drill 0.243.0 complete: 0 interventions, the connect e-mail proven, NOT ready for a volunteer

The automatic connect e-mail is proven with a real mailbox: the host record was
deleted at 12:22:59Z and the mail reached the customer at 12:23:00Z, one second
later, with selfbind_link_sent (host delete) on the timeline. The requirement was
two minutes. The hub refuses to delete an ONLINE host with no override, so the
record had to fall stale first — that wait is part of the proof.

Interventions: 0. Every P1 fix this drill set out to prove held on a fresh box.
The verdict is still no, for a new reason: a one-drive box with no off-site tier
keeps none of the household's own files in any backup, the page says otherwise,
and the restore that should save them makes it worse (R-537, R-538).

Teardown, three layers, stated. Customer tester-1 kept; RESET never used; nothing
on the off-site server written or removed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -1,5 +1,51 @@
 # STATUS — what works, what's broken, what's next
 
+**Updated 2026-09-16 (drill on a fresh box) — the fixes hold; the backup promise does not.**
+
+> **Ready for a volunteer: NO — one reason, and it is new.** On a brand-new box with one drive, the
+> household's own files are in **no backup at all**, and the backup page says they are. I deleted five
+> photos the way a child would, restored from the box's own backup, and the folder came back listing all
+> five photos — none of which opens. The bytes had never been copied. The app's own wastebasket still held
+> them, and the restore made that unreachable too.
+
+**What I proved on a fresh box.** The installer downloads and installs; the box lands on the golden this
+drill baked (checked by checksum, not by trust); the connect e-mail and the bind page work; the dashboard
+opens through the tunnel from outside; the file manager has its own password and „admin/admin" is refused;
+four apps installed and were used; the backup page tells the truth per tier; „Mentés most" stopped the apps
+for 26 seconds, inside what the button promises.
+
+**The five faults.** A controller killed during an install: back in 37 seconds. Two reboots a minute apart:
+everything back in 124 seconds, and the box did not count the reboots against its own safety brake. Wrong
+passwords five times: the app lets you keep trying, the box's own setup code locks for 15 minutes after two
+and e-mails you — correctly. Memory pressure: the box still cannot see it (second box, same result).
+The deleted photo folder: see above.
+
+**The automatic connect e-mail: it works.** I deleted the box's record on the hub and the „connect your
+Felhom box" e-mail reached the customer **one second later**, naming the reason. That was the last thing
+waiting to be proven with a real mailbox.
+
+**Decisions I took.** None under the unattended rule.
+
+**Needs you.**
+1. **Say whether the backup page may keep promising what it does not hold.** Today, a new box with one drive
+   backs up its apps' settings and databases — not the household's own files. The page says otherwise, and a
+   restore then reports success while the files are gone. If you do nothing: the first volunteer can lose
+   their photos and be told everything is fine. I can fix the wording and the refusal in the controller; the
+   real protection needs a second drive or the off-site copy switched on.
+2. **Grant the off-site server one permission.** The re-issue fails on a missing grant, so a rebuilt or new
+   box gets no off-site copy at all. If you do nothing: the third backup level stays unavailable for every
+   new box, and the fix already written stays dead.
+3. **Rule on the restart brake.** The box stops retrying after three restarts in fifteen minutes. I measured
+   that a controller dying every twenty minutes is restarted forever, and the only trace is a note that
+   e-mails nobody. Options: leave it (the box heals itself and the timeline records it); add a second,
+   slower counter that raises a warning; or make the fifth restart in a day a warning. My pick: the second
+   counter — it keeps the healing and ends the silence. If you do nothing: a slowly failing box stays
+   invisible until someone reads the timeline.
+
+---
+
+## Previous note
+
 **Updated 2026-09-15 (P1 fixes) — the big night's blockers, fixed and shipped.**
 
 > **Ready for a volunteer: almost.** The file manager has a real password, the backup page tells the truth, the
@@ -739,3 +785,4 @@ off. **`peti-felhom` is a real machine we have not heard from since 15 July** an
 
 The 2026-08-09 batch (R-279 … R-292), still untriaged; the three remaining R-264 readers; R-317 (one
 line in the agent); R-327 (decide the naming claim's status); R-359 (nothing reads the off-site store).
+