R-203 Part 2: a run that missed a MANDATORY directory is not a successful run (v0.197.0)

The gap was already detected and warned about, in Hungarian, naming the app and the folders --
that warning is what stopped the R-201 drill. The defect was that the run still reported `ok`
beside it, and a warning standing beside a success is read as a success.

last_status gains "incomplete": minted, because "ok" | "error" | "running" had nothing meaning
"it ran, and this app is not fully protected". NOT "error" -- the rest of the run worked and
what was captured is real, so SnapshotCount and the LastSuccess anchor still record it. Half a
backup is not no backup.

The gaps are now recorded STRUCTURALLY (offboxRunResult.mandatoryGaps), not only as prose, so
the verdict has something to act on. It reaches the operator through the EXISTING per-run digest
(backup_run_failures) rather than a new event type -- a new type is a two-repo change and the
hub drops anything outside allowedEventTypes.

The stat-filter gains the ClassMandatory check Tier 2 already had. It is a NO-OP today
(TierOffsite admits mandatory only), so no customer-visible warning disappears -- demonstrated
by widening the tier filter alone and watching the check hold the line.

ANTICIPATED: calibre-web on demo-hp has exactly this gap, so its off-site status becomes
incomplete the moment this ships. That is correct and is the point.

Red-proofs: my first Scenario-C proof PASSED because the test only reached offboxCaptureSet
while the mutation lives in runOffboxInternal -- a mutation the test cannot observe is not a
red-proof, and the fix was the test. The run-level test now fails under both mutations
(unreachable gap recording; unconditional ok).

controller/internal/backup/offbox_capture.go

@@ -29,13 +29,13 @@ type offboxBlocked struct {
 // snapshot, plus any Hungarian warnings for capture gaps. It never returns optional/excluded paths
 // (the TierOffsite filter drops them — §2). Returns (nil, nil) for the legacy / no-provider / no-block
 // world: offsite stays UNIT-ONLY, byte-identical to pre-v0.134.0 (the SQ5 cost-regression guard).
-func (m *Manager) offboxCaptureSet(stack string) (extra []string, warns []string) {
+func (m *Manager) offboxCaptureSet(stack string) (extra []string, warns []string, gaps []string) {
 	if m.stackProvider == nil {
-		return nil, nil // no provider wired → legacy world → unit only
+		return nil, nil, nil // no provider wired → legacy world → unit only
 	}
 	binds, has := m.stackProvider.GetStackClassifiedBinds(stack)
 	if !has {
-		return nil, nil // no backup block → legacy → unit only
+		return nil, nil, nil // no backup block → legacy → unit only
 	}
 	// Resolve against the app's LIVE HDD_PATH (raw — NOT GetAppDrivePath, whose systemDataPath fallback
 	// would resolve userdata onto the wrong drive). Empty ⇒ undeployed / no HDD (decision §2.4):
@@ -43,12 +43,11 @@ func (m *Manager) offboxCaptureSet(stack string) (extra []string, warns []string
 	hdd := strings.TrimSpace(m.stackProvider.GetStackHDDPath(stack))
 	if hdd == "" {
 		m.logger.Printf("[WARN] [offbox] %s: not deployed — offsite push is unit-only (mandatory userdata not resolvable)", stack)
-		return nil, []string{fmt.Sprintf("Figyelmeztetés: a(z) %s nincs telepítve — csak a mentési egység került a távoli mentésbe.", stack)}
+		return nil, []string{fmt.Sprintf("Figyelmeztetés: a(z) %s nincs telepítve — csak a mentési egység került a távoli mentésbe.", stack)}, nil
 	}
 	nsRoot := m.namespaceRoot(hdd)
 	cs := appbackup.ComputeCaptureSet(binds, has, appbackup.TierOffsite, nsRoot, m.stackProvider.GetImportRoot())
 
-	var gaps []string
 	// Structurally-refused MANDATORY paths (traversal / bare drive-root / reserved backups/ zone) are
 	// loud ERROR gaps — the path the customer thinks is protected is not in the snapshot.
 	for _, sk := range cs.Skipped {
@@ -60,11 +59,18 @@ func (m *Manager) offboxCaptureSet(stack string) (extra []string, warns []string
 	}
 	// Stat-filter (§2.5): a declared mandatory path absent on disk. restic would skip it SILENTLY
 	// (SP-3.4), so drop it from argv AND warn — never a silent "looks backed up but isn't".
+	//
+	// R-203: the class check mirrors tier2_capture.go's ("optional-missing is silent"). It is a NO-OP
+	// today — TierOffsite's tierKeeps() already admits ClassMandatory only, so cs.Paths cannot contain
+	// an optional path here — and it is written anyway so the two tiers read the same and so the
+	// verdict below can never be flipped by an unused optional folder if that filter ever widens.
 	for _, p := range cs.Paths {
 		if _, err := os.Stat(p.Abs); err != nil {
-			m.logger.Printf("[WARN] [offbox] %s: mandatory data path missing on disk, skipped from offsite: %s", stack, p.Abs)
-			gaps = append(gaps, p.RelPath)
-			continue
+			if p.Class == appbackup.ClassMandatory {
+				m.logger.Printf("[WARN] [offbox] %s: mandatory data path missing on disk, skipped from offsite: %s", stack, p.Abs)
+				gaps = append(gaps, p.RelPath)
+			}
+			continue // optional-missing is silent (not a gap) — parity with Tier 2
 		}
 		extra = append(extra, p.Abs)
 	}
@@ -72,5 +78,5 @@ func (m *Manager) offboxCaptureSet(stack string) (extra []string, warns []string
 		warns = append(warns, fmt.Sprintf("Figyelmeztetés: a(z) %s alkalmazás egyes adatmappái nem kerültek a távoli mentésbe: %s.",
 			stack, strings.Join(gaps, ", ")))
 	}
-	return extra, warns
+	return extra, warns, gaps
 }