controller v0.178.0 — R-88 Part 2: only a positive 'never' fires the valve

MinAgent: 0.105.0. scheduledRunAllowed fired on any nil age; it now requires a
licence from valveLicensed, which grants it for AgeStateAbsent and for a LEGACY
agent, and refuses it for AgeStateUnknown. An unreadable storage no longer
masquerades as a first-ever backup and no longer quiesces apps outside the window.

A missing wire field means legacy, not unknown — deliberately. Treating it as
unknown would stop the valve firing on un-upgraded boxes and starve genuinely new
ones. Degrade logged once; unrecognised future values also map to legacy.

Caught in passing: TieredBackend is satisfied by a RUNTIME assertion, so the
signature change compiled and vetted clean while quiesceBackend silently stopped
satisfying it — which would have degraded every box to the single-tier path with
no error. Added a compile-time witness.

Also corrects the notifier comment that claimed operator-only came from a missing
customerMessages entry; enforcement is hub-side operatorOnlyEvents (hub 0.79.0).

controller/cmd/controller/main.go

@@ -1741,9 +1741,11 @@ func (b quiesceBackend) Tiers(ctx context.Context) ([]quiesce.BackupTier, error)
 	return out, nil
 }
 
-func (b quiesceBackend) DueFor(ctx context.Context, target string) (bool, *int64, error) {
+func (b quiesceBackend) DueFor(ctx context.Context, target string) (bool, *int64, string, error) {
 	r, err := b.c.BackupDueFor(ctx, target)
-	return r.Due, r.AgeSecs, err
+	// AgeState is passed through RAW; quiesce.ageStateFromWire owns the mapping, including the
+	// legacy-vs-unknown distinction. An empty string here means a pre-v0.105.0 agent.
+	return r.Due, r.AgeSecs, r.AgeState, err
 }
 func (b quiesceBackend) StartBackupFor(ctx context.Context, target string) (string, error) {
 	r, err := b.c.StartBackupFor(ctx, target)

controller/cmd/controller/tieredbackend_assert_test.go

@@ -0,0 +1,19 @@
+package main
+
+import (
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/quiesce"
+)
+
+// R-88 Part 2 — TieredBackend is satisfied by a RUNTIME type assertion in `resolveDueTiers`
+// (`l.backend.(TieredBackend)`), NOT at compile time. So when DueFor's signature changed, the whole
+// repo still built and vetted clean while `quiesceBackend` silently stopped satisfying the
+// interface — which would have degraded every box to the untargeted single-tier path, losing R-82's
+// multi-tier backups entirely, with no error anywhere.
+//
+// This compile-time assertion is the only thing that catches it. It caught it during R-88 Part 2.
+// Do not delete it; a runtime-asserted interface needs a compile-time witness.
+func TestQuiesceBackendSatisfiesTieredBackend(t *testing.T) {
+	var _ quiesce.TieredBackend = quiesceBackend{}
+}