kept data: the choice at reinstall, the list, the read-only view, the load (09 decision 36); R-690 fixed

An install over an app's kept drive folder (appdata/<app> non-empty) asks the household:
"use my kept data" (a load from the newest copy of THIS drive's install, own unit or
second-drive mirror, then the template's after_load) or "start fresh" (the folder is
renamed into <drive>/kept/<app>/<date>/ with the removed app's unit; nothing deleted).
The install API answers 409 kept_data_choice until one is chosen; DeployStack refuses
too. New page Megorzott adatok / Kept data (/kept-data): Load / Look / Delete (typed
confirmation, the only deletion of kept data). FileBrowser gets a read-only source.
The drive-full warning names the kept folders. <drive>/kept is protected and outside
every backup leg.

R-690: the removed-app restore (R-487) never found a unit on a DATA drive — it asked
GetStackComposePath (true for every catalog app) and restored nextcloud with no env.
Now isStackDeployed; pinned with a production-shaped provider.

Red-proofs: audits/night-2026-09-26/E/redproofs/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/api/kept_install.go

@@ -0,0 +1,134 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/appbackup"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
+)
+
+// keptChoiceData is what the install page needs to ask the household (`09` §3 decision 36). The
+// sentences come rendered in the request's language; the page shows them as they are.
+type keptChoiceData struct {
+	Code       string `json:"code"` // "kept_data_choice"
+	Title      string `json:"title"`
+	Body       string `json:"body"`
+	UseLabel   string `json:"use_label"`
+	UseDesc    string `json:"use_desc"`    // "" when use is off
+	UseOff     string `json:"use_off"`     // "" when use is offered
+	UseOffered bool   `json:"use_offered"` // a database copy exists for these files
+	FreshLabel string `json:"fresh_label"`
+	FreshDesc  string `json:"fresh_desc"`
+	NotBacked  string `json:"not_backed_up"`
+}
+
+// keptDataAtInstall answers the install when the app's private drive folder already holds data:
+//
+//   - no choice → 409 kept_data_choice with the sentences (nothing moved, nothing installed);
+//   - "use"     → a LOAD from the newest usable copy (backup.KeptDBCopy), the removed-app restore with
+//     the unit named, then the app's after_load; 202. Refused 409 with use_off when no copy exists;
+//   - "fresh"   → not handled here: DeployStack moves the old data aside and installs.
+//
+// Returns true when it wrote the response.
+func (r *Router) keptDataAtInstall(w http.ResponseWriter, req *http.Request, name, hdd, choice string) bool {
+	old := r.stackMgr.OldAppData(name, hdd)
+	if len(old) == 0 || choice == stacks.KeptChoiceFresh {
+		return false
+	}
+	display := name
+	if st, ok := r.stackMgr.GetStack(name); ok && st.Meta.DisplayName != "" {
+		display = st.Meta.DisplayName
+	}
+	var size int64
+	var newest time.Time
+	for _, p := range old {
+		size += stacks.DirSizeBytes(p)
+		if t := stacks.DirModTime(p); t.After(newest) {
+			newest = t
+		}
+	}
+	var cp struct {
+		ok   bool
+		time time.Time
+		dir  string
+	}
+	if r.backupMgr != nil {
+		if c, ok := r.backupMgr.KeptDBCopy(name, hdd); ok {
+			cp.ok, cp.time, cp.dir = true, c.Time, c.UnitDir
+		}
+	}
+	lang := r.langFor(req)
+	data := keptChoiceData{
+		Code:       "kept_data_choice",
+		Title:      r.msgLang(lang, "kept.choice.title"),
+		Body:       r.msgLang(lang, "kept.choice.body", display, appbackup.HumanizeBytes(size), localDay(newest)),
+		UseLabel:   r.msgLang(lang, "kept.choice.use.label"),
+		UseOffered: cp.ok,
+		FreshLabel: r.msgLang(lang, "kept.choice.fresh.label"),
+		FreshDesc:  r.msgLang(lang, "kept.choice.fresh.desc"),
+		NotBacked:  r.msgLang(lang, "kept.not_backed_up"),
+	}
+	if cp.ok {
+		data.UseDesc = r.msgLang(lang, "kept.choice.use.desc", localDay(cp.time))
+	} else {
+		data.UseOff = r.msgLang(lang, "kept.choice.use_off")
+	}
+
+	switch choice {
+	case "":
+		r.logger.Printf("[INFO] [api] Deploy %s: the drive already holds its old data %v (%d bytes) — asking the household (use offered: %v)", name, old, size, cp.ok)
+		writeJSON(w, http.StatusConflict, apiResponse{OK: false, Error: data.Title, Data: data})
+		return true
+	case stacks.KeptChoiceUse:
+		if !cp.ok {
+			r.logger.Printf("[WARN] [api] Deploy %s: use my kept data REFUSED — no database copy for %s", name, hdd)
+			writeJSON(w, http.StatusConflict, apiResponse{OK: false, Error: data.UseOff, Data: data})
+			return true
+		}
+		if st := r.backupMgr.RestoreStatus(); st.Running || r.backupMgr.IsRunning() {
+			writeJSON(w, http.StatusConflict, apiResponse{OK: false, Error: r.msgLang(lang, "api.kept.busy")})
+			return true
+		}
+		r.logger.Printf("[INFO] [api] Deploy %s: USE MY KEPT DATA — loading from %s (%s) under the kept files %v", name, cp.dir, cp.time.UTC().Format(time.RFC3339), old)
+		r.startKeptLoad(name, cp.dir, lang, nil)
+		writeJSON(w, http.StatusAccepted, apiResponse{OK: true, Message: r.msgLang(lang, "kept.load.started", display)})
+		return true
+	default:
+		writeJSON(w, http.StatusBadRequest, apiResponse{OK: false, Error: fmt.Sprintf("kept_data %q is not a choice", choice)})
+		return true
+	}
+}
+
+// startKeptLoad runs the load and, when it succeeded, the app's after_load. then(ok) runs last.
+func (r *Router) startKeptLoad(name, unitDir, lang string, then func(ok bool)) {
+	display := name
+	if st, ok := r.stackMgr.GetStack(name); ok && st.Meta.DisplayName != "" {
+		display = st.Meta.DisplayName
+	}
+	r.backupMgr.LoadKeptApp(name, unitDir,
+		func(error) string { return r.msgLang(lang, "kept.load.done", display) },
+		func(err error) string { return r.msgLang(lang, "kept.load.failed", display, err) },
+		func(ok bool) {
+			if ok {
+				if ran, err := r.stackMgr.RunAfterLoad(name, 10*time.Minute); ran && err != nil {
+					r.logger.Printf("[WARN] [api] kept load %s: after_load failed: %v", name, err)
+				}
+			}
+			if then != nil {
+				then(ok)
+			}
+		})
+}
+
+func localDay(t time.Time) string {
+	if t.IsZero() {
+		return "?"
+	}
+	loc, err := time.LoadLocation("Europe/Budapest")
+	if err != nil {
+		loc = time.UTC
+	}
+	return t.In(loc).Format("2006-01-02")
+}

controller/internal/api/kept_install_test.go

@@ -0,0 +1,78 @@
+package api
+
+import (
+	"encoding/json"
+	"io"
+	"log"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
+)
+
+// `09` §3 decision 36 — the install API answers an install over old data with the CHOICE (409,
+// code kept_data_choice, both sentences, "use" OFF when no database copy exists) and installs nothing;
+// "use" without a copy is refused; "fresh" is left to DeployStack. Nothing here reaches Docker.
+// COMPANION RED-PROOF: make keptDataAtInstall return false at once → the no-choice case writes nothing
+// and the first assertion fails (the install would go on to DeployStack).
+func TestKept_InstallAPIAsksAndInstallsNothing(t *testing.T) {
+	dir := t.TempDir()
+	drive := filepath.Join(dir, "drive")
+	cfg := &config.Config{}
+	cfg.Paths.StacksDir = filepath.Join(dir, "stacks")
+	cfg.Stacks.ComposeCommand = "docker compose"
+	app := filepath.Join(cfg.Paths.StacksDir, "cloudapp")
+	for _, d := range []string{app, filepath.Join(drive, "appdata/cloudapp")} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	_ = os.WriteFile(filepath.Join(app, "docker-compose.yml"), []byte("services:\n  cloudapp:\n    image: busybox\n    volumes:\n      - ${HDD_PATH}/appdata/cloudapp:/data\n"), 0o644)
+	_ = os.WriteFile(filepath.Join(app, ".felhom.yml"), []byte("display_name: Cloud App\n"), 0o644)
+	_ = os.WriteFile(filepath.Join(drive, "appdata/cloudapp/old.txt"), []byte("old"), 0o644)
+	m, err := stacks.NewManager(cfg, log.New(io.Discard, "", 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := m.ScanStacks(); err != nil {
+		t.Fatal(err)
+	}
+	r := &Router{stackMgr: m, logger: log.New(io.Discard, "", 0)}
+
+	call := func(choice string) (bool, int, map[string]interface{}) {
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodPost, "/api/stacks/cloudapp/deploy?lang=en", nil)
+		handled := r.keptDataAtInstall(w, req, "cloudapp", drive, choice)
+		var body map[string]interface{}
+		_ = json.Unmarshal(w.Body.Bytes(), &body)
+		return handled, w.Code, body
+	}
+	handled, code, body := call("")
+	data, _ := body["data"].(map[string]interface{})
+	if !handled || code != http.StatusConflict || data["code"] != "kept_data_choice" {
+		t.Fatalf("no choice: handled=%v code=%d body=%v", handled, code, body)
+	}
+	if data["title"] != "This app's old data is still here" || data["use_offered"] != false ||
+		data["use_off"] != "There is no backup of the database, so the app cannot load the old files. You can look at the files under Kept data." ||
+		data["fresh_label"] != "Start fresh" || data["not_backed_up"] != "This is not backed up." {
+		t.Fatalf("the choice's sentences: %v", data)
+	}
+	if handled, code, _ := call("use"); !handled || code != http.StatusConflict {
+		t.Fatalf("use with no copy: handled=%v code=%d", handled, code)
+	}
+	if handled, _, _ := call("fresh"); handled {
+		t.Fatal("fresh must be left to DeployStack (which moves the old data aside)")
+	}
+	if st, _ := m.GetStack("cloudapp"); st.Deployed || st.Deploying {
+		t.Fatal("something was installed")
+	}
+	// No old data → the API does not interfere.
+	_ = os.RemoveAll(filepath.Join(drive, "appdata/cloudapp"))
+	if handled, _, _ := call(""); handled {
+		t.Fatal("an install with no old data was intercepted")
+	}
+}

controller/internal/api/router.go

@@ -417,7 +417,7 @@ func (r *Router) getDeployFields(w http.ResponseWriter, req *http.Request, name
 // Pinned by TestR553_Deploy_DecisionSurvivesWordingChange.
 func deployStatusFor(err error) int {
 	switch {
-	case errors.Is(err, stacks.ErrAlreadyDeployed):
+	case errors.Is(err, stacks.ErrAlreadyDeployed), errors.Is(err, stacks.ErrKeptDataChoice):
 		return http.StatusConflict
 	case errors.Is(err, stacks.ErrRequiredField), errors.Is(err, stacks.ErrPathMissing),
 		errors.Is(err, stacks.ErrNotEnoughMemory):
@@ -432,7 +432,8 @@ func (r *Router) deployStack(w http.ResponseWriter, req *http.Request, name stri
 	r.dbg("deployStack: name=%s contentLength=%d", name, req.ContentLength)
 
 	var body struct {
-		Values map[string]string `json:"values"`
+		Values   map[string]string `json:"values"`
+		KeptData string            `json:"kept_data"`
 	}
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
 		writeJSON(w, http.StatusBadRequest, apiResponse{OK: false, Error: "invalid request body"})
@@ -490,9 +491,15 @@ func (r *Router) deployStack(w http.ResponseWriter, req *http.Request, name stri
 		return
 	}
 
+	// `09` §3 decision 36: the app's drive folder already holds its old data → the household chooses.
+	if handled := r.keptDataAtInstall(w, req, name, body.Values["HDD_PATH"], body.KeptData); handled {
+		return
+	}
+
 	deployReq := stacks.DeployRequest{
 		StackName: name,
 		Values:    body.Values,
+		KeptData:  body.KeptData,
 	}
 
 	warning, err := r.stackMgr.DeployStack(deployReq)

controller/internal/backup/kept_load.go

@@ -0,0 +1,143 @@
+package backup
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"gopkg.in/yaml.v3"
+)
+
+// ── Kept data: which copy can bring it back, and the load (`09` §3 decision 36) ───────────────────
+//
+// „Use my kept data" (at install) and „Load" (on the kept-data list) are the SAME act: the app's
+// recovery unit (definition + database + volumes) is restored — through RestoreFromRecoveryUnitAt, the
+// one body every unit restore uses (R-102) — while its files stay where they are on the drive. It is the
+// removed-app restore (R-487) with the unit named explicitly.
+//
+// WHICH COPY. The newest unit that (1) opens (a readable manifest), (2) holds the app's data state (a
+// database dump or a volume tar — a definition alone would install an empty app over the kept files), and
+// (3) was taken of THIS drive's install: its app.yaml's HDD_PATH names this drive. Looked for in the
+// app's own unit on the drive (Tier 1, R-487) and in every connected second-drive mirror (Tier 2). The
+// off-site copy is NOT looked at here: its restore is a different operation (reconstitute) and it is
+// not built into this choice yet — said on the page as "none" when it is the only one.
+
+// KeptCopy is one database copy a kept folder can be loaded from.
+type KeptCopy struct {
+	UnitDir    string
+	Tier       int // 1 own unit, 2 second drive
+	Time       time.Time
+	DriveLabel string
+}
+
+// unitHoldsData: a readable manifest that lists a database dump or a volume tar.
+func unitHoldsData(unitDir string) (*RecoveryManifest, bool) {
+	man := readManifest(UnitManifestFile(unitDir))
+	if man == nil {
+		return nil, false
+	}
+	return man, len(man.DBDumps)+len(man.VolumeDumps) > 0
+}
+
+// unitHDDPath reads the unit's own app.yaml env HDD_PATH (a plain, non-secret field). "" when absent.
+func unitHDDPath(unitDir string) string {
+	b, err := os.ReadFile(filepath.Join(unitDir, "compose", "app.yaml"))
+	if err != nil {
+		return ""
+	}
+	var doc struct {
+		Env map[string]string `yaml:"env"`
+	}
+	if yaml.Unmarshal(b, &doc) != nil {
+		return ""
+	}
+	return strings.TrimSpace(doc.Env["HDD_PATH"])
+}
+
+// KeptCopyAt judges one unit directory for drive: usable, and when it was taken.
+func (m *Manager) KeptCopyAt(unitDir, drive string, tier int) (KeptCopy, bool) {
+	if _, ok := unitHoldsData(unitDir); !ok {
+		return KeptCopy{}, false
+	}
+	if h := unitHDDPath(unitDir); h != "" && filepath.Clean(h) != filepath.Clean(drive) {
+		m.logger.Printf("[INFO] [backup] kept: unit %s was taken of %s, not %s — not offered", unitDir, h, drive)
+		return KeptCopy{}, false
+	}
+	t, ok := unitNewestArtifact(unitDir)
+	if !ok {
+		return KeptCopy{}, false
+	}
+	return KeptCopy{UnitDir: unitDir, Tier: tier, Time: t}, true
+}
+
+// KeptDBCopy returns the NEWEST usable copy of app's data for kept files on drive: the app's own unit
+// (Tier 1) and every connected second-drive mirror (Tier 2). Only for an app that is NOT installed — an
+// installed app's unit is its live backup, never a kept-data offer.
+func (m *Manager) KeptDBCopy(app, drive string) (KeptCopy, bool) {
+	if app == "" || m.isStackDeployed(app) {
+		return KeptCopy{}, false
+	}
+	var best KeptCopy
+	found := false
+	consider := func(c KeptCopy, ok bool) {
+		if ok && (!found || c.Time.After(best.Time)) {
+			best, found = c, true
+		}
+	}
+	if u, ok := m.RemovedAppUnitFor(app); ok {
+		c, ok := m.KeptCopyAt(u.UnitDir, drive, 1)
+		c.DriveLabel = u.DriveLabel
+		consider(c, ok)
+	}
+	for _, d := range m.Tier2MirrorDirsForApp(app) {
+		consider(m.KeptCopyAt(tier2UnitDir(d), drive, 2))
+	}
+	return best, found
+}
+
+// RemovedUnitOnDrive is the start-fresh hook (stacks.SetKeptUnitFinder): the removed app's OWN unit when
+// it sits on drive, so it moves into the kept folder with the files it belongs to. "" otherwise.
+func (m *Manager) RemovedUnitOnDrive(app, drive string) string {
+	if m.isStackDeployed(app) {
+		return ""
+	}
+	u, ok := m.RemovedAppUnitFor(app)
+	if !ok {
+		return ""
+	}
+	if !strings.HasPrefix(filepath.Clean(u.UnitDir), filepath.Clean(drive)+string(filepath.Separator)) {
+		return ""
+	}
+	return u.UnitDir
+}
+
+// PrimaryUnitHome is where app's own unit lives on drive (backups/primary/<app>).
+func (m *Manager) PrimaryUnitHome(app, drive string) string {
+	return RecoveryUnitPath(m.namespaceRoot(drive), app)
+}
+
+// LoadKeptApp runs the load as a restore operation the backup pages already follow (the poll banner):
+// Begin → RestoreFromRecoveryUnitAt(app, unitDir) → End, then after(ok) in the same goroutine (the
+// after_load command, the kept folder's tidy-up). The caller has checked RestoreStatus/IsRunning.
+func (m *Manager) LoadKeptApp(app, unitDir string, okMsg, failMsg func(err error) string, after func(ok bool)) {
+	m.BeginRestoreOp("restore", app)
+	go func() {
+		start := time.Now()
+		res, err := m.RestoreFromRecoveryUnitAt(app, unitDir)
+		if err != nil {
+			m.logger.Printf("[ERROR] [backup] kept load %s from %s FAILED after %s: %v", app, unitDir, time.Since(start).Round(time.Second), err)
+			m.EndRestoreOp(false, failMsg(err))
+			if after != nil {
+				after(false)
+			}
+			return
+		}
+		m.logger.Printf("[INFO] [backup] kept load %s from %s done in %s (volumes %d/%d, dbs %d/%d)", app, unitDir,
+			time.Since(start).Round(time.Second), res.VolumesReplayed, res.ManifestVolumes, res.DBsReplayed, res.ManifestDBs)
+		m.EndRestoreOp(true, okMsg(nil))
+		if after != nil {
+			after(true)
+		}
+	}()
+}

controller/internal/backup/kept_load_test.go

@@ -0,0 +1,65 @@
+package backup
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func writeKeptUnit(t *testing.T, unitDir, hdd string, withData bool, at time.Time) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Join(unitDir, "compose"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	man := RecoveryManifest{SchemaVersion: 2, AppName: "nextcloud"}
+	if withData {
+		man.DBDumps = []string{"nextcloud-mariadb.sql"}
+	}
+	b, _ := json.Marshal(man)
+	if err := os.WriteFile(UnitManifestFile(unitDir), b, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	_ = os.Chtimes(UnitManifestFile(unitDir), at, at)
+	if hdd != "" {
+		if err := os.WriteFile(filepath.Join(unitDir, "compose", "app.yaml"), []byte("env:\n  HDD_PATH: "+hdd+"\n"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// `09` §3 decision 36 — „use my kept data" loads only a copy that (1) holds the app's data and (2) was
+// taken of THIS drive's install; the newest such copy on any local tier wins.
+// COMPANION RED-PROOF: drop the HDD_PATH comparison in KeptCopyAt → a unit taken of ANOTHER drive is
+// offered and the first assertion fails.
+func TestKept_DBCopyIsTheNewestUsableForThisDrive(t *testing.T) {
+	m, sett, drive := r690Manager(t)
+	_ = sett
+	unit := RecoveryUnitPath(m.namespaceRoot(drive), "nextcloud")
+
+	writeKeptUnit(t, unit, "/mnt/felhom-drives/other", true, time.Now().Add(-time.Hour))
+	if c, ok := m.KeptDBCopy("nextcloud", drive); ok {
+		t.Fatalf("a unit taken of another drive was offered: %+v", c)
+	}
+	writeKeptUnit(t, unit, drive, false, time.Now().Add(-time.Hour))
+	if c, ok := m.KeptDBCopy("nextcloud", drive); ok {
+		t.Fatalf("a unit holding no data was offered: %+v", c)
+	}
+	writeKeptUnit(t, unit, drive, true, time.Now().Add(-time.Hour))
+	c, ok := m.KeptDBCopy("nextcloud", drive)
+	if !ok || c.UnitDir != unit || c.Tier != 1 {
+		t.Fatalf("own unit not offered: %+v ok=%v", c, ok)
+	}
+	// An INSTALLED app's unit is its live backup, never a kept-data offer.
+	if c, ok := m.KeptDBCopy("still-here", drive); ok {
+		t.Fatalf("an installed app's unit was offered: %+v", c)
+	}
+	// The start-fresh hook names the unit only on the same drive.
+	if got := m.RemovedUnitOnDrive("nextcloud", drive); got != unit {
+		t.Fatalf("RemovedUnitOnDrive = %q, want %q", got, unit)
+	}
+	if got := m.RemovedUnitOnDrive("nextcloud", "/elsewhere"); got != "" {
+		t.Fatalf("RemovedUnitOnDrive named a unit on another drive: %q", got)
+	}
+}

controller/internal/backup/r690_removed_unit_test.go

@@ -0,0 +1,62 @@
+package backup
+
+import (
+	"log"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
+)
+
+// r690Provider answers GetStackComposePath the way PRODUCTION does (main.go stackAdapter): ok for
+// every stack the box knows — deployed or not, because every catalog template is a stack — while
+// ListDeployedStacks names only the deployed ones. The R-487 fake answered it for deployed apps
+// only, which is why its test passed while the box restored nextcloud with no env (R-690).
+type r690Provider struct{ floorProvider }
+
+func (p *r690Provider) GetStackComposePath(name string) (string, bool) {
+	return filepath.Join(p.dir, "stacks", name, "docker-compose.yml"), true
+}
+
+func r690Manager(t *testing.T) (*Manager, *settings.Settings, string) {
+	t.Helper()
+	sett, err := settings.Load(filepath.Join(t.TempDir(), "settings.json"), log.New(os.Stderr, "", 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	sys := t.TempDir()
+	cfg := &config.Config{}
+	cfg.Paths.SystemDataPath = sys
+	m := NewManager(cfg, sett, log.New(os.Stderr, "", 0))
+	m.SetStackProvider(&r690Provider{floorProvider{stacks: []string{"still-here"}, dir: t.TempDir()}})
+	drive := t.TempDir()
+	if err := sett.AddStoragePath(settings.StoragePath{Path: drive, Label: "HDD", Schedulable: true}); err != nil {
+		t.Fatal(err)
+	}
+	return m, sett, drive
+}
+
+// The consequence, not the mechanism: the unit the restore OPENS and the copy the picker OFFERS are
+// the removed app's unit on the data drive, while its catalog stack still exists.
+// COMPANION RED-PROOF: put GetStackComposePath back as the "removed?" test in primaryUnitDirFor →
+// this fails naming the system-drive path; in ListRestorePoints → the picker offers 0 copies.
+func TestR690_RemovedUnitFoundWhenTheStackStillExists(t *testing.T) {
+	m, _, drive := r690Manager(t)
+	want := writeR487Unit(t, m.namespaceRoot(drive), "nextcloud", "Nextcloud", time.Now())
+
+	if got := m.primaryUnitDirFor("nextcloud"); got != want {
+		t.Fatalf("the restore opens %s, want the kept unit %s on the data drive", got, want)
+	}
+	pts, found := m.ListRestorePoints("nextcloud")
+	if !found || len(pts) != 1 || pts[0].DriveLabel != "HDD" {
+		t.Fatalf("the picker offers %+v (found=%v), want the one kept copy on HDD", pts, found)
+	}
+	// Negative control: a DEPLOYED app is never redirected to a removed-app unit.
+	writeR487Unit(t, m.namespaceRoot(drive), "still-here", "Still", time.Now())
+	if got := m.primaryUnitDirFor("still-here"); got == RecoveryUnitPath(m.namespaceRoot(drive), "still-here") {
+		t.Fatalf("a deployed app was sent to the removed-app unit %s", got)
+	}
+}

controller/internal/backup/restore_points.go

@@ -38,14 +38,18 @@ func (m *Manager) ListRestorePoints(stackName string) (points []RestorePoint, fo
 	if m.stackProvider == nil {
 		return nil, false
 	}
-	if _, ok := m.stackProvider.GetStackComposePath(stackName); !ok {
-		// R-487: a removed app whose backups were kept is not deployed, but its unit is on a drive
-		// and POST /backup/restore reinstalls from it. The picker used to be told 404 here while the
-		// restore itself worked — the list is keyed on the drive now, the way R-237 keyed the
-		// off-site list on the store.
+	// R-487: a removed app whose backups were kept is not deployed, but its unit is on a drive
+	// and POST /backup/restore reinstalls from it. The picker used to be told 404 here while the
+	// restore itself worked — the list is keyed on the drive now, the way R-237 keyed the
+	// off-site list on the store.
+	// R-690: "removed" is isStackDeployed, not GetStackComposePath — the latter is true for every
+	// catalog app on a box, so the picker offered 0 copies for a removed app on a data drive.
+	if !m.isStackDeployed(stackName) {
 		if u, found := m.RemovedAppUnitFor(stackName); found {
 			return []RestorePoint{{Time: u.Time, ShortID: restorePointShortID, Tier: 1, DriveLabel: u.DriveLabel}}, true
 		}
+	}
+	if _, ok := m.stackProvider.GetStackComposePath(stackName); !ok {
 		return nil, false
 	}
 

controller/internal/backup/restore_unit.go

@@ -192,12 +192,16 @@ func (m *Manager) RestoreFromRecoveryUnit(stackName string) (UnitRestoreResult,
 // backups/primary/<stack> on its own drive. For a REMOVED app (R-487) the drive is no longer known
 // — GetAppDrivePath falls back to the system path — so a unit kept on a data drive was unreachable
 // and the restore silently took the volume-only fallback. It is now found where it sits.
+//
+// R-690 (2026-09-25): "removed" is asked with isStackDeployed — the removed-app list's OWN predicate.
+// It used to be GetStackComposePath's ok, which in production is true for EVERY catalog app (every
+// template is a stack), so this branch never ran on a box: nextcloud's unit on a data drive was
+// missed, the restore took the volume-only fallback, and the app came back with no env and no
+// database. Pinned by TestR690_RemovedUnitFoundWhenTheStackStillExists (production-shaped provider).
 func (m *Manager) primaryUnitDirFor(stackName string) string {
-	if m.stackProvider != nil {
-		if _, deployed := m.stackProvider.GetStackComposePath(stackName); !deployed {
-			if u, found := m.RemovedAppUnitFor(stackName); found {
-				return u.UnitDir
-			}
+	if m.stackProvider != nil && !m.isStackDeployed(stackName) {
+		if u, found := m.RemovedAppUnitFor(stackName); found {
+			return u.UnitDir
 		}
 	}
 	return RecoveryUnitPath(m.namespaceRoot(m.GetAppDrivePath(stackName)), stackName)

controller/internal/fillwatch/fillwatch.go

@@ -142,6 +142,9 @@ type Watcher struct {
 	usage func(path string) *Usage
 	// notify pushes the customer event. Nil-safe.
 	notify func(Event)
+	// extra appends a sentence to the warning for one target — the kept folders on it the household
+	// can delete (`09` §3 decision 36). Nil-safe; "" appends nothing.
+	extra func(Target) string
 
 	mu    sync.Mutex
 	bands map[string]Band
@@ -164,6 +167,9 @@ func New(statePath string, logger *log.Logger, targets func() []Target, usage fu
 // SetNotify wires the customer event push. INIT-ONLY — call once at startup.
 func (w *Watcher) SetNotify(fn func(Event)) { w.notify = fn }
 
+// SetExtra wires the kept-data sentence (main.go). INIT-ONLY.
+func (w *Watcher) SetExtra(fn func(Target) string) { w.extra = fn }
+
 // classify decides the band from a reading AND the previous band, which is what makes the hysteresis
 // work: between the clear and warn thresholds the previous band is HELD rather than recomputed.
 //
@@ -231,6 +237,11 @@ func (w *Watcher) Check() error {
 		}
 
 		msg := Message(t, *u, next)
+		if w.extra != nil {
+			if x := w.extra(t); x != "" {
+				msg += " " + x
+			}
+		}
 		w.logger.Printf("[WARN] [fillwatch] %s (%q): %s → %s — %.0f%% used, %.1f GB free of %.1f GB; notifying the customer",
 			t.Path, t.Label, prev, next, u.UsedPercent, u.AvailGB, u.TotalGB)
 		emitted++

controller/internal/fillwatch/kept_extra_test.go

@@ -0,0 +1,30 @@
+package fillwatch
+
+import (
+	"io"
+	"log"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// `09` §3 decision 36 — the drive-full warning names the kept folders on that drive (and only there).
+func TestFillwatch_ExtraSentenceRidesTheWarning(t *testing.T) {
+	var got []Event
+	w := New(filepath.Join(t.TempDir(), "s.json"), log.New(io.Discard, "", 0),
+		func() []Target { return []Target{{Path: "/mnt/d", Label: "HDD"}} },
+		func(string) *Usage { return &Usage{UsedPercent: 97, AvailGB: 3, UsedGB: 97, TotalGB: 100} })
+	w.SetNotify(func(e Event) { got = append(got, e) })
+	w.SetExtra(func(tg Target) string {
+		if tg.Path == "/mnt/d" {
+			return "KEPT: Nextcloud (126.0 MB)."
+		}
+		return ""
+	})
+	if err := w.Check(); err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 || !strings.HasSuffix(got[0].Message, " KEPT: Nextcloud (126.0 MB).") {
+		t.Fatalf("events = %+v", got)
+	}
+}

controller/internal/i18n/locales/en.json

@@ -2417,5 +2417,42 @@
   "backup.tier.no_space_unknown": "The full system backup does not fit on the disk. Keeping fewer old backups, or a bigger disk, fixes it.",
   "update.phase.converting": "Converting the database",
   "err.stacks.update_convert_space": "Converting the database of %s needs %s of free space, and only %s is free. Nothing changed.",
-  "err.stacks.update_engine_no_test": "This step would move the main version of the database of %s, but it has no test. Nothing changed."
+  "err.stacks.update_engine_no_test": "This step would move the main version of the database of %s, but it has no test. Nothing changed.",
+  "kept.choice.title": "This app's old data is still here",
+  "kept.choice.body": "The old data of %s (%s, from %s) is still on the drive. What should happen to it?",
+  "kept.choice.use.label": "Use my kept data",
+  "kept.choice.use.desc": "We load the database from the backup of %s and start the app with the old files. Changes made after that time can be missing.",
+  "kept.choice.use_off": "There is no backup of the database, so the app cannot load the old files. You can look at the files under Kept data.",
+  "kept.choice.fresh.label": "Start fresh",
+  "kept.choice.fresh.desc": "The old data moves to a folder marked with today's date. Nothing is deleted.",
+  "kept.not_backed_up": "This is not backed up.",
+  "kept.delete.confirm": "The kept data of %s (%s) is deleted for good. This cannot be undone.",
+  "kept.delete.type": "To delete it, type: %s",
+  "kept.delete.mismatch": "The name you typed does not match (%s), so nothing was deleted.",
+  "kept.deleted": "The kept data of %s is deleted.",
+  "kept.page.title": "Kept data",
+  "kept.page.back": "Back",
+  "kept.page.intro": "Data that removed apps left on the drives. You can look at it, load it into a new install, or delete it. The server never deletes any of it by itself.",
+  "kept.page.link_hint": "Data that removed apps left on the drives",
+  "kept.list.backup": "Can be loaded from:",
+  "kept.list.installed": "The app is installed again.",
+  "kept.list.empty": "There is no kept data.",
+  "kept.backup.own": "its own backup, %s",
+  "kept.backup.second": "the second drive, %s",
+  "kept.backup.with": "the backup kept with it, %s",
+  "kept.backup.none": "no backup — the files only",
+  "kept.action.load": "Load",
+  "kept.action.look": "Look",
+  "kept.action.delete": "Delete",
+  "kept.action.delete_final": "Delete for good",
+  "kept.load.started": "Loading the kept data of %s has started.",
+  "kept.load.done": "%s runs with its kept data.",
+  "kept.load.failed": "Loading %s did not work: %v. The kept files stayed where they are.",
+  "kept.load.installed": "%s is installed already, so this cannot be loaded now.",
+  "kept.fb_source": "Kept data",
+  "kept.diskwarn": "Kept data on this storage that you can delete on the Kept data page: %s.",
+  "err.kept.not_listed": "This is not kept data, so nothing was touched.",
+  "err.kept.occupied": "The app's folder already holds data, so the kept files were not put back. Nothing changed.",
+  "api.kept.busy": "A backup or a restore is running now. Try again when it has finished.",
+  "page.title.kept_data": "Kept data"
 }

controller/internal/i18n/locales/hu.json

@@ -2405,5 +2405,42 @@
   "backup.tier.no_space_unknown": "A teljes rendszermentés nem fér el a lemezen. Kevesebb régi mentés megtartása vagy nagyobb lemez segít.",
   "update.phase.converting": "Adatbázis átalakítása",
   "err.stacks.update_convert_space": "A(z) %s adatbázisának átalakításához %s szabad hely kell, de csak %s van. Nem változott semmi.",
-  "err.stacks.update_engine_no_test": "Ez a lépés a(z) %s adatbázisának fő verzióját váltaná, de nincs róla próba. Nem változott semmi."
+  "err.stacks.update_engine_no_test": "Ez a lépés a(z) %s adatbázisának fő verzióját váltaná, de nincs róla próba. Nem változott semmi.",
+  "kept.choice.title": "Ennek az alkalmazásnak megvannak a régi adatai",
+  "kept.choice.body": "A(z) %s korábbi adatai (%s, %s) még a lemezen vannak. Mit csináljunk velük?",
+  "kept.choice.use.label": "A megőrzött adataimat használom",
+  "kept.choice.use.desc": "Az adatbázist a %s-i mentésből töltjük vissza, és a régi fájlokkal indítjuk az alkalmazást. Ami ezután változott, hiányozhat.",
+  "kept.choice.use_off": "Az adatbázisról nincs mentés, ezért az alkalmazás nem tudja betölteni a régi fájlokat. A fájlokat megnézheted a Megőrzött adatok között.",
+  "kept.choice.fresh.label": "Tiszta lappal kezdem",
+  "kept.choice.fresh.desc": "A régi adatok egy mai dátummal jelölt mappába kerülnek. Nem törlünk semmit.",
+  "kept.not_backed_up": "Erről nem készül mentés.",
+  "kept.delete.confirm": "A(z) %s megőrzött adatai (%s) véglegesen törlődnek. Ezt nem lehet visszacsinálni.",
+  "kept.delete.type": "A törléshez írd be: %s",
+  "kept.delete.mismatch": "A beírt név nem egyezik (%s), ezért nem töröltünk semmit.",
+  "kept.deleted": "A(z) %s megőrzött adatai törölve.",
+  "kept.page.title": "Megőrzött adatok",
+  "kept.page.back": "Vissza",
+  "kept.page.intro": "Az eltávolított alkalmazások lemezen maradt adatai. Megnézheted őket, betöltheted egy új telepítésbe, vagy törölheted. Magától a szerver soha nem töröl közülük semmit.",
+  "kept.page.link_hint": "Eltávolított alkalmazások lemezen maradt adatai",
+  "kept.list.backup": "Visszatölthető innen:",
+  "kept.list.installed": "Az alkalmazás újra telepítve van.",
+  "kept.list.empty": "Nincs megőrzött adat.",
+  "kept.backup.own": "saját mentés, %s",
+  "kept.backup.second": "második meghajtó, %s",
+  "kept.backup.with": "a vele megőrzött mentés, %s",
+  "kept.backup.none": "nincs mentés — csak a fájlok",
+  "kept.action.load": "Betöltés",
+  "kept.action.look": "Megnézem",
+  "kept.action.delete": "Törlés",
+  "kept.action.delete_final": "Végleges törlés",
+  "kept.load.started": "A(z) %s megőrzött adatainak betöltése elindult.",
+  "kept.load.done": "A(z) %s a megőrzött adataival fut.",
+  "kept.load.failed": "A(z) %s betöltése nem sikerült: %v. A megőrzött fájlok a helyükön maradtak.",
+  "kept.load.installed": "A(z) %s már telepítve van, ezért ez nem tölthető be most.",
+  "kept.fb_source": "Megőrzött adatok",
+  "kept.diskwarn": "Megőrzött adatok ezen a tárolón, amelyeket te törölhetsz a Megőrzött adatok oldalon: %s.",
+  "err.kept.not_listed": "Ez nem megőrzött adat, ezért nem nyúltunk hozzá.",
+  "err.kept.occupied": "Az alkalmazás mappájában már vannak adatok, ezért a megőrzött fájlokat nem tettük vissza. Nem változott semmi.",
+  "api.kept.busy": "Most egy mentés vagy visszaállítás fut. Ha befejeződött, próbáld újra.",
+  "page.title.kept_data": "Megőrzött adatok"
 }

controller/internal/infra/infra.go

@@ -34,6 +34,9 @@ const (
 	// template is /files/{encodeURIComponent(name)}/... (SPIKE P2). Accents round-trip correctly —
 	// the spike verified an accented, spaced and ampersand'd source name end to end.
 	FileBrowserImportLabel = "Beolvasás"
+	// FileBrowserKeptMount is the in-container folder NAME of the read-only „Megőrzött adatok" source
+	// (`09` §3 decision 36): each kept item is its own `:ro` bind under /srv/<this>/.
+	FileBrowserKeptMount = "megorzott"
 	// SambaImage is our own pinned LAN-sharing image (R-7 slice 1). Built by
 	// controller/scripts/build-samba-image.sh from controller/infra-images/samba/. NEVER :latest.
 	SambaImage = "gitea.dooplex.hu/admin/felhom-samba:1.1.0"
@@ -266,6 +269,12 @@ http:
 // storage path (each a named sidebar entry). Empty paths → a single default /srv source. Ported
 // verbatim from internal/web/handlers.go.
 func RenderFileBrowserConfig(paths []settings.StoragePath, importSource bool) string {
+	return RenderFileBrowserConfigKept(paths, importSource, "")
+}
+
+// RenderFileBrowserConfigKept is RenderFileBrowserConfig plus the read-only kept-data source, LAST,
+// named keptLabel ("" = no such source: nothing is kept, or the caller predates it).
+func RenderFileBrowserConfigKept(paths []settings.StoragePath, importSource bool, keptLabel string) string {
 	var sources string
 	// The canonical drop-zone (R-75) is FIRST and is NOT a registered storage path — it is a separate
 	// bind of <system namespace>/userdata/import. Separate rather than nested inside a drive source:
@@ -289,6 +298,10 @@ func RenderFileBrowserConfig(paths []settings.StoragePath, importSource bool) st
 		}
 	}
 
+	if keptLabel != "" {
+		sources += fmt.Sprintf("    - path: %q\n      name: %q\n      config:\n        defaultEnabled: true\n",
+			"/srv/"+FileBrowserKeptMount, keptLabel)
+	}
 	return fmt.Sprintf(`# FileBrowser Quantum — managed by felhom-controller
 # WARNING: This file is auto-generated. Manual edits will be overwritten.
 

controller/internal/infra/kept_source_test.go

@@ -0,0 +1,17 @@
+package infra
+
+import (
+	"strings"
+	"testing"
+)
+
+// `09` §3 decision 36 — the kept-data source appears only when named, at /srv/megorzott.
+func TestFileBrowser_KeptSourceOnlyWhenNamed(t *testing.T) {
+	if s := RenderFileBrowserConfigKept(nil, false, ""); strings.Contains(s, FileBrowserKeptMount) {
+		t.Fatal("a kept source rendered with no label")
+	}
+	s := RenderFileBrowserConfigKept(nil, false, "Megőrzött adatok")
+	if !strings.Contains(s, `path: "/srv/`+FileBrowserKeptMount+`"`) || !strings.Contains(s, `name: "Megőrzött adatok"`) {
+		t.Fatalf("kept source missing:\n%s", s)
+	}
+}

controller/internal/stacks/delete.go

@@ -209,6 +209,9 @@ func ProtectedHDDPaths(hddPath string) map[string]bool {
 		filepath.Join(hddPath, "backups"):      true,
 		filepath.Join(hddPath, "media"):        true,
 		filepath.Join(hddPath, "Dokumentumok"): true,
+		// `09` §3 decision 36: the dated kept folders. Never removed by an app's removal — only the
+		// household's Delete on the kept-data list removes one (kept.go rule 4).
+		filepath.Join(hddPath, KeptDirName): true,
 		// Legacy pre-Model-A double-nest location; kept protected so any leftover data there is
 		// never wiped by a removal.
 		filepath.Join(hddPath, felhomDataDir):            true,

controller/internal/stacks/deploy.go

@@ -191,8 +191,18 @@ type InstalledImage struct {
 type DeployRequest struct {
 	StackName string            `json:"stack_name"`
 	Values    map[string]string `json:"values"` // env_var -> user-provided value
+	// KeptData is the household's answer when the app's drive folder already holds old data
+	// (`09` §3 decision 36): KeptChoiceFresh here; KeptChoiceUse is carried out by the API as a load
+	// from a backup and never reaches DeployStack. "" = no choice was made — refused when old data exists.
+	KeptData string `json:"kept_data,omitempty"`
 }
 
+// Kept-data choices at install (`09` §3 decision 36).
+const (
+	KeptChoiceUse   = "use"
+	KeptChoiceFresh = "fresh"
+)
+
 // DeployStack handles first-time deployment of an app.
 // Returns a warning message (empty if none) and an error if deployment is blocked.
 // 1. Check available memory against app requirements
@@ -358,6 +368,34 @@ func (m *Manager) DeployStack(req DeployRequest) (string, error) {
 		}
 	}
 
+	// `09` §3 decision 36 (R-657): an install NEVER runs into an app's old data silently. When the app's
+	// private drive folder already holds something, the household chooses: „start fresh" moves it into a
+	// dated kept folder (a rename on the same drive — nothing is deleted); „use my kept data" is a load
+	// from a backup, which the API performs instead of an install. No choice → refused, nothing moved.
+	// Pinned by TestKept_DeployRefusesOverOldDataWithoutAChoice.
+	if old := OldAppDataPaths(stack.ComposePath, env["HDD_PATH"]); len(old) > 0 {
+		switch req.KeptData {
+		case KeptChoiceFresh:
+			unit := ""
+			if m.keptUnitFn != nil {
+				unit = m.keptUnitFn(req.StackName, env["HDD_PATH"])
+			}
+			kept, err := m.KeepAside(req.StackName, env["HDD_PATH"], old, unit, time.Now())
+			if err != nil {
+				clearDeploying()
+				return "", fmt.Errorf("start fresh: %w", err)
+			}
+			m.logger.Printf("[INFO] [stacks] Deploy %s: start fresh — the old data (%v) is kept in %s", req.StackName, old, kept)
+		case "":
+			clearDeploying()
+			m.logger.Printf("[WARN] [stacks] Deploy %s REFUSED: the drive already holds its old data %v and no choice was made", req.StackName, old)
+			return "", util.KindErrorf(ErrKeptDataChoice, "the drive already holds %s's old data (%s): choose use or fresh", req.StackName, strings.Join(old, ", "))
+		default:
+			clearDeploying()
+			return "", util.KindErrorf(ErrKeptDataChoice, "kept_data %q is not an install choice here (use is a load from a backup)", req.KeptData)
+		}
+	}
+
 	// Save app.yaml.
 	// CTRL-T2-1: persist the env now, but mark the ON-DISK state Deployed:false
 	// until `docker compose up -d` actually succeeds (done in runComposeDeploy).

controller/internal/stacks/deploy_errors.go

@@ -22,6 +22,9 @@ var (
 	ErrPathMissing = errors.New("path field does not exist")
 	// ErrNotEnoughMemory — the memory verdict refused the deploy (API: 400).
 	ErrNotEnoughMemory = errors.New("not enough memory")
+	// ErrKeptDataChoice — the app's drive folder already holds old data and the install named neither
+	// „use my kept data" nor „start fresh" (`09` §3 decision 36; API: 409 with code kept_data_choice).
+	ErrKeptDataChoice = errors.New("kept data: a choice is needed")
 	// ErrStackDeploying — R-634 (v0.265.0): a stop or start was asked of a stack whose deploy is still
 	// running. Refused, because a `compose down` or a second `compose up -d` in the middle of the
 	// deploy's own `up` makes BOTH fail, and the deploy then records „not deployed" over whatever

controller/internal/stacks/kept.go

@@ -0,0 +1,557 @@
+package stacks
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"syscall"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/util"
+)
+
+// ── Kept data (`09` §3 decision 36, operator ruling 2026-09-25 evening) ────────────────────────────
+//
+// WHAT IT REPLACES. „Remove the app, keep my data" left the app's private drive folder
+// (`<drive>/appdata/<app>`) behind, and a later install of the same app ran straight into it (R-657):
+// measured 2026-09-23 as an install loop, and 2026-09-25 as a clean install whose database simply knows
+// nothing of the old files. Nothing listed the folder, nothing opened it, nothing deleted it.
+//
+// THE RULING. A reinstall over kept data asks: "use my kept data" (the database from a backup, with the
+// kept files) or "start fresh" (the kept files MOVE to a dated folder; nothing is deleted). And kept data
+// is never a dead end: the household can see it (read only), load it later, and delete it.
+//
+// FOUR RULES, each a guard with a test:
+//
+//  1. ONLY `<drive>/appdata/<…>` IS "OLD DATA". An app's bind under userdata/ or media/ is the household's
+//     own shared files (a music library, a photo folder) — never moved, never listed here. Pinned by
+//     TestKept_OnlyAppdataBindsAreOldData.
+//  2. "START FRESH" IS A RENAME ON THE SAME DRIVE — never a copy, never across drives. A rename that
+//     fails with EXDEV (or anything else) puts back what it already moved and refuses. Pinned by
+//     TestKept_KeepAsideIsARenameAndRollsBack.
+//  3. THE KEPT FOLDER IS `<drive>/kept/<app>/<date>/` — beside appdata/ and userdata/, inside neither:
+//     no app bind reaches it, FileBrowser and Samba serve only userdata/, and no backup leg reads it (the
+//     Tier-2 and off-site legs read userdata/ and the declared binds of DEPLOYED apps). It is in
+//     ProtectedHDDPaths. The page says it is not backed up.
+//  4. THE BOX NEVER DELETES KEPT DATA BY ITSELF (D3 is open). DeleteKept is reachable only from the
+//     household's typed confirmation, and refuses any path that is not a listed kept item. Pinned by
+//     TestKept_DeleteRefusesAnythingNotListed.
+
+// KeptDirName is the folder at a drive's namespace root that holds the dated kept folders.
+const KeptDirName = "kept"
+
+// keptMarkerFile is written LAST into a dated kept folder: what was moved, from where, and when.
+const keptMarkerFile = ".felhom-kept.json"
+
+// keptUnitDir is where a start-fresh moves the removed app's recovery unit, so the kept files keep the
+// database copy that belongs to them (the next backup of the fresh install would overwrite it in place).
+const keptUnitDir = "unit"
+
+// Kept item kinds.
+const (
+	KeptKindDated    = "dated"    // a start-fresh folder under <drive>/kept/<app>/<date>
+	KeptKindLeftover = "leftover" // <drive>/appdata/<x> that no installed app binds (a plain keep-data remove)
+)
+
+// KeptMarker is the record inside a dated kept folder.
+type KeptMarker struct {
+	App     string   `json:"app"`
+	MovedAt string   `json:"moved_at"`        // RFC3339 UTC
+	Paths   []string `json:"paths"`           // relative to the drive root, as they were (e.g. appdata/nextcloud)
+	Unit    bool     `json:"unit,omitempty"`  // a recovery unit was moved in with them (<kept>/unit)
+	Drive   string   `json:"drive,omitempty"` // the drive root they came from
+}
+
+// KeptItem is one row of the „Megőrzött adatok" list.
+type KeptItem struct {
+	App         string    `json:"app"`          // the catalog app it belongs to ("" = unknown)
+	DisplayName string    `json:"display_name"` // the app's name, else the folder name
+	Path        string    `json:"path"`         // the kept folder (absolute)
+	Drive       string    `json:"drive"`        // the drive root it sits on
+	Kind        string    `json:"kind"`
+	Date        time.Time `json:"date"`
+	SizeBytes   int64     `json:"size_bytes"`
+	// UnitDir is the recovery unit moved in with a dated folder ("" none) — its database copy.
+	UnitDir string `json:"unit_dir,omitempty"`
+	// Marker is the dated folder's record (nil for a leftover).
+	Marker *KeptMarker `json:"marker,omitempty"`
+}
+
+// Errors, born as bundle keys.
+var (
+	ErrKeptNotListed = util.MsgError("err.kept.not_listed")
+	ErrKeptOccupied  = util.MsgError("err.kept.occupied")
+)
+
+// OldAppDataPaths is rule 1 as a pure function: the app's binds under `<hdd>/appdata/` (never appdata
+// itself) that exist and hold at least one entry.
+func OldAppDataPaths(composePath, hddPath string) []string {
+	if hddPath == "" {
+		return nil
+	}
+	appdata := filepath.Join(filepath.Clean(hddPath), "appdata") + string(filepath.Separator)
+	var out []string
+	for _, p := range ParseComposeHDDMounts(composePath, hddPath) {
+		p = filepath.Clean(p)
+		if !strings.HasPrefix(p, appdata) {
+			continue
+		}
+		if dirHasEntries(p) {
+			out = append(out, p)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+func dirHasEntries(p string) bool {
+	f, err := os.Open(p)
+	if err != nil {
+		return false
+	}
+	defer f.Close()
+	names, _ := f.Readdirnames(1)
+	return len(names) > 0
+}
+
+// OldAppData is OldAppDataPaths for an app about to be installed on hddPath (its catalog definition).
+func (m *Manager) OldAppData(name, hddPath string) []string {
+	st, ok := m.GetStack(name)
+	if !ok || st.ComposePath == "" {
+		return nil
+	}
+	return OldAppDataPaths(st.ComposePath, hddPath)
+}
+
+// KeptDirFor names a new dated kept folder. The date is the box's local day and time, so the household
+// recognises „today" in the name.
+func KeptDirFor(hddPath, app string, now time.Time) string {
+	return filepath.Join(filepath.Clean(hddPath), KeptDirName, app, now.In(getTimezone()).Format("2006-01-02_150405"))
+}
+
+// renameFn is the rename seam (tests inject EXDEV); production is os.Rename.
+var renameFn = os.Rename
+
+// KeepAside is "start fresh": it MOVES each old-data folder (and, when unitDir is on the same drive, the
+// removed app's recovery unit) into a new dated kept folder, keeping each one's path relative to the drive.
+// A failed move puts back everything already moved and returns the error — nothing is copied, nothing is
+// deleted. Returns the kept folder.
+func (m *Manager) KeepAside(name, hddPath string, paths []string, unitDir string, now time.Time) (string, error) {
+	drive := filepath.Clean(hddPath)
+	if len(paths) == 0 {
+		return "", fmt.Errorf("nothing to keep aside for %s", name)
+	}
+	dest := KeptDirFor(drive, name, now)
+	if _, err := os.Stat(dest); err == nil {
+		return "", fmt.Errorf("the kept folder %s already exists", dest)
+	}
+	if err := os.MkdirAll(dest, 0o755); err != nil {
+		return "", fmt.Errorf("creating the kept folder: %w", err)
+	}
+	type moved struct{ from, to string }
+	var done []moved
+	undo := func() {
+		for i := len(done) - 1; i >= 0; i-- {
+			if err := renameFn(done[i].to, done[i].from); err != nil {
+				m.logger.Printf("[ERROR] [stacks] kept %s: putting %s back to %s FAILED: %v", name, done[i].to, done[i].from, err)
+			}
+		}
+		removeEmptyDirs(dest) // os.Remove only: a folder a failed move-back left data in STAYS
+	}
+	marker := KeptMarker{App: name, MovedAt: now.UTC().Format(time.RFC3339), Drive: drive}
+	for _, p := range paths {
+		p = filepath.Clean(p)
+		rel, err := filepath.Rel(drive, p)
+		if err != nil || strings.HasPrefix(rel, "..") || !strings.HasPrefix(rel, "appdata"+string(filepath.Separator)) {
+			undo()
+			return "", fmt.Errorf("refusing to keep aside %s: not under %s/appdata", p, drive)
+		}
+		to := filepath.Join(dest, rel)
+		if err := os.MkdirAll(filepath.Dir(to), 0o755); err != nil {
+			undo()
+			return "", err
+		}
+		if err := renameFn(p, to); err != nil {
+			undo()
+			if errors.Is(err, syscall.EXDEV) {
+				return "", fmt.Errorf("moving %s would cross drives — refused, nothing moved: %w", p, err)
+			}
+			return "", fmt.Errorf("moving %s: %w — nothing moved", p, err)
+		}
+		done = append(done, moved{p, to})
+		marker.Paths = append(marker.Paths, rel)
+		m.logger.Printf("[INFO] [stacks] kept %s: moved %s → %s (start fresh)", name, p, to)
+	}
+	if unitDir != "" {
+		to := filepath.Join(dest, keptUnitDir)
+		if err := renameFn(unitDir, to); err != nil {
+			// The files are kept either way; without the unit a later Load has no database copy, which
+			// the list then says. Not a reason to undo the household's choice.
+			m.logger.Printf("[WARN] [stacks] kept %s: the recovery unit %s could not move in with the files (%v) — the kept folder has no database copy", name, unitDir, err)
+		} else {
+			marker.Unit = true
+			m.logger.Printf("[INFO] [stacks] kept %s: moved the recovery unit %s → %s", name, unitDir, to)
+		}
+	}
+	b, _ := json.MarshalIndent(marker, "", "  ")
+	if err := os.WriteFile(filepath.Join(dest, keptMarkerFile), b, 0o644); err != nil {
+		m.logger.Printf("[WARN] [stacks] kept %s: could not write the marker in %s: %v — listed without it", name, dest, err)
+	}
+	return dest, nil
+}
+
+func readKeptMarker(dir string) *KeptMarker {
+	b, err := os.ReadFile(filepath.Join(dir, keptMarkerFile))
+	if err != nil {
+		return nil
+	}
+	var mk KeptMarker
+	if json.Unmarshal(b, &mk) != nil {
+		return nil
+	}
+	return &mk
+}
+
+// liveDriveBinds is every drive folder an INSTALLED app binds — never kept data.
+func (m *Manager) liveDriveBinds() []string {
+	var out []string
+	for _, st := range m.GetStacks() {
+		if !st.Deployed || st.AppConfig == nil {
+			continue
+		}
+		hdd := strings.TrimSpace(st.AppConfig.Env["HDD_PATH"])
+		if hdd == "" {
+			continue
+		}
+		for _, p := range ParseComposeHDDMounts(st.ComposePath, hdd) {
+			out = append(out, filepath.Clean(p))
+		}
+	}
+	return out
+}
+
+func overlaps(a, b string) bool {
+	sep := string(filepath.Separator)
+	return a == b || strings.HasPrefix(a, b+sep) || strings.HasPrefix(b, a+sep)
+}
+
+// ownerOf names the catalog app whose definition binds drive-relative folder rel (e.g. appdata/paperless
+// → paperless-ngx). A stack named like the folder wins; "" when none declares it.
+func (m *Manager) ownerOf(drive, abs string) (string, string) {
+	var cands []Stack
+	for _, st := range m.GetStacks() {
+		if st.ComposePath == "" {
+			continue
+		}
+		for _, p := range ParseComposeHDDMounts(st.ComposePath, drive) {
+			if filepath.Clean(p) == abs {
+				cands = append(cands, st)
+				break
+			}
+		}
+	}
+	if len(cands) == 0 {
+		return "", ""
+	}
+	pick := cands[0]
+	for _, c := range cands {
+		if c.Name == filepath.Base(abs) {
+			pick = c
+		}
+	}
+	dn := pick.Meta.DisplayName
+	if dn == "" {
+		dn = pick.Name
+	}
+	return pick.Name, dn
+}
+
+// sizeFn is the size seam (production walks the tree).
+var sizeFn = getDirSizeBytes
+
+// ListKept lists every kept item on the given drive roots: the dated folders under <drive>/kept/<app>/,
+// and each <drive>/appdata/<x> that holds something and that no installed app binds. Sorted newest first.
+func (m *Manager) ListKept(drives []string) []KeptItem {
+	live := m.liveDriveBinds()
+	var out []KeptItem
+	seen := map[string]bool{}
+	for _, d := range drives {
+		d = filepath.Clean(d)
+		if d == "" || seen[d] {
+			continue
+		}
+		seen[d] = true
+		apps, _ := os.ReadDir(filepath.Join(d, KeptDirName))
+		for _, a := range apps {
+			if !a.IsDir() {
+				continue
+			}
+			stamps, _ := os.ReadDir(filepath.Join(d, KeptDirName, a.Name()))
+			for _, s := range stamps {
+				if !s.IsDir() {
+					continue
+				}
+				dir := filepath.Join(d, KeptDirName, a.Name(), s.Name())
+				it := KeptItem{App: a.Name(), DisplayName: a.Name(), Path: dir, Drive: d, Kind: KeptKindDated,
+					Marker: readKeptMarker(dir), SizeBytes: sizeFn(dir)}
+				if st, ok := m.GetStack(a.Name()); ok && st.Meta.DisplayName != "" {
+					it.DisplayName = st.Meta.DisplayName
+				}
+				if it.Marker != nil {
+					if t, err := time.Parse(time.RFC3339, it.Marker.MovedAt); err == nil {
+						it.Date = t
+					}
+					if it.Marker.Unit {
+						if _, err := os.Stat(filepath.Join(dir, keptUnitDir)); err == nil {
+							it.UnitDir = filepath.Join(dir, keptUnitDir)
+						}
+					}
+				}
+				if it.Date.IsZero() {
+					if fi, err := os.Stat(dir); err == nil {
+						it.Date = fi.ModTime()
+					}
+				}
+				out = append(out, it)
+			}
+		}
+		ents, _ := os.ReadDir(filepath.Join(d, "appdata"))
+		for _, e := range ents {
+			if !e.IsDir() {
+				continue
+			}
+			abs := filepath.Join(d, "appdata", e.Name())
+			isLive := false
+			for _, l := range live {
+				if overlaps(abs, l) {
+					isLive = true
+					break
+				}
+			}
+			if isLive || !dirHasEntries(abs) {
+				continue
+			}
+			app, dn := m.ownerOf(d, abs)
+			if dn == "" {
+				dn = e.Name()
+			}
+			it := KeptItem{App: app, DisplayName: dn, Path: abs, Drive: d, Kind: KeptKindLeftover, SizeBytes: sizeFn(abs)}
+			if fi, err := os.Stat(abs); err == nil {
+				it.Date = fi.ModTime()
+			}
+			out = append(out, it)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if !out[i].Date.Equal(out[j].Date) {
+			return out[i].Date.After(out[j].Date)
+		}
+		return out[i].Path < out[j].Path
+	})
+	return out
+}
+
+// FindKept returns the listed item at exactly path — the only way an action names a kept item.
+func (m *Manager) FindKept(drives []string, path string) (KeptItem, bool) {
+	clean := filepath.Clean(path)
+	for _, it := range m.ListKept(drives) {
+		if it.Path == clean {
+			return it, true
+		}
+	}
+	return KeptItem{}, false
+}
+
+// DeleteKept is the household's Delete, and the ONLY deletion of kept data anywhere in the product
+// (rule 4). It refuses a path that is not a listed kept item — a live app's folder is never listed.
+func (m *Manager) DeleteKept(drives []string, path string) (KeptItem, error) {
+	it, ok := m.FindKept(drives, path)
+	if !ok {
+		m.logger.Printf("[WARN] [stacks] kept: delete REFUSED for %s — not a listed kept item", path)
+		return KeptItem{}, ErrKeptNotListed
+	}
+	if err := os.RemoveAll(it.Path); err != nil {
+		return it, fmt.Errorf("deleting %s: %w", it.Path, err)
+	}
+	m.logger.Printf("[INFO] [stacks] kept: DELETED %s (%s, %d bytes) — the household's typed confirmation", it.Path, it.DisplayName, it.SizeBytes)
+	if it.Kind == KeptKindDated {
+		_ = os.Remove(filepath.Dir(it.Path)) // the per-app folder, only when now empty
+	}
+	return it, nil
+}
+
+// RestoreKeptFiles puts a dated item's files back where they were (a rename, the reverse of KeepAside)
+// before a Load; a leftover item is already in place. It refuses when any destination holds something —
+// that would be two installs' data in one folder. Returns the unit to load from ("" none).
+func (m *Manager) RestoreKeptFiles(it KeptItem) (string, error) {
+	if it.Kind != KeptKindDated {
+		return "", nil
+	}
+	if it.Marker == nil || len(it.Marker.Paths) == 0 {
+		return "", fmt.Errorf("the kept folder %s has no record of where its files came from", it.Path)
+	}
+	for _, rel := range it.Marker.Paths {
+		if dirHasEntries(filepath.Join(it.Drive, rel)) {
+			return "", ErrKeptOccupied
+		}
+	}
+	var done []string
+	for _, rel := range it.Marker.Paths {
+		from, to := filepath.Join(it.Path, rel), filepath.Join(it.Drive, rel)
+		_ = os.Remove(to) // an EMPTY leftover directory only (checked above)
+		if err := os.MkdirAll(filepath.Dir(to), 0o755); err != nil {
+			return "", err
+		}
+		if err := renameFn(from, to); err != nil {
+			for _, r := range done {
+				_ = renameFn(filepath.Join(it.Drive, r), filepath.Join(it.Path, r))
+			}
+			return "", fmt.Errorf("moving %s back: %w — nothing moved", from, err)
+		}
+		done = append(done, rel)
+		m.logger.Printf("[INFO] [stacks] kept %s: moved %s back → %s (load)", it.App, from, to)
+	}
+	return it.UnitDir, nil
+}
+
+// FinishKeptLoad runs after a successful Load of a dated item: the unit it carried becomes the app's own
+// unit again when that place is free (unitHome = backups/primary/<app> on the drive), and the kept folder
+// is removed only when nothing but empty directories and its marker remain — no data is deleted here.
+func (m *Manager) FinishKeptLoad(it KeptItem, unitHome string) {
+	if it.Kind != KeptKindDated {
+		return
+	}
+	if it.UnitDir != "" && unitHome != "" {
+		if _, err := os.Stat(unitHome); os.IsNotExist(err) {
+			if err := os.MkdirAll(filepath.Dir(unitHome), 0o755); err == nil {
+				if err := renameFn(it.UnitDir, unitHome); err == nil {
+					m.logger.Printf("[INFO] [stacks] kept %s: the loaded unit is the app's own again → %s", it.App, unitHome)
+				}
+			}
+		} else {
+			m.logger.Printf("[INFO] [stacks] kept %s: %s already holds a unit — the loaded one stays in %s (listed; the household decides)", it.App, unitHome, it.UnitDir)
+		}
+	}
+	if keptHoldsOnlyEmptyDirs(it.Path) {
+		_ = os.Remove(filepath.Join(it.Path, keptMarkerFile))
+		removeEmptyDirs(it.Path)
+		if _, err := os.Stat(it.Path); os.IsNotExist(err) {
+			_ = os.Remove(filepath.Dir(it.Path))
+			m.logger.Printf("[INFO] [stacks] kept %s: %s is empty after the load — removed from the list", it.App, it.Path)
+		}
+	}
+}
+
+// keptHoldsOnlyEmptyDirs: true when the tree holds no file other than the marker.
+func keptHoldsOnlyEmptyDirs(root string) bool {
+	only := true
+	_ = filepath.Walk(root, func(p string, fi os.FileInfo, err error) error {
+		if err != nil {
+			only = false
+			return filepath.SkipDir
+		}
+		if !fi.IsDir() && !(filepath.Dir(p) == root && fi.Name() == keptMarkerFile) {
+			only = false
+			return filepath.SkipDir
+		}
+		return nil
+	})
+	return only
+}
+
+// RunAfterLoad runs the app's `after_load:` once, after a Load, when the app is running (waits up to
+// wait). Logged by name either way; a failure is reported, never retried.
+func (m *Manager) RunAfterLoad(name string, wait time.Duration) (bool, error) {
+	st, ok := m.GetStack(name)
+	if !ok {
+		return false, fmt.Errorf("stack %q not found", name)
+	}
+	al := st.Meta.AfterLoad
+	if al == nil || al.Service == "" || len(al.Command) == 0 {
+		return false, nil
+	}
+	deadline := time.Now().Add(wait)
+	for {
+		_ = m.RefreshStatus()
+		if s, ok := m.GetStack(name); ok && (s.State == StateRunning || s.State == StateUnhealthy) {
+			break
+		}
+		if time.Now().After(deadline) {
+			return true, fmt.Errorf("the app did not start within %s — after_load not run", wait)
+		}
+		time.Sleep(5 * time.Second)
+	}
+	return true, m.runAfterLoadNow(name)
+}
+
+// runAfterLoadNow runs the declared command once, now (RunAfterLoad has waited for the app).
+func (m *Manager) runAfterLoadNow(name string) error {
+	st, ok := m.GetStack(name)
+	if !ok || st.Meta.AfterLoad == nil {
+		return nil
+	}
+	al := st.Meta.AfterLoad
+	dir := filepath.Dir(st.ComposePath)
+	args := []string{"exec", "-T"}
+	if al.User != "" {
+		args = append(args, "-u", al.User)
+	}
+	args = append(args, al.Service)
+	args = append(args, al.Command...)
+	t0 := time.Now()
+	out, err := m.afterLoadExec(dir, args...)
+	m.logger.Printf("[INFO] [stacks] after_load %s: %s %v in %s (err=%v): %s", name, al.Service, al.Command, time.Since(t0).Round(time.Millisecond), err, truncateStr(out, 400))
+	return err
+}
+
+// afterLoadExec is the exec seam; production runs compose with the app's env.
+func (m *Manager) afterLoadExec(dir string, args ...string) (string, error) {
+	if m.afterLoadFn != nil {
+		return m.afterLoadFn(dir, args...)
+	}
+	return m.composeExecCustomEnv(dir, m.stackEnv(dir), args...)
+}
+
+var keptTZ *time.Location
+
+func getTimezone() *time.Location {
+	if keptTZ == nil {
+		if loc, err := time.LoadLocation("Europe/Budapest"); err == nil {
+			keptTZ = loc
+		} else {
+			keptTZ = time.UTC
+		}
+	}
+	return keptTZ
+}
+
+// removeEmptyDirs removes root and every directory under it that is EMPTY — never a file, never a
+// directory holding one (os.Remove refuses a non-empty directory). Deepest first.
+func removeEmptyDirs(root string) {
+	var dirs []string
+	_ = filepath.Walk(root, func(p string, fi os.FileInfo, err error) error {
+		if err == nil && fi.IsDir() {
+			dirs = append(dirs, p)
+		}
+		return nil
+	})
+	for i := len(dirs) - 1; i >= 0; i-- {
+		_ = os.Remove(dirs[i])
+	}
+}
+
+// DirSizeBytes is the size seam's value for one folder (du -sb; 0 when unreadable).
+func DirSizeBytes(p string) int64 { return sizeFn(p) }
+
+// DirModTime is a folder's modification time (zero when unreadable).
+func DirModTime(p string) time.Time {
+	fi, err := os.Stat(p)
+	if err != nil {
+		return time.Time{}
+	}
+	return fi.ModTime()
+}

controller/internal/stacks/kept_test.go

@@ -0,0 +1,270 @@
+package stacks
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
+)
+
+// keptManager is a real Manager over a temp stacks dir with one app, "cloudapp", whose compose binds
+// its private data (appdata/cloudapp), a household folder (userdata/Photos) and the shared media root.
+// Nothing here reaches Docker (R-650): no test calls a path that runs compose.
+func keptManager(t *testing.T) (*Manager, string) {
+	t.Helper()
+	dir := t.TempDir()
+	drive := filepath.Join(dir, "drive")
+	cfg := &config.Config{}
+	cfg.Paths.StacksDir = filepath.Join(dir, "stacks")
+	cfg.Paths.SystemDataPath = filepath.Join(dir, "system")
+	cfg.Stacks.ComposeCommand = "docker compose"
+	app := filepath.Join(cfg.Paths.StacksDir, "cloudapp")
+	must(t, os.MkdirAll(app, 0o755))
+	compose := "services:\n  cloudapp:\n    image: busybox\n    volumes:\n" +
+		"      - ${HDD_PATH}/appdata/cloudapp:/data\n" +
+		"      - ${HDD_PATH}/userdata/Photos:/photos\n" +
+		"      - ${HDD_PATH}/media:/media\n"
+	must(t, os.WriteFile(filepath.Join(app, "docker-compose.yml"), []byte(compose), 0o644))
+	must(t, os.WriteFile(filepath.Join(app, ".felhom.yml"), []byte("display_name: Cloud App\ndeploy_fields:\n  - env_var: HDD_PATH\n    label: Drive\n    type: path\n    required: true\n"), 0o644))
+	m, err := NewManager(cfg, log.New(io.Discard, "", 0))
+	must(t, err)
+	must(t, m.ScanStacks())
+	for _, d := range []string{"appdata/cloudapp/user1", "userdata/Photos", "media"} {
+		must(t, os.MkdirAll(filepath.Join(drive, d), 0o755))
+	}
+	must(t, os.WriteFile(filepath.Join(drive, "appdata/cloudapp/user1/file.txt"), []byte("old"), 0o644))
+	must(t, os.WriteFile(filepath.Join(drive, "userdata/Photos/p.jpg"), []byte("photo"), 0o644))
+	must(t, os.WriteFile(filepath.Join(drive, "media/song.mp3"), []byte("song"), 0o644))
+	return m, drive
+}
+
+func must(t *testing.T, err error) {
+	t.Helper()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+// Rule 1 — only the app's private appdata bind is "old data"; the household's shared folders never are.
+// COMPANION RED-PROOF: drop the appdata prefix check in OldAppDataPaths → the Photos and media folders
+// are returned and this fails.
+func TestKept_OnlyAppdataBindsAreOldData(t *testing.T) {
+	m, drive := keptManager(t)
+	got := m.OldAppData("cloudapp", drive)
+	want := []string{filepath.Join(drive, "appdata/cloudapp")}
+	if fmt.Sprint(got) != fmt.Sprint(want) {
+		t.Fatalf("old data = %v, want only %v (a household folder must never be moved)", got, want)
+	}
+	// An EMPTY private folder is not old data.
+	must(t, os.RemoveAll(filepath.Join(drive, "appdata/cloudapp/user1")))
+	if got := m.OldAppData("cloudapp", drive); len(got) != 0 {
+		t.Fatalf("an empty folder was called old data: %v", got)
+	}
+}
+
+// Rule 2 — start fresh is a RENAME (same inode, nothing copied) and a failed move puts back what moved.
+// COMPANION RED-PROOF: delete the undo() call on the rename failure → the first folder stays inside the
+// kept folder and this fails at "was not put back".
+func TestKept_KeepAsideIsARenameAndRollsBack(t *testing.T) {
+	m, drive := keptManager(t)
+	src := filepath.Join(drive, "appdata/cloudapp")
+	second := filepath.Join(drive, "appdata/cloudapp-extra")
+	must(t, os.MkdirAll(second, 0o755))
+	must(t, os.WriteFile(filepath.Join(second, "x"), []byte("x"), 0o644))
+	before, err := os.Stat(filepath.Join(src, "user1/file.txt"))
+	must(t, err)
+	now := time.Date(2026, 9, 25, 11, 0, 0, 0, time.UTC)
+
+	// A: the second rename fails with EXDEV → both stay where they were, no kept folder, the error says so.
+	calls := 0
+	renameFn = func(a, b string) error {
+		calls++
+		if calls == 2 {
+			return &os.LinkError{Op: "rename", Old: a, New: b, Err: syscall.EXDEV}
+		}
+		return os.Rename(a, b)
+	}
+	defer func() { renameFn = os.Rename }()
+	_, err = m.KeepAside("cloudapp", drive, []string{src, second}, "", now)
+	if err == nil || !strings.Contains(err.Error(), "cross drives") {
+		t.Fatalf("want a cross-drive refusal, got %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(src, "user1/file.txt")); err != nil {
+		t.Fatalf("the first folder was not put back after the failed move: %v", err)
+	}
+	if _, err := os.Stat(KeptDirFor(drive, "cloudapp", now)); !os.IsNotExist(err) {
+		t.Fatalf("a failed start-fresh left a kept folder behind (%v)", err)
+	}
+
+	// B: success — the data is in the kept folder under its drive-relative path, as the SAME file.
+	renameFn = os.Rename
+	kept, err := m.KeepAside("cloudapp", drive, []string{src}, "", now)
+	must(t, err)
+	after, err := os.Stat(filepath.Join(kept, "appdata/cloudapp/user1/file.txt"))
+	must(t, err)
+	if !os.SameFile(before, after) {
+		t.Fatal("the kept file is not the same inode — it was copied, not moved")
+	}
+	if _, err := os.Stat(src); !os.IsNotExist(err) {
+		t.Fatalf("the old folder is still in place after start fresh (%v)", err)
+	}
+	if mk := readKeptMarker(kept); mk == nil || mk.App != "cloudapp" || fmt.Sprint(mk.Paths) != "[appdata/cloudapp]" {
+		t.Fatalf("marker = %+v", mk)
+	}
+	if !strings.HasPrefix(kept, filepath.Join(drive, KeptDirName)+string(filepath.Separator)) ||
+		strings.Contains(kept, "userdata") {
+		t.Fatalf("kept folder %s is not under <drive>/kept (and never under userdata)", kept)
+	}
+}
+
+// Rule 3 — the kept folder is protected from an app removal's drive clean-up.
+// COMPANION RED-PROOF: drop the KeptDirName line from ProtectedHDDPaths → fails.
+func TestKept_KeptDirIsProtected(t *testing.T) {
+	if !ProtectedHDDPaths("/mnt/d")["/mnt/d/"+KeptDirName] {
+		t.Fatal("<drive>/kept is not in ProtectedHDDPaths")
+	}
+}
+
+// The list: a dated folder (with its unit) and a leftover appdata folder are listed; a live app's
+// folder is not; the leftover is named after the catalog app that declares it.
+func TestKept_ListShowsKeptAndNeverALiveFolder(t *testing.T) {
+	m, drive := keptManager(t)
+	// A leftover of cloudapp (not installed): listed, owner resolved from the catalog definition.
+	items := m.ListKept([]string{drive})
+	if len(items) != 1 || items[0].Kind != KeptKindLeftover || items[0].App != "cloudapp" || items[0].DisplayName != "Cloud App" {
+		t.Fatalf("leftover listing = %+v", items)
+	}
+	// Installed now: its folder is LIVE and disappears from the list.
+	m.mu.Lock()
+	s := m.stacks["cloudapp"]
+	s.Deployed = true
+	s.AppConfig = &AppConfig{Deployed: true, Env: map[string]string{"HDD_PATH": drive}}
+	m.mu.Unlock()
+	if items := m.ListKept([]string{drive}); len(items) != 0 {
+		t.Fatalf("a live app's folder was listed as kept data: %+v", items)
+	}
+	// A dated kept folder with a unit moved in.
+	unit := filepath.Join(drive, "backups/primary/cloudapp")
+	must(t, os.MkdirAll(unit, 0o755))
+	must(t, os.WriteFile(filepath.Join(unit, "manifest.json"), []byte("{}"), 0o644))
+	old := filepath.Join(drive, "appdata/older")
+	must(t, os.MkdirAll(old, 0o755))
+	must(t, os.WriteFile(filepath.Join(old, "f"), []byte("f"), 0o644))
+	kept, err := m.KeepAside("cloudapp", drive, []string{old}, unit, time.Now())
+	must(t, err)
+	items = m.ListKept([]string{drive})
+	if len(items) != 1 || items[0].Kind != KeptKindDated || items[0].Path != kept || items[0].UnitDir != filepath.Join(kept, keptUnitDir) {
+		t.Fatalf("dated listing = %+v", items)
+	}
+}
+
+// Rule 4 — Delete removes ONLY a listed kept item; anything else is refused and untouched.
+// COMPANION RED-PROOF: skip the FindKept check in DeleteKept → the live folder is deleted and this fails.
+func TestKept_DeleteRefusesAnythingNotListed(t *testing.T) {
+	m, drive := keptManager(t)
+	m.mu.Lock()
+	s := m.stacks["cloudapp"]
+	s.Deployed = true
+	s.AppConfig = &AppConfig{Deployed: true, Env: map[string]string{"HDD_PATH": drive}}
+	m.mu.Unlock()
+	for _, p := range []string{
+		filepath.Join(drive, "appdata/cloudapp"), // a LIVE app's folder
+		filepath.Join(drive, "userdata/Photos"),  // the household's files
+		drive,                                    // the drive itself
+		filepath.Join(drive, "appdata/cloudapp/../../userdata"),
+	} {
+		if _, err := m.DeleteKept([]string{drive}, p); !errors.Is(err, ErrKeptNotListed) {
+			t.Fatalf("delete of %s: want ErrKeptNotListed, got %v", p, err)
+		}
+	}
+	for _, p := range []string{"appdata/cloudapp/user1/file.txt", "userdata/Photos/p.jpg", "media/song.mp3"} {
+		if _, err := os.Stat(filepath.Join(drive, p)); err != nil {
+			t.Fatalf("%s was touched by a refused delete: %v", p, err)
+		}
+	}
+	// A listed item IS deleted.
+	left := filepath.Join(drive, "appdata/gone")
+	must(t, os.MkdirAll(left, 0o755))
+	must(t, os.WriteFile(filepath.Join(left, "f"), []byte("f"), 0o644))
+	if _, err := m.DeleteKept([]string{drive}, left); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(left); !os.IsNotExist(err) {
+		t.Fatalf("the listed kept item is still there (%v)", err)
+	}
+}
+
+// The install never runs into old data silently: no choice (or a wrong one) is refused BEFORE anything
+// is written — no app.yaml, the old data in place.
+// COMPANION RED-PROOF: delete the OldAppDataPaths block in DeployStack → the deploy saves app.yaml and
+// goes on to compose (this test then fails at "no choice was accepted").
+func TestKept_DeployRefusesOverOldDataWithoutAChoice(t *testing.T) {
+	m, drive := keptManager(t)
+	for _, choice := range []string{"", "use", "whatever"} {
+		_, err := m.DeployStack(DeployRequest{StackName: "cloudapp", Values: map[string]string{"HDD_PATH": drive}, KeptData: choice})
+		if !errors.Is(err, ErrKeptDataChoice) {
+			t.Fatalf("choice %q: no choice was accepted — want ErrKeptDataChoice, got %v", choice, err)
+		}
+		if _, err := os.Stat(filepath.Join(m.cfg.Paths.StacksDir, "cloudapp", "app.yaml")); !os.IsNotExist(err) {
+			t.Fatalf("choice %q: app.yaml was written by a refused install", choice)
+		}
+		if st, _ := m.GetStack("cloudapp"); st.Deploying || st.Deployed {
+			t.Fatalf("choice %q: the stack is left Deploying=%v Deployed=%v", choice, st.Deploying, st.Deployed)
+		}
+	}
+	if _, err := os.Stat(filepath.Join(drive, "appdata/cloudapp/user1/file.txt")); err != nil {
+		t.Fatalf("the old data moved without a choice: %v", err)
+	}
+}
+
+// Load puts a dated item's files back, refusing when the destination already holds something.
+func TestKept_RestoreKeptFilesRefusesAnOccupiedFolder(t *testing.T) {
+	m, drive := keptManager(t)
+	src := filepath.Join(drive, "appdata/cloudapp")
+	kept, err := m.KeepAside("cloudapp", drive, []string{src}, "", time.Now())
+	must(t, err)
+	it, ok := m.FindKept([]string{drive}, kept)
+	if !ok {
+		t.Fatal("kept folder not listed")
+	}
+	must(t, os.MkdirAll(filepath.Join(src, "new"), 0o755)) // a fresh install wrote here
+	if _, err := m.RestoreKeptFiles(it); !errors.Is(err, ErrKeptOccupied) {
+		t.Fatalf("want ErrKeptOccupied over an occupied folder, got %v", err)
+	}
+	must(t, os.RemoveAll(src))
+	if _, err := m.RestoreKeptFiles(it); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(src, "user1/file.txt")); err != nil {
+		t.Fatalf("the file did not come back: %v", err)
+	}
+	m.FinishKeptLoad(it, "")
+	if _, err := os.Stat(kept); !os.IsNotExist(err) {
+		t.Fatalf("the emptied kept folder is still listed (%v)", err)
+	}
+}
+
+// after_load runs the template's ONE command, as its user, in its service.
+func TestKept_AfterLoadRunsTheDeclaredCommand(t *testing.T) {
+	m, _ := keptManager(t)
+	var got []string
+	m.afterLoadFn = func(dir string, args ...string) (string, error) { got = args; return "ok", nil }
+	m.mu.Lock()
+	m.stacks["cloudapp"].Meta.AfterLoad = &AfterLoadCommand{Service: "cloudapp", User: "www-data", Command: []string{"php", "occ", "files:scan", "--all"}}
+	m.stacks["cloudapp"].State = StateRunning
+	m.mu.Unlock()
+	if err := m.runAfterLoadNow("cloudapp"); err != nil {
+		t.Fatal(err)
+	}
+	if want := "exec -T -u www-data cloudapp php occ files:scan --all"; strings.Join(got, " ") != want {
+		t.Fatalf("after_load ran %q, want %q", strings.Join(got, " "), want)
+	}
+}

controller/internal/stacks/manager.go

@@ -284,13 +284,18 @@ type Manager struct {
 	pgConv             pgConverter
 	convertFreeFn      func(path string) (int64, bool)
 	updateUndoHealthFn func(ctx context.Context, name string, timeout time.Duration, meta *Metadata) (bool, string)
-	probeRunFn         func(t probeTarget) *HealthProbeResult // the health wait's network probe; nil ⇒ runChecks
-	updateEventSink    func(UpdateEvent)                      // v0.264.0: the notifier; nil ⇒ no events
-	updateMemoryFn     func(newReqMB, newLimitMB, releasedReqMB, releasedLimitMB int) (refusal error, warning string)
-	updateDiskFreeFn   func() (freeGiB float64, ok bool)
-	updateNowFn        func() time.Time
-	updateJournalMu    sync.Mutex
-	updateResume       []string // apps whose update was interrupted after `up`; resumed once guards exist
+	// afterLoadFn is RunAfterLoad's exec seam (kept.go); nil = compose exec with the app's env.
+	afterLoadFn func(dir string, args ...string) (string, error)
+	// keptUnitFn names the removed app's recovery unit on a drive (backup.RemovedAppUnitFor, wired in
+	// main.go) so a start-fresh moves it in with the files it belongs to. nil = files only.
+	keptUnitFn       func(app, drive string) string
+	probeRunFn       func(t probeTarget) *HealthProbeResult // the health wait's network probe; nil ⇒ runChecks
+	updateEventSink  func(UpdateEvent)                      // v0.264.0: the notifier; nil ⇒ no events
+	updateMemoryFn   func(newReqMB, newLimitMB, releasedReqMB, releasedLimitMB int) (refusal error, warning string)
+	updateDiskFreeFn func() (freeGiB float64, ok bool)
+	updateNowFn      func() time.Time
+	updateJournalMu  sync.Mutex
+	updateResume     []string // apps whose update was interrupted after `up`; resumed once guards exist
 	// inspectRestartPolicyFn is the docker-inspect seam for the above; nil in production
 	// (dockerRestartPolicy). Tests inject a scripted lookup and never touch docker.
 	inspectRestartPolicyFn func(containerName string) (string, error)
@@ -1711,3 +1716,6 @@ func (m *Manager) getCatalogTemplateSlugs() map[string]bool {
 func AggregateStateForTest(containers []ContainerInfo) ContainerState {
 	return aggregateState(containers, func(string) string { return "unless-stopped" })
 }
+
+// SetKeptUnitFinder wires the backup side's removed-app unit lookup (INIT-ONLY; main.go).
+func (m *Manager) SetKeptUnitFinder(fn func(app, drive string) string) { m.keptUnitFn = fn }

controller/internal/stacks/metadata.go

@@ -48,7 +48,12 @@ type Metadata struct {
 	AppInfo        AppInfo               `yaml:"app_info" json:"app_info"`
 	OptionalConfig []OptionalConfigGroup `yaml:"optional_config" json:"optional_config"`
 	HealthCheck    *HealthCheckConfig    `yaml:"healthcheck,omitempty" json:"healthcheck,omitempty"`
-	Integrations   []IntegrationDef      `yaml:"integrations,omitempty" json:"integrations,omitempty"`
+	// AfterLoad (`09` §3 decision 36, E1 2026-09-25) is ONE command the box runs once after it loads an
+	// app's kept data (a database from a backup under files kept on the drive) — for an app whose own
+	// index of its files must be rebuilt. Measured on nextcloud: a file written after the backup is on
+	// the drive and invisible until `occ files:scan --all`. Optional; absent = nothing runs.
+	AfterLoad    *AfterLoadCommand `yaml:"after_load,omitempty" json:"after_load,omitempty"`
+	Integrations []IntegrationDef  `yaml:"integrations,omitempty" json:"integrations,omitempty"`
 	// InitialCreds: for apps that auto-generate a first-login credential into a file inside the
 	// container (e.g. Crafty's default-creds.txt). The controller reads + parses that file live and
 	// surfaces it on the app page, so the customer never has to dig through logs. Optional.
@@ -533,3 +538,10 @@ func (m *Metadata) HasOptionalConfig() bool {
 func (m *Metadata) HasIntegrations() bool {
 	return len(m.Integrations) > 0
 }
+
+// AfterLoadCommand is `.felhom.yml`'s `after_load:` — run with `docker compose exec -T` in Service.
+type AfterLoadCommand struct {
+	Service string   `yaml:"service" json:"service"`
+	User    string   `yaml:"user,omitempty" json:"user,omitempty"`
+	Command []string `yaml:"command" json:"command"`
+}

controller/internal/web/handlers.go

@@ -3404,8 +3404,16 @@ func (s *Server) syncFileBrowserMounts(resetDBOnChange bool) {
 	}
 
 	// Generate and write config.yaml (sources + sidebar entries per drive/share)
+	// `09` §3 decision 36: the read-only „Megőrzött adatok" source — one `:ro` bind per kept item, and
+	// the source only when there is at least one (a source with no mount is a broken sidebar entry, R-67).
+	keptLabel := ""
+	if kb := s.keptFileBrowserBinds(); len(kb) > 0 {
+		storageMounts = append(storageMounts, kb...)
+		keptLabel = s.msgLang(s.boxLang(), "kept.fb_source")
+	}
+
 	configPath := stackDir + "/config.yaml"
-	fbConfig := generateFileBrowserConfig(configPaths, importSource)
+	fbConfig := infra.RenderFileBrowserConfigKept(configPaths, importSource, keptLabel)
 
 	// Capture the current on-disk content BEFORE any writes, so we can detect whether this sync
 	// actually changes anything (F2). The integrations' ReapplyConfigForTarget edits config.yaml

controller/internal/web/i18n_cases_c_test.go

@@ -36,6 +36,23 @@ func i18nCasesC() []i18nCase {
 		{"storage_empty", "storage", func() map[string]interface{} {
 			return i18nLayoutData("storage", "Tárhely")
 		}},
+		// `09` §3 decision 36 — the kept-data list, one dated and one leftover row, and the empty page.
+		{"kept_data_full", "kept_data", func() map[string]interface{} {
+			d := i18nLayoutData("kept-data", "Megőrzött adatok")
+			d["KeptRows"] = []keptRow{
+				{DisplayName: "Nextcloud", App: "nextcloud", Path: "/mnt/felhom-drives/hdd_1/kept/nextcloud/2026-09-14_031200", Date: "2026-09-14 05:12", Size: "126.0 MB",
+					Backup: "unit 2026-09-14 04:44", CanLoad: true, LookURL: "https://files.example.hu/files/x/y",
+					DeleteText: "delete-text Nextcloud 126.0 MB", TypePrompt: "type-prompt Nextcloud"},
+				{DisplayName: "Paperless-ngx", App: "paperless-ngx", Path: "/mnt/felhom-drives/hdd_1/appdata/paperless", Date: "2026-09-13 10:00", Size: "71.0 MB",
+					Backup: "none", Installed: true, LookURL: "https://files.example.hu/files/x/z",
+					DeleteText: "x", TypePrompt: "y"},
+			}
+			d["KeptFlash"], d["KeptError"] = "flash-ok", "flash-error"
+			return d
+		}},
+		{"kept_data_empty", "kept_data", func() map[string]interface{} {
+			return i18nLayoutData("kept-data", "Megőrzött adatok")
+		}},
 		{"storage_network_full", "storage_network", func() map[string]interface{} {
 			d := i18nLayoutData("storage-network", "Hálózati tárhely")
 			base := func(name, health string, orphan bool) m {

controller/internal/web/i18n_parity_test.go

@@ -61,6 +61,7 @@ var i18nTitleKeys = map[string]string{
 	"Biztonság és hozzáférés":    "page.title.settings_security",
 	"Tárhely":                    "page.title.storage",
 	"Hálózati tárhely":           "page.title.storage_network",
+	"Megőrzött adatok":           "page.title.kept_data",
 	"Új meghajtó inicializálása": "page.title.storage_init",
 	"Meglévő meghajtó csatolása": "page.title.storage_attach",
 	"Hálózati megosztás":         "page.title.sharing",

controller/internal/web/kept_fb_test.go

@@ -0,0 +1,31 @@
+package web
+
+import (
+	"strings"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
+)
+
+// `09` §3 decision 36 — the file browser's kept-data view is READ-ONLY: every bind ends in :ro, and
+// two items never collide on one name.
+// COMPANION RED-PROOF: drop the ":ro" suffix in keptBindLines → fails.
+func TestKept_FileBrowserBindsAreReadOnly(t *testing.T) {
+	items := []stacks.KeptItem{
+		{Path: "/mnt/felhom-drives/hdd_1/kept/nextcloud/2026-09-25_130000", Drive: "/mnt/felhom-drives/hdd_1", Kind: stacks.KeptKindDated},
+		{Path: "/mnt/felhom-drives/hdd_1/kept/nextcloud/2026-09-26_090000", Drive: "/mnt/felhom-drives/hdd_1", Kind: stacks.KeptKindDated},
+		{Path: "/mnt/felhom-drives/hdd_1/appdata/nextcloud", Drive: "/mnt/felhom-drives/hdd_1", Kind: stacks.KeptKindLeftover},
+	}
+	lines := keptBindLines(items)
+	seen := map[string]bool{}
+	for i, l := range lines {
+		if !strings.HasSuffix(l, ":ro") || !strings.HasPrefix(l, "      - "+items[i].Path+":/srv/megorzott/") {
+			t.Fatalf("bind %q is not a read-only bind of %s under /srv/megorzott", l, items[i].Path)
+		}
+		target := strings.Split(l, ":")[1]
+		if seen[target] {
+			t.Fatalf("two kept items share %s", target)
+		}
+		seen[target] = true
+	}
+}

controller/internal/web/kept_handlers.go

@@ -0,0 +1,209 @@
+package web
+
+import (
+	"net/http"
+	"net/url"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/appbackup"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/infra"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
+)
+
+// ── „Megőrzött adatok" / "Kept data" (`09` §3 decision 36) ────────────────────────────────────────
+//
+// Every leftover app folder on a connected drive, with the three things a household can do with it:
+// Load (install the app with it — only with a database copy), Look (read only, in the file browser)
+// and Delete (typed confirmation — the ONLY deletion of kept data in the product; D3 is open, so the box
+// never deletes one by itself).
+
+// keptRow is one row of the page.
+type keptRow struct {
+	DisplayName string
+	App         string
+	Path        string
+	Drive       string
+	Date        string
+	Size        string
+	Backup      string // which copy can bring it back, or none — rendered in the reader's language
+	CanLoad     bool
+	LookURL     string
+	Installed   bool   // the app is installed again: Load is not offered
+	DeleteText  string // „A(z) %s megőrzött adatai (%s) véglegesen törlődnek…" in the reader's language
+	TypePrompt  string // what to type to confirm
+}
+
+// keptDrives are the drive roots kept data can sit on: every registered, connected, local drive.
+func (s *Server) keptDrives() []string {
+	var out []string
+	if s.settings == nil {
+		return nil
+	}
+	for _, sp := range s.settings.GetStoragePaths() {
+		if sp.IsNetwork() || sp.Disconnected || sp.Path == "" {
+			continue
+		}
+		out = append(out, sp.Path)
+	}
+	return out
+}
+
+// KeptViewName is a kept item's folder name inside the file browser's „Megőrzött adatok" source: the
+// drive, the app (or folder) and, for a dated folder, its date — unique per item, stable across syncs.
+func KeptViewName(it stacks.KeptItem) string {
+	base := filepath.Base(it.Drive) + "-"
+	if it.Kind == stacks.KeptKindDated {
+		return base + filepath.Base(filepath.Dir(it.Path)) + "-" + filepath.Base(it.Path)
+	}
+	return base + filepath.Base(it.Path)
+}
+
+// keptBackupFor names the copy a Load would use for it, and whether one exists.
+func (s *Server) keptBackupFor(lang string, it stacks.KeptItem) (string, string, bool) {
+	if s.backupMgr == nil {
+		return s.msgLang(lang, "kept.backup.none"), "", false
+	}
+	if it.Kind == stacks.KeptKindDated {
+		if it.UnitDir == "" {
+			return s.msgLang(lang, "kept.backup.none"), "", false
+		}
+		if c, ok := s.backupMgr.KeptCopyAt(it.UnitDir, it.Drive, 1); ok {
+			return s.msgLang(lang, "kept.backup.with", c.Time.In(getTimezone()).Format("2006-01-02 15:04")), c.UnitDir, true
+		}
+		return s.msgLang(lang, "kept.backup.none"), "", false
+	}
+	if it.App == "" {
+		return s.msgLang(lang, "kept.backup.none"), "", false
+	}
+	c, ok := s.backupMgr.KeptDBCopy(it.App, it.Drive)
+	if !ok {
+		return s.msgLang(lang, "kept.backup.none"), "", false
+	}
+	key := "kept.backup.own"
+	if c.Tier == 2 {
+		key = "kept.backup.second"
+	}
+	return s.msgLang(lang, key, c.Time.In(getTimezone()).Format("2006-01-02 15:04")), c.UnitDir, true
+}
+
+func (s *Server) keptPageHandler(w http.ResponseWriter, r *http.Request) {
+	lang := s.langFor(r)
+	data := s.baseData("kept-data", "Megőrzött adatok")
+	data["TitleKey"] = "page.title.kept_data"
+	var rows []keptRow
+	if s.stackMgr != nil {
+		for _, it := range s.stackMgr.ListKept(s.keptDrives()) {
+			backup, _, can := s.keptBackupFor(lang, it)
+			row := keptRow{
+				DisplayName: it.DisplayName, App: it.App, Path: it.Path, Drive: it.Drive,
+				Date: it.Date.In(getTimezone()).Format("2006-01-02 15:04"),
+				Size: appbackup.HumanizeBytes(it.SizeBytes), Backup: backup, CanLoad: can && it.App != "",
+				LookURL: fileBrowserLink(s.cfg.Customer.Domain, s.msgLang(s.boxLang(), "kept.fb_source"), KeptViewName(it)),
+			}
+			row.DeleteText = s.msgLang(lang, "kept.delete.confirm", it.DisplayName, row.Size)
+			row.TypePrompt = s.msgLang(lang, "kept.delete.type", it.DisplayName)
+			if st, ok := s.stackMgr.GetStack(it.App); ok && st.Deployed {
+				row.Installed, row.CanLoad = true, false
+			}
+			rows = append(rows, row)
+		}
+	}
+	data["KeptRows"] = rows
+	go s.SyncFileBrowserMounts() // the read-only view follows the list (no recreate when nothing changed)
+	data["KeptFlash"] = r.URL.Query().Get("flash")
+	data["KeptError"] = r.URL.Query().Get("flash_error")
+	s.executeTemplate(w, r, "kept_data", data)
+}
+
+func (s *Server) keptRedirect(w http.ResponseWriter, r *http.Request, key, val string) {
+	http.Redirect(w, r, "/kept-data?"+key+"="+url.QueryEscape(val), http.StatusFound)
+}
+
+// keptDeleteHandler — the household's Delete. The typed confirmation must equal the item's name.
+func (s *Server) keptDeleteHandler(w http.ResponseWriter, r *http.Request) {
+	_ = r.ParseForm()
+	lang := s.langFor(r)
+	path, confirm := r.FormValue("path"), strings.TrimSpace(r.FormValue("confirm"))
+	it, ok := s.stackMgr.FindKept(s.keptDrives(), path)
+	if !ok {
+		s.logger.Printf("[WARN] [web] kept delete REFUSED: %q is not a listed kept item (from %s)", path, r.RemoteAddr)
+		s.keptRedirect(w, r, "flash_error", s.msgLang(lang, "err.kept.not_listed"))
+		return
+	}
+	if confirm != it.DisplayName {
+		s.logger.Printf("[WARN] [web] kept delete REFUSED for %s: the typed confirmation did not match", it.Path)
+		s.keptRedirect(w, r, "flash_error", s.msgLang(lang, "kept.delete.mismatch", it.DisplayName))
+		return
+	}
+	if _, err := s.stackMgr.DeleteKept(s.keptDrives(), path); err != nil {
+		s.keptRedirect(w, r, "flash_error", s.errText(r, err))
+		return
+	}
+	go s.SyncFileBrowserMounts() // the view follows the list
+	s.keptRedirect(w, r, "flash", s.msgLang(lang, "kept.deleted", it.DisplayName))
+}
+
+// keptLoadHandler — Load: install the app with this data (the same act as „use my kept data").
+func (s *Server) keptLoadHandler(w http.ResponseWriter, r *http.Request) {
+	_ = r.ParseForm()
+	lang := s.langFor(r)
+	it, ok := s.stackMgr.FindKept(s.keptDrives(), r.FormValue("path"))
+	if !ok {
+		s.keptRedirect(w, r, "flash_error", s.msgLang(lang, "err.kept.not_listed"))
+		return
+	}
+	if st, ok := s.stackMgr.GetStack(it.App); it.App == "" || !ok || st.Deployed {
+		s.keptRedirect(w, r, "flash_error", s.msgLang(lang, "kept.load.installed", it.DisplayName))
+		return
+	}
+	if msg, blocked := s.restoreOpBlocked(); blocked {
+		s.keptRedirect(w, r, "flash_error", msg)
+		return
+	}
+	_, unit, can := s.keptBackupFor(lang, it)
+	if !can {
+		s.keptRedirect(w, r, "flash_error", s.msgLang(lang, "kept.choice.use_off"))
+		return
+	}
+	if it.Kind == stacks.KeptKindDated {
+		if _, err := s.stackMgr.RestoreKeptFiles(it); err != nil {
+			s.keptRedirect(w, r, "flash_error", s.errText(r, err))
+			return
+		}
+	}
+	s.logger.Printf("[INFO] [web] kept LOAD %s: %s from %s (from %s)", it.App, it.Path, unit, r.RemoteAddr)
+	app, disp := it.App, it.DisplayName
+	s.backupMgr.LoadKeptApp(app, unit,
+		func(error) string { return s.msgLang(lang, "kept.load.done", disp) },
+		func(err error) string { return s.msgLang(lang, "kept.load.failed", disp, err) },
+		func(ok bool) {
+			if ok {
+				if ran, err := s.stackMgr.RunAfterLoad(app, 10*time.Minute); ran && err != nil {
+					s.logger.Printf("[WARN] [web] kept load %s: after_load failed: %v", app, err)
+				}
+				s.stackMgr.FinishKeptLoad(it, s.backupMgr.PrimaryUnitHome(app, it.Drive))
+			}
+			s.SyncFileBrowserMounts()
+		})
+	http.Redirect(w, r, "/backups/restore?"+flashQuery("flash", "flash.restore.started"), http.StatusFound)
+}
+
+// keptFileBrowserBinds are the read-only binds of the „Megőrzött adatok" source: one per listed item,
+// `:ro`, under /srv/<source dir> — never a live app's folder (ListKept never lists one).
+func (s *Server) keptFileBrowserBinds() []string {
+	if s.stackMgr == nil {
+		return nil
+	}
+	return keptBindLines(s.stackMgr.ListKept(s.keptDrives()))
+}
+
+// keptBindLines renders the compose bind lines — each READ-ONLY. Pinned by TestKept_FileBrowserBindsAreReadOnly.
+func keptBindLines(items []stacks.KeptItem) []string {
+	var out []string
+	for _, it := range items {
+		out = append(out, "      - "+it.Path+":/srv/"+infra.FileBrowserKeptMount+"/"+KeptViewName(it)+":ro")
+	}
+	return out
+}

controller/internal/web/server.go

@@ -632,6 +632,12 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		s.settingsHandler(w, r)
 	case path == "/storage" && r.Method == http.MethodGet:
 		s.storagePageHandler(w, r)
+	case path == "/kept-data" && r.Method == http.MethodGet:
+		s.keptPageHandler(w, r)
+	case path == "/kept-data/delete" && r.Method == http.MethodPost:
+		s.keptDeleteHandler(w, r)
+	case path == "/kept-data/load" && r.Method == http.MethodPost:
+		s.keptLoadHandler(w, r)
 	case path == "/storage/network" && r.Method == http.MethodGet:
 		s.storageNetworkPageHandler(w, r)
 	// „Megosztás" — LAN network sharing (R-7 slice 1)

controller/internal/web/templates/deploy.html

@@ -449,6 +449,7 @@
     {{end}}
     {{end}}
 
+    <div id="kept-choice" class="kept-choice card" hidden></div>
     <form id="deploy-form" class="deploy-form">
         {{/* R-351 SCENARIO A — the values below came from this app's OWN backup, so a reinstall does
              not ask the customer to remember what the backup already recorded. Stated, never silent:
@@ -680,6 +681,32 @@ var postDeployInfo = {
     deployFields: {{json .Meta.DeployFields}}
 };
 
+// showKeptChoice renders the two choices of `09` §3 decision 36. Every sentence arrives rendered in the
+// reader's language from the server (textContent only — nothing is parsed as HTML).
+function showKeptChoice(d, form) {
+    var box = document.getElementById('kept-choice');
+    box.textContent = '';
+    function el(tag, cls, text) { var x = document.createElement(tag); if (cls) x.className = cls; if (text) x.textContent = text; return x; }
+    box.appendChild(el('h3', 'kept-choice-title', d.title));
+    box.appendChild(el('p', 'kept-choice-body', d.body));
+    function option(label, desc, choice, enabled, extra) {
+        var o = el('div', 'kept-choice-option');
+        var b = el('button', enabled ? 'btn btn-primary' : 'btn btn-outline', label);
+        b.type = 'button';
+        b.disabled = !enabled;
+        b.setAttribute('data-kept-choice', choice);
+        b.addEventListener('click', function () { window.keptChoice = choice; box.hidden = true; form.requestSubmit(); });
+        o.appendChild(b);
+        o.appendChild(el('p', 'kept-choice-desc', desc));
+        if (extra) o.appendChild(el('p', 'kept-choice-note', extra));
+        return o;
+    }
+    box.appendChild(option(d.use_label, d.use_offered ? d.use_desc : d.use_off, 'use', d.use_offered, ''));
+    box.appendChild(option(d.fresh_label, d.fresh_desc, 'fresh', true, d.not_backed_up));
+    box.hidden = false;
+    box.scrollIntoView({behavior: 'smooth'});
+}
+
 function buildPostDeployCard(stackName) {
     var subdomain = '';
     var sdField = document.getElementById('field-SUBDOMAIN');
@@ -992,9 +1019,16 @@ document.getElementById('deploy-form').addEventListener('submit', async function
         var resp = await fetch('/api/stacks/' + stackName + '/deploy', {
             method: 'POST',
             headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
-            body: JSON.stringify({values: values})
+            body: JSON.stringify({values: values, kept_data: window.keptChoice || ''})
         });
         var data = await resp.json();
+        // `09` §3 decision 36: the drive already holds this app's old data — the household chooses.
+        if (!data.ok && data.data && data.data.code === 'kept_data_choice') {
+            showKeptChoice(data.data, e.target);
+            btn.textContent = '{{T "deploy.telepites_inditasa"}}';
+            btn.disabled = false;
+            return;
+        }
         if (!data.ok) {
             showAlert('{{T "common.hiba_kettospont"}} ' + data.error);
             btn.textContent = '{{T "deploy.telepites_inditasa"}}';
@@ -1015,7 +1049,7 @@ document.getElementById('deploy-form').addEventListener('submit', async function
 
         // Phase 2: Poll stack status
         var startTime = Date.now();
-        var pollTimeout = 120000;
+        var pollTimeout = window.keptChoice === 'use' ? 900000 : 120000; // a load restores a backup first
         var pollTimer = setInterval(async function() {
             var elapsed = Math.round((Date.now() - startTime) / 1000);
             elapsedEl.textContent = elapsed + ' {{T "deploy.masodperce"}}';

controller/internal/web/templates/kept_data.html

@@ -0,0 +1,58 @@
+{{define "kept_data"}}
+{{template "layout_start" .}}
+
+<div class="page-header">
+    <div class="kept-header">
+        <a href="/storage" class="btn btn-sm btn-outline">{{T "kept.page.back"}}</a>
+        <h2>{{T "kept.page.title"}}</h2>
+    </div>
+</div>
+
+{{if .KeptError}}<div class="alert alert-error">{{.KeptError}}</div>{{end}}
+{{if .KeptFlash}}<div class="alert alert-info">{{.KeptFlash}}</div>{{end}}
+
+<div class="settings-card">
+    <p class="settings-card-desc">{{T "kept.page.intro"}}</p>
+    <p class="form-hint">{{T "kept.not_backed_up"}}</p>
+    {{if .KeptRows}}
+    <div class="kept-list">
+        {{range .KeptRows}}
+        <div class="kept-item" data-kept-path="{{.Path}}">
+            <div class="kept-item-head">
+                <span class="kept-item-name">{{.DisplayName}}</span>
+                <span class="kept-item-meta mono">{{.Date}} · {{.Size}}</span>
+            </div>
+            <div class="kept-item-backup">{{T "kept.list.backup"}} {{.Backup}}</div>
+            <div class="kept-item-actions">
+                {{if .CanLoad}}
+                <form method="POST" action="/kept-data/load" class="kept-inline-form">
+                    {{$.CSRFField}}
+                    <input type="hidden" name="path" value="{{.Path}}">
+                    <button type="submit" class="btn btn-sm btn-primary">{{T "kept.action.load"}}</button>
+                </form>
+                {{else if .Installed}}
+                <span class="form-hint">{{T "kept.list.installed"}}</span>
+                {{end}}
+                <a href="{{.LookURL}}" target="_blank" rel="noopener" class="btn btn-sm btn-outline">{{T "kept.action.look"}}</a>
+            </div>
+            <details class="kept-delete">
+                <summary class="btn btn-sm btn-outline">{{T "kept.action.delete"}}</summary>
+                <form method="POST" action="/kept-data/delete" class="kept-delete-form">
+                    {{$.CSRFField}}
+                    <input type="hidden" name="path" value="{{.Path}}">
+                    <p class="kept-delete-text">{{.DeleteText}}</p>
+                    <label class="form-hint">{{.TypePrompt}}</label>
+                    <input type="text" name="confirm" autocomplete="off" required>
+                    <button type="submit" class="btn btn-sm btn-danger">{{T "kept.action.delete_final"}}</button>
+                </form>
+            </details>
+        </div>
+        {{end}}
+    </div>
+    {{else}}
+    <p class="form-hint">{{T "kept.list.empty"}}</p>
+    {{end}}
+</div>
+
+{{template "layout_end" .}}
+{{end}}

controller/internal/web/templates/storage.html

@@ -12,6 +12,7 @@
 
     {{if .StorageError}}<div class="alert alert-error">{{.StorageError}}</div>{{end}}
     {{if .StorageSuccess}}<div class="alert alert-info">{{.StorageSuccess}}</div>{{end}}
+    <p class="storage-kept-link"><a href="/kept-data" class="btn btn-sm btn-outline">{{T "kept.page.title"}}</a> <span class="form-hint">{{T "kept.page.link_hint"}}</span></p>
 
     {{if .StoragePaths}}
     <div class="storage-paths-list">

controller/internal/web/templates/style.css

@@ -3682,3 +3682,25 @@ html::-webkit-scrollbar-track { background: var(--bg-0); }
    the shared .lang-globe-menu rule, so this block adds no positioning of its own. It floated in the
    top-left of the viewport before, outside the card, which read as a stray browser control. */
 .shell-lang { display: flex; justify-content: center; margin-top: 1.5rem; }
+
+/* ── Kept data (`09` §3 decision 36): the install-time choice and the „Megőrzött adatok" list ── */
+.kept-choice { margin-bottom: 1rem; }
+.kept-choice-title { margin: 0 0 .5rem; }
+.kept-choice-body { color: var(--text-1); margin: 0 0 1rem; }
+.kept-choice-option { border-top: 1px solid var(--line-soft); padding: .75rem 0; }
+.kept-choice-desc, .kept-choice-note { color: var(--text-2); margin: .4rem 0 0; font-size: .9rem; }
+.kept-choice-note { color: var(--text-3); }
+.kept-header { display: flex; align-items: center; gap: .5rem; }
+.kept-list { display: flex; flex-direction: column; gap: .75rem; margin-top: .75rem; }
+.kept-item { border: 1px solid var(--line); border-radius: var(--radius); padding: .75rem; background: var(--bg-1); }
+.kept-item-head { display: flex; justify-content: space-between; gap: .75rem; flex-wrap: wrap; }
+.kept-item-name { font-weight: 600; color: var(--text-1); }
+.kept-item-meta { color: var(--text-2); }
+.kept-item-backup { color: var(--text-2); margin: .35rem 0 .5rem; font-size: .9rem; }
+.kept-item-actions { display: flex; gap: .5rem; align-items: center; flex-wrap: wrap; }
+.kept-inline-form { display: inline; margin: 0; }
+.kept-delete { margin-top: .5rem; }
+.kept-delete summary { list-style: none; display: inline-block; cursor: pointer; }
+.kept-delete-form { display: flex; flex-direction: column; gap: .4rem; margin-top: .5rem; max-width: 32rem; }
+.kept-delete-text { color: var(--warn); margin: 0; }
+.storage-kept-link { margin-top: .75rem; }

controller/internal/web/testdata/i18n_parity/deploy_deployed_running.html

@@ -664,6 +664,7 @@
 
     
 
+    <div id="kept-choice" class="kept-choice card" hidden></div>
     <form id="deploy-form" class="deploy-form">
         
         
@@ -919,6 +920,32 @@ var postDeployInfo = {
     deployFields: null
 };
 
+
+
+function showKeptChoice(d, form) {
+    var box = document.getElementById('kept-choice');
+    box.textContent = '';
+    function el(tag, cls, text) { var x = document.createElement(tag); if (cls) x.className = cls; if (text) x.textContent = text; return x; }
+    box.appendChild(el('h3', 'kept-choice-title', d.title));
+    box.appendChild(el('p', 'kept-choice-body', d.body));
+    function option(label, desc, choice, enabled, extra) {
+        var o = el('div', 'kept-choice-option');
+        var b = el('button', enabled ? 'btn btn-primary' : 'btn btn-outline', label);
+        b.type = 'button';
+        b.disabled = !enabled;
+        b.setAttribute('data-kept-choice', choice);
+        b.addEventListener('click', function () { window.keptChoice = choice; box.hidden = true; form.requestSubmit(); });
+        o.appendChild(b);
+        o.appendChild(el('p', 'kept-choice-desc', desc));
+        if (extra) o.appendChild(el('p', 'kept-choice-note', extra));
+        return o;
+    }
+    box.appendChild(option(d.use_label, d.use_offered ? d.use_desc : d.use_off, 'use', d.use_offered, ''));
+    box.appendChild(option(d.fresh_label, d.fresh_desc, 'fresh', true, d.not_backed_up));
+    box.hidden = false;
+    box.scrollIntoView({behavior: 'smooth'});
+}
+
 function buildPostDeployCard(stackName) {
     var subdomain = '';
     var sdField = document.getElementById('field-SUBDOMAIN');
@@ -1231,9 +1258,16 @@ document.getElementById('deploy-form').addEventListener('submit', async function
         var resp = await fetch('/api/stacks/' + stackName + '/deploy', {
             method: 'POST',
             headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
-            body: JSON.stringify({values: values})
+            body: JSON.stringify({values: values, kept_data: window.keptChoice || ''})
         });
         var data = await resp.json();
+        
+        if (!data.ok && data.data && data.data.code === 'kept_data_choice') {
+            showKeptChoice(data.data, e.target);
+            btn.textContent = 'Telepítés indítása';
+            btn.disabled = false;
+            return;
+        }
         if (!data.ok) {
             showAlert('Hiba: ' + data.error);
             btn.textContent = 'Telepítés indítása';
@@ -1254,7 +1288,7 @@ document.getElementById('deploy-form').addEventListener('submit', async function
 
         
         var startTime = Date.now();
-        var pollTimeout = 120000;
+        var pollTimeout = window.keptChoice === 'use' ? 900000 : 120000; 
         var pollTimer = setInterval(async function() {
             var elapsed = Math.round((Date.now() - startTime) / 1000);
             elapsedEl.textContent = elapsed + ' másodperce...';

controller/internal/web/testdata/i18n_parity/deploy_deployed_stopped.html

@@ -613,6 +613,7 @@
 
     
 
+    <div id="kept-choice" class="kept-choice card" hidden></div>
     <form id="deploy-form" class="deploy-form">
         
         
@@ -846,6 +847,32 @@ var postDeployInfo = {
     deployFields: null
 };
 
+
+
+function showKeptChoice(d, form) {
+    var box = document.getElementById('kept-choice');
+    box.textContent = '';
+    function el(tag, cls, text) { var x = document.createElement(tag); if (cls) x.className = cls; if (text) x.textContent = text; return x; }
+    box.appendChild(el('h3', 'kept-choice-title', d.title));
+    box.appendChild(el('p', 'kept-choice-body', d.body));
+    function option(label, desc, choice, enabled, extra) {
+        var o = el('div', 'kept-choice-option');
+        var b = el('button', enabled ? 'btn btn-primary' : 'btn btn-outline', label);
+        b.type = 'button';
+        b.disabled = !enabled;
+        b.setAttribute('data-kept-choice', choice);
+        b.addEventListener('click', function () { window.keptChoice = choice; box.hidden = true; form.requestSubmit(); });
+        o.appendChild(b);
+        o.appendChild(el('p', 'kept-choice-desc', desc));
+        if (extra) o.appendChild(el('p', 'kept-choice-note', extra));
+        return o;
+    }
+    box.appendChild(option(d.use_label, d.use_offered ? d.use_desc : d.use_off, 'use', d.use_offered, ''));
+    box.appendChild(option(d.fresh_label, d.fresh_desc, 'fresh', true, d.not_backed_up));
+    box.hidden = false;
+    box.scrollIntoView({behavior: 'smooth'});
+}
+
 function buildPostDeployCard(stackName) {
     var subdomain = '';
     var sdField = document.getElementById('field-SUBDOMAIN');
@@ -1158,9 +1185,16 @@ document.getElementById('deploy-form').addEventListener('submit', async function
         var resp = await fetch('/api/stacks/' + stackName + '/deploy', {
             method: 'POST',
             headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
-            body: JSON.stringify({values: values})
+            body: JSON.stringify({values: values, kept_data: window.keptChoice || ''})
         });
         var data = await resp.json();
+        
+        if (!data.ok && data.data && data.data.code === 'kept_data_choice') {
+            showKeptChoice(data.data, e.target);
+            btn.textContent = 'Telepítés indítása';
+            btn.disabled = false;
+            return;
+        }
         if (!data.ok) {
             showAlert('Hiba: ' + data.error);
             btn.textContent = 'Telepítés indítása';
@@ -1181,7 +1215,7 @@ document.getElementById('deploy-form').addEventListener('submit', async function
 
         
         var startTime = Date.now();
-        var pollTimeout = 120000;
+        var pollTimeout = window.keptChoice === 'use' ? 900000 : 120000; 
         var pollTimer = setInterval(async function() {
             var elapsed = Math.round((Date.now() - startTime) / 1000);
             elapsedEl.textContent = elapsed + ' másodperce...';

controller/internal/web/testdata/i18n_parity/deploy_new.html

@@ -610,6 +610,7 @@
     
     
 
+    <div id="kept-choice" class="kept-choice card" hidden></div>
     <form id="deploy-form" class="deploy-form">
         
         
@@ -895,6 +896,32 @@ var postDeployInfo = {
     deployFields: null
 };
 
+
+
+function showKeptChoice(d, form) {
+    var box = document.getElementById('kept-choice');
+    box.textContent = '';
+    function el(tag, cls, text) { var x = document.createElement(tag); if (cls) x.className = cls; if (text) x.textContent = text; return x; }
+    box.appendChild(el('h3', 'kept-choice-title', d.title));
+    box.appendChild(el('p', 'kept-choice-body', d.body));
+    function option(label, desc, choice, enabled, extra) {
+        var o = el('div', 'kept-choice-option');
+        var b = el('button', enabled ? 'btn btn-primary' : 'btn btn-outline', label);
+        b.type = 'button';
+        b.disabled = !enabled;
+        b.setAttribute('data-kept-choice', choice);
+        b.addEventListener('click', function () { window.keptChoice = choice; box.hidden = true; form.requestSubmit(); });
+        o.appendChild(b);
+        o.appendChild(el('p', 'kept-choice-desc', desc));
+        if (extra) o.appendChild(el('p', 'kept-choice-note', extra));
+        return o;
+    }
+    box.appendChild(option(d.use_label, d.use_offered ? d.use_desc : d.use_off, 'use', d.use_offered, ''));
+    box.appendChild(option(d.fresh_label, d.fresh_desc, 'fresh', true, d.not_backed_up));
+    box.hidden = false;
+    box.scrollIntoView({behavior: 'smooth'});
+}
+
 function buildPostDeployCard(stackName) {
     var subdomain = '';
     var sdField = document.getElementById('field-SUBDOMAIN');
@@ -1207,9 +1234,16 @@ document.getElementById('deploy-form').addEventListener('submit', async function
         var resp = await fetch('/api/stacks/' + stackName + '/deploy', {
             method: 'POST',
             headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
-            body: JSON.stringify({values: values})
+            body: JSON.stringify({values: values, kept_data: window.keptChoice || ''})
         });
         var data = await resp.json();
+        
+        if (!data.ok && data.data && data.data.code === 'kept_data_choice') {
+            showKeptChoice(data.data, e.target);
+            btn.textContent = 'Telepítés indítása';
+            btn.disabled = false;
+            return;
+        }
         if (!data.ok) {
             showAlert('Hiba: ' + data.error);
             btn.textContent = 'Telepítés indítása';
@@ -1230,7 +1264,7 @@ document.getElementById('deploy-form').addEventListener('submit', async function
 
         
         var startTime = Date.now();
-        var pollTimeout = 120000;
+        var pollTimeout = window.keptChoice === 'use' ? 900000 : 120000; 
         var pollTimer = setInterval(async function() {
             var elapsed = Math.round((Date.now() - startTime) / 1000);
             elapsedEl.textContent = elapsed + ' másodperce...';

controller/internal/web/testdata/i18n_parity/deploy_new_blocked.html

@@ -590,6 +590,7 @@
     
     
 
+    <div id="kept-choice" class="kept-choice card" hidden></div>
     <form id="deploy-form" class="deploy-form">
         
         
@@ -844,6 +845,32 @@ var postDeployInfo = {
     deployFields: null
 };
 
+
+
+function showKeptChoice(d, form) {
+    var box = document.getElementById('kept-choice');
+    box.textContent = '';
+    function el(tag, cls, text) { var x = document.createElement(tag); if (cls) x.className = cls; if (text) x.textContent = text; return x; }
+    box.appendChild(el('h3', 'kept-choice-title', d.title));
+    box.appendChild(el('p', 'kept-choice-body', d.body));
+    function option(label, desc, choice, enabled, extra) {
+        var o = el('div', 'kept-choice-option');
+        var b = el('button', enabled ? 'btn btn-primary' : 'btn btn-outline', label);
+        b.type = 'button';
+        b.disabled = !enabled;
+        b.setAttribute('data-kept-choice', choice);
+        b.addEventListener('click', function () { window.keptChoice = choice; box.hidden = true; form.requestSubmit(); });
+        o.appendChild(b);
+        o.appendChild(el('p', 'kept-choice-desc', desc));
+        if (extra) o.appendChild(el('p', 'kept-choice-note', extra));
+        return o;
+    }
+    box.appendChild(option(d.use_label, d.use_offered ? d.use_desc : d.use_off, 'use', d.use_offered, ''));
+    box.appendChild(option(d.fresh_label, d.fresh_desc, 'fresh', true, d.not_backed_up));
+    box.hidden = false;
+    box.scrollIntoView({behavior: 'smooth'});
+}
+
 function buildPostDeployCard(stackName) {
     var subdomain = '';
     var sdField = document.getElementById('field-SUBDOMAIN');
@@ -1156,9 +1183,16 @@ document.getElementById('deploy-form').addEventListener('submit', async function
         var resp = await fetch('/api/stacks/' + stackName + '/deploy', {
             method: 'POST',
             headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
-            body: JSON.stringify({values: values})
+            body: JSON.stringify({values: values, kept_data: window.keptChoice || ''})
         });
         var data = await resp.json();
+        
+        if (!data.ok && data.data && data.data.code === 'kept_data_choice') {
+            showKeptChoice(data.data, e.target);
+            btn.textContent = 'Telepítés indítása';
+            btn.disabled = false;
+            return;
+        }
         if (!data.ok) {
             showAlert('Hiba: ' + data.error);
             btn.textContent = 'Telepítés indítása';
@@ -1179,7 +1213,7 @@ document.getElementById('deploy-form').addEventListener('submit', async function
 
         
         var startTime = Date.now();
-        var pollTimeout = 120000;
+        var pollTimeout = window.keptChoice === 'use' ? 900000 : 120000; 
         var pollTimer = setInterval(async function() {
             var elapsed = Math.round((Date.now() - startTime) / 1000);
             elapsedEl.textContent = elapsed + ' másodperce...';

controller/internal/web/testdata/i18n_parity/deploy_new_memory_blocked.html

@@ -595,6 +595,7 @@
     
     
 
+    <div id="kept-choice" class="kept-choice card" hidden></div>
     <form id="deploy-form" class="deploy-form">
         
         
@@ -874,6 +875,32 @@ var postDeployInfo = {
     deployFields: null
 };
 
+
+
+function showKeptChoice(d, form) {
+    var box = document.getElementById('kept-choice');
+    box.textContent = '';
+    function el(tag, cls, text) { var x = document.createElement(tag); if (cls) x.className = cls; if (text) x.textContent = text; return x; }
+    box.appendChild(el('h3', 'kept-choice-title', d.title));
+    box.appendChild(el('p', 'kept-choice-body', d.body));
+    function option(label, desc, choice, enabled, extra) {
+        var o = el('div', 'kept-choice-option');
+        var b = el('button', enabled ? 'btn btn-primary' : 'btn btn-outline', label);
+        b.type = 'button';
+        b.disabled = !enabled;
+        b.setAttribute('data-kept-choice', choice);
+        b.addEventListener('click', function () { window.keptChoice = choice; box.hidden = true; form.requestSubmit(); });
+        o.appendChild(b);
+        o.appendChild(el('p', 'kept-choice-desc', desc));
+        if (extra) o.appendChild(el('p', 'kept-choice-note', extra));
+        return o;
+    }
+    box.appendChild(option(d.use_label, d.use_offered ? d.use_desc : d.use_off, 'use', d.use_offered, ''));
+    box.appendChild(option(d.fresh_label, d.fresh_desc, 'fresh', true, d.not_backed_up));
+    box.hidden = false;
+    box.scrollIntoView({behavior: 'smooth'});
+}
+
 function buildPostDeployCard(stackName) {
     var subdomain = '';
     var sdField = document.getElementById('field-SUBDOMAIN');
@@ -1186,9 +1213,16 @@ document.getElementById('deploy-form').addEventListener('submit', async function
         var resp = await fetch('/api/stacks/' + stackName + '/deploy', {
             method: 'POST',
             headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
-            body: JSON.stringify({values: values})
+            body: JSON.stringify({values: values, kept_data: window.keptChoice || ''})
         });
         var data = await resp.json();
+        
+        if (!data.ok && data.data && data.data.code === 'kept_data_choice') {
+            showKeptChoice(data.data, e.target);
+            btn.textContent = 'Telepítés indítása';
+            btn.disabled = false;
+            return;
+        }
         if (!data.ok) {
             showAlert('Hiba: ' + data.error);
             btn.textContent = 'Telepítés indítása';
@@ -1209,7 +1243,7 @@ document.getElementById('deploy-form').addEventListener('submit', async function
 
         
         var startTime = Date.now();
-        var pollTimeout = 120000;
+        var pollTimeout = window.keptChoice === 'use' ? 900000 : 120000; 
         var pollTimer = setInterval(async function() {
             var elapsed = Math.round((Date.now() - startTime) / 1000);
             elapsedEl.textContent = elapsed + ' másodperce...';

controller/internal/web/testdata/i18n_parity/kept_data_empty.html

@@ -0,0 +1,521 @@
+
+
+<!DOCTYPE html>
+<html lang="hu" class="no-js">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Megőrzött adatok — Felhom.eu</title>
+    
+    <link rel="icon" type="image/svg+xml" href="/static/favicon.svg?v=0.247.0">
+    <link rel="stylesheet" href="/static/style.css?v=0.247.0">
+    <meta name="csrf-token" content="tok">
+    <script>
+    
+    
+    document.documentElement.className=document.documentElement.className.replace('no-js','js');
+    function csrfHeaders(){var el=document.querySelector('meta[name="csrf-token"]');return el?{'X-CSRF-Token':el.content}:{};}
+    
+    
+    
+    
+    
+    function felhomConfirm(el,question,onYes){
+        if(!el||el.dataset.fcOpen)return;
+        el.dataset.fcOpen='1';
+        var wrap=document.createElement('span');wrap.className='inline-confirm';
+        var q=document.createElement('span');q.className='inline-confirm-q';q.textContent=question;
+        var yes=document.createElement('button');yes.type='button';yes.className='btn btn-xs btn-danger';yes.textContent='Igen';
+        var no=document.createElement('button');no.type='button';no.className='btn btn-xs btn-outline';no.textContent='Mégse';
+        wrap.appendChild(q);wrap.appendChild(yes);wrap.appendChild(no);
+        el.style.display='none';el.parentNode.insertBefore(wrap,el.nextSibling);
+        function close(){wrap.remove();el.style.display='';delete el.dataset.fcOpen;}
+        no.addEventListener('click',close);
+        yes.addEventListener('click',function(){close();onYes();});
+    }
+    document.addEventListener('click',function(e){
+        var btn=e.target.closest?e.target.closest('[data-confirm]'):null;
+        if(!btn)return;
+        e.preventDefault();
+        felhomConfirm(btn,btn.getAttribute('data-confirm'),function(){
+            var form=btn.closest('form');
+            if(form){if(form.requestSubmit)form.requestSubmit(btn);else form.submit();}
+        });
+    });
+    
+
+    document.addEventListener('click',function(e){
+        var btn=e.target.closest?e.target.closest('.nav-group-toggle'):null;
+        if(!btn)return;
+        var group=btn.closest('.nav-group');
+        if(!group)return;
+        var willOpen=!group.classList.contains('is-open');
+        document.querySelectorAll('.nav-group.is-open').forEach(function(g){
+            g.classList.remove('is-open');
+            var t=g.querySelector('.nav-group-toggle');
+            if(t)t.setAttribute('aria-expanded','false');
+        });
+        if(willOpen){group.classList.add('is-open');btn.setAttribute('aria-expanded','true');}
+    });
+    function showAlert(msg){var o=document.createElement('div');o.className='modal-overlay';o.id='alert-modal';o.addEventListener('click',function(e){if(e.target===o)o.remove();});var c=document.createElement('div');c.className='modal-card';c.innerHTML='<h3>Üzenet</h3><pre style="white-space:pre-wrap;word-break:break-word;background:var(--bg-2);padding:.75rem;border-radius:.375rem;font-size:.85rem;max-height:60vh;overflow-y:auto;user-select:text;cursor:text">'+msg.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;')+'</pre><div class="modal-actions"><button class="btn btn-primary" onclick="document.getElementById(\'alert-modal\').remove()">OK</button></div>';o.appendChild(c);document.body.appendChild(o);}
+    </script>
+</head>
+<body>
+    <svg xmlns="http://www.w3.org/2000/svg" style="display:none" aria-hidden="true">
+<symbol id="i-hard-drive" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 16h.01" /> <path d="M2.212 11.577a2 2 0 0 0-.212.896V18a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-5.527a2 2 0 0 0-.212-.896L18.55 5.11A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z" /> <path d="M21.946 12.013H2.054" /> <path d="M6 16h.01" /></symbol>
+<symbol id="i-cpu" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 20v2" /> <path d="M12 2v2" /> <path d="M17 20v2" /> <path d="M17 2v2" /> <path d="M2 12h2" /> <path d="M2 17h2" /> <path d="M2 7h2" /> <path d="M20 12h2" /> <path d="M20 17h2" /> <path d="M20 7h2" /> <path d="M7 20v2" /> <path d="M7 2v2" /> <rect x="4" y="4" width="16" height="16" rx="2" /> <rect x="8" y="8" width="8" height="8" rx="1" /></symbol>
+<symbol id="i-memory-stick" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 12v-2" /> <path d="M12 18v-2" /> <path d="M16 12v-2" /> <path d="M16 18v-2" /> <path d="M2 11h1.5" /> <path d="M20 18v-2" /> <path d="M20.5 11H22" /> <path d="M4 18v-2" /> <path d="M8 12v-2" /> <path d="M8 18v-2" /> <rect x="2" y="6" width="20" height="10" rx="2" /></symbol>
+<symbol id="i-thermometer" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 4v10.54a4 4 0 1 1-4 0V4a2 2 0 0 1 4 0Z" /></symbol>
+<symbol id="i-triangle-alert" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3" /> <path d="M12 9v4" /> <path d="M12 17h.01" /></symbol>
+<symbol id="i-lock" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="18" height="11" x="3" y="11" rx="2" ry="2" /> <path d="M7 11V7a5 5 0 0 1 10 0v4" /></symbol>
+<symbol id="i-cloud" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M17.5 19H9a7 7 0 1 1 6.71-9h1.79a4.5 4.5 0 1 1 0 9Z" /></symbol>
+<symbol id="i-square" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="18" height="18" x="3" y="3" rx="2" /></symbol>
+<symbol id="i-rotate-cw" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12a9 9 0 1 1-9-9c2.52 0 4.93 1 6.74 2.74L21 8" /> <path d="M21 3v5h-5" /></symbol>
+<symbol id="i-file-text" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z" /> <path d="M14 2v5a1 1 0 0 0 1 1h5" /> <path d="M10 9H8" /> <path d="M16 13H8" /> <path d="M16 17H8" /></symbol>
+<symbol id="i-external-link" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 3h6v6" /> <path d="M10 14 21 3" /> <path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6" /></symbol>
+<symbol id="i-shield" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z" /></symbol>
+<symbol id="i-server" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="20" height="8" x="2" y="2" rx="2" ry="2" /> <rect width="20" height="8" x="2" y="14" rx="2" ry="2" /> <line x1="6" x2="6.01" y1="6" y2="6" /> <line x1="6" x2="6.01" y1="18" y2="18" /></symbol>
+<symbol id="i-share" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="18" cy="5" r="3" /> <circle cx="6" cy="12" r="3" /> <circle cx="18" cy="19" r="3" /> <line x1="8.59" x2="15.42" y1="13.51" y2="17.49" /> <line x1="15.41" x2="8.59" y1="6.51" y2="10.49" /></symbol>
+<symbol id="i-layout-grid" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="7" height="7" x="3" y="3" rx="1" /> <rect width="7" height="7" x="14" y="3" rx="1" /> <rect width="7" height="7" x="14" y="14" rx="1" /> <rect width="7" height="7" x="3" y="14" rx="1" /></symbol>
+<symbol id="i-rocket" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4.5 16.5c-1.5 1.26-2 5-2 5s3.74-.5 5-2c.71-.84.7-2.13-.09-2.91a2.18 2.18 0 0 0-2.91 0z" /> <path d="m12 15-3-3a22 22 0 0 1 2-3.95A12.88 12.88 0 0 1 22 2c0 2.72-.78 7.5-6 11a22.35 22.35 0 0 1-4 2z" /> <path d="M9 12H4s.55-3.03 2-4c1.62-1.08 5 0 5 0" /> <path d="M12 15v5s3.03-.55 4-2c1.08-1.62 0-5 0-5" /></symbol>
+<symbol id="i-settings" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9.671 4.136a2.34 2.34 0 0 1 4.659 0 2.34 2.34 0 0 0 3.319 1.915 2.34 2.34 0 0 1 2.33 4.033 2.34 2.34 0 0 0 0 3.831 2.34 2.34 0 0 1-2.33 4.033 2.34 2.34 0 0 0-3.319 1.915 2.34 2.34 0 0 1-4.659 0 2.34 2.34 0 0 0-3.32-1.915 2.34 2.34 0 0 1-2.33-4.033 2.34 2.34 0 0 0 0-3.831A2.34 2.34 0 0 1 6.35 6.051a2.34 2.34 0 0 0 3.319-1.915" /> <circle cx="12" cy="12" r="3" /></symbol>
+<symbol id="i-bell" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10.268 21a2 2 0 0 0 3.464 0" /> <path d="M3.262 15.326A1 1 0 0 0 4 17h16a1 1 0 0 0 .74-1.673C19.41 13.956 18 12.499 18 8A6 6 0 0 0 6 8c0 4.499-1.411 5.956-2.738 7.326" /></symbol>
+<symbol id="i-x" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 6 6 18" /> <path d="m6 6 12 12" /></symbol>
+<symbol id="i-check" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 6 9 17l-5-5" /></symbol>
+<symbol id="i-pencil" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21.174 6.812a1 1 0 0 0-3.986-3.987L3.842 16.174a2 2 0 0 0-.5.83l-1.321 4.352a.5.5 0 0 0 .623.622l4.353-1.32a2 2 0 0 0 .83-.497z" /> <path d="m15 5 4 4" /></symbol>
+<symbol id="i-info" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10" /> <path d="M12 16v-4" /> <path d="M12 8h.01" /></symbol>
+<symbol id="i-download" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 15V3" /> <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" /> <path d="m7 10 5 5 5-5" /></symbol>
+<symbol id="i-upload" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3v12" /> <path d="m17 8-5-5-5 5" /> <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" /></symbol>
+<symbol id="i-trash-2" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 11v6" /> <path d="M14 11v6" /> <path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6" /> <path d="M3 6h18" /> <path d="M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2" /></symbol>
+<symbol id="i-wrench" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.106-3.105c.32-.322.863-.22.983.218a6 6 0 0 1-8.259 7.057l-7.91 7.91a1 1 0 0 1-2.999-3l7.91-7.91a6 6 0 0 1 7.057-8.259c.438.12.54.662.219.984z" /></symbol>
+<symbol id="i-link" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71" /> <path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71" /></symbol>
+<symbol id="i-search" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m21 21-4.34-4.34" /> <circle cx="11" cy="11" r="8" /></symbol>
+<symbol id="i-plus" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M5 12h14" /> <path d="M12 5v14" /></symbol>
+<symbol id="i-chevron-down" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m6 9 6 6 6-6" /></symbol>
+<symbol id="i-play" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M5 5a2 2 0 0 1 3.008-1.728l11.997 6.998a2 2 0 0 1 .003 3.458l-12 7A2 2 0 0 1 5 19z" /></symbol>
+<symbol id="i-pause" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="14" y="3" width="5" height="18" rx="1" /> <rect x="5" y="3" width="5" height="18" rx="1" /></symbol>
+<symbol id="i-menu" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4 12h16" /> <path d="M4 6h16" /> <path d="M4 18h16" /></symbol>
+</svg>
+    <header class="mobile-topbar">
+        <a href="/" class="mobile-topbar-logo"><img src="/static/felhom-logo.svg?v=0.247.0" alt="Felhom.eu"></a>
+        <button type="button" class="nav-burger" aria-expanded="false" aria-controls="sidebar" aria-label="Menü">
+            <svg class="ico"><use href="#i-menu"/></svg>
+        </button>
+    </header>
+    <div class="nav-backdrop" hidden></div>
+    <nav class="sidebar" id="sidebar">
+        <div class="sidebar-header">
+            <img src="/static/felhom-logo.svg?v=0.247.0" alt="Felhom.eu" class="sidebar-logo">
+        </div>
+        <ul class="nav-links">
+            <li><a href="/launcher" class=""><svg class="ico"><use href="#i-rocket"/></svg>Indítópult</a></li>
+            <li><a href="/dashboard" class=""><svg class="ico"><use href="#i-layout-grid"/></svg>Vezérlőpult</a></li>
+            <li><a href="/stacks" class=""><svg class="ico"><use href="#i-cloud"/></svg>Alkalmazások</a></li>
+            
+            <li class="nav-group">
+                <button type="button" class="nav-group-toggle" aria-expanded="false" aria-controls="nav-group-storage"><svg class="ico"><use href="#i-hard-drive"/></svg>Tárhely<svg class="ico nav-chevron"><use href="#i-chevron-down"/></svg></button>
+                <ul id="nav-group-storage" class="nav-links nav-links-sub nav-links-nested">
+                    <li><a href="/storage" class="">Meghajtók</a></li>
+                    <li><a href="/storage/network" class="">Hálózati tárhely</a></li>
+                </ul>
+            </li>
+            
+            <li class="nav-group">
+                <button type="button" class="nav-group-toggle" aria-expanded="false" aria-controls="nav-group-backups"><svg class="ico"><use href="#i-shield"/></svg>Biztonsági mentés<svg class="ico nav-chevron"><use href="#i-chevron-down"/></svg></button>
+                <ul id="nav-group-backups" class="nav-links nav-links-sub nav-links-nested">
+                    <li><a href="/backups" class="">Áttekintés</a></li>
+                    <li><a href="/backups/remote" class="">Távoli mentés</a></li>
+                    <li><a href="/backups/apps" class="">Alkalmazások</a></li>
+                    <li><a href="/backups/restore" class="">Visszaállítás</a></li>
+                </ul>
+            </li>
+            
+            <li class="nav-group">
+                <button type="button" class="nav-group-toggle" aria-expanded="false" aria-controls="nav-group-sharing"><svg class="ico"><use href="#i-share"/></svg>Megosztás<svg class="ico nav-chevron"><use href="#i-chevron-down"/></svg></button>
+                <ul id="nav-group-sharing" class="nav-links nav-links-sub nav-links-nested">
+                    <li><a href="/sharing" class="">Hálózati megosztás</a></li>
+                </ul>
+            </li>
+            <li><a href="/monitoring" class=""><svg class="ico"><use href="#i-cpu"/></svg>Rendszermonitor</a></li>
+            <li><a href="/debug" class=""><svg class="ico"><use href="#i-wrench"/></svg>Debug</a></li>
+        </ul>
+        <div class="sidebar-bottom">
+            <div class="nav-group-label">Beállítások</div>
+            <ul class="nav-links nav-links-sub">
+                <li><a href="/settings" class=""><svg class="ico"><use href="#i-settings"/></svg>Rendszer</a></li>
+                <li><a href="/settings/notifications" class=""><svg class="ico"><use href="#i-bell"/></svg>Értesítések</a></li>
+                <li><a href="/settings/security" class=""><svg class="ico"><use href="#i-lock"/></svg>Biztonság és hozzáférés</a></li>
+            </ul>
+            <div class="sidebar-footer">
+                <span class="version">0.247.0</span><details class="lang-globe">
+    <summary class="lang-globe-btn" aria-label="Nyelv" title="Nyelv"><svg class="ico" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="10" /><path d="M2 12h20" /><path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z" /></svg></summary>
+    <ul class="lang-globe-menu">
+        <li><form method="POST" action="/settings/language"><input type="hidden" name="_csrf" value="CSRF"><input type="hidden" name="back" value="/i18n-fixture"><button type="submit" name="lang" value="hu" lang="hu" class="lang-globe-item current" aria-current="true">Magyar</button></form></li>
+        <li><form method="POST" action="/settings/language"><input type="hidden" name="_csrf" value="CSRF"><input type="hidden" name="back" value="/i18n-fixture"><button type="submit" name="lang" value="en" lang="en" class="lang-globe-item">English</button></form></li>
+    </ul>
+</details>
+                <a href="/logout" class="logout-link">Kijelentkezés ↗</a>
+            </div>
+        </div>
+    </nav>
+    <main class="content">
+
+
+
+
+
+
+
+
+<div class="page-header">
+    <div class="kept-header">
+        <a href="/storage" class="btn btn-sm btn-outline">Vissza</a>
+        <h2>Megőrzött adatok</h2>
+    </div>
+</div>
+
+
+
+
+<div class="settings-card">
+    <p class="settings-card-desc">Az eltávolított alkalmazások lemezen maradt adatai. Megnézheted őket, betöltheted egy új telepítésbe, vagy törölheted. Magától a szerver soha nem töröl közülük semmit.</p>
+    <p class="form-hint">Erről nem készül mentés.</p>
+    
+    <p class="form-hint">Nincs megőrzött adat.</p>
+    
+</div>
+
+
+    </main>
+    <script>
+    
+    
+    
+    (function(){
+        var burger=document.querySelector('.nav-burger');
+        var sidebar=document.getElementById('sidebar');
+        var backdrop=document.querySelector('.nav-backdrop');
+        if(!burger||!sidebar||!backdrop)return;
+        function setOpen(open){
+            sidebar.classList.toggle('is-open',open);
+            document.body.classList.toggle('nav-open',open);
+            backdrop.hidden=!open;
+            burger.setAttribute('aria-expanded',open?'true':'false');
+        }
+        burger.addEventListener('click',function(){setOpen(!sidebar.classList.contains('is-open'));});
+        backdrop.addEventListener('click',function(){setOpen(false);});
+        document.addEventListener('keydown',function(e){
+            if(e.key==='Escape'&&sidebar.classList.contains('is-open'))setOpen(false);
+        });
+    })();
+    document.addEventListener('click', function(e) {
+        if (e.target.closest('a, button, .btn, input, select, textarea, .app-row-actions, .stack-detail-actions')) return;
+        var card = e.target.closest('[data-href]');
+        if (card) window.location.href = card.dataset.href;
+    });
+    async function checkBeforeDeploy(e, name) {
+        try {
+            var resp = await fetch('/api/stacks/' + name);
+            var data = await resp.json();
+            if (data.ok && data.data && data.data.deployed) {
+                e.preventDefault();
+                showAlert('Ez az alkalmazás már telepítve van.');
+                window.location.reload();
+                return false;
+            }
+        } catch(err) {}
+        return true;
+    }
+    async function syncTemplates() {
+        const btn = document.getElementById('sync-btn');
+        const toast = document.getElementById('sync-toast');
+        if (!btn) return;
+        const origText = btn.innerHTML;
+        btn.disabled = true;
+        btn.innerHTML = '↻ Frissítés...';
+        btn.classList.add('loading');
+        try {
+            const resp = await fetch('/api/sync', {
+                method: 'POST',
+                headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders())
+            });
+            const data = await resp.json();
+            if (toast) {
+                toast.textContent = data.ok ? (data.message || 'Sablonok frissítve') : ('Hiba: ' + (data.error || 'Ismeretlen hiba'));
+                toast.className = 'sync-toast ' + (data.ok ? 'sync-toast-ok' : 'sync-toast-err');
+                toast.style.display = 'block';
+                setTimeout(function() { toast.style.display = 'none'; }, 5000);
+            }
+            if (data.ok && data.data && (data.data.new_apps && data.data.new_apps.length > 0 || data.data.updated && data.data.updated.length > 0)) {
+                setTimeout(function() { window.location.reload(); }, 1500);
+            }
+        } catch (err) {
+            if (toast) {
+                toast.textContent = 'Hálózati hiba: ' + err.message;
+                toast.className = 'sync-toast sync-toast-err';
+                toast.style.display = 'block';
+                setTimeout(function() { toast.style.display = 'none'; }, 5000);
+            }
+        }
+        btn.innerHTML = origText;
+        btn.disabled = false;
+        btn.classList.remove('loading');
+    }
+    async function stackAction(event, name, action) {
+        const btn = event.currentTarget;
+        const origText = btn.textContent;
+        btn.disabled = true;
+        btn.textContent = 'Folyamatban...';
+        btn.classList.add('loading');
+        try {
+            const resp = await fetch('/api/stacks/' + name + '/' + action, {
+                method: 'POST',
+                headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders())
+            });
+            const data = await resp.json();
+            if (!data.ok) {
+                showAlert('Hiba: ' + (data.error || 'Ismeretlen hiba'));
+                btn.textContent = origText;
+                btn.disabled = false;
+                btn.classList.remove('loading');
+                return;
+            }
+            
+            
+            
+            if (action === 'update') {
+                followUpdate(name, btn);
+                return;
+            }
+            window.location.reload();
+        } catch (err) {
+            showAlert('Hálózati hiba: ' + err.message);
+            btn.textContent = origText;
+            btn.disabled = false;
+            btn.classList.remove('loading');
+        }
+    }
+    function followUpdate(name, btn) {
+        var started = Date.now();
+        var timer = setInterval(async function() {
+            if (Date.now() - started > 30 * 60 * 1000) { clearInterval(timer); window.location.reload(); return; }
+            try {
+                var r = await fetch('/api/stacks/' + name);
+                var d = await r.json();
+                if (!d.ok || !d.data) return;
+                if (d.data.update_phase_label) btn.textContent = d.data.update_phase_label;
+                if (!d.data.updating) { clearInterval(timer); window.location.reload(); }
+            } catch (e) {}
+        }, 3000);
+    }
+    async function deleteOrphanStack(name) {
+        var modal = document.createElement('div');
+        modal.className = 'modal-overlay';
+        modal.id = 'delete-modal';
+        modal.innerHTML = '<div class="modal-card"><h3>Betöltés...</h3></div>';
+        modal.addEventListener('click', function(e) { if (e.target === modal) closeDeleteModal(); });
+        document.body.appendChild(modal);
+        try {
+            var resp = await fetch('/api/stacks/' + name + '/hdd-data');
+            var data = await resp.json();
+            var hddInfo = '';
+            var checkboxHTML = '';
+            if (data.ok && data.data && data.data.has_hdd_data) {
+                hddInfo = '<div class="modal-hdd-info"><strong>Felhasználói adatok a merevlemezen:</strong>';
+                data.data.hdd_paths.forEach(function(p) {
+                    hddInfo += '<div class="modal-hdd-path">' + p.path + ' (' + (p.exists ? p.size_human : 'nem létezik') + ')</div>';
+                });
+                hddInfo += '</div>';
+                checkboxHTML = '<label class="modal-checkbox"><input type="checkbox" id="delete-hdd-check"> Felhasználói adatok törlése a merevlemezről</label>';
+            }
+            modal.querySelector('.modal-card').innerHTML =
+                '<h3>Alkalmazás törlése: ' + name + '</h3>' +
+                '<p style="color:var(--text-2);font-size:.9rem;margin-bottom:.75rem">Ez a művelet eltávolítja a konténereket, a köteteket és a konfigurációs fájlokat.</p>' +
+                '<div class="alert alert-warning" style="margin-bottom:.75rem">Ez a művelet nem visszavonható!</div>' +
+                hddInfo + checkboxHTML +
+                '<div class="modal-actions">' +
+                    '<button class="btn btn-outline" onclick="closeDeleteModal()">Mégsem</button>' +
+                    '<button class="btn btn-danger" id="confirm-delete-btn" onclick="confirmDelete(\'' + name + '\')">Törlés</button>' +
+                '</div>';
+        } catch (err) {
+            modal.querySelector('.modal-card').innerHTML =
+                '<h3>Hiba</h3><p style="color:var(--text-2)">Nem sikerült lekérni az adatokat: ' + err.message + '</p>' +
+                '<div class="modal-actions"><button class="btn btn-outline" onclick="closeDeleteModal()">Bezárás</button></div>';
+        }
+    }
+    function closeDeleteModal() {
+        var modal = document.getElementById('delete-modal');
+        if (modal) modal.remove();
+    }
+    async function confirmDelete(name) {
+        var btn = document.getElementById('confirm-delete-btn');
+        var checkbox = document.getElementById('delete-hdd-check');
+        var removeHDD = checkbox ? checkbox.checked : false;
+        btn.disabled = true;
+        btn.textContent = 'Törlés folyamatban...';
+        try {
+            var resp = await fetch('/api/stacks/' + name, {
+                method: 'DELETE',
+                headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
+                body: JSON.stringify({remove_hdd_data: removeHDD})
+            });
+            var data = await resp.json();
+            if (data.ok) {
+                var modal = document.getElementById('delete-modal');
+                var removedInfo = '';
+                if (data.data && data.data.hdd_paths_removed && data.data.hdd_paths_removed.length > 0) {
+                    removedInfo = '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Törölt adatok: ' + data.data.hdd_paths_removed.join(', ') + '</p>';
+                }
+                var preservedInfo = '';
+                if (data.data && data.data.hdd_paths_preserved && data.data.hdd_paths_preserved.length > 0) {
+                    preservedInfo = '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Megőrzött adatok: ' + data.data.hdd_paths_preserved.join(', ') + '</p>';
+                }
+                if (data.data && data.data.hdd_note) {
+                    preservedInfo += '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">' + data.data.hdd_note + '</p>';
+                }
+                modal.querySelector('.modal-card').innerHTML =
+                    '<h3>Sikeresen törölve!</h3>' +
+                    '<p style="color:var(--text-2)">Az alkalmazás (' + name + ') törölve lett.</p>' +
+                    removedInfo + preservedInfo +
+                    '<div class="modal-actions"><button class="btn btn-primary" onclick="window.location.href=\'/stacks\'">Bezárás</button></div>';
+            } else {
+                showAlert('Hiba: ' + (data.error || 'Ismeretlen hiba'));
+                btn.disabled = false;
+                btn.textContent = 'Törlés';
+            }
+        } catch (err) {
+            showAlert('Hálózati hiba: ' + err.message);
+            btn.disabled = false;
+            btn.textContent = 'Törlés';
+        }
+    }
+    async function removeStack(name) {
+        var modal = document.createElement('div');
+        modal.className = 'modal-overlay';
+        modal.id = 'remove-modal';
+        modal.innerHTML = '<div class="modal-card"><h3>Betöltés...</h3></div>';
+        modal.addEventListener('click', function(e) { if (e.target === modal) closeRemoveModal(); });
+        document.body.appendChild(modal);
+        try {
+            var [hddResp, backupResp] = await Promise.all([
+                fetch('/api/stacks/' + name + '/hdd-data').then(function(r) { return r.json(); }),
+                fetch('/api/stacks/' + name + '/backup-data').then(function(r) { return r.json(); })
+            ]);
+            var sections = '';
+            
+            var keepOnly = hddResp.ok && hddResp.data && hddResp.data.keep_data_only;
+            if (keepOnly) {
+                sections += '<div class="alert alert-info" style="margin-bottom:.75rem" data-remove-keep-only="true">Az ügyfélszolgálat foglalkozik ezzel az alkalmazással, ezért az adatai megmaradnak: most csak magát az alkalmazást távolíthatod el.</div>';
+            }
+            
+            sections += '<div class="modal-section">' +
+                '<strong>Mindig törlődik:</strong>' +
+                '<ul style="margin:.25rem 0;padding-left:1.2rem;color:var(--text-2);font-size:.85rem">' +
+                '<li>Docker kötetek (adatbázis, alkalmazás konfiguráció)</li>' +
+                '<li>Telepítési konfiguráció (app.yaml)</li>' +
+                '<li>Másodlagos mentés ütemezése</li>' +
+                '</ul></div>';
+            
+            var hddCheckbox = '';
+            if (!keepOnly && hddResp.ok && hddResp.data && hddResp.data.has_hdd_data) {
+                var hddPaths = '';
+                hddResp.data.hdd_paths.forEach(function(p) {
+                    hddPaths += '<div class="modal-hdd-path">' + p.path + ' (' + (p.exists ? p.size_human : 'nem létezik') + ')</div>';
+                });
+                sections += '<div class="modal-section">' +
+                    '<strong>Felhasználói adatok a merevlemezen:</strong>' + hddPaths +
+                    '<label class="modal-checkbox"><input type="checkbox" id="remove-hdd-check"> Felhasználói adatok törlése</label>' +
+                    '<div class="alert alert-info" style="margin-top:.5rem;font-size:.8rem" id="remove-hdd-keep-warning">' +
+                    'Ha újratelepíti az alkalmazást, az adatokat újra importálnia kell, mivel az adatbázis törlődik. A megtartott adatok a továbbiakban NEM lesznek automatikusan mentve.' +
+                    '</div></div>';
+                hddCheckbox = '\x3Cscript>document.getElementById("remove-hdd-check").addEventListener("change",function(){document.getElementById("remove-hdd-keep-warning").style.display=this.checked?"none":"";});<\/script>';
+            }
+            
+            var backupCheckbox = '';
+            if (!keepOnly && backupResp.ok && backupResp.data && backupResp.data.has_backups) {
+                var bkPaths = '';
+                backupResp.data.backup_paths.forEach(function(p) {
+                    if (p.exists) bkPaths += '<div class="modal-hdd-path">' + p.path + ' (' + p.size_human + ')</div>';
+                });
+                if (bkPaths) {
+                    sections += '<div class="modal-section">' +
+                        '<strong>Mentési adatok:</strong>' + bkPaths +
+                        '<label class="modal-checkbox"><input type="checkbox" id="remove-backup-check"> Mentési adatok törlése</label>' +
+                        '<div class="alert alert-info" style="margin-top:.5rem;font-size:.8rem">' +
+                        'Az éjszakai restic pillanatképek nem törölhetők egyenként — a megőrzési szabályok szerint automatikusan elavulnak.' +
+                        '</div></div>';
+                }
+            }
+            modal.querySelector('.modal-card').innerHTML =
+                '<h3>Alkalmazás eltávolítása: ' + name + '</h3>' +
+                '<p style="color:var(--text-2);font-size:.9rem;margin-bottom:.75rem">Az alkalmazás visszaáll "Nincs telepítve" állapotba. A sablon megmarad, újratelepíthető.</p>' +
+                '<div class="alert alert-warning" style="margin-bottom:.75rem">Ez a művelet nem visszavonható!</div>' +
+                sections +
+                '<div class="modal-actions">' +
+                    '<button class="btn btn-outline" onclick="closeRemoveModal()">Mégsem</button>' +
+                    '<button class="btn btn-danger" id="confirm-remove-btn" onclick="confirmRemoveStack(\'' + name + '\')">Eltávolítás</button>' +
+                '</div>' + hddCheckbox;
+        } catch (err) {
+            modal.querySelector('.modal-card').innerHTML =
+                '<h3>Hiba</h3><p style="color:var(--text-2)">Nem sikerült lekérni az adatokat: ' + err.message + '</p>' +
+                '<div class="modal-actions"><button class="btn btn-outline" onclick="closeRemoveModal()">Bezárás</button></div>';
+        }
+    }
+    function closeRemoveModal() {
+        var modal = document.getElementById('remove-modal');
+        if (modal) modal.remove();
+    }
+    async function confirmRemoveStack(name) {
+        var btn = document.getElementById('confirm-remove-btn');
+        var hddCheck = document.getElementById('remove-hdd-check');
+        var backupCheck = document.getElementById('remove-backup-check');
+        var removeHDD = hddCheck ? hddCheck.checked : false;
+        var removeBackups = backupCheck ? backupCheck.checked : false;
+        btn.disabled = true;
+        btn.textContent = 'Eltávolítás folyamatban...';
+        try {
+            var resp = await fetch('/api/stacks/' + name + '/remove', {
+                method: 'POST',
+                headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
+                body: JSON.stringify({remove_hdd_data: removeHDD, remove_backups: removeBackups})
+            });
+            var data = await resp.json();
+            if (data.ok) {
+                var modal = document.getElementById('remove-modal');
+                var removedInfo = '';
+                if (data.data && data.data.hdd_paths_removed && data.data.hdd_paths_removed.length > 0) {
+                    removedInfo += '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Törölt adatok: ' + data.data.hdd_paths_removed.join(', ') + '</p>';
+                }
+                if (data.data && data.data.backup_paths_removed && data.data.backup_paths_removed.length > 0) {
+                    removedInfo += '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Törölt mentések: ' + data.data.backup_paths_removed.join(', ') + '</p>';
+                }
+                var preservedInfo = '';
+                if (data.data && data.data.hdd_paths_preserved && data.data.hdd_paths_preserved.length > 0) {
+                    preservedInfo = '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Megőrzött adatok: ' + data.data.hdd_paths_preserved.join(', ') + '</p>';
+                }
+                if (data.data && data.data.hdd_note) {
+                    preservedInfo += '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">' + data.data.hdd_note + '</p>';
+                }
+                if (data.data && data.data.backup_paths_refused && data.data.backup_paths_refused.length > 0) {
+                    preservedInfo += '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Nem törölt mentések: ' + data.data.backup_paths_refused.join('; ') + '</p>';
+                }
+                modal.querySelector('.modal-card').innerHTML =
+                    '<h3>Sikeresen eltávolítva!</h3>' +
+                    '<p style="color:var(--text-2)">Az alkalmazás (' + name + ') eltávolítva. Újratelepíthető a Telepítés gombbal.</p>' +
+                    removedInfo + preservedInfo +
+                    '<div class="modal-actions"><button class="btn btn-primary" onclick="window.location.href=\'/stacks\'">Bezárás</button></div>';
+            } else {
+                showAlert('Hiba: ' + (data.error || 'Ismeretlen hiba'));
+                btn.disabled = false;
+                btn.textContent = 'Eltávolítás';
+            }
+        } catch (err) {
+            showAlert('Hálózati hiba: ' + err.message);
+            btn.disabled = false;
+            btn.textContent = 'Eltávolítás';
+        }
+    }
+    </script>
+</body>
+</html>
+

controller/internal/web/testdata/i18n_parity/kept_data_full.html

@@ -0,0 +1,577 @@
+
+
+<!DOCTYPE html>
+<html lang="hu" class="no-js">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Megőrzött adatok — Felhom.eu</title>
+    
+    <link rel="icon" type="image/svg+xml" href="/static/favicon.svg?v=0.247.0">
+    <link rel="stylesheet" href="/static/style.css?v=0.247.0">
+    <meta name="csrf-token" content="tok">
+    <script>
+    
+    
+    document.documentElement.className=document.documentElement.className.replace('no-js','js');
+    function csrfHeaders(){var el=document.querySelector('meta[name="csrf-token"]');return el?{'X-CSRF-Token':el.content}:{};}
+    
+    
+    
+    
+    
+    function felhomConfirm(el,question,onYes){
+        if(!el||el.dataset.fcOpen)return;
+        el.dataset.fcOpen='1';
+        var wrap=document.createElement('span');wrap.className='inline-confirm';
+        var q=document.createElement('span');q.className='inline-confirm-q';q.textContent=question;
+        var yes=document.createElement('button');yes.type='button';yes.className='btn btn-xs btn-danger';yes.textContent='Igen';
+        var no=document.createElement('button');no.type='button';no.className='btn btn-xs btn-outline';no.textContent='Mégse';
+        wrap.appendChild(q);wrap.appendChild(yes);wrap.appendChild(no);
+        el.style.display='none';el.parentNode.insertBefore(wrap,el.nextSibling);
+        function close(){wrap.remove();el.style.display='';delete el.dataset.fcOpen;}
+        no.addEventListener('click',close);
+        yes.addEventListener('click',function(){close();onYes();});
+    }
+    document.addEventListener('click',function(e){
+        var btn=e.target.closest?e.target.closest('[data-confirm]'):null;
+        if(!btn)return;
+        e.preventDefault();
+        felhomConfirm(btn,btn.getAttribute('data-confirm'),function(){
+            var form=btn.closest('form');
+            if(form){if(form.requestSubmit)form.requestSubmit(btn);else form.submit();}
+        });
+    });
+    
+
+    document.addEventListener('click',function(e){
+        var btn=e.target.closest?e.target.closest('.nav-group-toggle'):null;
+        if(!btn)return;
+        var group=btn.closest('.nav-group');
+        if(!group)return;
+        var willOpen=!group.classList.contains('is-open');
+        document.querySelectorAll('.nav-group.is-open').forEach(function(g){
+            g.classList.remove('is-open');
+            var t=g.querySelector('.nav-group-toggle');
+            if(t)t.setAttribute('aria-expanded','false');
+        });
+        if(willOpen){group.classList.add('is-open');btn.setAttribute('aria-expanded','true');}
+    });
+    function showAlert(msg){var o=document.createElement('div');o.className='modal-overlay';o.id='alert-modal';o.addEventListener('click',function(e){if(e.target===o)o.remove();});var c=document.createElement('div');c.className='modal-card';c.innerHTML='<h3>Üzenet</h3><pre style="white-space:pre-wrap;word-break:break-word;background:var(--bg-2);padding:.75rem;border-radius:.375rem;font-size:.85rem;max-height:60vh;overflow-y:auto;user-select:text;cursor:text">'+msg.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;')+'</pre><div class="modal-actions"><button class="btn btn-primary" onclick="document.getElementById(\'alert-modal\').remove()">OK</button></div>';o.appendChild(c);document.body.appendChild(o);}
+    </script>
+</head>
+<body>
+    <svg xmlns="http://www.w3.org/2000/svg" style="display:none" aria-hidden="true">
+<symbol id="i-hard-drive" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 16h.01" /> <path d="M2.212 11.577a2 2 0 0 0-.212.896V18a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-5.527a2 2 0 0 0-.212-.896L18.55 5.11A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z" /> <path d="M21.946 12.013H2.054" /> <path d="M6 16h.01" /></symbol>
+<symbol id="i-cpu" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 20v2" /> <path d="M12 2v2" /> <path d="M17 20v2" /> <path d="M17 2v2" /> <path d="M2 12h2" /> <path d="M2 17h2" /> <path d="M2 7h2" /> <path d="M20 12h2" /> <path d="M20 17h2" /> <path d="M20 7h2" /> <path d="M7 20v2" /> <path d="M7 2v2" /> <rect x="4" y="4" width="16" height="16" rx="2" /> <rect x="8" y="8" width="8" height="8" rx="1" /></symbol>
+<symbol id="i-memory-stick" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 12v-2" /> <path d="M12 18v-2" /> <path d="M16 12v-2" /> <path d="M16 18v-2" /> <path d="M2 11h1.5" /> <path d="M20 18v-2" /> <path d="M20.5 11H22" /> <path d="M4 18v-2" /> <path d="M8 12v-2" /> <path d="M8 18v-2" /> <rect x="2" y="6" width="20" height="10" rx="2" /></symbol>
+<symbol id="i-thermometer" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 4v10.54a4 4 0 1 1-4 0V4a2 2 0 0 1 4 0Z" /></symbol>
+<symbol id="i-triangle-alert" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3" /> <path d="M12 9v4" /> <path d="M12 17h.01" /></symbol>
+<symbol id="i-lock" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="18" height="11" x="3" y="11" rx="2" ry="2" /> <path d="M7 11V7a5 5 0 0 1 10 0v4" /></symbol>
+<symbol id="i-cloud" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M17.5 19H9a7 7 0 1 1 6.71-9h1.79a4.5 4.5 0 1 1 0 9Z" /></symbol>
+<symbol id="i-square" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="18" height="18" x="3" y="3" rx="2" /></symbol>
+<symbol id="i-rotate-cw" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12a9 9 0 1 1-9-9c2.52 0 4.93 1 6.74 2.74L21 8" /> <path d="M21 3v5h-5" /></symbol>
+<symbol id="i-file-text" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z" /> <path d="M14 2v5a1 1 0 0 0 1 1h5" /> <path d="M10 9H8" /> <path d="M16 13H8" /> <path d="M16 17H8" /></symbol>
+<symbol id="i-external-link" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 3h6v6" /> <path d="M10 14 21 3" /> <path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6" /></symbol>
+<symbol id="i-shield" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z" /></symbol>
+<symbol id="i-server" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="20" height="8" x="2" y="2" rx="2" ry="2" /> <rect width="20" height="8" x="2" y="14" rx="2" ry="2" /> <line x1="6" x2="6.01" y1="6" y2="6" /> <line x1="6" x2="6.01" y1="18" y2="18" /></symbol>
+<symbol id="i-share" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="18" cy="5" r="3" /> <circle cx="6" cy="12" r="3" /> <circle cx="18" cy="19" r="3" /> <line x1="8.59" x2="15.42" y1="13.51" y2="17.49" /> <line x1="15.41" x2="8.59" y1="6.51" y2="10.49" /></symbol>
+<symbol id="i-layout-grid" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="7" height="7" x="3" y="3" rx="1" /> <rect width="7" height="7" x="14" y="3" rx="1" /> <rect width="7" height="7" x="14" y="14" rx="1" /> <rect width="7" height="7" x="3" y="14" rx="1" /></symbol>
+<symbol id="i-rocket" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4.5 16.5c-1.5 1.26-2 5-2 5s3.74-.5 5-2c.71-.84.7-2.13-.09-2.91a2.18 2.18 0 0 0-2.91 0z" /> <path d="m12 15-3-3a22 22 0 0 1 2-3.95A12.88 12.88 0 0 1 22 2c0 2.72-.78 7.5-6 11a22.35 22.35 0 0 1-4 2z" /> <path d="M9 12H4s.55-3.03 2-4c1.62-1.08 5 0 5 0" /> <path d="M12 15v5s3.03-.55 4-2c1.08-1.62 0-5 0-5" /></symbol>
+<symbol id="i-settings" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9.671 4.136a2.34 2.34 0 0 1 4.659 0 2.34 2.34 0 0 0 3.319 1.915 2.34 2.34 0 0 1 2.33 4.033 2.34 2.34 0 0 0 0 3.831 2.34 2.34 0 0 1-2.33 4.033 2.34 2.34 0 0 0-3.319 1.915 2.34 2.34 0 0 1-4.659 0 2.34 2.34 0 0 0-3.32-1.915 2.34 2.34 0 0 1-2.33-4.033 2.34 2.34 0 0 0 0-3.831A2.34 2.34 0 0 1 6.35 6.051a2.34 2.34 0 0 0 3.319-1.915" /> <circle cx="12" cy="12" r="3" /></symbol>
+<symbol id="i-bell" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10.268 21a2 2 0 0 0 3.464 0" /> <path d="M3.262 15.326A1 1 0 0 0 4 17h16a1 1 0 0 0 .74-1.673C19.41 13.956 18 12.499 18 8A6 6 0 0 0 6 8c0 4.499-1.411 5.956-2.738 7.326" /></symbol>
+<symbol id="i-x" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 6 6 18" /> <path d="m6 6 12 12" /></symbol>
+<symbol id="i-check" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 6 9 17l-5-5" /></symbol>
+<symbol id="i-pencil" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21.174 6.812a1 1 0 0 0-3.986-3.987L3.842 16.174a2 2 0 0 0-.5.83l-1.321 4.352a.5.5 0 0 0 .623.622l4.353-1.32a2 2 0 0 0 .83-.497z" /> <path d="m15 5 4 4" /></symbol>
+<symbol id="i-info" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10" /> <path d="M12 16v-4" /> <path d="M12 8h.01" /></symbol>
+<symbol id="i-download" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 15V3" /> <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" /> <path d="m7 10 5 5 5-5" /></symbol>
+<symbol id="i-upload" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3v12" /> <path d="m17 8-5-5-5 5" /> <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" /></symbol>
+<symbol id="i-trash-2" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 11v6" /> <path d="M14 11v6" /> <path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6" /> <path d="M3 6h18" /> <path d="M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2" /></symbol>
+<symbol id="i-wrench" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.106-3.105c.32-.322.863-.22.983.218a6 6 0 0 1-8.259 7.057l-7.91 7.91a1 1 0 0 1-2.999-3l7.91-7.91a6 6 0 0 1 7.057-8.259c.438.12.54.662.219.984z" /></symbol>
+<symbol id="i-link" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71" /> <path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71" /></symbol>
+<symbol id="i-search" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m21 21-4.34-4.34" /> <circle cx="11" cy="11" r="8" /></symbol>
+<symbol id="i-plus" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M5 12h14" /> <path d="M12 5v14" /></symbol>
+<symbol id="i-chevron-down" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m6 9 6 6 6-6" /></symbol>
+<symbol id="i-play" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M5 5a2 2 0 0 1 3.008-1.728l11.997 6.998a2 2 0 0 1 .003 3.458l-12 7A2 2 0 0 1 5 19z" /></symbol>
+<symbol id="i-pause" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="14" y="3" width="5" height="18" rx="1" /> <rect x="5" y="3" width="5" height="18" rx="1" /></symbol>
+<symbol id="i-menu" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4 12h16" /> <path d="M4 6h16" /> <path d="M4 18h16" /></symbol>
+</svg>
+    <header class="mobile-topbar">
+        <a href="/" class="mobile-topbar-logo"><img src="/static/felhom-logo.svg?v=0.247.0" alt="Felhom.eu"></a>
+        <button type="button" class="nav-burger" aria-expanded="false" aria-controls="sidebar" aria-label="Menü">
+            <svg class="ico"><use href="#i-menu"/></svg>
+        </button>
+    </header>
+    <div class="nav-backdrop" hidden></div>
+    <nav class="sidebar" id="sidebar">
+        <div class="sidebar-header">
+            <img src="/static/felhom-logo.svg?v=0.247.0" alt="Felhom.eu" class="sidebar-logo">
+        </div>
+        <ul class="nav-links">
+            <li><a href="/launcher" class=""><svg class="ico"><use href="#i-rocket"/></svg>Indítópult</a></li>
+            <li><a href="/dashboard" class=""><svg class="ico"><use href="#i-layout-grid"/></svg>Vezérlőpult</a></li>
+            <li><a href="/stacks" class=""><svg class="ico"><use href="#i-cloud"/></svg>Alkalmazások</a></li>
+            
+            <li class="nav-group">
+                <button type="button" class="nav-group-toggle" aria-expanded="false" aria-controls="nav-group-storage"><svg class="ico"><use href="#i-hard-drive"/></svg>Tárhely<svg class="ico nav-chevron"><use href="#i-chevron-down"/></svg></button>
+                <ul id="nav-group-storage" class="nav-links nav-links-sub nav-links-nested">
+                    <li><a href="/storage" class="">Meghajtók</a></li>
+                    <li><a href="/storage/network" class="">Hálózati tárhely</a></li>
+                </ul>
+            </li>
+            
+            <li class="nav-group">
+                <button type="button" class="nav-group-toggle" aria-expanded="false" aria-controls="nav-group-backups"><svg class="ico"><use href="#i-shield"/></svg>Biztonsági mentés<svg class="ico nav-chevron"><use href="#i-chevron-down"/></svg></button>
+                <ul id="nav-group-backups" class="nav-links nav-links-sub nav-links-nested">
+                    <li><a href="/backups" class="">Áttekintés</a></li>
+                    <li><a href="/backups/remote" class="">Távoli mentés</a></li>
+                    <li><a href="/backups/apps" class="">Alkalmazások</a></li>
+                    <li><a href="/backups/restore" class="">Visszaállítás</a></li>
+                </ul>
+            </li>
+            
+            <li class="nav-group">
+                <button type="button" class="nav-group-toggle" aria-expanded="false" aria-controls="nav-group-sharing"><svg class="ico"><use href="#i-share"/></svg>Megosztás<svg class="ico nav-chevron"><use href="#i-chevron-down"/></svg></button>
+                <ul id="nav-group-sharing" class="nav-links nav-links-sub nav-links-nested">
+                    <li><a href="/sharing" class="">Hálózati megosztás</a></li>
+                </ul>
+            </li>
+            <li><a href="/monitoring" class=""><svg class="ico"><use href="#i-cpu"/></svg>Rendszermonitor</a></li>
+            <li><a href="/debug" class=""><svg class="ico"><use href="#i-wrench"/></svg>Debug</a></li>
+        </ul>
+        <div class="sidebar-bottom">
+            <div class="nav-group-label">Beállítások</div>
+            <ul class="nav-links nav-links-sub">
+                <li><a href="/settings" class=""><svg class="ico"><use href="#i-settings"/></svg>Rendszer</a></li>
+                <li><a href="/settings/notifications" class=""><svg class="ico"><use href="#i-bell"/></svg>Értesítések</a></li>
+                <li><a href="/settings/security" class=""><svg class="ico"><use href="#i-lock"/></svg>Biztonság és hozzáférés</a></li>
+            </ul>
+            <div class="sidebar-footer">
+                <span class="version">0.247.0</span><details class="lang-globe">
+    <summary class="lang-globe-btn" aria-label="Nyelv" title="Nyelv"><svg class="ico" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="10" /><path d="M2 12h20" /><path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z" /></svg></summary>
+    <ul class="lang-globe-menu">
+        <li><form method="POST" action="/settings/language"><input type="hidden" name="_csrf" value="CSRF"><input type="hidden" name="back" value="/i18n-fixture"><button type="submit" name="lang" value="hu" lang="hu" class="lang-globe-item current" aria-current="true">Magyar</button></form></li>
+        <li><form method="POST" action="/settings/language"><input type="hidden" name="_csrf" value="CSRF"><input type="hidden" name="back" value="/i18n-fixture"><button type="submit" name="lang" value="en" lang="en" class="lang-globe-item">English</button></form></li>
+    </ul>
+</details>
+                <a href="/logout" class="logout-link">Kijelentkezés ↗</a>
+            </div>
+        </div>
+    </nav>
+    <main class="content">
+
+
+
+
+
+
+
+
+<div class="page-header">
+    <div class="kept-header">
+        <a href="/storage" class="btn btn-sm btn-outline">Vissza</a>
+        <h2>Megőrzött adatok</h2>
+    </div>
+</div>
+
+<div class="alert alert-error">flash-error</div>
+<div class="alert alert-info">flash-ok</div>
+
+<div class="settings-card">
+    <p class="settings-card-desc">Az eltávolított alkalmazások lemezen maradt adatai. Megnézheted őket, betöltheted egy új telepítésbe, vagy törölheted. Magától a szerver soha nem töröl közülük semmit.</p>
+    <p class="form-hint">Erről nem készül mentés.</p>
+    
+    <div class="kept-list">
+        
+        <div class="kept-item" data-kept-path="/mnt/felhom-drives/hdd_1/kept/nextcloud/2026-09-14_031200">
+            <div class="kept-item-head">
+                <span class="kept-item-name">Nextcloud</span>
+                <span class="kept-item-meta mono">2026-09-14 05:12 · 126.0 MB</span>
+            </div>
+            <div class="kept-item-backup">Visszatölthető innen: unit 2026-09-14 04:44</div>
+            <div class="kept-item-actions">
+                
+                <form method="POST" action="/kept-data/load" class="kept-inline-form">
+                    
+                    <input type="hidden" name="path" value="/mnt/felhom-drives/hdd_1/kept/nextcloud/2026-09-14_031200">
+                    <button type="submit" class="btn btn-sm btn-primary">Betöltés</button>
+                </form>
+                
+                <a href="https://files.example.hu/files/x/y" target="_blank" rel="noopener" class="btn btn-sm btn-outline">Megnézem</a>
+            </div>
+            <details class="kept-delete">
+                <summary class="btn btn-sm btn-outline">Törlés</summary>
+                <form method="POST" action="/kept-data/delete" class="kept-delete-form">
+                    
+                    <input type="hidden" name="path" value="/mnt/felhom-drives/hdd_1/kept/nextcloud/2026-09-14_031200">
+                    <p class="kept-delete-text">delete-text Nextcloud 126.0 MB</p>
+                    <label class="form-hint">type-prompt Nextcloud</label>
+                    <input type="text" name="confirm" autocomplete="off" required>
+                    <button type="submit" class="btn btn-sm btn-danger">Végleges törlés</button>
+                </form>
+            </details>
+        </div>
+        
+        <div class="kept-item" data-kept-path="/mnt/felhom-drives/hdd_1/appdata/paperless">
+            <div class="kept-item-head">
+                <span class="kept-item-name">Paperless-ngx</span>
+                <span class="kept-item-meta mono">2026-09-13 10:00 · 71.0 MB</span>
+            </div>
+            <div class="kept-item-backup">Visszatölthető innen: none</div>
+            <div class="kept-item-actions">
+                
+                <span class="form-hint">Az alkalmazás újra telepítve van.</span>
+                
+                <a href="https://files.example.hu/files/x/z" target="_blank" rel="noopener" class="btn btn-sm btn-outline">Megnézem</a>
+            </div>
+            <details class="kept-delete">
+                <summary class="btn btn-sm btn-outline">Törlés</summary>
+                <form method="POST" action="/kept-data/delete" class="kept-delete-form">
+                    
+                    <input type="hidden" name="path" value="/mnt/felhom-drives/hdd_1/appdata/paperless">
+                    <p class="kept-delete-text">x</p>
+                    <label class="form-hint">y</label>
+                    <input type="text" name="confirm" autocomplete="off" required>
+                    <button type="submit" class="btn btn-sm btn-danger">Végleges törlés</button>
+                </form>
+            </details>
+        </div>
+        
+    </div>
+    
+</div>
+
+
+    </main>
+    <script>
+    
+    
+    
+    (function(){
+        var burger=document.querySelector('.nav-burger');
+        var sidebar=document.getElementById('sidebar');
+        var backdrop=document.querySelector('.nav-backdrop');
+        if(!burger||!sidebar||!backdrop)return;
+        function setOpen(open){
+            sidebar.classList.toggle('is-open',open);
+            document.body.classList.toggle('nav-open',open);
+            backdrop.hidden=!open;
+            burger.setAttribute('aria-expanded',open?'true':'false');
+        }
+        burger.addEventListener('click',function(){setOpen(!sidebar.classList.contains('is-open'));});
+        backdrop.addEventListener('click',function(){setOpen(false);});
+        document.addEventListener('keydown',function(e){
+            if(e.key==='Escape'&&sidebar.classList.contains('is-open'))setOpen(false);
+        });
+    })();
+    document.addEventListener('click', function(e) {
+        if (e.target.closest('a, button, .btn, input, select, textarea, .app-row-actions, .stack-detail-actions')) return;
+        var card = e.target.closest('[data-href]');
+        if (card) window.location.href = card.dataset.href;
+    });
+    async function checkBeforeDeploy(e, name) {
+        try {
+            var resp = await fetch('/api/stacks/' + name);
+            var data = await resp.json();
+            if (data.ok && data.data && data.data.deployed) {
+                e.preventDefault();
+                showAlert('Ez az alkalmazás már telepítve van.');
+                window.location.reload();
+                return false;
+            }
+        } catch(err) {}
+        return true;
+    }
+    async function syncTemplates() {
+        const btn = document.getElementById('sync-btn');
+        const toast = document.getElementById('sync-toast');
+        if (!btn) return;
+        const origText = btn.innerHTML;
+        btn.disabled = true;
+        btn.innerHTML = '↻ Frissítés...';
+        btn.classList.add('loading');
+        try {
+            const resp = await fetch('/api/sync', {
+                method: 'POST',
+                headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders())
+            });
+            const data = await resp.json();
+            if (toast) {
+                toast.textContent = data.ok ? (data.message || 'Sablonok frissítve') : ('Hiba: ' + (data.error || 'Ismeretlen hiba'));
+                toast.className = 'sync-toast ' + (data.ok ? 'sync-toast-ok' : 'sync-toast-err');
+                toast.style.display = 'block';
+                setTimeout(function() { toast.style.display = 'none'; }, 5000);
+            }
+            if (data.ok && data.data && (data.data.new_apps && data.data.new_apps.length > 0 || data.data.updated && data.data.updated.length > 0)) {
+                setTimeout(function() { window.location.reload(); }, 1500);
+            }
+        } catch (err) {
+            if (toast) {
+                toast.textContent = 'Hálózati hiba: ' + err.message;
+                toast.className = 'sync-toast sync-toast-err';
+                toast.style.display = 'block';
+                setTimeout(function() { toast.style.display = 'none'; }, 5000);
+            }
+        }
+        btn.innerHTML = origText;
+        btn.disabled = false;
+        btn.classList.remove('loading');
+    }
+    async function stackAction(event, name, action) {
+        const btn = event.currentTarget;
+        const origText = btn.textContent;
+        btn.disabled = true;
+        btn.textContent = 'Folyamatban...';
+        btn.classList.add('loading');
+        try {
+            const resp = await fetch('/api/stacks/' + name + '/' + action, {
+                method: 'POST',
+                headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders())
+            });
+            const data = await resp.json();
+            if (!data.ok) {
+                showAlert('Hiba: ' + (data.error || 'Ismeretlen hiba'));
+                btn.textContent = origText;
+                btn.disabled = false;
+                btn.classList.remove('loading');
+                return;
+            }
+            
+            
+            
+            if (action === 'update') {
+                followUpdate(name, btn);
+                return;
+            }
+            window.location.reload();
+        } catch (err) {
+            showAlert('Hálózati hiba: ' + err.message);
+            btn.textContent = origText;
+            btn.disabled = false;
+            btn.classList.remove('loading');
+        }
+    }
+    function followUpdate(name, btn) {
+        var started = Date.now();
+        var timer = setInterval(async function() {
+            if (Date.now() - started > 30 * 60 * 1000) { clearInterval(timer); window.location.reload(); return; }
+            try {
+                var r = await fetch('/api/stacks/' + name);
+                var d = await r.json();
+                if (!d.ok || !d.data) return;
+                if (d.data.update_phase_label) btn.textContent = d.data.update_phase_label;
+                if (!d.data.updating) { clearInterval(timer); window.location.reload(); }
+            } catch (e) {}
+        }, 3000);
+    }
+    async function deleteOrphanStack(name) {
+        var modal = document.createElement('div');
+        modal.className = 'modal-overlay';
+        modal.id = 'delete-modal';
+        modal.innerHTML = '<div class="modal-card"><h3>Betöltés...</h3></div>';
+        modal.addEventListener('click', function(e) { if (e.target === modal) closeDeleteModal(); });
+        document.body.appendChild(modal);
+        try {
+            var resp = await fetch('/api/stacks/' + name + '/hdd-data');
+            var data = await resp.json();
+            var hddInfo = '';
+            var checkboxHTML = '';
+            if (data.ok && data.data && data.data.has_hdd_data) {
+                hddInfo = '<div class="modal-hdd-info"><strong>Felhasználói adatok a merevlemezen:</strong>';
+                data.data.hdd_paths.forEach(function(p) {
+                    hddInfo += '<div class="modal-hdd-path">' + p.path + ' (' + (p.exists ? p.size_human : 'nem létezik') + ')</div>';
+                });
+                hddInfo += '</div>';
+                checkboxHTML = '<label class="modal-checkbox"><input type="checkbox" id="delete-hdd-check"> Felhasználói adatok törlése a merevlemezről</label>';
+            }
+            modal.querySelector('.modal-card').innerHTML =
+                '<h3>Alkalmazás törlése: ' + name + '</h3>' +
+                '<p style="color:var(--text-2);font-size:.9rem;margin-bottom:.75rem">Ez a művelet eltávolítja a konténereket, a köteteket és a konfigurációs fájlokat.</p>' +
+                '<div class="alert alert-warning" style="margin-bottom:.75rem">Ez a művelet nem visszavonható!</div>' +
+                hddInfo + checkboxHTML +
+                '<div class="modal-actions">' +
+                    '<button class="btn btn-outline" onclick="closeDeleteModal()">Mégsem</button>' +
+                    '<button class="btn btn-danger" id="confirm-delete-btn" onclick="confirmDelete(\'' + name + '\')">Törlés</button>' +
+                '</div>';
+        } catch (err) {
+            modal.querySelector('.modal-card').innerHTML =
+                '<h3>Hiba</h3><p style="color:var(--text-2)">Nem sikerült lekérni az adatokat: ' + err.message + '</p>' +
+                '<div class="modal-actions"><button class="btn btn-outline" onclick="closeDeleteModal()">Bezárás</button></div>';
+        }
+    }
+    function closeDeleteModal() {
+        var modal = document.getElementById('delete-modal');
+        if (modal) modal.remove();
+    }
+    async function confirmDelete(name) {
+        var btn = document.getElementById('confirm-delete-btn');
+        var checkbox = document.getElementById('delete-hdd-check');
+        var removeHDD = checkbox ? checkbox.checked : false;
+        btn.disabled = true;
+        btn.textContent = 'Törlés folyamatban...';
+        try {
+            var resp = await fetch('/api/stacks/' + name, {
+                method: 'DELETE',
+                headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
+                body: JSON.stringify({remove_hdd_data: removeHDD})
+            });
+            var data = await resp.json();
+            if (data.ok) {
+                var modal = document.getElementById('delete-modal');
+                var removedInfo = '';
+                if (data.data && data.data.hdd_paths_removed && data.data.hdd_paths_removed.length > 0) {
+                    removedInfo = '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Törölt adatok: ' + data.data.hdd_paths_removed.join(', ') + '</p>';
+                }
+                var preservedInfo = '';
+                if (data.data && data.data.hdd_paths_preserved && data.data.hdd_paths_preserved.length > 0) {
+                    preservedInfo = '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Megőrzött adatok: ' + data.data.hdd_paths_preserved.join(', ') + '</p>';
+                }
+                if (data.data && data.data.hdd_note) {
+                    preservedInfo += '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">' + data.data.hdd_note + '</p>';
+                }
+                modal.querySelector('.modal-card').innerHTML =
+                    '<h3>Sikeresen törölve!</h3>' +
+                    '<p style="color:var(--text-2)">Az alkalmazás (' + name + ') törölve lett.</p>' +
+                    removedInfo + preservedInfo +
+                    '<div class="modal-actions"><button class="btn btn-primary" onclick="window.location.href=\'/stacks\'">Bezárás</button></div>';
+            } else {
+                showAlert('Hiba: ' + (data.error || 'Ismeretlen hiba'));
+                btn.disabled = false;
+                btn.textContent = 'Törlés';
+            }
+        } catch (err) {
+            showAlert('Hálózati hiba: ' + err.message);
+            btn.disabled = false;
+            btn.textContent = 'Törlés';
+        }
+    }
+    async function removeStack(name) {
+        var modal = document.createElement('div');
+        modal.className = 'modal-overlay';
+        modal.id = 'remove-modal';
+        modal.innerHTML = '<div class="modal-card"><h3>Betöltés...</h3></div>';
+        modal.addEventListener('click', function(e) { if (e.target === modal) closeRemoveModal(); });
+        document.body.appendChild(modal);
+        try {
+            var [hddResp, backupResp] = await Promise.all([
+                fetch('/api/stacks/' + name + '/hdd-data').then(function(r) { return r.json(); }),
+                fetch('/api/stacks/' + name + '/backup-data').then(function(r) { return r.json(); })
+            ]);
+            var sections = '';
+            
+            var keepOnly = hddResp.ok && hddResp.data && hddResp.data.keep_data_only;
+            if (keepOnly) {
+                sections += '<div class="alert alert-info" style="margin-bottom:.75rem" data-remove-keep-only="true">Az ügyfélszolgálat foglalkozik ezzel az alkalmazással, ezért az adatai megmaradnak: most csak magát az alkalmazást távolíthatod el.</div>';
+            }
+            
+            sections += '<div class="modal-section">' +
+                '<strong>Mindig törlődik:</strong>' +
+                '<ul style="margin:.25rem 0;padding-left:1.2rem;color:var(--text-2);font-size:.85rem">' +
+                '<li>Docker kötetek (adatbázis, alkalmazás konfiguráció)</li>' +
+                '<li>Telepítési konfiguráció (app.yaml)</li>' +
+                '<li>Másodlagos mentés ütemezése</li>' +
+                '</ul></div>';
+            
+            var hddCheckbox = '';
+            if (!keepOnly && hddResp.ok && hddResp.data && hddResp.data.has_hdd_data) {
+                var hddPaths = '';
+                hddResp.data.hdd_paths.forEach(function(p) {
+                    hddPaths += '<div class="modal-hdd-path">' + p.path + ' (' + (p.exists ? p.size_human : 'nem létezik') + ')</div>';
+                });
+                sections += '<div class="modal-section">' +
+                    '<strong>Felhasználói adatok a merevlemezen:</strong>' + hddPaths +
+                    '<label class="modal-checkbox"><input type="checkbox" id="remove-hdd-check"> Felhasználói adatok törlése</label>' +
+                    '<div class="alert alert-info" style="margin-top:.5rem;font-size:.8rem" id="remove-hdd-keep-warning">' +
+                    'Ha újratelepíti az alkalmazást, az adatokat újra importálnia kell, mivel az adatbázis törlődik. A megtartott adatok a továbbiakban NEM lesznek automatikusan mentve.' +
+                    '</div></div>';
+                hddCheckbox = '\x3Cscript>document.getElementById("remove-hdd-check").addEventListener("change",function(){document.getElementById("remove-hdd-keep-warning").style.display=this.checked?"none":"";});<\/script>';
+            }
+            
+            var backupCheckbox = '';
+            if (!keepOnly && backupResp.ok && backupResp.data && backupResp.data.has_backups) {
+                var bkPaths = '';
+                backupResp.data.backup_paths.forEach(function(p) {
+                    if (p.exists) bkPaths += '<div class="modal-hdd-path">' + p.path + ' (' + p.size_human + ')</div>';
+                });
+                if (bkPaths) {
+                    sections += '<div class="modal-section">' +
+                        '<strong>Mentési adatok:</strong>' + bkPaths +
+                        '<label class="modal-checkbox"><input type="checkbox" id="remove-backup-check"> Mentési adatok törlése</label>' +
+                        '<div class="alert alert-info" style="margin-top:.5rem;font-size:.8rem">' +
+                        'Az éjszakai restic pillanatképek nem törölhetők egyenként — a megőrzési szabályok szerint automatikusan elavulnak.' +
+                        '</div></div>';
+                }
+            }
+            modal.querySelector('.modal-card').innerHTML =
+                '<h3>Alkalmazás eltávolítása: ' + name + '</h3>' +
+                '<p style="color:var(--text-2);font-size:.9rem;margin-bottom:.75rem">Az alkalmazás visszaáll "Nincs telepítve" állapotba. A sablon megmarad, újratelepíthető.</p>' +
+                '<div class="alert alert-warning" style="margin-bottom:.75rem">Ez a művelet nem visszavonható!</div>' +
+                sections +
+                '<div class="modal-actions">' +
+                    '<button class="btn btn-outline" onclick="closeRemoveModal()">Mégsem</button>' +
+                    '<button class="btn btn-danger" id="confirm-remove-btn" onclick="confirmRemoveStack(\'' + name + '\')">Eltávolítás</button>' +
+                '</div>' + hddCheckbox;
+        } catch (err) {
+            modal.querySelector('.modal-card').innerHTML =
+                '<h3>Hiba</h3><p style="color:var(--text-2)">Nem sikerült lekérni az adatokat: ' + err.message + '</p>' +
+                '<div class="modal-actions"><button class="btn btn-outline" onclick="closeRemoveModal()">Bezárás</button></div>';
+        }
+    }
+    function closeRemoveModal() {
+        var modal = document.getElementById('remove-modal');
+        if (modal) modal.remove();
+    }
+    async function confirmRemoveStack(name) {
+        var btn = document.getElementById('confirm-remove-btn');
+        var hddCheck = document.getElementById('remove-hdd-check');
+        var backupCheck = document.getElementById('remove-backup-check');
+        var removeHDD = hddCheck ? hddCheck.checked : false;
+        var removeBackups = backupCheck ? backupCheck.checked : false;
+        btn.disabled = true;
+        btn.textContent = 'Eltávolítás folyamatban...';
+        try {
+            var resp = await fetch('/api/stacks/' + name + '/remove', {
+                method: 'POST',
+                headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
+                body: JSON.stringify({remove_hdd_data: removeHDD, remove_backups: removeBackups})
+            });
+            var data = await resp.json();
+            if (data.ok) {
+                var modal = document.getElementById('remove-modal');
+                var removedInfo = '';
+                if (data.data && data.data.hdd_paths_removed && data.data.hdd_paths_removed.length > 0) {
+                    removedInfo += '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Törölt adatok: ' + data.data.hdd_paths_removed.join(', ') + '</p>';
+                }
+                if (data.data && data.data.backup_paths_removed && data.data.backup_paths_removed.length > 0) {
+                    removedInfo += '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Törölt mentések: ' + data.data.backup_paths_removed.join(', ') + '</p>';
+                }
+                var preservedInfo = '';
+                if (data.data && data.data.hdd_paths_preserved && data.data.hdd_paths_preserved.length > 0) {
+                    preservedInfo = '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Megőrzött adatok: ' + data.data.hdd_paths_preserved.join(', ') + '</p>';
+                }
+                if (data.data && data.data.hdd_note) {
+                    preservedInfo += '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">' + data.data.hdd_note + '</p>';
+                }
+                if (data.data && data.data.backup_paths_refused && data.data.backup_paths_refused.length > 0) {
+                    preservedInfo += '<p style="color:var(--text-2);font-size:.85rem;margin-top:.5rem">Nem törölt mentések: ' + data.data.backup_paths_refused.join('; ') + '</p>';
+                }
+                modal.querySelector('.modal-card').innerHTML =
+                    '<h3>Sikeresen eltávolítva!</h3>' +
+                    '<p style="color:var(--text-2)">Az alkalmazás (' + name + ') eltávolítva. Újratelepíthető a Telepítés gombbal.</p>' +
+                    removedInfo + preservedInfo +
+                    '<div class="modal-actions"><button class="btn btn-primary" onclick="window.location.href=\'/stacks\'">Bezárás</button></div>';
+            } else {
+                showAlert('Hiba: ' + (data.error || 'Ismeretlen hiba'));
+                btn.disabled = false;
+                btn.textContent = 'Eltávolítás';
+            }
+        } catch (err) {
+            showAlert('Hálózati hiba: ' + err.message);
+            btn.disabled = false;
+            btn.textContent = 'Eltávolítás';
+        }
+    }
+    </script>
+</body>
+</html>
+

controller/internal/web/testdata/i18n_parity/storage_empty.html

@@ -178,6 +178,7 @@
 
     
     
+    <p class="storage-kept-link"><a href="/kept-data" class="btn btn-sm btn-outline">Megőrzött adatok</a> <span class="form-hint">Eltávolított alkalmazások lemezen maradt adatai</span></p>
 
     
     <div class="empty-state" style="padding:1.5rem">

controller/internal/web/testdata/i18n_parity/storage_full.html

@@ -178,6 +178,7 @@
 
     <div class="alert alert-error">Az útvonal nem írható most.</div>
     <div class="alert alert-info">A tárhely hozzáadva rendben.</div>
+    <p class="storage-kept-link"><a href="/kept-data" class="btn btn-sm btn-outline">Megőrzött adatok</a> <span class="form-hint">Eltávolított alkalmazások lemezen maradt adatai</span></p>
 
     
     <div class="storage-paths-list">