Backup hover names the check and the capture separately

plugins/geenforce/api/routes.py

@@ -960,7 +960,7 @@ def _asset_facts(hostnames):
             'toolpluginid': None,
             'displayrole': None,
             'backupkind': None, 'backuplastseen': None,
-            'backuplastseenat': None,
+            'backuplastseenat': None, 'backupcollectedat': None,
         }
 
     _attach_controlled_assets(facts, assetidtohost)
@@ -1083,6 +1083,14 @@ def _attach_backup_state(facts, hostnames):
             # Raw value kept beside the wire string so the verdict compares
             # datetimes rather than re-parsing its own output.
             entry['backuplastseenat'] = revision.lastseenat
+            # collectedat is when this configuration was CAPTURED, and it only
+            # moves when the config actually changed. Pairing it with lastseenat
+            # is what lets the hover say "checked X, and what it verified is
+            # still the backup taken at Y" instead of one date that has to mean
+            # both and ends up meaning neither.
+            entry['backupcollectedat'] = (
+                revision.collectedat.isoformat() + 'Z'
+                if revision.collectedat else None)
 
 
 def _backup_ok(lastseenat, cutoff):
@@ -1225,6 +1233,7 @@ def list_reports():
             # trust; the date alone reads as "nothing has happened since", which
             # is the healthy steady state and looks like neglect.
             'backupok': _backup_ok(known.get('backuplastseenat'), backupcutoff),
+            'backupcollectedat': known.get('backupcollectedat'),
             'backupstaleafterdays': backupafterdays,
             'scopename': report.scopename,
             'phase': report.phase,

plugins/geenforce/frontend/views/EnforcementReports.vue

@@ -213,17 +213,30 @@ function backupClass(report) {
   return ''
 }
 
+// Two dates, and they mean different things. checked = when the collector last
+// CONFIRMED this config; taken = when the config was last CAPTURED, which only
+// moves when something actually changed. Showing one date forced it to stand
+// for both, which is what made a healthy machine look neglected.
 function backupTitle(report) {
-  const seen = report.backuplastseen ? formatDate(report.backuplastseen) : 'never'
+  const checked = report.backuplastseen ? formatDate(report.backuplastseen) : 'never'
+  const taken = report.backupcollectedat ? formatDate(report.backupcollectedat) : null
+  const kind = report.backupkind
+
   if (report.backupok === true) {
-    return `${report.backupkind}: checked and verified ${seen}.`
-      + ' Config unchanged since, which is why the date does not move.'
+    return taken
+      ? `${kind}: checked ${checked}. Verified the backup taken ${taken} is still current.`
+      : `${kind}: checked and verified ${checked}.`
   }
   if (report.backupok === false) {
-    return `${report.backupkind}: last confirmed ${seen}, more than`
-      + ` ${report.backupstaleafterdays} day(s) ago - the backup has stopped running.`
+    const age = `more than ${report.backupstaleafterdays} day(s) ago`
+    return taken
+      ? `${kind}: last checked ${checked}, ${age} - the backup has stopped running.`
+        + ` The newest copy is the one taken ${taken}.`
+      : `${kind}: last checked ${checked}, ${age} - the backup has stopped running.`
   }
-  return `${report.backupkind}: last confirmed ${seen}.`
+  return taken
+    ? `${kind}: last checked ${checked}; backup taken ${taken}.`
+    : `${kind}: last checked ${checked}.`
 }
 
 function staleTitle(report) {