feat(backups): tell an empty ledger apart from an empty bucket

On the release that adds the ledger the table is empty, so on a host that has
been uploading nightly for months every account read Never, under a sentence
saying no copy had ever reached the bucket. That sentence is untrue on exactly
the morning an operator opens the new card for the first time, and it is a
claim the host cannot make: what is empty is the record, not the bucket.

The run now records every account it walks, not only the ones an object came
of. A walk that produced nothing moves the attempt instant and leaves the
success columns alone, so the two cases separate: no row at all is no record
yet, a row without a success is never. Never now means what the word says —
a run looked at this account and has never put anything there.

The card names the last check on the never row, so the state is a fact with a
timestamp rather than an assertion. Runbook and all seven bundles carry the
same two sentences. The integration file proves both arms against real
Postgres, including that a failed run leaves the previous good copy on the
row.

src/components/admin/__tests__/offhost-backups-section.test.tsx

@@ -59,6 +59,7 @@ describe("<OffhostBackupsSection>", () => {
         {
           userId: "u1",
           username: "account-one",
+          lastAttemptAt: "2026-09-10T06:00:00.000Z",
           lastSuccessAt: "2026-09-10T06:00:00.000Z",
           sizeBytes: 4096,
           ageHours: 3,
@@ -67,6 +68,7 @@ describe("<OffhostBackupsSection>", () => {
         {
           userId: "u2",
           username: "account-two",
+          lastAttemptAt: "2026-09-06T06:00:00.000Z",
           lastSuccessAt: "2026-09-06T06:00:00.000Z",
           sizeBytes: 2048,
           ageHours: 99,
@@ -75,20 +77,35 @@ describe("<OffhostBackupsSection>", () => {
         {
           userId: "u3",
           username: "account-three",
+          lastAttemptAt: "2026-09-10T02:30:00.000Z",
           lastSuccessAt: null,
           sizeBytes: null,
           ageHours: null,
           freshness: "never",
         },
+        {
+          userId: "u4",
+          username: "account-four",
+          lastAttemptAt: null,
+          lastSuccessAt: null,
+          sizeBytes: null,
+          ageHours: null,
+          freshness: "unknown",
+        },
       ],
     });
 
     expect(html).toContain('data-offhost-freshness="fresh"');
     expect(html).toContain('data-offhost-freshness="stale"');
     expect(html).toContain('data-offhost-freshness="never"');
+    expect(html).toContain('data-offhost-freshness="unknown"');
     expect(html).toContain("account-two");
-    // The account with no object says so instead of showing a blank cell.
-    expect(html).toContain("No copy has ever reached the bucket");
+    // The account a run walked and found nothing for says that, with the
+    // instant it was checked.
+    expect(html).toContain("Nothing has landed for this account");
+    // The account no run has recorded says THAT — not "never", which would
+    // claim the bucket is empty on the strength of an empty ledger.
+    expect(html).toContain("No nightly run has recorded this account yet");
     // Never the bucket's own coordinates.
     expect(html).not.toMatch(/secret|access[- ]key/i);
   });

src/components/admin/offhost-backups-section.tsx

@@ -34,16 +34,17 @@ import type { BackupsList, OffhostAccountRow } from "@/types/backups";
 import { formatBytes } from "./backups-section";
 
 /**
- * Status wash per verdict. `never` is deliberately neutral rather than
- * alarming: a host that turned the off-host job on this afternoon has not
- * failed at anything yet, and painting every row red on day one is how an
- * operator learns to stop reading the colour.
+ * Status wash per verdict. `never` and `unknown` are deliberately neutral
+ * rather than alarming: a host that turned the off-host job on this afternoon
+ * has not failed at anything yet, and painting every row red on day one is how
+ * an operator learns to stop reading the colour.
  */
 const FRESHNESS_STYLE: Record<OffhostBackupFreshness, string> = {
   fresh: "border-success/30 bg-success/10 text-success",
   due: "border-warning/30 bg-warning/10 text-warning",
   stale: "border-destructive/30 bg-destructive/10 text-destructive",
   never: "border-border bg-muted text-muted-foreground",
+  unknown: "border-border bg-muted text-muted-foreground",
 };
 
 function freshnessLabel(
@@ -61,6 +62,8 @@ function freshnessLabel(
       return t("admin.section.backups.offhost.stateStale");
     case "never":
       return t("admin.section.backups.offhost.stateNever");
+    case "unknown":
+      return t("admin.section.backups.offhost.stateUnknown");
   }
 }
 
@@ -87,14 +90,22 @@ function AccountRow({ row }: { row: OffhostAccountRow }) {
           </Badge>
         </div>
         <p className="text-muted-foreground text-xs">
-          {row.lastSuccessAt === null || row.sizeBytes === null
-            ? t("admin.section.backups.offhost.neverDetail")
-            : `${fmt.dateTime(row.lastSuccessAt)} · ${formatBytes(
-                row.sizeBytes,
-                fmt,
-              )} · ${t("admin.section.backups.offhost.age", {
-                hours: row.ageHours ?? 0,
-              })}`}
+          {row.lastAttemptAt === null
+            ? // No run has recorded this account. Saying "never" here would
+              // claim the bucket is empty when what is empty is the ledger,
+              // which is exactly what every account looks like between the
+              // upgrade that adds it and the first nightly run after that.
+              t("admin.section.backups.offhost.unknownDetail")
+            : row.lastSuccessAt === null || row.sizeBytes === null
+              ? t("admin.section.backups.offhost.neverDetail", {
+                  when: fmt.dateTime(row.lastAttemptAt),
+                })
+              : `${fmt.dateTime(row.lastSuccessAt)} · ${formatBytes(
+                  row.sizeBytes,
+                  fmt,
+                )} · ${t("admin.section.backups.offhost.age", {
+                  hours: row.ageHours ?? 0,
+                })}`}
         </p>
       </li>
     </ListRow>