dooplex-offsite: failure mail survives the shared config's unset variable (found by the live dry run); Part B push + restore evidence

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/dooplex-offsite/felhom-backup-failmail

@@ -2,7 +2,7 @@
 # felhom-backup-failmail — mail admin@ that a Felhom backup unit on DooPlex failed (R-232 (a) route, reused).
 # Called by felhom-backup-failmail@<unit>.service, which the backup units name in OnFailure=.
 # Reuses notify_failure from /opt/backup/scripts/backup-config.sh (Resend; never prints the key; never fails).
-set -u
+# No `set -u`: backup-config.sh reads unset variables (NOTIFY_WEBHOOK_URL), which killed the first dry run.
 UNIT=${1:?unit name}
 CONFIG=${FELHOM_FAILMAIL_CONFIG:-/opt/backup/scripts/backup-config.sh}
 # shellcheck source=/dev/null

scripts/dooplex-offsite/test_dooplex_offsite.py

@@ -313,7 +313,10 @@ class FailMail(unittest.TestCase):
         t = tempfile.mkdtemp()
         try:
             cfg = os.path.join(t, "cfg.sh"); out = os.path.join(t, "out")
-            open(cfg, "w").write('notify_failure() { echo "$1" > %s; return 0; }\n' % out)
+            # Like the real backup-config.sh, it reads a variable that is unset (NOTIFY_WEBHOOK_URL is commented out
+            # there): the 2026-10-09 dry run found the mail script under `set -u` dying on exactly that line.
+            open(cfg, "w").write('notify_failure() { if [ -n "${NOTIFY_WEBHOOK_URL_UNSET_IN_TEST}" ]; then :; fi; '
+                                 'echo "$1" > %s; return 0; }\n' % out)
             r = subprocess.run([FAILMAIL, "felhom-dooplex-offsite.service"], env=dict(os.environ, FELHOM_FAILMAIL_CONFIG=cfg),
                                capture_output=True, text=True)
             self.assertEqual(r.returncode, 0, r.stderr)