controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

R-486 (P1): removing an app with its backups KEPT keeps its Tier-2 record,
so the second-drive restore is no longer refused over an intact mirror.
R-484: postgis/pgvector/timescaledb images are Postgres (logical dumps).
R-485: the backup card sizes the recovery unit and the mirror(s).
R-480: a held update's sentence leaves the card once the hold is lifted.
R-477: the update's off-site lookup is one snapshots call, no stats.
R-478: a copy older than this install's deploy does not count.
R-474: "delete backups" deletes the unit, the mirror(s) and the prefs.

Tests and red-proofs per row; evidence in felhom.eu
documentation/audits/v0240-2026-09-13/ and nightly-2026-09-13-adventurelog/.

controller/internal/backup/update_guard.go

@@ -189,26 +189,24 @@ func (m *Manager) updateTierPoint(ctx context.Context, stackName string, tier in
 		}
 		return UpdateTierPoint{}, false
 	case UpdateTierOffsite:
-		inv := m.updateOffsiteInvFn
-		if inv == nil {
+		times := m.updateOffsiteTimesFn
+		if times == nil {
 			if m.settings == nil || !m.OffboxConfigured() {
 				return UpdateTierPoint{}, false
 			}
-			inv = m.OffsiteInventoryList
+			times = m.OffsiteSnapshotTimes
 		}
 		cctx, cancel := context.WithTimeout(ctx, updateOffsiteCheckTimeout)
 		defer cancel()
-		got, err := inv(cctx)
+		got, err := times(cctx)
 		if err != nil {
 			if !errors.Is(err, errNoOffsiteTarget) {
 				m.logger.Printf("[WARN] [backup] update precondition for %s: the off-site copy could not be checked within %s (%v) — counted as ABSENT", stackName, updateOffsiteCheckTimeout, err)
 			}
 			return UpdateTierPoint{}, false
 		}
-		for _, a := range got.Apps {
-			if a.App == stackName && !a.LatestAt.IsZero() {
-				return UpdateTierPoint{Tier: tier, At: a.LatestAt}, true
-			}
+		if at, ok := got[stackName]; ok && !at.IsZero() {
+			return UpdateTierPoint{Tier: tier, At: at}, true
 		}
 	}
 	return UpdateTierPoint{}, false