R-1252 (P2): a rejected or absent backup block never deletes second-drive copies — reconcile only on a valid classification; a rejected block is said on the app's status and once a day to the operator (backup_run_failures); kept copies stay kept (H2); Remove drops the kept records it deleted (H9). Commit only.

CHANGELOG.md

@@ -22,6 +22,26 @@ brief 2026-10-24, Part 4 (commit only; the release rides the next normal train).
   `…OnlyWhenTheAgentWaitsAndAnAppRuns`, `…QBLimitRuleSkipsAHeldLimit`, `…TheTwoAppsReadAndWriteTheirLimit`,
   `TestLineTestRunOutlastsTheClientTimeout`, `TestStartUpwatchRecoversTheHoldFirst`, `TestUpwatchHoldGetsBothAgentCalls`.
 
+### A rejected backup block never deletes second-drive copies (R-1252, P2; review round 2 HUNT-2 H1, H2, H9) — 2026-10-24 night, commit only
+
+- **One wrong line in an app's backup block no longer deletes its second-drive copy.** LoadMetadata rejects the whole
+  block; the app fell back to the legacy legs (its appdata only) and the night copy reconciled every other dest dir
+  away — on 9202 the household's audiobooks copy („removed stale dest dir userdata/media"). `RunTier2` now reconciles
+  ONLY on a valid classification (`tier2CaptureSetFull` returns `classified`): with a rejected or absent block,
+  nothing is deleted that night. A REJECTED block (`Metadata.BackupRejected`, `Manager.BackupBlockRejected`, read
+  through the stack adapter) puts „note.tier2.settings_unreadable_kept" on the app's status and tells the operator
+  once per app per day through the existing operator-only digest (`backup_run_failures`, leg
+  `tier2-settings-unreadable`, `SetTier2SettingsUnreadableNotify`) — no new event type, no hub change.
+- **A D25 kept copy stays kept when its leg leaves the declared set (HUNT-2 H2):** every kept copy recorded inside
+  the dest tree joins the reconcile's keep set (`keptCopyRels`).
+- **Remove with „remove backups" drops the kept-copy records of what it deleted (HUNT-2 H9)** (`dropKeptCopiesUnder`
+  in `RemoveTier2Mirrors`), so the backups page never lists a copy that is gone.
+- Tests (each seen failing with its rule taken out): `TestR1252_ARejectedBlockKeepsEveryCopy` (the review's 9202 steps:
+  two control runs, then the bogus path; and the once-a-day signal), `…AnAbsentBlockReconcilesNothing`,
+  `…AValidClassificationStillReconciles` (the control: §8.2's re-classed leg still goes), `…AKeptCopyStaysWhenItsLegLeaves`,
+  `…RemoveDropsTheKeptRecordsItDeleted`, `TestR1252_BackupBlockRejectedNamesTheReason` (stacks, the real
+  LoadMetadata), `TestR1252_MainWiresTheUnreadableSettingsSignal` + a compile-time pin on the adapter.
+
 ### A pending put-back blocks every start (R-1251, P1; review round 2 HUNT-1 H1, H2, H7) — 2026-10-24 night, commit only
 
 - **A power cut during a restore of a drive-backed app no longer brings old data back later.** The restore's copy of