docs: v0.242.0 report, context; R-489 measured limit recorded (row kept open)

A volume recreated by a unit restore carries no compose label, so the
before/after difference misses it; proven on the scratch guest. Docs only,
no release.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,33 +1,53 @@
-# REPORT — controller v0.241.0: a bind-data app leans on off-site before its own unit (2026-09-13, evening)
+# REPORT — controller v0.242.0: a removed app is listed with its kept backup, and five small ones (2026-09-13 night)
 
 *Overwritten each run. This records the most recent implementation only.*
 
-> **Operator ruling R-479, shipped as v0.241.0 and delivered by the managed floor** (declared MinAgent
-> 0.129.0): demo-hp +16 s, demo-felhom +18 s. Proven live on demo-hp with a nextcloud throwaway on the
-> registered drive. Evidence: `felhom.eu/documentation/audits/v0241-2026-09-13/`.
+> **Nightly session under `.claude/rules/unprompted-work.md`.** Architecture read and named:
+> `felhom.eu/documentation/architecture/07-backup-architecture.md` (§6.3 restore destination, the
+> R-237 store-keyed list rule) and `09-update-architecture.md` (holds). Shipped as **v0.242.0**
+> (`d698ce3`), delivered by the managed floor with the declared MinAgent 0.129.0: demo-hp +16 s,
+> demo-felhom +17 s; hand-set on the scratch guest 9202 (the one place that is allowed). Evidence:
+> `felhom.eu/documentation/audits/v0242-2026-09-14/`.
 
-## What changed (`3e81330`)
+## What changed
 
-- `UpdateTierOrderFor` / `DataOutsideUnit`: an app with classified binds walks 2 → 3 → 1; a volume app
-  keeps 2 → 1 → 3. `UpdateRestorePoints` reads it.
-- `RestoreHold.CopyHolds` + `UpdateCopyHolds`: the hold sentence ends with what the chosen copy holds;
-  the adapter passes it through `HoldAfterFailedUpdateHolding`. Holds from v0.239.0–v0.240.0 keep the
-  tier-only sentence (`UpdateHoldTierFmt`).
+- **R-487 (P2)** — `backup.ListRemovedAppUnits` walks `backups/primary/` on the system path and every
+  connected registered drive and returns the units whose app is not deployed. The Mentések page lists
+  them after the deployed rows („Eltávolítva — visszaállítható", one action: *Visszaállítás a
+  mentésből* = `POST /backup/restore`), the Visszaállítás picker lists them in their own group,
+  `GET /api/backup/snapshots` answers for them, and `RestoreFromRecoveryUnit` opens the unit where it
+  sits (`primaryUnitDirFor`) — a unit kept on a data drive was unreachable before. The claim text is
+  registered with the retrieval-promise gate as conditional on the readable unit.
+- **R-491 (P2)** — `removeStack` clears an UPDATE hold (`Settings.ClearUpdateHold`), never an R-379
+  restore hold. Logged.
+- **R-490** — `/api/system/info` mounted exactly ahead of the web layer's `/api/system/` prefix;
+  `systemInfo` reads the default storage path like every other reader of the empty global. Nil-safe
+  on the syncer. **The global's deletion is R-492.**
+- **R-489** — `volumes_removed` is the before/after difference of the project's volumes, `[]` when
+  none. **Measured limit, row kept open:** the listing filters on the compose project label and a
+  volume recreated by a unit restore (`docker volume create`) carries none — compose removes it, the
+  response says `[]`. A fresh compose volume is reported.
+- **R-476** — `Tier2Coverage.UnitDataDate`: a refreshed leg is dated by its newest dump, a preserved
+  package keeps the manifest date (R-403).
+- **R-456** — the boot-orphan rule pinned by a test; design unchanged.
 
-## Gates, tests, red-proof, live
+## Proof
 
-- `go build ./... && go vet ./... && go test ./...` green; `controller_gates.py --fast` green.
-- `internal/backup/r479_tier_order_test.go`: order per layout, the consequence (Tier 2 absent, unit
-  and off-site both fresh → the bind app leans on off-site), the phrases, the sentence verbatim, the
-  older sentence; the adapter wiring test demands the phrase.
-- Red-proof: a layout-blind order fails the bind case (`rp-v241-R479-order-layout-blind.txt`).
-- Live (`13-R479-live.txt`): nextcloud with `HDD_PATH` on the drive (2 classified binds), Tier 2 off,
-  backup now (unit with db-dump and volume tars), a never-healthy update → held, the sentence names
-  „saját meghajtó, 2026-09-13 21:51 — ez a másolat csak a beállításokat és az adatbázist tartalmazza,
-  a fájlokat nem." The 2→3→1 preference is unit-proven only: a live off-site run would touch the
-  standing apps' leg.
+- Red-proofs (each a compiling mutation that made its test fail, restored byte-identical):
+  `rp-v242-*.txt` — R-487 ×6 (lister inert, picker 404, wrong unit dir, row not built, row not
+  rendered, picker not rendered), R-491, R-490 ×2, R-489, R-476.
+- Full gate green before the build (`go build/vet/test ./...`, `controller_gates.py --fast`).
+- Live on 9202 (endpoint-level, the exact endpoints the UI invokes; no browser on DooPlex): an
+  opengist throwaway — `GET /api/system/info` 200 with the drive figures; a seeded update hold
+  cleared by the removal (log line + store), the app redeployed by the restore without refusal; the
+  removed app's row, badge, form, picker option and snapshot API all present, „Visszaállítás a
+  mentésből" reinstalled it running in 9.1 s; two captures under one definition dated the Tier-2
+  confirm by the second capture's dump (22:58 against a manifest from 22:52). First pass was refused
+  409 (a running app must be stopped first) and repeated; the R-489 cause was then isolated in a
+  third pass (`19-R489-cause.txt`).
 
-## Observations
+## Teardown (three layers)
 
-1. **A removed app keeps its `update_failed` hold in the store; a reinstall under the same name would start held.** FILED: R-491
-2. **The 2→3→1 preference was not exercised live (no off-site run on a box with standing apps).** NOT-A-FINDING: the unit test and red-proof pin it; a live pass belongs to a night whose throwaway has off-site of its own.
+Machine: the opengist throwaway removed with data and backups, no volume and no unit left; the
+scratch guest 9202 persists on purpose with filebrowser + traefik + the controller. Host: nothing
+changed. Hub: floor raised to 0.242.0 (that is the delivery), nothing else touched.