v0.279.0: after_install (decision 45), known default logins on the page, Part D empty-backup alarm, night chain (R-705), R-706

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/api/router.go

@@ -929,6 +929,29 @@ func (r *Router) dropLeftoverHold(name, why string) {
 	}
 }
 
+// removeVerificationCopy (R-706, v0.279.0) deletes the app's off-site VERIFICATION copy
+// (`backups/offsite-restore/<app>`, left by a full off-site restore for the household to inspect) when the
+// app is removed "with its backups". Measured 2026-09-28 on demo-hp: ~1 GB stayed after such a removal, and
+// the app list no longer showed anything it belonged to. Returns the removed path as the removal reports it.
+// Pinned by TestR706_RemovalWithBackupsDeletesTheVerificationCopy.
+func (r *Router) removeVerificationCopy(name string) []string {
+	if r.backupMgr == nil {
+		return nil
+	}
+	var out []string
+	for _, c := range r.backupMgr.ListOffsiteRestoreCopies() {
+		if c.Stack != name {
+			continue
+		}
+		if err := r.backupMgr.DeleteOffsiteRestoreCopy(name); err != nil {
+			r.logger.Printf("[WARN] [api] remove %s: its off-site verification copy %s could not be deleted: %v", name, c.Path, err)
+			continue
+		}
+		out = append(out, fmt.Sprintf("%s (%s)", c.Path, c.SizeHuman))
+	}
+	return out
+}
+
 func (r *Router) removeStack(w http.ResponseWriter, req *http.Request, name string) {
 	if name == "" {
 		writeJSON(w, http.StatusBadRequest, apiResponse{OK: false, Error: "invalid stack name"})
@@ -1008,6 +1031,9 @@ func (r *Router) removeStack(w http.ResponseWriter, req *http.Request, name stri
 	if body.RemoveBackups && r.backupMgr != nil && len(mirrorDirs) > 0 {
 		resp.BackupPathsRemoved = append(resp.BackupPathsRemoved, r.backupMgr.RemoveTier2Mirrors(name, mirrorDirs)...)
 	}
+	if body.RemoveBackups {
+		resp.BackupPathsRemoved = append(resp.BackupPathsRemoved, r.removeVerificationCopy(name)...)
+	}
 
 	// R-486 (v0.240.0): the app's backup preferences — and with them the Tier-2 RECORD that
 	// tier2RecordedCopyDir needs — are forgotten ONLY when the customer asked for the backups to be