controller v0.272.0: the backup page says when a whole-box backup does not fit (R-685); R-671, R-670, R-677

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/cmd/controller/main.go

@@ -589,6 +589,8 @@ func main() {
 	// updated, not only once it is held — found live in Scenario F, see backup.Manager.isHeld.
 	if backupMgr != nil {
 		backupMgr.SetUpdatingCheck(stackMgr.IsUpdating)
+		// R-671 (v0.272.0): a restore that lifts an update hold removes the undo copies that hold kept.
+		backupMgr.SetUndoCopyRemover(stackMgr.RemoveUndoCopies)
 	}
 	if n := stackMgr.ResumeInterruptedUpdates(ctx); n > 0 {
 		logger.Printf("[WARN] [update] resumed %d interrupted update(s)", n)

controller/cmd/controller/update_leg_wiring_test.go

@@ -71,3 +71,12 @@ func TestUpdateLegIsWiredAtStartup(t *testing.T) {
 		t.Error("the offbox-backup job must run through chainUpdateLeg")
 	}
 }
+
+// TestUndoCopyRemoverIsWiredAtStartup — R-671's seam is CALLED from main.go (AST walk).
+// COMPANION RED-PROOF (REPORT.md): drop the SetUndoCopyRemover call — this fails.
+func TestUndoCopyRemoverIsWiredAtStartup(t *testing.T) {
+	lines, _, _ := slice4CallLines(t)
+	if len(lines["SetUndoCopyRemover"]) == 0 {
+		t.Fatal("main.go never calls SetUndoCopyRemover — a lifted hold's undo copies would stay for ever")
+	}
+}