kept second-drive copies (D25: R-1175, R-1181, R-1179); .fab import keeps the family gate (R-1191); stale restore temp (R-1188 c); the overcommit sentence made true (R-1192); escrow before the floor (R-1176); unreleased

controller/internal/backup/r1179_r1188c_test.go

@@ -0,0 +1,52 @@
+package backup
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// R-1179: a drive marked AWAY is never the second-drive target. Seen in the R-1175 unit test of the data-loss hunt
+// (a share copied to a drive marked disconnected). COMPANION RED-PROOF: drop the Disconnected skip → the copy lands
+// on hdd_1.
+func TestR1179_AnAwayDriveIsNotChosenAsTarget(t *testing.T) {
+	env := newSharesEnv(t, "hdd_1", "hdd_2", "hdd_3")
+	env.addShare(t, "hdd_2", "b_share", true)
+	if err := env.sett.SetDisconnected(env.drives["hdd_1"], true, nil); err != nil {
+		t.Fatal(err)
+	}
+	if err := env.m.RunSharesTier2(); err != nil {
+		t.Fatal(err)
+	}
+	for _, call := range env.mirrored {
+		if strings.Contains(call, "=>"+env.drives["hdd_1"]+string(os.PathSeparator)) {
+			t.Fatalf("a copy went to the AWAY drive hdd_1: %s", call)
+		}
+	}
+	if _, err := os.Stat(filepath.Join(sharesCopy(env, "hdd_3", "hdd_2", "b_share"), "b_share.txt")); err != nil {
+		t.Fatalf("no copy on the present drive hdd_3: %v", err)
+	}
+}
+
+// R-1188 (c): the data-loss hunt's C3 case (felhom.eu audits/dataloss-hunt-2026-10-20/C3-R12-leftover-temp/): a power
+// cut mid-copy leaves `<file>.felhom-restoring`; the retry must bring the file back instead of failing „file exists".
+// COMPANION RED-PROOF: drop the leftover removal in copyFilePreserving → the retry fails and p1.jpg stays missing.
+func TestR1188c_ALeftoverTempDoesNotBlockTheRetry(t *testing.T) {
+	f, _, liveLeg := wholeFixture(t)
+	if err := os.MkdirAll(liveLeg, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(liveLeg, "p1.jpg.felhom-restoring"), []byte("half"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := f.m.RestoreTier2Whole("app"); err != nil {
+		t.Fatalf("the retry failed: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(liveLeg, "p1.jpg")); err != nil {
+		t.Fatalf("p1.jpg is not back: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(liveLeg, "p1.jpg.felhom-restoring")); !os.IsNotExist(err) {
+		t.Fatalf("the leftover temp is still there: %v", err)
+	}
+}