admin 8b55de734c R-414: the fallback scratch must also be DELETABLE - caught by live validation ...

The system-data fallback resolved a scratch fine and removeProofScratch then refused to
delete it: its accepted-roots list is built from REGISTERED drives, and a driveless box has
none. Observed on demo-felhom: 'refusing to remove ... it is not inside a proof root', with
the copy still on disk. Every nightly proof would have left one behind, growing forever, on
exactly the boxes the fallback exists for.

My defect, introduced with the fallback in the same session. The unit tests missed it
because every one of them registers a drive; the new pair deliberately does not, and the
second asserts the guard still REFUSES a path outside every proof root, so the fix is not a
widening into uselessness.

2026-09-01 10:29:08 +02:00

..

admission_test.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

admission.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

appbackup_bridge.go

R-102 phase 1.1: split the recovery-unit path helpers, zero behaviour change

2026-08-31 11:16:02 +02:00

appstop_drivegate_test.go

v0.191.0 — warn before the wall comes down (R-167, R-158, R-174)

2026-08-02 23:18:51 +02:00

appstop_marker_test.go

v0.189.0 — desired state + the app-stop crash marker (R-166 / D-b)

2026-08-02 18:40:17 +02:00

appstop_marker.go

R-330: stop the backup alarming about the apps it is holding down (v0.224.0)

2026-08-30 17:58:15 +02:00

appstop_suppress_test.go

R-330: stop the backup alarming about the apps it is holding down (v0.224.0)

2026-08-30 17:58:15 +02:00

appstop_suppress.go

R-330: stop the backup alarming about the apps it is holding down (v0.224.0)

2026-08-30 17:58:15 +02:00

backup.go

R-403: a poorer copy must never delete a richer one

2026-08-31 14:02:13 +02:00

capture_floor_test.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

device_seam_test.go

v0.150.0 — green gate restored + the export link stops leaking the CSRF token

2026-07-20 09:42:24 +02:00

f5_stale_primary_test.go

controller: F7 atomic volume dumps + F6 no-single-copy + F5 stale-primary sweep (WIP, pre-build)

2026-07-12 09:00:16 +02:00

f6_single_copy_test.go

controller: F7 atomic volume dumps + F6 no-single-copy + F5 stale-primary sweep (WIP, pre-build)

2026-07-12 09:00:16 +02:00

migration_exclusion_test.go

B1: data-migration engine (MigrateAll + MigrateApp) + backup mutual-exclusion

2026-06-14 19:42:57 +02:00

offbox_3a_test.go

v0.205.0 — a run that skipped an app the customer selected is not successful (R-234)

2026-08-06 21:58:21 +02:00

offbox_abandon_pin_r302_test.go

R-302: the abandon banner promises only what the box can still see is true

2026-08-12 15:27:29 +02:00

offbox_abandon_r241_test.go

R-241 part 5: escalating reminders, and operator levers for a running countdown

2026-08-07 12:08:11 +02:00

offbox_abandon.go

R-302: the abandon banner promises only what the box can still see is true

2026-08-12 15:27:29 +02:00

offbox_capture.go

v0.205.0 — a run that skipped an app the customer selected is not successful (R-234)

2026-08-06 21:58:21 +02:00

offbox_declare_test.go

v0.201.0 — a correct recovery code is never called wrong again (CAMPAIGN-11) — MinAgent 0.125.0

2026-08-05 17:48:08 +02:00

offbox_integrity.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

offbox_inventory_test.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

offbox_inventory.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

offbox_lastsuccess_test.go

R-100: record the offsite last-SUCCESS anchor (v0.181.0)

2026-07-28 13:12:37 +02:00

offbox_mintguard_r241_test.go

R-241 part 1: the box does not mint a repository key over a sealed package

2026-08-07 11:25:58 +02:00

offbox_offer_shapec_r241_test.go

R-241 part 2: the comparison the box already makes becomes the thing that offers recovery

2026-08-07 11:33:42 +02:00

offbox_orphan_test.go

v0.142.0: offsite repo continuity — orphaned-repo guard (A) + run-status auto-refresh (C)

2026-07-17 10:47:30 +02:00

offbox_place_test.go

R-356: the off-site restore refused every app that has no data drive

2026-08-22 13:08:46 +02:00

offbox_placement_refusal_test.go

R-356: the off-site restore refused every app that has no data drive

2026-08-22 13:08:46 +02:00

offbox_placement_test.go

R-351: the restore compares where the backup says the data lived; second press cannot start a second run

2026-08-21 21:04:16 +02:00

offbox_placement.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

offbox_progress_test.go

v0.147.3 — 4c follow-up 3: the run does not end with the last app

2026-07-19 09:54:18 +02:00

offbox_progress.go

v0.148.0 — coherent snapshot pairs + an offsite restore that actually restores (R-43 + R-44)

2026-07-19 12:21:16 +02:00

offbox_proof.go

R-414: the fallback scratch must also be DELETABLE - caught by live validation

2026-09-01 10:29:08 +02:00

offbox_reconstitute_test.go

R-361: the safety dump destroyed the app's own database backup

2026-08-22 23:39:59 +02:00

offbox_reconstitute.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

offbox_recorded_unit_test.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

offbox_recovery_check_test.go

controller v0.196.0: the recovered key installs itself (R-200 plumbing half) -- MinAgent 0.125.0

2026-08-04 14:27:38 +02:00

offbox_recovery_check.go

controller v0.195.0: prove the offsite key comes back (R-200 plumbing half) -- MinAgent 0.125.0

2026-08-04 13:42:50 +02:00

offbox_recovery_cli.go

R-193: the recovery screen — unlocking, and only unlocking (v0.200.0)

2026-08-05 12:45:48 +02:00

offbox_restore.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

offbox_scratch_test.go

Tier-2 engine rework: class-driven legs, v2 layout, NAS-target exclusion (Task 3b, v0.135.0)

2026-07-15 10:10:20 +02:00

offbox_shares_test.go

feat(shares): R-7b Part 3 — offsite shares leg (Model B') + B' isolation proof

2026-07-18 12:51:46 +02:00

offbox_shares.go

feat(shares): R-7b Part 3 — offsite shares leg (Model B') + B' isolation proof

2026-07-18 12:51:46 +02:00

offbox_statsknown_report_test.go

R-331 (controller half): forward stats_known so the hub can tell empty from unmeasured (v0.225.0)

2026-08-30 18:38:10 +02:00

offbox_test.go

controller: zero-toggle honesty — a configured+escrowed offbox with no app selected shows 'Nincs távoli mentésre jelölt alkalmazás…' on the toggle list, and a zero-toggle run reports 'Sikeres — nincs mentésre jelölt alkalmazás' instead of bare success

2026-07-13 08:27:52 +02:00

offbox_verdict_r203_test.go

R-203 Part 2: a run that missed a MANDATORY directory is not a successful run (v0.197.0)

2026-08-04 18:32:56 +02:00

offbox_verdict_r234_test.go

v0.205.0 — a run that skipped an app the customer selected is not successful (R-234)

2026-08-06 21:58:21 +02:00

offbox_verify_copies_test.go

v0.147.0 — feedback slice 1: pressing a button says something

2026-07-19 09:30:30 +02:00

offbox_verify_copies.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

offbox.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

offsite_diag_test.go

R-101 + F-DIAG: the restore dialog names the last SUCCESSFUL copy (v0.182.0)

2026-07-28 16:36:47 +02:00

opstatus_recent_test.go

R-351: the restore compares where the backup says the data lived; second press cannot start a second run

2026-08-21 21:04:16 +02:00

opstatus_test.go

feat(backup): async restore family — no proxy-timeout error page on a succeeding restore (v0.102.0)

2026-07-06 20:23:49 +02:00

opstatus.go

R-351: the restore compares where the backup says the data lived; second press cannot start a second run

2026-08-21 21:04:16 +02:00

r47_replay_order_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

r87_judgement_test.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r87_proof_job_test.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r87_wiring_test.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r102_tier2_unit_test.go

R-102: the recovery unit on the second drive becomes a way back

2026-08-31 11:30:34 +02:00

r102_unit_at_test.go

R-102: the recovery unit on the second drive becomes a way back

2026-08-31 11:30:34 +02:00

r103_file_restore_untouched_test.go

R-103: the Tier-2 refusal becomes an action

2026-08-31 11:42:03 +02:00

r354_volume_replay_test.go

v0.218.0: attribute a DB container by its compose project, and replay volumes on the off-site restore

2026-08-22 09:43:22 +02:00

r355_safetydump_test.go

R-361: the safety dump destroyed the app's own database backup

2026-08-22 23:39:59 +02:00

r356_hot_only_restore_test.go

R-356: the off-site restore refused every app that has no data drive

2026-08-22 13:08:46 +02:00

r357_reconstitute_headroom_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

r358_scratch_marker_test.go

R-359 + R-397: the off-site store gets checked, and the advertised check becomes real

2026-08-30 21:03:29 +02:00

r359_dueness_test.go

R-359 + R-397: the off-site store gets checked, and the advertised check becomes real

2026-08-30 21:03:29 +02:00

r359_integrity_test.go

v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

2026-08-31 10:24:29 +02:00

r359_lock_safety_test.go

R-359 + R-397: the off-site store gets checked, and the advertised check becomes real

2026-08-30 21:03:29 +02:00

r361_canonical_dump_test.go

R-361 follow-on: the undo-copy prune must run above the already-current check

2026-08-23 00:02:32 +02:00

r379_rollback_test.go

R-361: the safety dump destroyed the app's own database backup

2026-08-22 23:39:59 +02:00

r383_undo_phrase_test.go

v0.222.0: ask whether a supervised member is DEAD before whether one is UNHEALTHY (R-384), and stop promising an undo copy nobody looked for (R-383)

2026-08-23 07:25:00 +02:00

r399_depth_test.go

v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

2026-08-31 10:24:29 +02:00

r399_slow_notice_test.go

v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

2026-08-31 10:24:29 +02:00

r403_hollow_test.go

R-403 fix, caught by the live run: the stale flag fired for every healthy app

2026-08-31 14:22:32 +02:00

r403_hollow.go

v0.231.0 - the box proves its own off-site copy still holds something (R-87)

2026-08-31 20:55:34 +02:00

r403_mirror_guard_test.go

R-403: a poorer copy must never delete a richer one

2026-08-31 14:02:13 +02:00

r403_rehydrate_test.go

R-403: a poorer copy must never delete a richer one

2026-08-31 14:02:13 +02:00

r408_invariant_walk_test.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

r411_lock_flag_test.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

r412a_push_wording_test.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

r414_reachability_test.go

R-414: the fallback scratch must also be DELETABLE - caught by live validation

2026-09-01 10:29:08 +02:00

recovery_unit_notify_test.go

v0.191.0 — warn before the wall comes down (R-167, R-158, R-174)

2026-08-02 23:18:51 +02:00

recovery_unit_test.go

D5: an app restore works from the drive alone (v0.188.0)

2026-07-30 16:33:06 +02:00

recovery_unit.go

R-361 follow-on: the undo-copy prune must run above the already-current check

2026-08-23 00:02:32 +02:00

restore_db_test.go

F17: per-app restore now replays the captured .sql DB dump (.sql wins)

2026-06-14 10:02:58 +02:00

restore_db.go

R-102: the recovery unit on the second drive becomes a way back

2026-08-31 11:30:34 +02:00

restore_destination_test.go

v0.207.0 — R-249: the retrieval passphrase leaves the page body; R-252/R-253: two refusals learn to say what to do

2026-08-07 18:04:26 +02:00

restore_points_test.go

test: F6 restore-point SSD label now clear (was blank)

2026-07-12 09:01:17 +02:00

restore_points.go

controller: F7 atomic volume dumps + F6 no-single-copy + F5 stale-primary sweep (WIP, pre-build)

2026-07-12 09:00:16 +02:00

restore_secrets_gen_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

restore_unit_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

restore_unit.go

R-102: the recovery unit on the second drive becomes a way back

2026-08-31 11:30:34 +02:00

restore.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

runsummary_test.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

runsummary.go

v0.194.0 — one operator email per backup run, and nothing dropped without a trace (R-182)

2026-08-03 13:46:14 +02:00

shares_payload.go

feat(shares): R-7b Parts 1-2 — shares payload builder + tier-2 shares job (Model B')

2026-07-18 12:45:57 +02:00

shares_restore_test.go

feat(shares): R-7b Parts 4-6 — shares restore, samba liveness, UI truth-up

2026-07-18 13:02:41 +02:00

shares_restore.go

one writer at a time, and a check that can run (R-411, R-408, R-407, R-414, R-412a)

2026-09-01 10:19:36 +02:00

shares_test.go

v0.150.0 — green gate restored + the export link stops leaking the CSRF token

2026-07-20 09:42:24 +02:00

tier2_anchor_test.go

R-101 + F-DIAG: the restore dialog names the last SUCCESSFUL copy (v0.182.0)

2026-07-28 16:36:47 +02:00

tier2_capture.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

tier2_coverage_test.go

C9-F1 + C9-F2: a restore that restored nothing, and a crash loop nobody saw (v0.183.0)

2026-07-28 18:53:56 +02:00

tier2_restore_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

tier2_restore.go

R-403 fix, caught by the live run: the stale flag fired for every healthy app

2026-08-31 14:22:32 +02:00

tier2_shares.go

R-403: a poorer copy must never delete a richer one

2026-08-31 14:02:13 +02:00

tier2_test.go

Tier-2 engine rework: class-driven legs, v2 layout, NAS-target exclusion (Task 3b, v0.135.0)

2026-07-15 10:10:20 +02:00

tier2_v2_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

tier2.go

R-403: a poorer copy must never delete a richer one

2026-08-31 14:02:13 +02:00

volume_atomic_test.go

controller: F7 atomic volume dumps + F6 no-single-copy + F5 stale-primary sweep (WIP, pre-build)

2026-07-12 09:00:16 +02:00

volume_dumps_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00