# REPORT — controller v0.245.0: the household is asked for the recovery code

**2026-09-16.** R-543. Off-site backup is ON by default and does not RUN until the household creates
its recovery code. **The pause is the design and is untouched here** — the escrow is zero-knowledge,
their code is the only key, and a run without one would write a copy nobody could ever open. What
was missing is that nothing asked them, while the page promised the very copy that had never run.

## What shipped

**The reminder bar.** While the off-site tier is configured and its escrow state is not `escrowed`,
every authenticated page carries „A távoli mentés szünetel, amíg nem hozod létre a helyreállítási
kódot." linking `/backup/escrow`. It is the **R-241 bar, second instance** — same session-cookie
dismissal („Most nem"), back at the next visit, gone for good when escrowed. No second banner system
was built.

*Where it hangs, and why it matters:* `executeTemplate` (server.go), the single render choke point,
not the three `addRecoveryBanner` call sites. A per-handler helper would have covered the pages
someone remembered — the seam-built-but-never-wired shape this repo has shipped four times. The
login and claim pages render through `ExecuteTemplate` directly and never pass through it; a session
check (`hasAdminSession`) additionally keeps it off the public guest share page.

**The tier-1 sentence renders by state.** v0.244.0 fixed the label (R-537) and put a new promise in
its place: „a távoli másolat … védi", printed from the app's shape alone. `driveFilesNoteFor` now
takes `tier3State`'s own vocabulary — `active` → „védi"; `escrow_pending` → „**védené** — a távoli
mentés a helyreállítási kód létrehozásáig szünetel" + the route; no off-site and no second drive →
„nincs másolat" + both ways out. One source of state, so the row and the sentence cannot disagree.

## Red-proofs — each seen failing, then passing

| fix | break | what failed |
|---|---|---|
| the bar | delete the one `addEscrowBanner` line from `executeTemplate` | „/dashboard does not tell the household the off-site copy is PAUSED" — **and the same on /launcher** |
| the sentence | compute it from the app's shape, as v0.244.0 did | „the sentence claims the files ARE protected while the copy is paused", quoting the exact v0.244.0 wording |

Negative controls: an escrowed box is not nagged; an unconfigured box is not nagged; an app with no
drive-side files gets no sentence in any state. The banner fixture asserts `OffboxConfigured()`
itself, so it cannot pass by silently losing its precondition.

## Live validation (endpoint-level; no browser on DooPlex)

Both boxes ran 0.245.0. Requests ran **inside** the guests (the controller answers on the container
address with the mandatory `Host` header; neither guest is reachable from DooPlex).

- **Escrowed (9201):** bar absent on /dashboard, /launcher, /backups/apps; the row reads „védi" (×2).
- **Paused (9202):** off-site configured through `POST /backup/offbox/config` → `escrow_state=pending`
  with both secret files on disk. Bar present on /dashboard, /launcher, /backups/apps and /settings.
  `POST /backup/offbox/run` → „A távoli mentés a kulcs letétbe helyezésére vár.", `last_run=None`,
  `snapshot_count=None` — refused by the fork-4 gate, **not** by an unreachable target. A throwaway
  class-A app's row rendered „…védené … szünetel" with „védi"=0. Dismissal sets a cookie with no
  Max-Age and no Expires; same visit 0 hits, next visit 1 hit.
- **Teardown, three layers:** app removed with data and backups (0 containers, 0 drive folders); the
  off-site target cleared and its three secrets `shred -u`'d (verified by re-reading); temp files
  gone on guest and host; the hub provisioned nothing (9202 does not report).

## Gates

`go build ./... && go vet ./... && go test ./...` — green. `controller_gates.py --fast` — 15/15 OK.
CI run 671 for the previous push (`ad398b60`) — **success**, matched by head_sha.

## Requires

Hub **v0.116.0** (unchanged from v0.244.0). MinAgent unchanged at **0.131.0**. No agent change, no
hub change, no installer change, no golden.