R-1271 (P2): „use my kept data” never takes a copy dated in the future — a copy more than 10 minutes past the box's clock never counts as the newest (the newest true date wins, tie local); alone it is still offered, said and not recommended. Red-proved. Commit only.

CHANGELOG.md

@@ -22,6 +22,25 @@ brief 2026-10-24, Part 4 (commit only; the release rides the next normal train).
   `…OnlyWhenTheAgentWaitsAndAnAppRuns`, `…QBLimitRuleSkipsAHeldLimit`, `…TheTwoAppsReadAndWriteTheirLimit`,
   `TestLineTestRunOutlastsTheClientTimeout`, `TestStartUpwatchRecoversTheHoldFirst`, `TestUpwatchHoldGetsBothAgentCalls`.
 
+### „Use my kept data" never takes a copy dated in the future (R-1271, P2) — 2026-10-25, commit only
+
+- **The cause, read from the code:** the catalog sweep's Tester4 off-site store held the 2026-10-20 rehearsal box's
+  copies, dated 2026-10-28 (that box's clock was set ahead). `KeptNewer` took the off-site copy whenever its date was
+  after the local one's; that date was the other box's snapshot time, uncapped (this box had no data time of its own
+  for it, `offsiteDataTime`). The `07` §6.5 „another drive" check (`KeptCopyAt`) compares the unit's `HDD_PATH` — a
+  mount path with the same name on every box — so it is a path check, and it stays one (an old box's data on a new box
+  is what off-site is for). Immich's 20 minutes of 404 were routing: the copy brought the old box's subdomain
+  (`photos`); the app was healthy at `photos.<domain>`.
+- **Now (`keptPick`, `KeptNewerAt`):** a copy dated more than `KeptClockSkew` (10 minutes) past this box's clock is
+  future-dated and never the newest; the newest copy with a true date wins (tie → local, own unit before the second
+  drive). A future-dated copy alone is still offered: the install question carries `use_future` and a sentence („…a
+  dátuma (…) a jövőben van… Csak akkor válaszd, ha biztosan ez a ti mentésetek."), and draws „use" as the plain button,
+  not the primary one; the kept-data list adds „(a dátuma a jövőben van…)". The question names the copy as before.
+- Tests (each seen failing with the future check off): `TestR1271_AFutureOffsiteCopyNeverBeatsTheOwnCopy`,
+  `…AFutureCopyAloneIsOfferedButMarked`, `…TheClockSkewAllowance`, api `…AFutureCopyAloneIsSaidAndNotRecommended`;
+  controls `…AnOlderOffsiteCopyAloneIsChosenAsBefore`, `…ANewerTrueOffsiteCopyStillWins`. The three install-page parity
+  fixtures carry the two changed script lines (nothing else moved).
+
 ### A restore downloads first (D48) — 2026-10-25, commit only
 
 Operator ruling D48 (2026-10-25 08:38, `09` §3 decision 257): every restore path resolves and pulls every image its