D22: every restore puts the data back exactly on failure and after a power cut (R-1177, R-1195); whole restore asks the unit first (R-1178); no mirror during a restore (R-1180); W22 restore refusals in Hungarian; unreleased

CHANGELOG.md

@@ -1,3 +1,35 @@
+## Unreleased — D22: every restore puts the household's data back exactly on failure, and after a power cut (R-1177, R-1195, R-1178, R-1180)
+
+**MinAgent: 0.158.1** (unchanged). Operator ruling D22 = yes (2026-10-21 20:05). Committed, not released (night brief
+2026-10-21).
+
+- **R-1177 / D22 — the local unit restore puts back exactly.** `RestoreFromRecoveryUnitAtWith` (the app's own unit, the
+  second drive's unit, a kept load) now reuses the off-site restore's undo (`offbox_restore_undo.go`): before the stop
+  the live volumes the unit replaces are measured and must fit (`err.backup.restore_undo_no_space`, nothing stopped);
+  the live definition is kept; right after the stop the volumes are copied; ANY failure after that (volume replay,
+  definition write, DB-only start, DB replay, start) pours them back, writes the live definition back and starts the
+  app („…Nem változott semmi…"). A put-back that fails HOLDS the app and keeps the copy (R-893 hold). With no copy (the
+  unit holds no volume) a half-done database replay HOLDS (R-379 ruling) instead of starting on it. The window is now
+  marked with the app-stop marker (`ReasonUnitRestore`). Changed on purpose: three tests that pinned the old outcome
+  („completed with data errors" and the app started on the half state) now pin the D22 outcome.
+- **R-1195 / D22 — a restore cut by a power loss is put back at start.** Once the copy is whole the restore writes
+  `undo.json` and the live definition files beside it and records the folder in the app-stop marker; `Recover` pours
+  it back before it restarts the app (`restore_crash_putback.go`, wired in main.go). The household reads „A
+  visszaállítás félbeszakadt (áramszünet). Az alkalmazás adatai a visszaállítás előtti állapotban vannak." A cut before
+  the copy was whole restarts as before. Both the local and the off-site restore.
+- **R-1178 — the second drive's „Teljes visszaállítás" asks the unit's refusals before its file half**
+  (`UnitRestoreOptions.CheckOnly`): a refusal moves nothing and never stops the app, so its „érintetlenek" is true. If
+  the unit still refuses after the file half, the app is started and the sentence says which files changed
+  (`err.backup.whole_restore_unit_refused_files_changed`); a put-back after files were placed says they stay.
+- **R-1180 — the night's second-drive mirror skips an app while a restore of it runs** (and the shares while a shares
+  restore runs), and mirrors it the next night.
+- **W22** — two raw English refusals on the restore path became Hungarian sentences with what to do
+  (`err.backup.restore_busy`, `err.backup.restore_no_drive`); the technical text stays in the log.
+- **Fixed: `TestR603_GoNamedValuesDoNotHideBehindHTMLEscaping` was red on main since v0.337.0** (CI runs the gates, not
+  `go test`): two English texts added that day carried an apostrophe (`flash.kept.changed`,
+  `err.stacks.memory_overcommit_slow`); reworded.
+- Tests (each seen failing first): `TestR1177_*` (5), `TestR1195_*` (5), `TestR1178_*`, `TestR1180_*`.
+
 ## v0.337.0 (2026-10-21) — kept second-drive copies (D25: R-1175, R-1181, R-1179); a `.fab` import keeps the family gate (R-1191); a stale restore temp no longer blocks the retry (R-1188 c); the overcommit sentence made true (R-1192); escrow recorded before the floor (R-1176); a finished off-site abandonment closes on the hub's word (R-1182); storage labels follow the language (W26)
 
 **MinAgent: 0.158.1** — the floor's, carried; no agent change is needed by this release (the R-1192 swap fix is the