# kept-offsite — 2026-09-28: "use my kept data" from the off-site copy (R-691 (2)), and the first live off-site restores

Architecture: `07-backup-architecture.md` §6.5 (kept data, now with the off-site copy), §6.6 (the data's version).
Controller v0.277.0 (the feature) and v0.278.0 (R-704, found on the way). Method: endpoint level — the exact calls the
pages make (`tools/kp.py`, `tools/walk.py`), the app's own front doors for data (nextcloud `occ`, WebDAV).

| file | what |
|---|---|
| `redproofs/RP1–RP3` | v0.277.0: local-only choice; no version refusal; copy removed after the outcome (first draft) |
| `redproofs/RP4–RP6` | v0.278.0: old hold predicate; no drop on "use"; no drop on install |
| `live/B4-9202-*` | Tier 1 route regression on 9202 (choice named "saját mentés"; seed + file back); teardown |
| `live/B5-floor.txt`, `live/B6-floor-0278.txt` | floor 0.277.0, 0.278.0, both demo boxes |
| `E/E0`, `E/E1` | demo-hp app list before; nextcloud installed, seeded, joined the off-site copy |
| `E/E2`, `E/E2b` | the page's off-site run-now; the snapshot held NO data — a 2026-09-13 hold (R-704) |
| `E/E3`, `E/E4` | old nextcloud removed (hold cleared); fresh install, seed, off-site run: snapshot `6cb379a8` with data |
| `E/E5-a-offsite-restore.txt` | (a) prepare → download → reconstitute; seed back, marker user gone, same version |
| `E/E6-b-kept-from-offsite.txt` | (b) remove keep data + delete local copies → choice names the off-site copy → use → seed + files back |
| `E/E9-teardown.txt` | removed with data; app list equal; verification copy deleted (R-706) |

Seed passwords live in the session scratchpad only.