v0.279.0: after_install (decision 45), known default logins on the page, Part D empty-backup alarm, night chain (R-705), R-706

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/backup.go

@@ -160,6 +160,9 @@ type Manager struct {
 	// INIT/TEST ONLY.
 	keptUnitRestoreFn func(app, unitDir string) (UnitRestoreResult, error)
 
+	// hollow (Part D, v0.279.0) — the running apps whose newest copy holds no data. See hollow_watch.go.
+	hollow hollowWatch
+
 	// F17 restore seams — overridable in tests so the .sql re-import orchestration can be unit-tested
 	// without Docker. Default to the real DiscoverDatabases / ImportDump (lazy-init in reimportDBDumps).
 	discoverDBs  func(ctx context.Context) ([]DiscoveredDB, error)
@@ -667,6 +670,8 @@ func (m *Manager) runDBDumpsInternal(ctx context.Context) error {
 	// Phase 2: refresh each deployed app's self-contained recovery unit (compose + manifest). A DATA run:
 	// the capture folds the stamps the legs above just wrote (v0.275.0).
 	m.captureAllRecoveryUnits(true)
+	// Part D (v0.279.0): a RUNNING app whose unit still holds no data after this run is an alarm.
+	m.checkLocalCopies()
 
 	// F5 (CAMPAIGN-3): after the units are fresh on the CURRENT drives, prune any orphaned
 	// backups/primary/<app> dir an app left on an OLD drive when its HDD_PATH moved — pure disk