R-1271 (P2): „use my kept data” never takes a copy dated in the future — a copy more than 10 minutes past the box's clock never counts as the newest (the newest true date wins, tie local); alone it is still offered, said and not recommended. Red-proved. Commit only.

controller/internal/web/kept_handlers.go

@@ -80,18 +80,27 @@ func (s *Server) keptBackupFor(lang string, it stacks.KeptItem, off map[string]b
 		// A dated folder's own unit is the copy taken with those files.
 		if it.UnitDir != "" {
 			if c, ok := s.backupMgr.KeptCopyAt(it.UnitDir, it.Drive, 1); ok {
-				return s.msgLang(lang, "kept.backup.with", fmtLocalTime(lang, c.Time)), c, true
+				name := s.msgLang(lang, "kept.backup.with", fmtLocalTime(lang, c.Time))
+				if backup.KeptFuture(c, time.Now()) { // R-1271: say it, never hide it
+					c.Future = true
+					name += " " + s.msgLang(lang, "kept.backup.future_note")
+				}
+				return name, c, true
 			}
 		}
 	} else {
 		local, lok = s.backupMgr.KeptDBCopy(it.App, it.Drive)
 	}
 	oc, ook := off[it.App]
-	c, ok := backup.KeptNewer(local, lok, oc, ook && it.App != "")
+	c, ok := backup.KeptNewerAt(time.Now(), local, lok, oc, ook && it.App != "")
 	if !ok {
 		return none, backup.KeptCopy{}, false
 	}
-	return s.msgLang(lang, backup.KeptCopyKey(c.Tier), fmtLocalTime(lang, c.Time)), c, true
+	name := s.msgLang(lang, backup.KeptCopyKey(c.Tier), fmtLocalTime(lang, c.Time))
+	if c.Future { // R-1271: the only copy, dated in the future — offered, and said
+		name += " " + s.msgLang(lang, "kept.backup.future_note")
+	}
+	return name, c, true
 }
 
 // keptOffsite asks the off-site repository ONCE for every listed app.