controller v0.241.0: a bind-data app leans on off-site before its own unit; the hold names what the copy holds (R-479)

Operator ruling 2026-09-13. An app with classified binds walks second
drive -> off-site -> own unit (its unit holds no files); volume apps keep
2 -> 1 -> 3. RestoreHold.CopyHolds records what the chosen copy holds and
the sentence ends with it; older holds keep their tier-only sentence.
Tests on both halves; red-proof: a layout-blind order fails the bind case.

CHANGELOG.md

@@ -1,3 +1,28 @@
+## v0.241.0 — a bind-data app leans on off-site before its own unit, and the hold says what the copy holds (2026-09-13, R-479)
+
+**MinAgent: 0.129.0** (unchanged)
+
+**Operator ruling 2026-09-13 (R-479).** For an app whose data lives in bind-mounted files, the
+recovery unit holds the definition and the database dumps but not the files, so a route back that
+names it restores settings and not data (measured on demo-hp with gokapi: „a beállítások
+visszaálltak … adatot nem"). Two changes:
+
+- **The tier order depends on the data layout.** An app with classified binds (`DataOutsideUnit`)
+  walks second drive → **off-site** → own unit (`updateTierOrderBindData`); an app whose data is in
+  named volumes keeps second drive → own unit → off-site. `UpdateTierOrderFor` is the one place that
+  decides; `UpdateRestorePoints` reads it.
+- **The hold sentence names what the copy holds.** `RestoreHold.CopyHolds`, computed at hold time by
+  `UpdateCopyHolds` from the app's layout and the chosen tier, e.g. *„… ebből a biztonsági mentésből:
+  saját meghajtó, 2026-09-13 17:34 — ez a másolat csak a beállításokat és az adatbázist tartalmazza,
+  a fájlokat nem."* A hold written by v0.239.0–v0.240.0 (tier, no phrase) keeps its sentence
+  (`UpdateHoldTierFmt`).
+
+**TESTS.** `internal/backup/r479_tier_order_test.go` — the order per layout, the CONSEQUENCE (Tier 2
+absent, unit and off-site both fresh: a bind app leans on off-site, a volume app on its unit), the
+phrases, the sentence verbatim, the tier-only sentence for older holds; the adapter wiring test
+demands the phrase travel through `HoldAfterFailedUpdateHolding`. **Red-proof:** making the order
+layout-blind fails the consequence case (felhom.eu `audits/v0241-2026-09-13/`).
+
 ## v0.240.0 — seven defects the any-tier proof and the first nightly rotation found (2026-09-13, R-486 / R-484 / R-485 / R-480 / R-477 / R-478 / R-474)
 
 **MinAgent: 0.129.0** (unchanged)