controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

R-486 (P1): removing an app with its backups KEPT keeps its Tier-2 record,
so the second-drive restore is no longer refused over an intact mirror.
R-484: postgis/pgvector/timescaledb images are Postgres (logical dumps).
R-485: the backup card sizes the recovery unit and the mirror(s).
R-480: a held update's sentence leaves the card once the hold is lifted.
R-477: the update's off-site lookup is one snapshots call, no stats.
R-478: a copy older than this install's deploy does not count.
R-474: "delete backups" deletes the unit, the mirror(s) and the prefs.

Tests and red-proofs per row; evidence in felhom.eu
documentation/audits/v0240-2026-09-13/ and nightly-2026-09-13-adventurelog/.

controller/README.md

@@ -576,7 +576,7 @@ or a migration running).
 
 **Any backup tier counts (v0.239.0, R-475).** The update leans on the first FRESH copy in the order
 second drive (Tier 2), the app's own recovery unit (Tier 1, „helyi"), off-site (Tier 3, looked up with
-a 15 s bound — unreachable counts as absent, with a WARN). `update.backup_max_age` applies to whichever
+a 15 s bound — unreachable counts as absent, with a WARN; since v0.240.0 it runs no per-app `stats`). `update.backup_max_age` applies to whichever
 tier is chosen. An app with no copy anywhere is backed up first. Tier 2 is required nowhere in the
 update path; the backups page's „Teljes visszaállítás" still reads the Tier-2 predicate alone.
 
@@ -588,7 +588,9 @@ every container running for an app with none; bounded by `update.health_timeout`
 puts the pin back. An app that does not become healthy is stopped and HELD** — the pin stays on the
 new version, and the hold sentence names the tier and the date of the copy it can be restored from
 („második meghajtó" / „saját meghajtó" / „távoli mentés"). A successful unit restore — and, since
-v0.239.0, a successful off-site restore — lifts an update hold.
+v0.239.0, a successful off-site restore — lifts an update hold, and since v0.240.0 the held update's
+sentence leaves the card with it. A copy older than the app's current `deployed_at` does not count
+(v0.240.0) — it belongs to a previous install. The off-site lookup is one `restic snapshots` call.
 
 **Config (`controller.yaml`):**
 
@@ -3780,7 +3782,7 @@ All daily jobs use Europe/Budapest timezone. Skip-if-running prevents concurrent
 | GET | `/api/stacks/{name}/logs` | Container logs (`?raw=1` for plain text) |
 | GET | `/api/stacks/{name}/hdd-data` | HDD data paths + sizes — resolved from the app's OWN `app.yaml` `HDD_PATH` (v0.236.0, R-442), never the global config |
 | GET | `/api/stacks/{name}/backup-data` | Backup data paths + sizes (DB dumps, cross-drive rsync) |
-| POST | `/api/stacks/{name}/remove` | Remove deployed stack (revert to "not deployed"). `remove_hdd_data: true` deletes the app's folders under its recorded `HDD_PATH` and lists them; **409 + a Hungarian sentence when the data was asked for but its location cannot be resolved or the drive is absent — nothing is touched, the app is kept** (v0.236.0, R-442). `hdd_paths_removed` is `[]` for an SSD app (never `null`); `hdd_paths_missing`, `hdd_note`, `backup_paths_refused` state what was not found / not removed |
+| POST | `/api/stacks/{name}/remove` | Remove deployed stack (revert to "not deployed"). `remove_hdd_data: true` deletes the app's folders under its recorded `HDD_PATH` and lists them; **409 + a Hungarian sentence when the data was asked for but its location cannot be resolved or the drive is absent — nothing is touched, the app is kept** (v0.236.0, R-442). `hdd_paths_removed` is `[]` for an SSD app (never `null`); `hdd_paths_missing`, `hdd_note`, `backup_paths_refused` state what was not found / not removed. `remove_backups: true` (v0.240.0, R-474) deletes the app's whole recovery unit, its Tier-2 mirror(s) on any registered drive and its backup preferences (`backup_paths_removed` lists them); **without it the backups AND the Tier-2 record are kept, so the removed app can still be restored from the second drive (R-486)**. Off-site snapshots are never touched by removal |
 | DELETE | `/api/stacks/{name}` | Delete orphaned stack — same R-442 resolution and refusal shape as `/remove` |
 | POST | `/api/sync` | Trigger catalog sync |
 | GET | `/api/system/info` | System info + sync status |