fixes 2026-10-21: evidence so far (R-1176 live proof, R-1192 freeze measured, R-1191 on 9202); design notes 03 §8a / 07 §7.0, §8.2a (D25) / 05 §16.5 (DST)

documentation/architecture/03-host-agent.md

@@ -481,6 +481,18 @@ box. The escrow is how `K` comes back **without** Felhom ever being able to read
 (hub v0.8.0, `PUT /api/v1/hosts/{host_id}/escrow`). Validated end-to-end on a throwaway in
 `documentation/tests/slice7-escrow-spike-findings.md`. Restore-mode *serving/consumption* is slice 10.
 
+#### The rebuilt box gets the household's package back — the CARRY [DESIGN, operator ruling 2026-10-21, hub v0.163.0, R-1176]
+
+After the operator deletes a dead box's host (escrow acknowledged), the package is demoted to retained custody under
+the OLD host id. The hub now **re-attaches** it: when the customer has exactly one live host, no live host holds a
+package, and its newest escrow-acknowledged deletion left a retained row with an identity blob, that row becomes the new
+host's current escrow row — moved, in one transaction, on the agent's first report (and again on the controller's
+report, idempotently). **Zero-knowledge is unchanged:** the hub moves the same ciphertext from one row to another; it
+never opens, re-seals or logs it; the audit (`escrow_carried`) carries host ids and the non-reversible hash. Two live
+hosts → no carry, `escrow_carry_refused` to the operator. The box then sees „identity present", its mint guard (R-241)
+holds, and it offers the recovery screen. Proven live 2026-10-21 (`audits/fixes-2026-10-21/P1-live/`: the right code
+opened the household's history, Nextcloud's 3 031 files came back byte-identical, the next off-site run appended).
+
 #### The separation principle (the rule that governs every posture)
 Reading customer data needs **BOTH** the encrypted chunks **AND** a usable key. **Zero-knowledge
 holds for exactly as long as Felhom never holds both at once.** Every posture below is just a

documentation/architecture/05-hub-architecture.md

@@ -575,6 +575,14 @@ are deleted at start-up and at each new day (`TestAccessLog_Keeps90DaysThenDelet
 ingress log: ≈ 1,900 hub requests a day at ≈ 110 bytes a line → ≈ 0.2 MB a day, ≈ 19 MB for 90 days. A logging
 failure never fails or delays a request: lines go through a non-blocking buffer to one writer (`internal/accesslog`).
 
+### 16.5 Daily jobs and the clock change [DESIGN — hub v0.163.0, operator ruling D24 2026-10-21, R-1183]
+
+Every daily hub job (`scheduleDaily`: db-snapshot 02:00, prune, deadline-check 05:00, offsite-key-audit 07:10) runs at
+its Budapest wall-clock time **once per calendar day**: the next run is the calendar day after (`time.Date`, day+1),
+never „now + 24 h", and the slot that ran last never runs again. On a 25-hour day (the last Sunday of October) the old
+arithmetic ran every job after 02:00 twice; on a 23-hour day it ran them an hour late. Pinned by `TestR1183_*` for
+2026-10-25 and 2027-03-28.
+
 ## 17. Operator access tokens [DESIGN — hub v0.152.0, operator ruling 2026-10-15 11:38 (`09` §3 decision 251)]
 
 **The problem.** Scripts — Claude Code's floor step first — drove the hub with the operator's own password (HTTP Basic,

documentation/architecture/07-backup-architecture.md

@@ -1051,6 +1051,14 @@ here — §8 has rows where it is the actual state.
 
 ### 7.0 What a customer can and cannot do ALONE — the four steps the drill found
 
+> **[DESIGN] 2026-10-21 — the box death, alone (operator ruling, hub v0.163.0, R-1176).** After the operator's one press
+> (delete the dead host — D19), the household reinstalls, binds, claims, and the rebuilt box offers „A korábbi, házon
+> kívüli mentéseid visszaszerezhetők" and asks for the recovery code: the hub carries the sealed package to the new
+> host (03 §8a, „the CARRY"). A wrong code is refused and changes nothing; the right code unlocks the history; each
+> app is reinstalled and brought back with „Teljes visszaállítás"; the night's off-site run appends to the same
+> history. Measured end to end 2026-10-21 (`audits/fixes-2026-10-21/P1-live/`). Before this ruling the rebuilt box saw
+> no package, minted a fresh key and set the history aside on its first night (rehearsal 2026-10-20 B7).
+
 > **[FACT] Added 2026-08-05.** The 2026-08-04 R-201 drill (`audits/DRILL-r201-night-run-2026-08-04.md`)
 > is the first end-to-end proof that a customer's file survives a machine rebuild and comes back
 > byte-identical. **It passed with an operator present, and four manual interventions stood between
@@ -1544,6 +1552,19 @@ absent or hollow primary unit from the mirror **inside the call, before returnin
 observe the hollow state. **The capture itself is deliberately not guarded:** a capture that describes
 an empty drive as empty is correct, and guarding it would make the manifest lie.
 
+### 8.2a A second-drive copy whose SOURCE is gone is kept until the household releases it [DESIGN, operator ruling D25, 2026-10-21]
+
+**[DESIGN]** The derived-copy rule (row 5) rebuilds the secondary from the source. When the SOURCE is gone — the drive
+is away or decommissioned, a registered share's folder or an app's declared folder is missing — there is nothing to
+rebuild from, and the copy may be the only one left. **D25:** such a copy is kept, recorded, and listed on the restore
+page („Megőrzött másolatok") with „Eltávolítás"; no night job removes it. This is a different case from „data legs are
+not guarded" for a leg that LEAVES the class set (the household's or the catalog's own choice). A share the household
+deleted or renamed on a present drive is still pruned. An EMPTIED present folder is not mirrored over a copy that
+holds files (the run warns). Removal is by the record (path inside the copy tree, same device + inode), never by size
+or pattern. **Why:** the data-loss hunt of 2026-10-20 proved two nights that deleted a household's only second copy
+(R-1175: one share group's reconcile removed the other groups' copies, and a dead drive's copy; R-1181: a missing or
+emptied folder took its copy within one night). Controller: `internal/backup/tier2_kept.go`.
+
 ### 8.1 The blank cells, listed explicitly
 
 Per the rule that a blank is a finding, here they are: