kept second-drive copies (D25: R-1175, R-1181, R-1179); .fab import keeps the family gate (R-1191); stale restore temp (R-1188 c); the overcommit sentence made true (R-1192); escrow before the floor (R-1176); unreleased

controller/README.md

@@ -1624,6 +1624,17 @@ backups/primary/<app>/
   maradtak."). **Every one is a claim about the BACKUP, never about the app** — see CONTEXT.md's ruling
   and 07-backup-architecture §6.3.
 
+### Kept second-drive copies — a gone source keeps its copy (D25, operator ruling 2026-10-21; R-1175, R-1181)
+
+A second-drive copy whose source is gone — the drive is away or decommissioned, or a declared folder is missing — is
+**kept until the household releases it**. No night job removes it. The restore page („Visszaállítás") lists it under
+„Megőrzött másolatok" („a(z) <meghajtó> meghajtóról megőrzött másolat · <ok>") with „Eltávolítás" (a confirm, then that
+one copy is removed by its record — path inside the copy tree, same device and inode). A share the household deleted or
+renamed on a present drive is still pruned. Each share group reconciles only its own drive key (R-1175). An EMPTIED
+present folder is not mirrored over a copy that holds files: the run warns and keeps the copy (R-1181). An away drive is
+never chosen as the target (R-1179). Code: `internal/backup/tier2_kept.go`, `internal/settings/kept_copies.go`,
+`internal/web/kept_copies.go`.
+
 ### Off-site content proof (v0.231.0, R-87)
 
 **What it is:** every night the box restores ONE app's newest off-site snapshot into a throwaway