v0.297.0: burn-down round 2 — 24 small rows (R-591 R-568 R-567 R-363 R-547 R-10 R-552 R-251 R-104 R-619 R-362 R-675 R-256 R-257 R-240 R-365 R-425 R-565 R-564 R-603 R-454 R-208 R-457-swept) + the banner countdown and deepCopyStack twins; MinAgent 0.131.0

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/offbox_inventory.go

@@ -61,6 +61,11 @@ type offsiteNewest struct {
 	paths []string
 }
 
+// OffboxMarkerTag is on EVERY off-site snapshot (`restic backup --tag felhom-offbox --tag <stack>`),
+// beside the app's own tag. It marks the tier, it does not name an app, so no per-app view may key
+// on it (R-251). Pinned by TestR251_MarkerTagIsNotAnApp.
+const OffboxMarkerTag = "felhom-offbox"
+
 // offsiteNewestPerTag runs ONE `snapshots --json` and returns the newest snapshot per app tag, and
 // whether the repository opened cleanly and holds no snapshots at all. Shared by the inventory page
 // and the update precondition (R-477), so the two cannot disagree about what is in the repository.
@@ -100,7 +105,10 @@ func (m *Manager) offsiteNewestPerTag(ctx context.Context) (map[string]offsiteNe
 			id = sn.ID
 		}
 		for _, tag := range sn.Tags {
-			if tag == "" {
+			if tag == "" || tag == OffboxMarkerTag {
+				// R-251: the marker is on EVERY off-site snapshot; it is not an app. Keyed here it
+				// became a second row on the recovery listing — a stranger's name beside the
+				// customer's app and their data counted twice.
 				continue
 			}
 			if cur, ok := newest[tag]; !ok || sn.Time.After(cur.at) {