Stray-copy fix: the capped second-drive copy container never outlives the copy — fixed name + label, removed by name on any error (the timeout included), every leftover removed at start before the scheduler and web server; a restore is refused while a copy runs or may still run; --mount (refuses a path the daemon does not see) and the image ID with --pull never (review); red-proved; unreleased

controller/internal/web/straycopy_restore_refused_test.go

@@ -0,0 +1,27 @@
+package web
+
+import (
+	"strings"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
+)
+
+// The stray-copy fix: a restore is refused while a second-drive copy (rsync --delete) runs — every restore entry
+// point asks restoreOpBlocked first. RED-PROOF (2026-10-22 night): with the Tier2CopyBlocksRestore check removed from
+// restoreOpBlocked, this fails.
+func TestStrayCopy_RestoreRefusedWhileACopyRuns(t *testing.T) {
+	s, _, _ := newOffboxWebServer(t)
+	if _, blocked := s.restoreOpBlocked(); blocked {
+		t.Fatal("fixture: nothing runs, a restore must be allowed")
+	}
+	done := backup.MarkTier2CopyForTest("immich")
+	msg, blocked := s.restoreOpBlocked()
+	done()
+	if !blocked || !strings.Contains(msg, "második meghajtóra") {
+		t.Fatalf("during a second-drive copy a restore must be refused with the copy named; got blocked=%v %q", blocked, msg)
+	}
+	if _, blocked := s.restoreOpBlocked(); blocked {
+		t.Fatal("after the copy a restore must be allowed again")
+	}
+}