R-1187 (c): refuse a .fab import over an installed app that is not running (it merged old and bundle data); R-1189 (d): the off-site proof + integrity check run after a catch-up; unreleased

controller/cmd/controller/main.go

@@ -1557,6 +1557,13 @@ func main() {
 				Event: func(missedAt time.Time) {
 					notifier.NotifyBackupCatchUp(missedAt.In(budapestLoc()).Format("15:04"))
 				},
+				// R-1189 (d): the off-site proof (05:30) and the integrity check (06:00) are daily jobs the scheduler
+				// never runs late; a box that is off at those hours comes back through this catch-up, so they run
+				// here — the proof picks one due snapshot, the integrity check runs only when it is due (max age).
+				After: func(ctx context.Context) {
+					runOffsiteProof(ctx, backupMgr, notifier, logger)
+					runOffsiteIntegrityCheck(ctx, backupMgr, notifier, logger, false)
+				},
 				Logger: logger,
 				Loc:    budapestLoc(),
 			}
@@ -1599,7 +1606,8 @@ func main() {
 		//
 		// DAILY JOB, WEEKLY BEHAVIOUR, and that is the point. It asks "is the last successful check
 		// older than the max age?" rather than "is it Sunday?", so a box that was switched off on its
-		// check day is checked the next day it is on. R-341 is exactly the other shape: a dated check
+		// check day is checked the next day it is on AT 06:00 — or, if it is off at that hour, at its next
+		// catch-up (R-1189 d: the catch-up's After hook runs this check and the proof). R-341 is exactly the other shape: a dated check
 		// quietly missed and never caught up. No `Weekly` primitive was added to the scheduler —
 		// due-ness is smaller, catches up, and is what R-86 already chose for restore-tests.
 		//

controller/cmd/controller/r1189d_wiring_test.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+// R-1189 (d): the catch-up in main.go carries the After hook that runs the off-site proof and the due-gated integrity
+// check (internal/nightchain TestR1189d_* pins that After runs; this pins that production wires it).
+// RED-PROOF: the After block removed from main.go → this fails.
+func TestR1189d_TheCatchUpIsWiredToTheChecks(t *testing.T) {
+	src, err := os.ReadFile("main.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := string(src)
+	i := strings.Index(s, "catchUp := &nightchain.CatchUp{")
+	if i < 0 {
+		t.Fatal("the catch-up literal is gone from main.go")
+	}
+	lit := s[i:]
+	lit = lit[:strings.Index(lit, "\n\t\t\t}\n")]
+	a := strings.Index(lit, "After: func(ctx context.Context) {")
+	if a < 0 || !strings.Contains(lit[a:], "runOffsiteProof(") || !strings.Contains(lit[a:], "runOffsiteIntegrityCheck(ctx, backupMgr, notifier, logger, false)") {
+		t.Fatal("the catch-up must run the off-site proof and the due-gated (force=false) integrity check after its legs")
+	}
+}