC Sundays 08:30; `remove-vanished` stays false. Dry-run by reasoning: nothing to remove yet (2 snapshots per group, 2 weeks). | CLOSED 2026-10-04 | `partB-copy-retention.txt`; `runbooks/ep0-datastore-copy.md` |
+| **R-830** | **The restore route from the DooPlex copy had never been walked.** Walked on demo-hp with a scratch VMID: list 2 s, restore 186 s, data read via `pct mount`, all torn down. DooPlex PBS is LAN-only; the options for another network are written. **Reasoning kept: a copy that was never restored is not proven — and the restore found a trap (R-834).** | CLOSED 2026-10-04 — WALKED (route 1); route 2 not walked | `partD-restore-walk.txt`; `runbooks/ep0-datastore-copy.md` |
+
+---
+
 ## 2026-10-03 (evening) — the off-site lock built (hub v0.127.0, controller v0.289.0/0.289.1, decisions 68–70)
 
 > Evidence: `audits/offsite-lock-build-2026-10-03/`.