fixes 2026-10-21: evidence so far (R-1176 live proof, R-1192 freeze measured, R-1191 on 9202); design notes 03 §8a / 07 §7.0, §8.2a (D25) / 05 §16.5 (DST)

documentation/architecture/07-backup-architecture.md

@@ -1051,6 +1051,14 @@ here — §8 has rows where it is the actual state.
 
 ### 7.0 What a customer can and cannot do ALONE — the four steps the drill found
 
+> **[DESIGN] 2026-10-21 — the box death, alone (operator ruling, hub v0.163.0, R-1176).** After the operator's one press
+> (delete the dead host — D19), the household reinstalls, binds, claims, and the rebuilt box offers „A korábbi, házon
+> kívüli mentéseid visszaszerezhetők" and asks for the recovery code: the hub carries the sealed package to the new
+> host (03 §8a, „the CARRY"). A wrong code is refused and changes nothing; the right code unlocks the history; each
+> app is reinstalled and brought back with „Teljes visszaállítás"; the night's off-site run appends to the same
+> history. Measured end to end 2026-10-21 (`audits/fixes-2026-10-21/P1-live/`). Before this ruling the rebuilt box saw
+> no package, minted a fresh key and set the history aside on its first night (rehearsal 2026-10-20 B7).
+
 > **[FACT] Added 2026-08-05.** The 2026-08-04 R-201 drill (`audits/DRILL-r201-night-run-2026-08-04.md`)
 > is the first end-to-end proof that a customer's file survives a machine rebuild and comes back
 > byte-identical. **It passed with an operator present, and four manual interventions stood between
@@ -1544,6 +1552,19 @@ absent or hollow primary unit from the mirror **inside the call, before returnin
 observe the hollow state. **The capture itself is deliberately not guarded:** a capture that describes
 an empty drive as empty is correct, and guarding it would make the manifest lie.
 
+### 8.2a A second-drive copy whose SOURCE is gone is kept until the household releases it [DESIGN, operator ruling D25, 2026-10-21]
+
+**[DESIGN]** The derived-copy rule (row 5) rebuilds the secondary from the source. When the SOURCE is gone — the drive
+is away or decommissioned, a registered share's folder or an app's declared folder is missing — there is nothing to
+rebuild from, and the copy may be the only one left. **D25:** such a copy is kept, recorded, and listed on the restore
+page („Megőrzött másolatok") with „Eltávolítás"; no night job removes it. This is a different case from „data legs are
+not guarded" for a leg that LEAVES the class set (the household's or the catalog's own choice). A share the household
+deleted or renamed on a present drive is still pruned. An EMPTIED present folder is not mirrored over a copy that
+holds files (the run warns). Removal is by the record (path inside the copy tree, same device + inode), never by size
+or pattern. **Why:** the data-loss hunt of 2026-10-20 proved two nights that deleted a household's only second copy
+(R-1175: one share group's reconcile removed the other groups' copies, and a dead drive's copy; R-1181: a missing or
+emptied folder took its copy within one night). Controller: `internal/backup/tier2_kept.go`.
+
 ### 8.1 The blank cells, listed explicitly
 
 Per the rule that a blank is a finding, here they are: