## RPC1: retention ignores the pin (the pre-v0.289.0 'forget --prune after every run')
=== RUN   TestRetention_PinnedWithoutWindowDeletesNothing
    offbox_window_test.go:106: a forget ran without a window: [[forget --group-by host,tags --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune] [forget --group-by host,tags --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune]]
--- FAIL: TestRetention_PinnedWithoutWindowDeletesNothing (0.00s)
=== RUN   TestRunOffboxBackup_PinnedNeverForgetsWithoutWindow
    offbox_window_test.go:127: the pinned run reached forget 1 time(s)
--- FAIL: TestRunOffboxBackup_PinnedNeverForgetsWithoutWindow (0.00s)

## RPC2: guard without the future-date check
=== RUN   TestOffsiteGuard_LabThirteenFutureFakes_Refused
    offbox_window_test.go:154: window close = [{ID:7 CountBefore:16 CountAfter:16 Removed:0 Outcome:guard-refused Reason:the policy would remove snapshot r1 from 2026-10-03T12:45:38Z — younger than 8 days, which honest retention never does}]
--- FAIL: TestOffsiteGuard_LabThirteenFutureFakes_Refused (0.00s)

## RPC3: bridge trusts the registrar without proving the pin
=== RUN   TestBridge_RegisteredButNotPinnedRefuses
    offsiteapply_test.go:212: a key that does not reach the pinned server must refuse
--- FAIL: TestBridge_RegisteredButNotPinnedRefuses (0.00s)

## restored:
ok  	gitea.dooplex.hu/admin/felhom-controller/internal/backup	433.945s
ok  	gitea.dooplex.hu/admin/felhom-controller/internal/offsiteapply	(cached)
FAIL

## RPC4: an unreadable count recorded as a measured zero (the v0.289.0 shape, live on demo-felhom)
=== RUN   TestRunOffbox_UnreadableCountIsNotZero
    offbox_window_test.go:266: an unreadable count was recorded as a measured zero: 0
--- FAIL: TestRunOffbox_UnreadableCountIsNotZero (0.00s)
