controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

R-650: internal/dockerexec — every docker exec routed through it; under
go test a real docker is refused (opt-in FELHOM_TEST_REAL_DOCKER=1; a stub
under the temp dir is allowed). api/stacks/web tests run under a silent
stub (TestMain). TestR650_NoBareDockerExec pins it repo-wide.
R-640: a dump without its engine's completion marker is refused before
the first mutation (unit + off-site restore) and again before any load.
R-499: the Tier-2 page's system-disk sentence has four true branches.
R-518: the backup button states the measured ~8 min stop.
R-626: measured on 9202, not reproduced.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/tier2_config_handler.go

@@ -34,6 +34,11 @@ func (s *Server) tier2ConfigPageHandler(w http.ResponseWriter, r *http.Request,
 	data["StackName"] = name
 	data["DisplayName"] = stack.Meta.DisplayName
 	data["Tier2"] = info
+	if !info.IsHDDApp {
+		// R-499: the sentence about a system-disk app must say where THIS box's whole-system backup
+		// goes. It used to promise „már szerepelnek a teljes rendszermentésben (PBS)" on every box.
+		data["SystemBackup"] = systemBackupFact(s.resolveBackupTargetState(r.Context()))
+	}
 	if flash := s.flashFrom(r, "flash"); flash != "" {
 		data["Flash"] = flash
 	}
@@ -133,3 +138,27 @@ func (s *Server) redirectTier2(w http.ResponseWriter, r *http.Request, name, fla
 	}
 	http.Redirect(w, r, dest, http.StatusSeeOther)
 }
+
+// systemBackupFact reduces the whole-system backup's target state to the one fact the Tier-2 page
+// states about an app on the system disk (R-499). The page used to tell every such app that its data
+// was „already in the full system backup (PBS)" and there was nothing to do — measured false on a box
+// whose only whole-system copy sat on the same disk (2026-09-14). Four states, four sentences:
+//
+//	protected — the whole-system backup goes to a drive of its own
+//	same_disk — it goes to the system disk itself: protects against bad files, not a dead disk
+//	absent    — its drive is configured and gone: no fresh whole-system backup is being made
+//	unknown   — the agent could not be asked: say so, promise nothing
+//
+// Pinned by TestR499_* (the mapping and one render per branch).
+func systemBackupFact(st BackupTargetState) string {
+	switch {
+	case !st.Known:
+		return "unknown"
+	case st.TargetAbsent:
+		return "absent"
+	case st.Degraded:
+		return "same_disk"
+	default:
+		return "protected"
+	}
+}