kept second-drive copies (D25: R-1175, R-1181, R-1179); .fab import keeps the family gate (R-1191); stale restore temp (R-1188 c); the overcommit sentence made true (R-1192); escrow before the floor (R-1176); unreleased

CHANGELOG.md

@@ -1,5 +1,43 @@
-## Unreleased (2026-10-20/21) — the monitoring page's storage labels follow the reader's language (W26); a finished off-site abandonment closes on the hub's word (R-1182)
+## Unreleased (2026-10-20/21) — kept second-drive copies (D25: R-1175, R-1181, R-1179); a `.fab` import keeps the family gate (R-1191); a stale restore temp no longer blocks the retry (R-1188 c); the overcommit sentence made true (R-1192); escrow recorded before the floor (R-1176); a finished off-site abandonment closes on the hub's word (R-1182); storage labels follow the language (W26)
 
+- **D25 / R-1175 / R-1181 (operator ruling 2026-10-21) — kept second-drive copies.** Shares on two drives that copy to
+  one second drive no longer delete each other's copies: each group reconciles only its own drive key (before: every key
+  on disk with only its own legs — after every run only the last group had a copy, and the night a drive died its only
+  second copy went). A copy whose source is gone (drive away/decommissioned, a registered share's folder or an app's
+  declared folder missing) is KEPT and recorded (`settings.KeptCopy`); the restore page lists it („Megőrzött
+  másolatok") with „Eltávolítás" (`POST /backup/kept/remove`: the record's path, inside its tree, same device + inode —
+  never by size or pattern). A share deleted or renamed on a present drive is still pruned. An EMPTIED present folder is
+  not mirrored over a copy that holds files (`rsync --delete` would empty it): the leg is kept and the run warns
+  („note.tier2.emptied_kept"). Tests `TestR1175_*` (3), `TestR1181_*` (2), `TestD25_*` (3) — red-proved: the old
+  reconcile line → both copies tests fail; the guard off with the real `rsync -a --delete` mirror → the emptied copy is
+  gone; the old tier-2 code → `the MISSING folder's second-drive copy was deleted`. i18n: a NEW parity case
+  `backups_restore_kept`; every existing restore page renders byte-identically (the section and its script are inside
+  `{{if .KeptCopies}}`).
+- **R-1179:** a drive marked away is never chosen as the second-drive target. `TestR1179_AnAwayDriveIsNotChosenAsTarget`
+  (red-proved: the copy landed on the away drive).
+- **R-1188 (c):** a leftover `<file>.felhom-restoring` from an interrupted whole restore is removed before the copy, so
+  the retry brings the file back (before: every retry failed „file exists"). `TestR1188c_ALeftoverTempDoesNotBlockTheRetry`
+  (red-proved with the data-loss hunt's own C3 case).
+- **R-1191 — a `.fab` import keeps the family gate.** The import wrote a bare record and the gate reconcile then removed
+  the gate file: a family-only app came back open to anyone (proven live on 9202). Now `stacks.SaveImportedAppConfig`
+  builds the record like the unit restore (locked fields, desired state, the PRIOR record's life records and pins) and
+  `PrepareImportedApp` — called by the import after the config step and before `StartStack` — writes the family gate and,
+  for an app with no record before, the sign-up lock, reusing `prepareFamilyGate` / `restoreSignupLock`; the in-memory
+  record is updated so the reconcile keeps the file. Tests `TestR1191_AnImportedFamilyAppKeepsItsDoor` (Glance, MeTube,
+  Grimmory stanzas) and `TestR1191_AnImportOverAnInstalledAppKeepsItsRecords` — red-proved (no gate step → „no door
+  after the import"; no carry → the installed app's records lost).
+- **R-1192 — the overcommit sentence.** „Normál használat mellett ez nem okoz problémát." was false: the 8 GB box froze
+  under its first uploads (felhom.eu `audits/fixes-2026-10-21/P4-freeze/`). New keys `deploy.memory_overcommit_slow` /
+  `err.stacks.memory_overcommit_slow`: „Az alkalmazások csúcsterhelése meghaladhatja a rendelkezésre álló memóriát.
+  Ilyenkor a doboz nagy feltöltések alatt lelassulhat, és akár percekig sem válaszol. Ha ez gyakran előfordul, távolíts
+  el egy alkalmazást." (EN twin). The fix itself is the agent's (swap = RAM, felhom-agent Unreleased); the install page's
+  parity fixture carries the new sentence.
+- **R-1176 — the ACK order.** `OnPushResponse` records the hub's escrow status BEFORE `SetFloor`: the off-site
+  apply-bridge GOes when the floor is known, and a rebuilt box must already know the hub holds the household's package
+  or its mint guard cannot hold. Pinned by `TestR1176_EscrowIsRecordedBeforeTheFloorIsKnown` (AST; red-proved on the old
+  order). Measured live 2026-10-21 with hub v0.163.0 (felhom.eu `audits/fixes-2026-10-21/P1-live/`): the hub carried
+  the package at the agent's first report, two minutes before the controller's first ACK, so the box (still 0.336.0)
+  logged „NOT minting a repository password" — this order change is the belt for a hub that carries later.
 - **R-1182 (2026-10-21, with hub v0.163.0):** the hub now purges only the recovery packages that open the set-aside copy
   it deleted, and keeps the packages of other stored copies, so `superseded_present` can stay true after a finished
   abandonment. The ACK field `escrow.abandon_purge_done` now reaches `report.EscrowStatus`; the confirmer's new hook