admin ad398b60d9 v0.245.0 — R-543: the household is asked for the recovery code, the page says "szunetel" until then ...

Off-site backup is ON by default and does not RUN until the household creates its
recovery code. The pause is the zero-knowledge escrow design and is untouched here;
what was missing is that nothing ASKED, while the app-backup page promised the very
copy that had never run.

- a reminder bar on every authenticated page while the off-site tier is configured
  and its escrow is not complete, linking /backup/escrow. It is the R-241 bar, second
  instance: same session-cookie dismissal, back next visit, gone for good when
  escrowed. No second banner system. It hangs off executeTemplate, the single render
  choke point, so it cannot reach only the pages someone remembered.
- the tier-1 file sentence renders by tier3State's own vocabulary instead of the
  app's shape: active -> "vedi", escrow_pending -> "vedene ... szunetel" + the route,
  no copy at all -> says so and names both ways out.
- both fixes red-proofed: the bar test fails on BOTH pages with the hook removed; the
  sentence test quotes the exact v0.244.0 promise when the state is ignored.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-09-16 21:02:51 +02:00

..

static

…

templates

v0.245.0 — R-543: the household is asked for the recovery code, the page says "szunetel" until then

2026-09-16 21:02:51 +02:00

abandon_promise_r302_test.go

R-302: the abandon banner promises only what the box can still see is true

2026-08-12 15:27:29 +02:00

agent_client_reuse_test.go

…

agent_disk_handlers.go

R-280: attach list from mounted-but-unregistered filesystems; two-clicks promise made conditional

2026-08-10 13:41:32 +02:00

agent_host_metrics_handler_test.go

…

agent_host_metrics_handler.go

…

alerts.go

v0.173.0 — R-77: endpoint-drift detection, samba protected-set gate, channel log honesty

2026-07-26 09:13:52 +02:00

app_dump_verdict_test.go

v0.210.0 — R-259 and R-258: two pictures that were not true

2026-08-08 16:29:52 +02:00

app_export_domain_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

app_initcreds_exposure_test.go

v0.208.0 — R-254: the last two secrets leave the page source, plus a gate against a fourth

2026-08-07 21:20:26 +02:00

app_row_test.go

Indítópult launcher page + universal app placeholder icon (v0.163.0)

2026-07-24 09:16:28 +02:00

async_restore_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

attach_sources_test.go

R-280: attach list from mounted-but-unregistered filesystems; two-clicks promise made conditional

2026-08-10 13:41:32 +02:00

attach_sources.go

R-280: attach list from mounted-but-unregistered filesystems; two-clicks promise made conditional

2026-08-10 13:41:32 +02:00

auth.go

R-241 part 4: the three-state surface, and the copy tells the truth about the date

2026-08-07 12:01:30 +02:00

backup_handlers.go

backup tile: unknown size shows a dash, not 0 B (R-517 follow-up, measured on 9201)

2026-09-15 10:53:20 +02:00

backup_page_state_test.go

v0.210.0 — R-259 and R-258: two pictures that were not true

2026-08-08 16:29:52 +02:00

backup_page_state.go

v0.245.0 — R-543: the household is asked for the recovery code, the page says "szunetel" until then

2026-09-16 21:02:51 +02:00

backup_target_absent_test.go

v0.186.0 — R-114 + R-112: tell the truth about the backup target, then show it

2026-07-29 19:21:32 +02:00

backup_target_keying_test.go

v0.184.1 — E-2b keying fix: the backup-target branch was unreachable

2026-07-29 08:30:36 +02:00

backup_target_offer_test.go

v0.185.1 — E-2: the offer endpoints were mounted where nothing routed to them

2026-07-29 09:13:13 +02:00

backup_target_offer.go

v0.186.0 — R-114 + R-112: tell the truth about the backup target, then show it

2026-07-29 19:21:32 +02:00

backup_target_render_test.go

v0.186.0 — R-114 + R-112: tell the truth about the backup target, then show it

2026-07-29 19:21:32 +02:00

backup_tier_view_test.go

backup tile: unknown size shows a dash, not 0 B (R-517 follow-up, measured on 9201)

2026-09-15 10:53:20 +02:00

backup_window_test.go

v0.168.0: customer-configurable backup window (Mentési időablak)

2026-07-24 20:55:44 +02:00

backups_remote_hubenabled_test.go

v0.161.0 — R-70: truthful hub-managed offsite empty state (kiépítve/automatikus banner replaces igényelhető + nincs beállítva in the pre-apply window)

2026-07-23 12:54:59 +02:00

backups_remote_statsknown_test.go

R-225/R-227/R-228 Parts 2-4: unknown is not zero, the gateway speaks Hungarian, the set-aside is visible

2026-08-06 08:17:48 +02:00

backups_split_test.go

v0.204.0 — the restore list is keyed on the store (R-237); the size gate stops refusing in silence (R-238)

2026-08-06 16:44:05 +02:00

capture_layer_test.go

…

claim_code_naming_test.go

R-294/R-295: orphan card stops promising restorability; one name per secret

2026-08-10 13:53:21 +02:00

claim_readthrough_test.go

R-204 item 1: a freshly minted reset code works without a restart (v0.198.0)

2026-08-05 07:17:13 +02:00

claim_reset_response_test.go

controller: F-15 instant reset codes — reset-request response hash applied via the ACK's generation-guarded ClaimSync (emailed code works immediately; old-hub bare response = no-op)

2026-07-13 08:05:07 +02:00

claim_test.go

controller: customer-claim password gate v0.122.0 (closes DRILL-day0-vm F-4/F-5)

2026-07-12 18:42:39 +02:00

claim.go

R-294/R-295: orphan card stops promising restorability; one name per secret

2026-08-10 13:53:21 +02:00

csrf.go

v0.165.0: Indítópult megosztása — guest launcher via capability URL (+ optional password, QR)

2026-07-24 12:08:43 +02:00

dashboard_backup_card_test.go

v0.170.0: root → Indítópult (302); Vezérlőpult at /dashboard; CLAUDE.md stale-note fix

2026-07-25 07:44:08 +02:00

dashboard_diskknown_test.go

v0.210.0 — R-259 and R-258: two pictures that were not true

2026-08-08 16:29:52 +02:00

datapath_card_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

datapath_card.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

deadapp_alert_test.go

…

decommission_test.go

…

deploy_restore_prefill_test.go

v0.217.0: prefill from the app's own backup, where-the-data-goes on deploy, bounded inventory fan-out

2026-08-21 21:29:01 +02:00

deploy_secret_exposure_test.go

v0.208.0 — R-254: the last two secrets leave the page source, plus a gate against a fourth

2026-08-07 21:20:26 +02:00

disk_health_state.go

fix(disk-health): the alert that never sent — severity, a real Hiba level, and a memory that survives a restart

2026-08-14 08:10:59 +02:00

disk_health_test.go

fix(disk-health): one physical disk must be evaluated once per run (R-335)

2026-08-14 10:30:22 +02:00

disk_health.go

fix(disk-health): one physical disk must be evaluated once per run (R-335)

2026-08-14 10:30:22 +02:00

edge_safe_status_test.go

v0.126.4: edge-safe error statuses + native-alert ban — writeDiskJSON maps 502/504→500 (CF swallows those bodies; the M1 refusal reached the operator as a JSON SyntaxError popup), M1 refusal = typed errLastUsableDrive → 409; all 29 native alert() swept to showAlert + native_confirm_gate now bans alert( (F-11 class complete)

2026-07-13 14:13:05 +02:00

embed.go

…

escrow_banner.go

v0.245.0 — R-543: the household is asked for the recovery code, the page says "szunetel" until then

2026-09-16 21:02:51 +02:00

escrow_handlers.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

escrow_wait_state_test.go

feat(escrow): v0.138.0 — "awaiting hub confirmation" waiting state

2026-07-16 18:44:13 +02:00

escrow_wizard_test.go

@

2026-07-14 09:52:11 +02:00

export_download_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

fab_export_test.go

R-203: the app and its backup look in the same directory — one resolver, every caller

2026-08-04 18:17:05 +02:00

filebrowser_gate_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

filebrowser_link_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

filebrowser_link.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

filebrowser_login_test.go

v0.243.0: FileBrowser generated admin password (R-513); per-tier whole-guest backup truth (R-517); skip absent-storage tiers (R-518); OOM-killed worker visible (R-514)

2026-09-15 10:12:08 +02:00

filebrowser_network_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

fonts_test.go

…

funcmap_test.go

…

funcmap.go

v0.233.0: record what each compose service actually installed, and badge whether it is current

2026-09-02 20:18:01 +02:00

handler_debug.go

v0.231.0: the off-site proof gets a by-hand trigger, like its integrity sibling (R-87)

2026-08-31 21:09:09 +02:00

handler_export_download.go

.fab exclusion scoping: classes in the manual export (Task 4, v0.136.0)

2026-07-15 11:28:40 +02:00

handler_export_upload_test.go

docs: v0.152.0 REPORT/CONTEXT + fix an async race in TestFabUpload_GCAndIdleTimeout

2026-07-20 13:55:03 +02:00

handler_export_upload.go

v0.128.0: chunked browser .fab upload on /import (tunnel-proof)

2026-07-13 21:09:20 +02:00

handler_export.go

v0.150.0 — green gate restored + the export link stops leaking the CSRF token

2026-07-20 09:42:24 +02:00

handlers.go

v0.245.0 — R-543: the household is asked for the recovery code, the page says "szunetel" until then

2026-09-16 21:02:51 +02:00

import_share_test.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

inframeta_test.go

Part B: infra stacks carry identity — curated Hungarian metadata for cloudflared/traefik/filebrowser (v0.126.0)

2026-07-13 11:31:38 +02:00

inframeta.go

Indítópult launcher page + universal app placeholder icon (v0.163.0)

2026-07-24 09:16:28 +02:00

integrationmgr_race_test.go

…

intermediary_test.go

v0.190.0 — the boot settle window, both gates on intent, and R-171

2026-08-02 19:56:20 +02:00

intermediary.go

v0.237.0: the Update button takes a backup first, and tells the truth (update arc slice 4 — R-448, R-443, R-439)

2026-09-13 11:41:31 +02:00

launcher_polish_test.go

Launcher polish: monogram reveal-on-failure + app placeholder on every icon surface (v0.163.1)

2026-07-24 10:14:25 +02:00

launcher_share_modal_test.go

v0.165.1: native Megosztás… button in the share modal (Web Share API)

2026-07-24 12:43:14 +02:00

launcher_test.go

Indítópult launcher page + universal app placeholder icon (v0.163.0)

2026-07-24 09:16:28 +02:00

levelfilter.go

…

lifecycle_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

logbuffer_spill_test.go

test: clean message in fix-6 spill tests

2026-07-12 10:09:22 +02:00

logbuffer.go

fix-6: raise ring display cap to 5000 (viewer + Entries clamp); viewer default limit 1000

2026-07-12 10:21:34 +02:00

metabadge.go

catalog: app lifecycle states - available/hidden/abandoned (v0.158.0)

2026-07-21 16:19:58 +02:00

mobile_nav_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

nav_accordion_test.go

test(nav): pin the v0.146.0 accordion's server-side half

2026-07-18 20:57:39 +02:00

netprobe_linux.go

…

netprobe_other.go

…

netprobe_stub_test.go

…

netprobe.go

…

netstorage_coherence_test.go

…

netstorage_gate_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

netstorage_handlers_test.go

…

netstorage_handlers.go

R-67: the NAS share appears in FileBrowser (v0.160.0)

2026-07-22 14:12:43 +02:00

netstorage_job_test.go

…

netstorage_job.go

R-67: the NAS share appears in FileBrowser (v0.160.0)

2026-07-22 14:12:43 +02:00

netstorage_remove_guard_test.go

C6B-F2: refuse network-share removal while a deployed app binds it

2026-07-14 15:28:24 +02:00

network_app_namespace_test.go

R-108: network storage may not host an app's data namespace (v0.187.0)

2026-07-30 14:10:20 +02:00

network_card_test.go

R-66: the box's own address becomes visible (v0.159.0)

2026-07-22 13:49:57 +02:00

networkstub_test.go

…

notifications_guard_test.go

v0.137.0: guard empty-email notification save (prevents alert-delivery wipe)

2026-07-15 19:40:01 +02:00

observability_test.go

…

offbox_escrow_test.go

v0.142.0: offsite repo continuity — orphaned-repo guard (A) + run-status auto-refresh (C)

2026-07-17 10:47:30 +02:00

offbox_handlers.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

offbox_lastsuccess_test.go

R-100: record the offsite last-SUCCESS anchor (v0.181.0)

2026-07-28 13:12:37 +02:00

offbox_restore_scope_test.go

R-204 item 3: a restore says what it restored, and what it did not (v0.198.0)

2026-08-05 07:17:20 +02:00

offbox_restore_silence_test.go

v0.204.0 — the restore list is keyed on the store (R-237); the size gate stops refusing in silence (R-238)

2026-08-06 16:44:05 +02:00

offbox_run_inflight_test.go

v0.205.0 — a run that skipped an app the customer selected is not successful (R-234)

2026-08-06 21:58:21 +02:00

offbox_warning_display_test.go

Part E: the stale zero-toggle line tells the truth (v0.126.0)

2026-07-13 11:37:47 +02:00

offsite_restore_list_test.go

v0.207.0 — R-249: the retrieval passphrase leaves the page body; R-252/R-253: two refusals learn to say what to do

2026-08-07 18:04:26 +02:00

offsite_restore_list.go

v0.204.0 — the restore list is keyed on the store (R-237); the size gate stops refusing in silence (R-238)

2026-08-06 16:44:05 +02:00

orphan_card_copy_test.go

R-299: the orphan card's second promise, and a guard that matched one inflection

2026-08-12 13:49:15 +02:00

r103_tier2_action_test.go

R-103: the Tier-2 refusal becomes an action

2026-08-31 11:42:03 +02:00

r329_toggle_split_test.go

v0.223.0: the app-down alarm reached nobody (R-329), and the stop nobody heard (R-386)

2026-08-23 11:21:06 +02:00

r353_unit_outcome_test.go

An unknown drawn as a zero: the defect v0.226.0's own fix introduced

2026-08-30 19:51:16 +02:00

r355_outcome_msg_test.go

v0.218.0: attribute a DB container by its compose project, and replay volumes on the off-site restore

2026-08-22 09:43:22 +02:00

r358_r360_handlers_test.go

R-353/R-357/R-358/R-360: the restore tells the truth (v0.226.0)

2026-08-30 19:31:31 +02:00

r397_debug_integrity_test.go

R-359 + R-397: the off-site store gets checked, and the advertised check becomes real

2026-08-30 21:03:29 +02:00

r400_debug_routes_test.go

v0.228.0 — the off-site check reads the data; the debug page stops lying (R-399 + R-400)

2026-08-31 10:24:29 +02:00

r403_surface_test.go

R-403: the restore OUTCOME names the package's date, not the run's

2026-08-31 14:32:29 +02:00

r487_removed_row_test.go

controller v0.242.0: a removed app is listed with its kept backup; five small ones (R-487 R-491 R-490 R-489 R-476 R-456)

2026-09-13 22:50:18 +02:00

r537_tier_contents_test.go

v0.244.0: the backup page stops promising what it does not hold (R-537/R-538/R-536)

2026-09-16 16:55:55 +02:00

r543_escrow_banner_test.go

v0.245.0 — R-543: the household is asked for the recovery code, the page says "szunetel" until then

2026-09-16 21:02:51 +02:00

r543_tier1_sentence_test.go

v0.245.0 — R-543: the household is asked for the recovery code, the page says "szunetel" until then

2026-09-16 21:02:51 +02:00

ratelimit_ip_test.go

@

2026-07-14 09:52:11 +02:00

recovery_class_test.go

v0.214.0 — the recovery screen stops hedging about a code it can now check (R-311)

2026-08-12 18:42:02 +02:00

recovery_gate_test.go

R-224/R-226 Part 1: why the unlock failed decides what we say

2026-08-06 08:06:57 +02:00

recovery_handlers.go

v0.214.0 — the recovery screen stops hedging about a code it can now check (R-311)

2026-08-12 18:42:02 +02:00

recovery_retained_r311_test.go

v0.214.0 — the recovery screen stops hedging about a code it can now check (R-311)

2026-08-12 18:42:02 +02:00

recovery_surface_r241_test.go

R-241 part 4: the three-state surface, and the copy tells the truth about the date

2026-08-07 12:01:30 +02:00

recovery_test.go

v0.214.0 — the recovery screen stops hedging about a code it can now check (R-311)

2026-08-12 18:42:02 +02:00

recovery_wiring_test.go

R-193: the recovery screen — unlocking, and only unlocking (v0.200.0)

2026-08-05 12:45:48 +02:00

recreate_intent_test.go

v0.190.0 — the boot settle window, both gates on intent, and R-171

2026-08-02 19:56:20 +02:00

report_trigger_seam_test.go

feat(report): v0.139.0 — immediate out-of-cycle hub report on user actions (Direction 1)

2026-07-16 19:31:19 +02:00

restore_inflight_guard_test.go

R-351: the restore compares where the backup says the data lived; second press cannot start a second run

2026-08-21 21:04:16 +02:00

restore_preconditions_test.go

v0.207.0 — R-249: the retrieval passphrase leaves the page body; R-252/R-253: two refusals learn to say what to do

2026-08-07 18:04:26 +02:00

restore_wizard_test.go

v0.204.0 — the restore list is keyed on the store (R-237); the size gate stops refusing in silence (R-238)

2026-08-06 16:44:05 +02:00

restore_wizard.go

R-351: the restore compares where the backup says the data lived; second press cannot start a second run

2026-08-21 21:04:16 +02:00

retrieval_password_exposure_test.go

v0.207.0 — R-249: the retrieval passphrase leaves the page body; R-252/R-253: two refusals learn to say what to do

2026-08-07 18:04:26 +02:00

root_redirect_test.go

v0.170.0: root → Indítópult (302); Vezérlőpult at /dashboard; CLAUDE.md stale-note fix

2026-07-25 07:44:08 +02:00

route_unpublished_test.go

…

samba_ensure_job_test.go

v0.147.0 — feedback slice 1: pressing a button says something

2026-07-19 09:30:30 +02:00

samba_ensure_job.go

v0.151.0 — the Megosztás page stops reloading, and says how to connect

2026-07-20 10:46:21 +02:00

server.go

v0.245.0 — R-543: the household is asked for the recovery code, the page says "szunetel" until then

2026-09-16 21:02:51 +02:00

settings_split_test.go

…

share_handlers.go

v0.165.0: Indítópult megosztása — guest launcher via capability URL (+ optional password, QR)

2026-07-24 12:08:43 +02:00

share_test.go

v0.165.0: Indítópult megosztása — guest launcher via capability URL (+ optional password, QR)

2026-07-24 12:08:43 +02:00

share.go

v0.165.0: Indítópult megosztása — guest launcher via capability URL (+ optional password, QR)

2026-07-24 12:08:43 +02:00

sharing_connect_card_test.go

v0.152.0 + felhom-samba 1.1.0 — mDNS for macOS, and the card stops offering a dead form

2026-07-20 13:38:07 +02:00

sharing_handlers_test.go

fix(samba): separate storage-ROOT validation from share-TARGET validation

2026-07-18 11:54:35 +02:00

sharing_handlers.go

v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

2026-07-26 08:12:57 +02:00

sharing_status_contract_test.go

v0.151.0 — the Megosztás page stops reloading, and says how to connect

2026-07-20 10:46:21 +02:00

slice4_page_test.go

v0.238.0: the page follows the update, and a held app offers no way to start it (update arc slice 4 Part 4)

2026-09-13 12:07:35 +02:00

slice4_update_test.go

controller v0.239.0: any backup tier lets an app update (R-475)

2026-09-13 17:16:24 +02:00

storage_classtag_test.go

v0.128.1: suppress the class hint on USB drives (ruling F5)

2026-07-13 21:40:37 +02:00

storage_handlers_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

storage_handlers.go

R-280: attach list from mounted-but-unregistered filesystems; two-clicks promise made conditional

2026-08-10 13:41:32 +02:00

storage_init_job.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

storage_network_template_test.go

style: gofmt normalization — no logic changes

2026-07-25 07:37:02 +02:00

storage_wizard_csrf_test.go

v0.126.3: storage wizard CSRF on claimed boxes — wizard pages rendered via raw render() shipped an EMPTY csrf-meta token, every /api/storage/init|attach POST died with 'token mismatch'; latent until the claim arc (unclaimed boxes skip CsrfProtect); fix = executeTemplate injection + session-backed regression test (red-proven)

2026-07-13 13:51:19 +02:00

system_memory_handlers.go

v0.143.0 — guest RAM resize UI (R-24) — MinAgent: 0.90.0

2026-07-17 19:10:00 +02:00

system_memory_test.go

v0.143.0 — guest RAM resize UI (R-24) — MinAgent: 0.90.0

2026-07-17 19:10:00 +02:00

templates.go

v0.167.0: outlined logo + favicon (Part 4 follow-up to v0.166.0)

2026-07-24 13:48:08 +02:00

tier2_config_handler.go

…

tier2_honest_message_test.go

C9-F1 + C9-F2: a restore that restored nothing, and a crash loop nobody saw (v0.183.0)

2026-07-28 18:53:56 +02:00

tier2_honesty_test.go

R-101 + F-DIAG: the restore dialog names the last SUCCESSFUL copy (v0.182.0)

2026-07-28 16:36:47 +02:00

tier2_legacy.go

R-101 + F-DIAG: the restore dialog names the last SUCCESSFUL copy (v0.182.0)

2026-07-28 16:36:47 +02:00

tier2_restore_handler_test.go

…

updatebadge_test.go

v0.235.0: freeze the version, keep the fixes flowing (operator ruling 2026-09-06)

2026-09-06 09:45:34 +02:00

updatebadge.go

v0.235.0: freeze the version, keep the fixes flowing (operator ruling 2026-09-06)

2026-09-06 09:45:34 +02:00

validate_test.go

…

validate.go

…