R-899: no OS leg after a household press (trigger=manual); after-boot kernel reports carry the saved ring

Unreleased; ships with tomorrow's release.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/localapi/server.go

@@ -825,6 +825,10 @@ func (s *Server) handleBackup(w http.ResponseWriter, r *http.Request, vmid int)
 		return
 	}
 	key := backupJobKey{vmid: vmid, target: tier.TargetID}
+	// R-899 (operator ruling 2026-10-08): a household press („Mentés most") is not the night's backup. A controller
+	// that knows sends `trigger=manual`; then the OS leg does not follow (it belongs to the night, after the night's
+	// own copy). An older controller sends nothing and keeps the old behaviour.
+	manual := r.URL.Query().Get("trigger") == "manual"
 
 	// ONE BACKUP AT A TIME PER GUEST, ACROSS ALL TIERS (operator ruling 2026-07-26: "other backup
 	// shouldn't start until finished"). vzdump takes a guest lock, so a concurrent second backup
@@ -926,7 +930,9 @@ func (s *Server) handleBackup(w http.ResponseWriter, r *http.Request, vmid int)
 		}
 		s.finishJob(key, jobID, b)
 		// OS leg (agent v0.140.0): after the night's whole-guest copy exists, still holding the heavy-op gate.
-		if b.Success && tier.Primary && s.afterPrimaryBackup != nil {
+		if b.Success && tier.Primary && s.afterPrimaryBackup != nil && manual {
+			s.logger.Info("local-api: no OS leg after a manual backup — it follows the night's own backup (R-899)", "vmid", vmid, "job", jobID)
+		} else if b.Success && tier.Primary && s.afterPrimaryBackup != nil {
 			s.afterPrimaryBackup(base, vmid)
 		}
 	}()