R-893 option A (operator D20): a failed off-site restore puts the app's live volumes and definition back exactly and starts it; fit check before the stop; the held sentence made true (R-1169)

controller/scripts/docker_run_volume_path_gate.py

@@ -35,6 +35,9 @@ ALLOWLIST = [
     ("internal/backup/restore.go", '"-v", dumpDir+":/in:ro"',
      "Tier-1 volume restore source: same registered-drive namespace argument as the dump "
      "target above — host-visible by the identical binds"),
+    ("internal/backup/offbox_restore_undo.go", '"-v", vol+":/v:ro"',
+     "the off-site restore's copy size check (R-893 option A, 2026-10-20): `du` on a NAMED volume mounted "
+     "read-only into a throwaway alpine — no host path, daemon-side, the estimate.go class"),
     ("internal/stacks/undo.go", '"-v", vol+":/v:ro"',
      "the undo's size check (v0.263.0): `du` on a NAMED volume mounted read-only — no host path, "
      "daemon-side, the estimate.go class"),

controller/scripts/i18n_go_keys.json

@@ -283,7 +283,13 @@
     "err.web.decommission_backup_target": "BORN AS A KEY (R-1063, 2026-10-18) -- the agent's 409 to a drive retirement (the drive holds the system backup), in plain words; nothing changed. Pinned by internal/web TestFinalizeDecommission_AgentRefusalChangesNothing.",
     "err.web.decommission_protected": "BORN AS A KEY (R-1063, 2026-10-18) -- the agent's 403 to a drive retirement (a protected system/backup disk), in plain words; nothing changed. Pinned by internal/web TestFinalizeDecommission_AgentRefusalChangesNothing.",
     "disk.decommission.apps_restarted": "BORN AS A KEY (R-1144, 2026-10-18) -- after a refused „Végleges leszerelés — mégis\", the apps that were running are started again; this sentence says so. Pinned by internal/web TestR1144_RefusalAfterStopStartsTheRunningAppsAgain.",
-    "disk.decommission.apps_not_all_restarted": "BORN AS A KEY (R-1144, 2026-10-18) -- after a refused „Végleges leszerelés — mégis\", the apps that were running are started again; this sentence says so. Pinned by internal/web TestR1144_RefusalAfterStopStartsTheRunningAppsAgain."
+    "disk.decommission.apps_not_all_restarted": "BORN AS A KEY (R-1144, 2026-10-18) -- after a refused „Végleges leszerelés — mégis\", the apps that were running are started again; this sentence says so. Pinned by internal/web TestR1144_RefusalAfterStopStartsTheRunningAppsAgain.",
+    "err.backup.restore_failed_put_back": "BORN AS A KEY (R-893 option A, D20 = A, 2026-10-20) -- a failed off-site restore was put back: the live volumes and definition from before the restore, the app started; nothing changed. Pinned by internal/backup TestR893A_AFailedReplayPutsTheLiveVolumesBackExactly.",
+    "err.backup.restore_failed_put_back_files": "BORN AS A KEY (R-893 option A, D20 = A, 2026-10-20) -- the same put-back when files were already copied from the backup; the sentence says the files stay. Pinned by internal/backup TestR893_AVersionChangeThenAFailedReplayStartsTheAppAtItsLiveDefinition.",
+    "err.backup.restore_failed_put_back_not_started": "BORN AS A KEY (R-893 option A, D20 = A, 2026-10-20) -- the data is put back but the app did not start; the household is told to start it. Pinned by internal/backup offbox_restore_undo.go putBackAfterFailedRestore (the restart branch).",
+    "err.backup.restore_undo_copy_failed": "BORN AS A KEY (R-893 option A, D20 = A, 2026-10-20) -- the copy of the live volumes failed, nothing was restored, the app runs again. Pinned by internal/backup TestR893A_AFailedCopyRestoresNothingAndStartsTheApp.",
+    "err.backup.restore_undo_no_space": "BORN AS A KEY (R-893 option A, D20 = A, 2026-10-20) -- the restore and the copy of the live volumes do not fit; refused before anything stops. Pinned by internal/backup TestR893A_TheCopyMustFitBeforeAnythingStops.",
+    "err.backup.restore_undo_unmeasured": "BORN AS A KEY (R-893 option A, D20 = A, 2026-10-20) -- a live volume cannot be measured for its copy; refused before anything stops. Pinned by internal/backup TestR893A_AnUnmeasurableVolumeRefusesBeforeAnythingStops."
   },
   "flash.share.already_on": "A megosztás már be van kapcsolva.",
   "flash.share.enable_failed": "A megosztás bekapcsolása nem sikerült.",