# REPORT — 2026-09-28: v0.277.0 — kept data also loads from the off-site copy (R-691 (2))

Architecture read first: `felhom.eu/documentation/architecture/07-backup-architecture.md` §6.5 (kept data), §6.6 (which
version a restore brings back); `06-offsite-connectivity.md` (what the off-site copy holds per app).

## What changed

- `backup.KeptBestCopy`: the newest usable LOCAL copy (own unit, second drive) or the OFF-SITE copy when it is newer or
  the only one (a tie goes local). One `snapshots --json`, bounded 20 s; the kept list asks once per page.
- The install choice and the kept list name the copy and its date (`kept.choice.use.desc_from`, `kept.backup.offsite`).
- `backup.LoadKeptOffsite`: download the unit ALONE (the proof's `restoreUnitReadOnly`, proof scratch) → judge (this
  drive, holds data, data version RECORDED — `07` §6.6, else refused; mixed/mismatched refused by `unitVersionCheck`) →
  `prepare` (a dated folder's files move back) → the one unit restore → scratch removed BEFORE the outcome is reported.

## Tests and red-proofs (`felhom.eu/documentation/audits/kept-offsite-2026-09-28/redproofs/`)

| test | red-proof | failed with |
|---|---|---|
| `TestR691_OffsiteCopyIsOfferedWhenItIsTheOnlyOrNewest` + `TestR691_InstallChoiceNamesTheOffsiteCopy` | RP1: `KeptBestCopy` = `KeptDBCopy` (0.276.0) | `ok=false`; `use_offered=false use_off="There is no backup…"` |
| `TestR691_OffsiteLoadRefusalsLeaveTheKeptFilesAlone` | RP2: the `data`-block refusal removed | "the load reported success" |
| `TestR691_OffsiteLoadDownloadsJudgesThenRestores` | RP3 (seen in the first draft): scratch removed in a `defer` | "the downloaded copy was left behind" |

`go build/vet/test ./...` green; `controller_gates.py` all OK (go-parity needed the 4 new keys listed).

## Live

- 9202 (endpoint level, the calls the pages make): Tier 1 route unchanged — the choice named „saját mentés,
  2026-09-28 10:06"; "use" loaded 3/3 volumes + 1/1 database; the seeded nextcloud user and file read back.
  Tier 2 not runnable live (9202 has one drive). 9202 has no off-site target, so the off-site path is not asked there.
- Floor 0.276.0 → **0.277.0** (MinAgent 0.131.0) at 08:11Z; both demo boxes on 0.277.0, healthy, within a minute.
- **Not yet proven live: the off-site route.** A throwaway nextcloud on demo-hp 9201 joined the off-site copy; its first
  snapshot is tonight's (Part E of the brief, morning of 2026-09-29).