R-1187 (c): refuse a .fab import over an installed app that is not running (it merged old and bundle data); R-1189 (d): the off-site proof + integrity check run after a catch-up; unreleased

controller/cmd/controller/main.go

@@ -1557,6 +1557,13 @@ func main() {
 				Event: func(missedAt time.Time) {
 					notifier.NotifyBackupCatchUp(missedAt.In(budapestLoc()).Format("15:04"))
 				},
+				// R-1189 (d): the off-site proof (05:30) and the integrity check (06:00) are daily jobs the scheduler
+				// never runs late; a box that is off at those hours comes back through this catch-up, so they run
+				// here — the proof picks one due snapshot, the integrity check runs only when it is due (max age).
+				After: func(ctx context.Context) {
+					runOffsiteProof(ctx, backupMgr, notifier, logger)
+					runOffsiteIntegrityCheck(ctx, backupMgr, notifier, logger, false)
+				},
 				Logger: logger,
 				Loc:    budapestLoc(),
 			}
@@ -1599,7 +1606,8 @@ func main() {
 		//
 		// DAILY JOB, WEEKLY BEHAVIOUR, and that is the point. It asks "is the last successful check
 		// older than the max age?" rather than "is it Sunday?", so a box that was switched off on its
-		// check day is checked the next day it is on. R-341 is exactly the other shape: a dated check
+		// check day is checked the next day it is on AT 06:00 — or, if it is off at that hour, at its next
+		// catch-up (R-1189 d: the catch-up's After hook runs this check and the proof). R-341 is exactly the other shape: a dated check
 		// quietly missed and never caught up. No `Weekly` primitive was added to the scheduler —
 		// due-ness is smaller, catches up, and is what R-86 already chose for restore-tests.
 		//