felhom-controller/REPORT.md

REPORT — 2026-09-28: v0.277.0 — kept data also loads from the off-site copy (R-691 (2))

Architecture read first: felhom.eu/documentation/architecture/07-backup-architecture.md §6.5 (kept data), §6.6 (which version a restore brings back); 06-offsite-connectivity.md (what the off-site copy holds per app).

What changed

• backup.KeptBestCopy: the newest usable LOCAL copy (own unit, second drive) or the OFF-SITE copy when it is newer or the only one (a tie goes local). One snapshots --json, bounded 20 s; the kept list asks once per page.
• The install choice and the kept list name the copy and its date (kept.choice.use.desc_from, kept.backup.offsite).
• backup.LoadKeptOffsite: download the unit ALONE (the proof's restoreUnitReadOnly, proof scratch) → judge (this drive, holds data, data version RECORDED — 07 §6.6, else refused; mixed/mismatched refused by unitVersionCheck) → prepare (a dated folder's files move back) → the one unit restore → scratch removed BEFORE the outcome is reported.

Tests and red-proofs (felhom.eu/documentation/audits/kept-offsite-2026-09-28/redproofs/)

test	red-proof	failed with
TestR691_OffsiteCopyIsOfferedWhenItIsTheOnlyOrNewest + TestR691_InstallChoiceNamesTheOffsiteCopy	RP1: KeptBestCopy = KeptDBCopy (0.276.0)	ok=false; use_offered=false use_off="There is no backup…"
TestR691_OffsiteLoadRefusalsLeaveTheKeptFilesAlone	RP2: the data-block refusal removed	"the load reported success"
TestR691_OffsiteLoadDownloadsJudgesThenRestores	RP3 (seen in the first draft): scratch removed in a defer	"the downloaded copy was left behind"

go build/vet/test ./... green; controller_gates.py all OK (go-parity needed the 4 new keys listed).

Live

• 9202 (endpoint level, the calls the pages make): Tier 1 route unchanged — the choice named „saját mentés, 2026-09-28 10:06"; "use" loaded 3/3 volumes + 1/1 database; the seeded nextcloud user and file read back. Tier 2 not runnable live (9202 has one drive). 9202 has no off-site target, so the off-site path is not asked there.
• Floor 0.276.0 → 0.277.0 (MinAgent 0.131.0) at 08:11Z; both demo boxes on 0.277.0, healthy, within a minute.
• Not yet proven live: the off-site route. A throwaway nextcloud on demo-hp 9201 joined the off-site copy; its first snapshot is tonight's (Part E of the brief, morning of 2026-09-29).