v0.291.0: decision 78 (R-726) — a returning household's first night sets the orphaned copy aside; R-838 — traefik v3.7.13, cloudflared 2026.9.3, filebrowser 1.5.6-stable, a release now moves a running file browser, check-infra-pins.py

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/offbox_orphan_test.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"strings"
 	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
 )
 
 // classifyResticProbe maps the exact restic stderr to a repo class (the 2026-07-17 diagnosis
@@ -59,7 +61,10 @@ func wrongPwRunner(seen *[]string) offboxRunner {
 // no state → these assertions FAIL.
 func TestOffbox_OrphanDetection_Claimed(t *testing.T) {
 	m, sett := newOffboxManager(t)
-	if err := sett.SetClaimed(); err != nil { // claimed → orphan card, NEVER auto-reset
+	if err := sett.SetClaimed(); err != nil { // claimed AND has made copies before → orphan card, NEVER auto-reset
+		t.Fatal(err)
+	}
+	if err := sett.UpdateOffboxStatus(func(o *settings.OffboxTarget) { o.LastSuccess = "2026-10-01T02:00:00Z" }); err != nil {
 		t.Fatal(err)
 	}
 	var events []string
@@ -170,3 +175,71 @@ func TestOffbox_ConfirmedReset(t *testing.T) {
 		t.Fatal("state not cleared after confirmed reset")
 	}
 }
+
+// R-726, decision 78: a CLAIMED box that has NEVER made an off-site copy (a returning household's new box, night
+// one) sets the old copy aside by itself and makes its first copy — as an unclaimed box does. The old copy is
+// moved, never deleted, and recorded so it can be put back. Red-proof: drop `|| firstNight` and this fails while
+// TestOffbox_OrphanDetection_Claimed still passes.
+func TestR726_ReturningHouseholdFirstNightSetsAside(t *testing.T) {
+	m, sett := newOffboxManager(t)
+	if err := sett.SetClaimed(); err != nil {
+		t.Fatal(err)
+	}
+	var events []string
+	m.SetOffboxOrphanEvent(func(evt, _ string) { events = append(events, evt) })
+	var sshCmds []string
+	m.SetOffboxSSH(func(_ context.Context, _, _ string, _ int, _, _, remoteCmd string) ([]byte, error) {
+		sshCmds = append(sshCmds, remoteCmd)
+		if strings.HasPrefix(remoteCmd, "test -e") {
+			return nil, fmt.Errorf("exit status 1")
+		}
+		return nil, nil
+	})
+	var seen []string
+	m.SetOffboxRunner(wrongPwRunner(&seen))
+	if err := m.RunOffboxBackup(context.Background()); err != nil {
+		t.Fatalf("the first night must make a copy, got %v", err)
+	}
+	if m.OffboxOrphaned() {
+		t.Fatal("the returning household's box stayed orphaned")
+	}
+	got := sett.GetOffboxTarget()
+	if !strings.Contains(got.OrphanedRenamedTo, ".orphaned-") {
+		t.Fatalf("the old copy's new place is not recorded (it must be listable and restorable): %q", got.OrphanedRenamedTo)
+	}
+	for _, c := range sshCmds {
+		if strings.HasPrefix(c, "rm ") || strings.Contains(c, "rm -") {
+			t.Fatalf("something was deleted: %q", c)
+		}
+	}
+	backedUp := false
+	for _, s := range seen {
+		backedUp = backedUp || s == "init"
+	}
+	if !backedUp {
+		t.Fatalf("no fresh repository was started: %v", seen)
+	}
+	if len(events) != 2 || events[0] != "offbox_repo_orphaned" || events[1] != "offbox_repo_reset" {
+		t.Fatalf("events = %v, want [orphaned reset]", events)
+	}
+}
+
+// A box whose repository is NOT orphaned changes nothing (no move, no reset event).
+func TestR726_NotOrphanedChangesNothing(t *testing.T) {
+	m, sett := newOffboxManager(t)
+	_ = sett.SetClaimed()
+	var events []string
+	m.SetOffboxOrphanEvent(func(evt, _ string) { events = append(events, evt) })
+	var sshCmds []string
+	m.SetOffboxSSH(func(_ context.Context, _, _ string, _ int, _, _, remoteCmd string) ([]byte, error) {
+		sshCmds = append(sshCmds, remoteCmd)
+		return nil, nil
+	})
+	m.SetOffboxRunner(func(_ context.Context, _ []string, args ...string) ([]byte, error) { return nil, nil })
+	if err := m.RunOffboxBackup(context.Background()); err != nil {
+		t.Fatalf("run: %v", err)
+	}
+	if len(events) != 0 || len(sshCmds) != 0 || sett.GetOffboxTarget().OrphanedRenamedTo != "" {
+		t.Fatalf("a healthy repository was touched: events=%v ssh=%v", events, sshCmds)
+	}
+}