Limit statistics to 48 hours and handle verified rights requests

[frahlg]

Household statistics were retained for 13 months and a lost box had no bounded operator path for a verified statistics rights request. Use Core's v3 policy and 48-hour retention age. Prune before serving, migrate older grants without a policy, and filter grants and public cells by the current policy. A failure to read rights holds stops restore instead of silently hiding homes. Add an offline, private export/erasure tool that requires Cloud's registry to be closed. Erasure persists a rights hold: reconnects, restart and a new policy cannot resume reports or Cloud access while the request is unresolved. Ordinary signed home deletion still works. No staff HTTP route or new operator access is added.

The DPIA now records actual AWS controls, the shared account and broad operator access, the published Apple declaration, the rights procedure and the unresolved legal decisions. The lawful-basis assessment compares mandatory Cloud statistics with less intrusive alternatives. This PR does not sign the DPIA, establish a lawful basis or enable collection. The production policy flag remains empty.

Paired Core: srcfl/ftw#1710; iOS: srcfl/ftw-app#88. The privacy-site PR follows the same v3 terms. The README/CLAUDE overlap with #14 is limited to the required retention/policy wording; none of that PR's relay code is changed.

Validation: go vet ./..., go test -race ./..., go test -tags ftwclouddev ./..., and bash scripts/check-imports.sh pass against the pinned Core module. Tests use actual Go-created SQLite and TLS: legacy-schema migration and old-policy exclusion; immediate startup pruning with collection off; restriction storage failure; 48-hour boundaries; live-DB refusal; private scoped export; malformed/unverified request rejection; no overwrite; erasure with another home intact; restart/reconnect blocking; and original-key recovery with signed deletion receipt. No production household records were read, exported or erased.

Service size: registry +74, statistics +3 and uplink +20 non-test Go lines. The operator script is separate from the service. Existing ordinary Cloud withdrawal and OAuth key/token purge tests remain green.

Release scope: Fredrik asked to complete this work without publishing a new beta. Core and native releases remain a separate step in Claude.

Paired public privacy notice: srcfl/ftw-web#24.

Review source: merged Core 75a8b2c910ad66559f385e93b3d36c15e86a9ebf via protocol module v0.0.0-20261017163816-75a8b2c910ad; Cloud head 649fcb62682aa5fe82bf34fe0682605352df59a7; native head faf59e42b9f090d76a73313a6829c6f31ca07813; public privacy 601665aef4ef179a16cf48d457516722035ba29e. The host has Python 3.9.25, SQLite 3.40.0 and O_NOFOLLOW; no household database was opened during that prerequisite check.

Production verification, 17 October 2026: merged source bb5b49b5696e952f00a3c04039d496813c7648df, image sha256:7d5025891c5721ab810531eb3a7f7c6df0eb6615617b94f418c74acdbf0fea5d. Verified the GitHub attestation against the exact source digest, main ref and image workflow. The existing SSM deploy helper completed; public /source reports that source/image, and the health probe passes over HTTP/1.1 and HTTP/3. The policy flag is still empty and /v1/stats returns 503 with Ftw-Statistics-State: disabled. No hourly collection was activated.

Activation order: finish and record the C8 review; release the paired Core/native changes separately; let owners give the fresh v3 answer; then consider the exact v3 server flag. Enabling v3 while clients still have v2 terms can interrupt their Cloud access. Publishing a beta or uploading an app is outside this requested completion step.

Final verification: the deployed container reached healthy; main CI passed. Native PR #88 merged as 9ca87ecb1f82ac221af25509bd9fca8d16195c19 after the full Apple job passed, including screenshots. Core remains 75a8b2c910ad66559f385e93b3d36c15e86a9ebf; public privacy remains 601665aef4ef179a16cf48d457516722035ba29e. No Core beta, TestFlight upload or App Store release was triggered for this v3 change.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T16:31:54.970913Z	1bea413	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1bea413c6a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".