R-1187 (c): refuse a .fab import over an installed app that is not running (it merged old and bundle data); R-1189 (d): the off-site proof + integrity check run after a catch-up; unreleased

CHANGELOG.md

@@ -1,3 +1,21 @@
+## Unreleased — two data-loss candidates fixed (R-1187 c, R-1189 d), 2026-10-22 night
+
+**MinAgent: 0.158.1** (unchanged). Committed, not released (night brief 2026-10-22: no controller release tonight).
+
+- **R-1187 (c) — a `.fab` import over an installed app that is NOT running is refused.** It used to „overwrite config
+  in place": only a RUNNING app's volumes were removed first, and `docker cp` adds and overwrites but never deletes, so
+  the old data MERGED with the bundle's, reported as success. Proven on 9202 (felhom.eu
+  `audits/night-2026-10-22/P3-candidates/`): a marker written after the export survived an import into the stopped
+  app; the same import into the running app replaced it (the control). Now `executeImport` refuses before anything
+  is written: „Az alkalmazás telepítve van, de nem fut … Az alkalmazás érintetlen. Indítsd el (vagy távolítsd el), és
+  próbáld újra." `TestR1187c_AStoppedAppIsNotImportedOver`, red-proved.
+- **R-1189 (d) — the off-site proof and the integrity check run after a catch-up.** They are daily jobs at 05:30 and
+  06:00 that the scheduler never runs late, so a box that is off at those hours was never checked, and the comment
+  claimed „checked the next day it is on". `nightchain.CatchUp.After` now runs once after the catch-up's legs, wired in
+  main.go to `runOffsiteProof` and the due-gated `runOffsiteIntegrityCheck` (force=false). Tests
+  `TestR1189d_TheChecksRunAfterTheCatchUpLegs` (nightchain) and `TestR1189d_TheCatchUpIsWiredToTheChecks`, both
+  red-proved.
+
 ## Unreleased — a template may exclude a named volume from every backup (R-49, operator ruling D21 = B, 2026-10-22)
 
 **MinAgent: 0.158.1** (unchanged). Committed, not released (night brief 2026-10-22: no controller release tonight).