kept second-drive copies (D25: R-1175, R-1181, R-1179); .fab import keeps the family gate (R-1191); stale restore temp (R-1188 c); the overcommit sentence made true (R-1192); escrow before the floor (R-1176); unreleased

controller/internal/backup/tier2.go

@@ -152,6 +152,12 @@ func (m *Manager) selectTier2TargetFrom(stackName, sourceDrive string, fullSize,
 			if sp.Path == sourceDrive {
 				continue
 			}
+			// R-1179: a drive marked away is never a target. Its mount point is an empty folder on the guest's root
+			// disk (or the host's), so the night's copy would fill the wrong disk and not be where the household
+			// thinks. Decommissioned drives are already left out by GetSchedulableStoragePaths.
+			if sp.Disconnected {
+				continue
+			}
 			if sp.IsNetwork() {
 				sawNetworkCandidate = true // F-6C-1: never a tier-2 target
 				continue
@@ -350,7 +356,7 @@ func (m *Manager) RunTier2(stackName string) error {
 	}
 
 	// Class-driven legs (classified) / resolver legs (legacy) + loud gap warnings (§7-H).
-	legs, warns := m.tier2CaptureSet(stackName, sourceNsRoot)
+	legs, missingLegs, warns := m.tier2CaptureSetFull(stackName, sourceNsRoot)
 
 	// Two sizes: full = unit + all legs; state-only = unit + mandatory legs (the SSD ceiling).
 	unitSize := dirSizeBytes(unitDir)
@@ -440,7 +446,13 @@ func (m *Manager) RunTier2(stackName string) error {
 	legRels := make([]string, 0, len(legs))
 	mirroredSize := unitSize
 	for _, lg := range legs {
-		if err := mirror(lg.Src, filepath.Join(destBase, filepath.FromSlash(lg.DestRel))); err != nil {
+		dst := filepath.Join(destBase, filepath.FromSlash(lg.DestRel))
+		if m.emptiedSourceRefused(stackName+" "+lg.DestRel, lg.Src, dst) {
+			legRels = append(legRels, lg.DestRel) // kept as it is (R-1181)
+			warns = append(warns, m.note("note.tier2.emptied_kept", lg.DestRel))
+			continue
+		}
+		if err := mirror(lg.Src, dst); err != nil {
 			m.recordTier2Failure(stackName, target, err)
 			if m.tier2Notify != nil {
 				m.tier2Notify(stackName, target.Label, time.Since(start), err)
@@ -449,6 +461,13 @@ func (m *Manager) RunTier2(stackName string) error {
 		}
 		legRels = append(legRels, lg.DestRel)
 		mirroredSize += dirSizeBytes(lg.Src)
+		m.releaseKeptCopy(dst)
+	}
+	// D25 / R-1181: a declared folder that is MISSING keeps its copy (kept + listed), never reconciled away.
+	for _, lg := range missingLegs {
+		legRels = append(legRels, lg.DestRel)
+		m.keepCopy("app", stackName+": "+lg.DestRel, m.storageLabel(sourceDrive), "folder_missing", destBase,
+			filepath.Join(destBase, filepath.FromSlash(lg.DestRel)))
 	}
 
 	// Reconcile stale dest dirs (a bind removed / re-classed excluded), then write the marker LAST.