D62: restore copies kept 30 days, listed with their date, deletable by hand (typed name, never a needed copy, operator event); D63: a test-build-only fault switch for the R-1256 H4/H5 live proofs — tests red first

CHANGELOG.md

@@ -1,3 +1,27 @@
+## Unreleased (2026-10-29, attended) — D62: restore copies kept 30 days, listed, and deletable by hand; D63: a test-build fault switch for the H4/H5 live proofs; commit only, rides the next release
+
+**MinAgent: 0.158.1** (unchanged). Needs hub ≥ the release carrying `restore_copy_deleted` (felhom.eu `19afefab`): an
+older hub answers that one event 400 and the record is lost (the delete itself is unaffected).
+
+- **D62 (operator ruling 2026-10-29 08:17) — the age: 30 days** (`restoreCopyUnusedAge`, was 14, the night's safest
+  reading). `TestD62_AnUnusedCopyIsKept30Days` (red at 14: the 20-day copy was swept).
+- **D62 — the list (`backup.RestoreCopies`, `web.restoreCopyRows`, `backups_restore.html` „Megőrzött másolatok"):** each
+  restore copy shows the app, the date of the restore it protects, its size and „automatikusan törlődik: <date>". A copy
+  a hold or a pending put-back needs (a hold; the putback_pending hold; the app-stop marker naming it; an unreadable
+  marker) shows why in one line and its button is off — it never gets a date, because the sweep never takes it.
+- **D62 — „Törlés most" (`POST /backup/restore-copy/delete`, `backup.DeleteRestoreCopy`):** the warning names the app
+  and the restore's date (the operator's text, hu + en); the household types the app's name. JSON answer: 200; 400 a
+  wrong name; 404 no such copy; 409 the copy is needed, or a backup/restore runs, or the app updates. The check and the
+  removal are one step under the backup manager's lock (no restore can begin in between). Path guard: both names one
+  path element, the copy a real directory (not a link) directly under `backups/restore-undo/<app>/`. One `[WARN]` log
+  line and one operator event `restore_copy_deleted` (who, app, restore date, size) per delete. CSRF as every form.
+  Tests `TestD62_*` (backup, web, notify) — each seen failing by a mutation of the check it pins.
+- **D63 — the fault switch, TEST BUILDS ONLY (`cmd/controller/faultpoint_{on,off}.go`):** `go build -tags faultinject`
+  arms two points from a file (`<data>/faults/<point>` = „<skip> <fail>"): `defwrite-after-compose` (the definition
+  writer fails after the compose was written — H4) and `stop-<app>` (the app's stop fails — H5). Without the tag it
+  is a no-op that reads nothing; `TestD63_TheReleaseBuildHasNoFaultSwitch` pins that, and that build.sh and the
+  Dockerfile pass no build tag (red-proofed both ways).
+
 ## Unreleased (2026-10-28 night) — four restore edges (felhom.eu R-1256, review round 2 HUNT-1 H4/H5/H6/H8); commit only, rides the next release
 
 **MinAgent: 0.158.1** (unchanged). Each edge: a test seen failing first, then the fix; live proof on 9202 in the felhom.eu