v0.148.0 — coherent snapshot pairs + an offsite restore that actually restores (R-43 + R-44)

Closes the two findings from DIAG-immich-restore-2026-07-19. Viktor deleted 11
immich photos to test offsite restore; both runs flashed success and the photos
stayed gone. Two independent defects.

R-43 — no offsite path could restore a database. All three buttons were
file-only: the two "visszaállítás" actions staged to a scratch folder and never
touched postgres, and place-to-live merged only MISSING files. For a DB-indexed
app the bytes returned and the app still could not see them. The dump was
carried INTO every snapshot and could never be replayed OUT of one.

New ReconstituteFromOffsite (/backup/offbox/reconstitute): safety dump → stop →
files overwritten to the snapshot version → start → the snapshot's own dump
replayed → health wait. Two invariants:
  - nothing is ever deleted (-a, no --ignore-existing, no --delete): a file
    created after the snapshot survives as an extra;
  - the undo exists before the act — the pre-restore- dump is verified ON DISK
    before anything is stopped, overwritten or replayed; if it cannot be taken
    the operation refuses with zero changes.
The replay reads the SCRATCH unit: the live unit is never overwritten, so
replaying from it would replay the current DB over itself and restore nothing.

R-44 — a manual push shipped an unrefreshed dump (up to ~24h old). That day's
predated the customer's account by four hours and probed to asset:0/user:0/
album:0 inside 52MB whose bulk was immich's shipped geodata. Every run, manual
AND nightly, now refreshes dumps + units BEFORE capturing. Order is the
mechanism: the gap can only ADD files the DB does not reference yet, never
remove one it does. Manifests carry offsite_run_id + dumps_at, so coherence is
verifiable at restore time rather than assumed; the periodic refresh carries a
prior stamp forward and never invents one.

Honesty surfaces, all warn-level and none a gate: unstamped (pre-v0.148) pairs
report their skew, ValidateDump gained an EXACT-match accounts-table sniff for
customer-empty dumps, the completion flash states an outcome instead of a
mechanism, and the missing-only button now says what it does NOT do.

11 tests; 5 red-proofs run and reverted. Two of those found real test weaknesses
rather than confirming strength — the first undo mutation was caught by a second
guard, and the first table-matching test did not discriminate between the two
matchers at all. Both tests were rewritten to the cases that separate them.

NOT in scope: R-41's catalog invariant check, nightly cadence, retention, quota
math, tier-2, and v0.147.x progress semantics beyond one added phase line.

Live acceptance (§9) has NOT run: no capability-map flip, customer-restore row
stays MISSING, R-3 stays DRAFT.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P9Nn14TWGzKoqAJAiVwC2s

controller/internal/web/offbox_handlers.go

@@ -3,6 +3,7 @@ package web
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -340,6 +341,69 @@ func (s *Server) offboxRestoreHandler(w http.ResponseWriter, r *http.Request) {
 	offboxRedirectTo(w, r, "/backups/restore", "A távoli visszaállítás elindult — az állapot itt frissül.", false)
 }
 
+// offboxReconstituteHandler is the TRUE offsite restore (R-43, v0.148.0): files overwritten to the
+// snapshot's version + that same snapshot's database replayed + the app restarted, with a safety
+// dump of the current database taken first.
+//
+// It is a separate button from the missing-only place, not a flag on it. The two do opposite things
+// to an existing file, and the v0.147 flash („hiányzó fájljai helyreállítva") described a mechanism
+// that could report success after merging zero files while the customer's photos stayed invisible.
+// The flash here states the OUTCOME instead — file count, database, backup timestamp, restart —
+// because that is the only part the customer can check against what they see in the app.
+func (s *Server) offboxReconstituteHandler(w http.ResponseWriter, r *http.Request) {
+	if s.backupMgr == nil || !s.backupMgr.OffboxConfigured() {
+		offboxRedirectTo(w, r, "/backups/restore", "A távoli mentési cél nincs beállítva.", true)
+		return
+	}
+	_ = r.ParseForm()
+	app := strings.TrimSpace(r.FormValue("app"))
+	if app == "" {
+		offboxRedirectTo(w, r, "/backups/restore", "Hiányzó alkalmazás.", true)
+		return
+	}
+	// This one overwrites live files and replays a database — it must never happen on a stray click.
+	if r.FormValue("confirm") != "1" {
+		offboxRedirectTo(w, r, "/backups/restore", "A teljes visszaállítás megerősítés nélkül nem hajtható végre.", true)
+		return
+	}
+	if s.backupMgr.IsRunning() {
+		offboxRedirectTo(w, r, "/backups/restore", "Egy mentési/visszaállítási művelet már fut.", true)
+		return
+	}
+	s.backupMgr.BeginRestoreOp("offbox-reconstitute", app)
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 60*time.Minute)
+		defer cancel()
+		res, err := s.backupMgr.ReconstituteFromOffsite(ctx, app)
+		if err != nil {
+			s.logger.Printf("[ERROR] [web] off-box reconstitute %s (async): %v", app, err)
+			s.backupMgr.EndRestoreOp(false, "A teljes visszaállítás sikertelen: "+err.Error())
+			return
+		}
+		s.logger.Printf("[INFO] [web] off-box reconstitute %s completed (async): files=%d dbs=%d snapshot=%s",
+			app, res.FilesPlaced, res.DBsReplayed, res.SnapshotID)
+		s.backupMgr.EndRestoreOp(true, reconstituteOutcomeMsg(app, res))
+	}()
+	offboxRedirectTo(w, r, "/backups/restore", "A teljes visszaállítás elindult — az állapot itt frissül.", false)
+}
+
+// reconstituteOutcomeMsg builds the OUTCOME flash for a completed reconstitution. Pure, so the
+// wording is unit-testable — this string is the customer's only evidence that the operation did
+// what its label promised, and the zero-file and no-database cases must each read truthfully rather
+// than borrowing the confident sentence that belongs to the full case.
+func reconstituteOutcomeMsg(app string, res backup.OffsiteReconstituteResult) string {
+	when := ""
+	if !res.DumpsAt.IsZero() {
+		when = " (mentés: " + res.DumpsAt.In(getTimezone()).Format("2006-01-02 15:04") + ")"
+	}
+	if res.DBsReplayed == 0 {
+		// A no-database app: saying "és az adatbázis" here would be a lie, and this is precisely the
+		// class of sentence the DIAG found being printed over a no-op.
+		return fmt.Sprintf("A(z) %s: %d fájl visszaállítva%s — az alkalmazás újraindult. Ennek az alkalmazásnak nincs adatbázisa.", app, res.FilesPlaced, when)
+	}
+	return fmt.Sprintf("A(z) %s: %d fájl és az adatbázis visszaállítva%s — az alkalmazás újraindult.", app, res.FilesPlaced, when)
+}
+
 // offboxVerifyCopyDeleteHandler removes ONE verification copy (v0.147.0, 4a).
 //
 // The only delete this slice adds, so it is deliberately narrow: it names a STACK, never a path — the