docs: v0.99.0 — CHANGELOG/CONTEXT/REUSE/README for the restore-path fixes (F1/F3/O4)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -1,5 +1,40 @@
 ## Changelog
 
+### v0.99.0 — restore-path fixes: dead restore UI + volume dumps + blank-secret redeploy (2026-07-05)
+
+TASK C1 — fixes F1/F3/O4 from the 2026-07-04 restore drill
+(`felhom.eu/documentation/audits/DRILL-appdata-restore-2026-07-04.md`). F2 (one-click in-place
+class-C restore) deliberately NOT included — product-design work (C2).
+
+- **F1 (HIGH — the restore panel was dead):** `GET /api/backup/snapshots?stack=` now exists
+  (`internal/api/router.go` + `backup.Manager.ListRestorePoints`, `internal/backup/restore_points.go`).
+  The backups.html restore panel fetched this restic-era route, got the catch-all 404, so the
+  snapshot dropdown never populated and "Visszaállítás indítása" could never enable. Returns the
+  ONE honest keep-side restore point (the current recovery unit): `time` = newest artifact mtime
+  (manifest / db-dumps / volume-dumps), `short_id:"helyi"`, `tier:1` always (Tier-2 copies are NOT
+  restorable via POST /backup/restore — never listed), `drive_label` from the storage registry.
+  Guards: traversal/empty → 400 (`validStackParam`), unknown stack → 404, no unit yet → `ok:true, data:[]`.
+  No template change needed — the JS payload contract was honoured server-side.
+- **F3 — named-volume data was never backed up:** `DumpAppVolumesSafe` had no production caller.
+  New `runVolumeDumps` loop in `runDBDumpsInternal` (`internal/backup/backup.go`), running BEFORE
+  `captureAllRecoveryUnits` so manifests enumerate the fresh tars. Gate order is load-bearing:
+  protected-stack + has-volumes checks precede the Safe call (which stops the stack before its own
+  check — unconditional calls would bounce every volume-less app nightly); disconnected/decommissioned
+  drives skip like the DB loop. Failures land in the run summary and fail the run (no silent
+  partial). Zero-DB early return removed (volume-only apps still get dumps + unit refresh).
+  Test seam: `dumpVolumesSafe` func field (F17-style).
+- **O4 — missing resettable secret redeployed blank:** the restore proceed-path now generates a
+  replacement credential via the catalog field's `generate` spec (`stacks.Manager.GenerateSecretForField`
+  → `backup.SetSecretGenerator` seam, wired in main.go), persisted encrypted through the existing
+  `RecreateStackFromUnit` → `SaveAppConfig` path. Data-keys are NEVER generated (gate untouched +
+  generator refuses `data_key` fields); values never logged. No-generator fields keep proceeding
+  with an upgraded "may fail to start" WARN. Residual case documented: a restored volume tar
+  carrying the OLD internal credential hash may still need a manual in-DB reset.
+
+Tests: +12 (api snapshots ×3, backup restore-points ×4, volume-dump gating ×3, secret-gen ×2 files);
+all three fixes companion-red-proofed (hollow `[]` endpoint / removed volume gate / no-generation
+each fail their test). Full `go build && go vet && go test ./...` green.
+
 ### docs — CLAUDE.md refresh: slim-down to stable orientation (2026-07-03)
 
 No code change, no version bump. CLAUDE.md 338 → ~160 lines: full 30-package layout map (was 7);