v0.291.0: decision 78 (R-726) — a returning household's first night sets the orphaned copy aside; R-838 — traefik v3.7.13, cloudflared 2026.9.3, filebrowser 1.5.6-stable, a release now moves a running file browser, check-infra-pins.py

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/offbox.go

@@ -875,14 +875,24 @@ func (m *Manager) ensureOffboxRepo(ctx context.Context, base, env []string) erro
 		return nil
 	case "orphaned":
 		// The repo EXISTS but is keyed under a passphrase we no longer have (the reinstall shape). An
-		// UNCLAIMED (as-delivered) box auto-resets (Scenario B); a CLAIMED box surfaces the orphan card
-		// and skips until the customer confirms a reset (Scenario C). Move-aside, never delete.
-		if !m.settings.GetClaimed() {
-			m.logger.Printf("[INFO] [offbox] orphaned repo on an UNCLAIMED box — auto-resetting (move-aside + re-init)")
+		// UNCLAIMED (as-delivered) box auto-resets (Scenario B). So does a CLAIMED box that has NEVER made
+		// an off-site copy itself (LastSuccess empty) — a returning household's new box on its first night
+		// (`09` §3 decision 78, R-726): without this it would make no off-site copy until someone pressed
+		// the reset button. A claimed box that HAS made copies surfaces the orphan card and skips until the
+		// customer confirms (Scenario C) — its key changing is a real fault, not a new box. Move-aside, never
+		// delete; the old copy can be put back. Pinned by TestOffbox_OrphanDetection_* and TestR726_*.
+		t0 := m.settings.GetOffboxTarget()
+		firstNight := t0 != nil && t0.LastSuccess == ""
+		if !m.settings.GetClaimed() || firstNight {
+			reason := "auto (unclaimed)"
+			if m.settings.GetClaimed() {
+				reason = "auto (returning household — this box never made an off-site copy; decision 78)"
+			}
+			m.logger.Printf("[INFO] [offbox] orphaned repo, %s — setting the old copy aside (move-aside + re-init, nothing deleted)", reason)
 			if m.offboxOrphanEvent != nil {
 				m.offboxOrphanEvent("offbox_repo_orphaned", "")
 			}
-			if rerr := m.resetOrphanedRepo(ctx, base, env, "auto (unclaimed)"); rerr != nil {
+			if rerr := m.resetOrphanedRepo(ctx, base, env, reason); rerr != nil {
 				m.markOrphaned() // auto-reset failed → fall back to the orphan card so it isn't silent
 				return ErrOffboxOrphaned
 			}