v0.205.0 — a run that skipped an app the customer selected is not successful (R-234)

THE VERDICT. The R-203 block already said "a warning beside a success is read as a
success" and applied it to ONE of the two shapes it describes: an app missing a
declared mandatory FOLDER made the run incomplete, while an app skipped ENTIRELY
still reported ok. Both do now. Which skips count, decided by measurement:
selected+deployed with no recovery unit YES; selected but NOT deployed no (named,
with what to do — a box left amber by an app somebody removed is a status nobody
reads); disconnected/decommissioned drive no (own signal); nothing selected no.
LastSuccess and SnapshotCount still record what WAS captured.

THE FILED MECHANISM WAS NOT THE MEASURED CAUSE, and saying so is the point. §3
stated that toggling an app on leaves it without a bundle so the first run skips
it. Measured on demo-hp: the run's own pre-dump phase calls captureAllRecoveryUnits
for every DEPLOYED stack, through admitApp, before the push — a unit moved aside
was RECREATED and the run reported ok. That state does not survive a run.

What actually produced the 2026-08-06 sequence: the manual run was dropped by the
single-flight while an earlier run was still going. runOffboxBackup returned nil,
the handler had already answered "A tavoli mentes elindult", and the card then
showed the PREVIOUS run's green verdict — read as covering the app just selected.
The decision is now taken synchronously in the handler and a dropped request says
so. The nightly path still returns nil on purpose: nobody asked, and it retries.

§7.3 measured before deciding: CaptureRecoveryUnit writes a few KB of compose +
manifest, only ENUMERATES dumps rather than creating them, is idempotent and does
NOT stop the app — and already runs inside the off-site run. So there is no wait to
remove for a deployed app and NOTHING was built.

28 packages ok, 9/9 gates. Four red-proofs, each asserted to have applied. Fixture
note: the shared provider's ListDeployedStacks returned nil, so Scenario A first
passed for the wrong reason; fixed with an opt-in deployed set that defaults to nil.

controller/internal/web/offbox_handlers.go

@@ -3,6 +3,7 @@ package web
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -229,12 +230,28 @@ func (s *Server) offboxRunHandler(w http.ResponseWriter, r *http.Request) {
 		offboxRedirect(w, r, "A távoli tároló elárvult — előbb indíts új távoli mentést a kártyán látható módon.", true)
 		return
 	}
+	// R-234: the single-flight decision is taken SYNCHRONOUSLY, before the goroutine, so the customer
+	// is told what actually happened to THEIR request. Deciding it inside the goroutine is what made
+	// the drop invisible: the handler had already answered „elindult" and the page then showed the
+	// PREVIOUS run's „✓ Rendben".
+	// IsRunning() is the CONCURRENCY flag — the very one acquireRunning guards — which is what this
+	// question is about. (The documented "use RestoreStatus for display" trap is a different question.)
+	if s.backupMgr.IsRunning() {
+		s.logger.Printf("[INFO] [web] manual off-box backup NOT started for this request: a run is already in flight")
+		offboxRedirect(w, r, "Már fut egy távoli mentés — ez a kérés nem indított újat. A most látható eredmény még a korábbi futásé; várd meg, míg ez befejeződik.", true)
+		return
+	}
 	go func() {
 		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Hour)
 		defer cancel()
 		// ...WithProgress: this is the MANUAL trigger, so the page gets live bytes/percent/current app
 		// (4c). The nightly scheduler keeps calling RunOffboxBackup and stays silent.
 		if err := s.backupMgr.RunOffboxBackupWithProgress(ctx); err != nil {
+			if errors.Is(err, backup.ErrOffboxRunInFlight) {
+				// Lost the race between the check above and acquireRunning — rare, and still not a failure.
+				s.logger.Printf("[INFO] [web] manual off-box backup dropped by the single-flight (raced)")
+				return
+			}
 			s.logger.Printf("[WARN] [web] manual off-box backup failed: %v", err)
 		}
 	}()