W21 sharing switched on without a password asks for it and says why it waits; W25 failed off-site run shows the household a sentence built from the classifier, raw text only to log and operator; W28 share restore skips the controller's drop-zone share; unreleased

controller/internal/backup/shares_restore.go

@@ -241,6 +241,16 @@ func (m *Manager) PlaceSharesRestore(ctx context.Context) (SharesRestoreResult,
 		// THE PREFIX ASSERT. The snapshot's path is untrusted layout input; a destination that is not
 		// strictly inside a live registered root is refused, never created.
 		if !m.liveShareRootOK(sh.Path) {
+			// W28 (rehearsal 2026-10-20): the controller's OWN drop-zone share („beolvasas", R-75) lives on the
+			// SYSTEM drive, never under a data-drive root, so it is always refused here — and the household read
+			// „Nem állítható vissza (…): beolvasas." about a share it never made. Its definition comes back by
+			// itself (ensureImportShare, whenever sharing is on) and its folder is an inbox apps empty, so it is
+			// skipped without a word to the household; the refusal of any OTHER share is unchanged.
+			// Pinned by TestW28_TheSystemDropZoneIsNotNamedAsRefused.
+			if sh.System {
+				m.logger.Printf("[INFO] [shares] restore skipped for the system drop-zone share %s — the controller re-creates it while sharing is on", sh.Name)
+				continue
+			}
 			m.logger.Printf("[WARN] [shares] restore refused for %s — destination is not under a live storage root", sh.Name)
 			res.Refused = append(res.Refused, sh.Name)
 			continue