v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

R-399: monitoring.integrity.read_data_subset defaults to 100%. A pack damaged
without changing its size made plain `restic check` report "no errors were found"
on demo-hp 2026-08-30; every read-data form caught it. Cost on that 134 MB store:
35.0s structure vs 39.2s at 100%. "off" (any case) is the off token; empty means
not-configured, therefore the default; a malformed value falls back to the DEFAULT,
never to structure. A completed check over 5 minutes logs a WARN naming the
duration, the depth and R-401 — operator log only, no hub event, no depth change.
The depth is now recorded with the verdict (LastIntegrityDepth; empty = NOT
RECORDED, never "structure").

R-400: 24 debug-page references, 17 dispatched, 7 dead — three of which fetched on
page LOAD, so those panels were permanently blank. backup/crossdrive implemented;
backup/infra, hub/infra-push, dr/infra-status, storage/watchdog-status and both
storage/simulate-* deleted with their panels and JavaScript.
scripts/debug_route_gate.py fails in both directions and is registered after the
seven were resolved. 18 referenced, 18 dispatched, none orphaned.

Corrections: the dead-field warning in report/types.go said the controller runs no
integrity check and the notifiers are called from nowhere — both false since
v0.227.0. controller.yaml.example gains its missing integrity: block.
integrityCheckTimeout's "ships OFF" comment rewritten.

controller/internal/backup/offbox.go

@@ -1469,6 +1469,12 @@ type OffboxReportStatus struct {
 	// timestamp is the field that says whether the bool means anything at all.
 	LastIntegrityCheck string `json:"last_integrity_check,omitempty"` // RFC3339
 	LastIntegrityOK    bool   `json:"last_integrity_ok,omitempty"`
+	// LastIntegrityDepth (R-399) is how deep that verdict looked — "structure", or the subset that was
+	// re-read ("100%"). THIRD field, same argument as the two above and as StatsKnown: a hub that shows
+	// "checked, OK" without the depth shows the same words for a check that re-read every byte and one
+	// that only read the index, and those are different news. Absent = the box cannot answer (a
+	// controller older than v0.228.0), never "structure".
+	LastIntegrityDepth string `json:"last_integrity_depth,omitempty"`
 }
 
 // OffsiteStateNeedsCredential is the ONE declared state (v0.199.0, R-204 item 4 / R-193): this box
@@ -1662,6 +1668,7 @@ func (m *Manager) OffboxReportStatus() *OffboxReportStatus {
 		StatsKnown:    t.StatsKnown, // R-331 — without it the hub cannot tell "empty" from "unmeasured"
 		LastIntegrityCheck: t.LastIntegrityCheck, // R-359
 		LastIntegrityOK:    t.LastIntegrityOK,
+		LastIntegrityDepth: t.LastIntegrityDepth, // R-399
 		AbandonPurgeRequested: t.AbandonPurgeRequested, // R-241: declared until the hub drops the package
 	}
 }