# REPORT — controller v0.336.0: a failed off-site restore puts the app back exactly (R-893 option A) — 2026-10-20

**Task:** night brief part 2 (run by day, 2026-10-20), Parts 2 and 7. Operator answer: „D20 A". Architecture:
`felhom.eu/documentation/architecture/07-backup-architecture.md` §6.3; `09` §3 decision 192.

**What changed:** `internal/backup/offbox_restore_undo.go` + `offbox_reconstitute.go`. Before the stop, the live volumes the
snapshot will replace are measured and the copy is added to the restore's own free-space need (too little room or an
unmeasurable volume refuses with nothing stopped). Right after the stop they are tarred into
`<namespace>/backups/restore-undo/<app>/<stamp>/`. On any failure after a volume or the definition moved, the copies are poured
back, a volume the snapshot added is removed, the live definition is written back and the app starts; the household reads
„…sikertelen. Nem változott semmi…"; the operator gets `backup_run_failures` leg `restore-put-back`. A put-back that fails holds
the app and keeps the copy. On success the copy is removed. R-1169: the held sentence says only what is certain.

**Tests:** 7 new (`r893_putback_test.go`) + 4 moved to option A (`r893_mixed_restore_test.go`); nine mutations, each red
(felhom.eu `audits/night2-2026-10-20/P2/redproof-unit.txt`). `controller_gates.py --fast` green; `go test ./...` green.

**Live proof on 9202** (rc.1, a helper with the brief's fences; `audits/night2-2026-10-20/P2/live/`): Rallly + postgres 18, a
forced failure after the volume was replaced → the copy (69 MB, 0.9 s) poured back: 36 tables, markers A–D, the table only the
backup had ABSENT, schema/data/row-count md5 EQUAL to before, the app running, no hold, the copy gone. Then a normal restore of
the same snapshot: the snapshot's content, the app running, the copy gone. 9202 back on 0.331.0 as found.

**Release:** image `sha256:93cd67d871125877e935a024765075b5a0b7c0e7683e1165976ff7a654fe8d73` (clean clone `93fb251`); per-box
floors → the three test boxes on 0.336.0 within a minute → box walk green (0 unhealthy, 0 allow-list refusals, catalog in
sync, https-only 28 OK, „Fájlok ↗" one sign-in on demo-hp and Tester 1) → global floor 0.336.0 / MinAgent 0.158.1 at 08:54:35
UTC; per-box floors cleared. Evidence `audits/night2-2026-10-20/P7/`.

**Not measured live:** the version-change branch, the `_files` sentence, the refusals before the stop, a failing put-back —
each pinned by a red-proved unit test. **Found:** a successful put-back is logged at ERROR by the web handler, and an empty
`backups/restore-undo/` folder stays — one register row (small; a version is pushed once, so it waits for the next release).