v0.297.0: burn-down round 2 — 24 small rows (R-591 R-568 R-567 R-363 R-547 R-10 R-552 R-251 R-104 R-619 R-362 R-675 R-256 R-257 R-240 R-365 R-425 R-565 R-564 R-603 R-454 R-208 R-457-swept) + the banner countdown and deepCopyStack twins; MinAgent 0.131.0

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/r256_r257_offbox_refusals_test.go

@@ -0,0 +1,76 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
+)
+
+// R-256 / R-257 (C2 copy sample): two refusals on the remote-backup surface were dead ends. R-256
+// „A mentéskezelő nem elérhető." named an internal component and no route; R-257 „Az offsite tároló
+// nincs elárvult állapotban." put an English loanword and the internal state name in front of the
+// household. The consequence asserted, through the real handlers: the flash each one redirects with
+// renders, in both languages, a sentence that carries a ROUTE (try again / support) and none of the
+// internal words.
+func TestR256_R257_OffboxRefusalsNameARoute(t *testing.T) {
+	flashOf := func(t *testing.T, w *httptest.ResponseRecorder) string {
+		t.Helper()
+		u, err := url.Parse(w.Header().Get("Location"))
+		if err != nil || w.Code != http.StatusFound {
+			t.Fatalf("no redirect: %d %q", w.Code, w.Header().Get("Location"))
+		}
+		return u.Query().Get("flash_error")
+	}
+
+	// R-256: no backup manager.
+	s := noteServer(t)
+	w := httptest.NewRecorder()
+	s.offboxConfigHandler(w, httptest.NewRequest(http.MethodPost, "/backup/offbox/config", nil))
+	key := flashOf(t, w)
+	hu, en := s.msgLang("hu", key), s.msgLang("en", key)
+	if strings.Contains(hu, "mentéskezelő") || !strings.Contains(hu, "néhány perc múlva") || !strings.Contains(hu, "ügyfélszolgálat") {
+		t.Errorf("R-256: the Hungarian refusal names no route or still names the component: %q", hu)
+	}
+	if strings.Contains(strings.ToLower(en), "backup manager") || !strings.Contains(en, "few minutes") || !strings.Contains(en, "support") {
+		t.Errorf("R-256: the English refusal names no route or still names the component: %q", en)
+	}
+	w = httptest.NewRecorder()
+	s.offboxVerifyCopyDeleteHandler(w, httptest.NewRequest(http.MethodPost, "/backup/offbox/verify-copy/delete", nil))
+	if got := s.msgLang("hu", flashOf(t, w)); got != hu {
+		t.Errorf("R-256: the restore page's twin refusal differs: %q vs %q", got, hu)
+	}
+
+	// R-257: a configured remote backup that is NOT orphaned; the reset is refused.
+	bm := backup.NewManager(s.cfg, s.settings, s.logger)
+	s.cfg.Paths.DataDir = t.TempDir()
+	if err := s.settings.SetOffboxTarget(&settings.OffboxTarget{Enabled: true, Host: "nas.local", Port: 22, User: "felhom", RepoPath: "/srv/repo", EscrowState: "escrowed"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := bm.WriteOffboxSecrets("KEYMATERIAL", "nas.local ssh-ed25519 HOSTKEY"); err != nil {
+		t.Fatal(err)
+	}
+	if !bm.OffboxConfigured() || bm.OffboxOrphaned() {
+		t.Fatalf("setup: configured=%v orphaned=%v", bm.OffboxConfigured(), bm.OffboxOrphaned())
+	}
+	s.backupMgr = bm
+	w = httptest.NewRecorder()
+	s.offboxResetHandler(w, httptest.NewRequest(http.MethodPost, "/backup/offbox/reset", nil))
+	key = flashOf(t, w)
+	hu, en = s.msgLang("hu", key), s.msgLang("en", key)
+	for _, bad := range []string{"offsite", "elárvult"} {
+		if strings.Contains(hu, bad) {
+			t.Errorf("R-257: the Hungarian refusal still says %q: %q", bad, hu)
+		}
+	}
+	if !strings.Contains(hu, "ügyfélszolgálat") || !strings.Contains(hu, "nem kell") {
+		t.Errorf("R-257: the Hungarian refusal does not say why or where to go: %q", hu)
+	}
+	if strings.Contains(strings.ToLower(en), "orphan") || !strings.Contains(en, "support") {
+		t.Errorf("R-257: the English refusal: %q", en)
+	}
+}