v0.142.0: offsite repo continuity — orphaned-repo guard (A) + run-status auto-refresh (C)

- Part A: classify restic cat-config failure (wrong-password=orphaned vs no-repo vs other); ORPHANED state + Hungarian card + offbox_repo_orphaned/reset events (once, not nightly); reset = move-aside (never delete) + init, unclaimed auto / claimed confirm. Red-proofs TestOffbox_OrphanDetection_* + ConfirmedReset.
- Part C: GET /backup/offbox/status + poll on backups_remote → flips Fut→Rendben/Hiba without manual reload.

CHANGELOG.md

@@ -1,5 +1,30 @@
 ## Changelog
 
+### v0.142.0 — offsite repo continuity: orphaned-repo guard (A) + run-status auto-refresh (C) (2026-07-17)
+
+Closes the reinstall-orphaned-repo incident class (`memory` offbox-repo-orphaned-2026-07-17): a
+recreated data volume minted a new repo passphrase; the offsite repo, keyed under the old one, became
+unreadable and surfaced only as a raw nightly `wrong password or no key found`. Green:
+`go build ./... && go vet ./... && go test ./...` + template/emoji/native-confirm gates. Pairs with hub
+v0.60.0 (Part B escrow retention).
+
+- **Part A — orphaned-repo guard.** `ensureOffboxRepo` now CLASSIFIES the `restic cat config` failure
+  (`classifyResticProbe`, the exact 07-17 stderr): `wrong password or no key found` → **ORPHANED**;
+  no-repo → init; other (network/SFTP-auth) → existing error handling. An orphaned repo persists
+  `OffboxTarget.RepoState="orphaned"` and, ONLY on the transition, pushes `offbox_repo_orphaned`
+  (never nightly-spam — scheduled runs then SKIP). The remote page shows a calm Hungarian card
+  (exception color) explaining the remote holds backups under a previous, no-longer-available key —
+  NOT the raw restic banner. **Reset (move-aside, never delete):** an UNCLAIMED box auto-resets on
+  detection (Scenario B); a CLAIMED box gets an explicit reveal-then-confirm reset (Scenario C) →
+  `mv <repo> <repo>.orphaned-<date>` (collision-suffixed) + `restic init` + `offbox_repo_reset` event.
+  `internal/backup/offbox.go` (+ `ErrOffboxOrphaned`, `ResetOrphanedRepo`, an ssh-exec seam),
+  `web/offbox_handlers.go` (`/backup/offbox/reset` + the orphaned-run refuse), `backups_remote.html`.
+  Red-proof `TestOffbox_OrphanDetection_Claimed` (pre-fix = the incident: raw error, no state → FAIL)
+  + `TestOffbox_OrphanDetection_UnclaimedAutoReset` + `TestOffbox_ConfirmedReset`.
+- **Part C — run-status auto-refresh.** New `GET /backup/offbox/status` (JSON) + a poll on
+  `backups_remote.html`: while a run shows "Fut…" the page polls and flips to Rendben/Hiba + fresh
+  numbers without a manual reload; polling stops at the terminal state. Test `TestOffboxStatusHandler`.
+
 ### v0.141.0 — N100 polish: initialize-to-usable (F6) + Vissza back-routes (F7) (2026-07-17)
 
 Closes two `VALIDATION-n100-baremetal-2026-07-16.md` findings. Green: