[techmore]

Why

Production's scheduled encrypted backups have been refused since late October ("no active backup key") and nothing told the owner. Separately, a punched "meal" of a few minutes came off paid hours, which federal law does not allow.

Backups

• BackupHealth: one plain answer (off / starting / working / needs attention) built from the active backup key and the per-layer reports the backup scripts already write. Nothing new is stored and no second backup system is added. After a key is turned on, each layer gets one interval of its own schedule to make its first encrypted backup before an older "refused: no key" report counts as a failure.
• Settings → Backups: status first (last good backup, weekly check, key fingerprint), then a two-step Turn on backups path. The recovery kit PDF downloads, the page moves on to the check code by itself (it used to sit unchanged until a manual refresh), and after the code it refreshes when the first backup lands (the rolling snapshot runs every 5 minutes). Plain language on what the kit is, where to keep it and what happens if it is lost.
• Alarms: while backups are off, failed, or quiet past their schedule, super admins see a red alert on the bell on every page, a banner on the dashboard and a red status-bar entry (that entry used to track the never-connected Drive backup, so it was permanently red and ignored). BackupHealthAlertJob (hourly) leaves one notification a day until it is fixed.
• Unchanged: age encryption, the one-time kit, the check code, the fresh sign-in rule, the scripts and the weekly verify. The private key is still never stored, logged or shown again (the existing test that scans every table and the log still passes).

Time & pay

A punched break of 20 minutes or less is paid time even when punched as a meal or where the store marks that kind unpaid (FLSA, 29 CFR 785.18-785.19). One predicate, ClockBreak#unpaid?, feeds ClockShift#unpaid_break_seconds and paid_hours_between, so the clock, the Pay page, the timesheet import and the payroll export agree. A break is judged by its whole length when a day boundary clips it. Checked that nothing deducts a break automatically: only punched breaks come off (scheduled-shift break minutes are a planning figure, and Square timecards keep Square's own paid flag). Approved sheets are not rewritten.

Tests

bin/rails test (4,059 runs, 0 failures) and bin/rubocop clean locally. New: backup_health_test.rb, backup_health_alerts_test.rb, three break tests in foundation_test.rb, and a timesheet import → pay run test.

No migration.

🤖 Generated with Claude Code