v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

controller/internal/backup/offbox_capture.go

@@ -12,10 +12,12 @@ import (
 // TierOffsite capture set (recovery unit + MANDATORY userdata only) into the extra absolute paths
 // appended to the app's restic snapshot, plus the Hungarian customer warnings for LOUD capture gaps.
 //
-// SP-3.4 is law here: restic does NOT error on a missing source path — it skips with a warning, exits 0,
-// and silently writes a partial snapshot (0.14.0, and re-measured on 0.18.1 for R-1105, 2026-10-16). So a skipped/missing MANDATORY path is detected in
-// THIS function (the structural-guard Skipped list + an os.Stat filter) and surfaced in BOTH the
-// English log and the Hungarian LastWarning. A restic exit code proves nothing about a missing path.
+// SP-3.4 is law here: restic skips a missing source path with a warning and still writes a partial snapshot.
+// 0.14.0 and 0.18.1 then exit 0; 0.19.x exits 3 (restic #4467 — measured 2026-10-16, R-1107), which the run reads
+// as that app's failure. Either way the filter below keeps a declared-but-absent path out of argv, so only a path
+// that vanishes between the stat and restic reaches it — and on 0.19 that race is now loud instead of silent.
+// So a skipped/missing MANDATORY path is detected in THIS function (the structural-guard Skipped list + an os.Stat
+// filter) and surfaced in BOTH the English log and the Hungarian LastWarning — never left to restic's exit code.
 
 // offboxBlocked records an app whose enlarged (userdata-carrying) push was refused by the pre-push
 // quota gate. The unit-only push still proceeds (never a protection regression). estBytes is the