Restore-holes run close-out: README, CONTEXT, REPORT; the interrupted-restore log line names a waiting put-back. Commit only.

REPORT.md

@@ -1,21 +1,21 @@
-# REPORT — review round 2 (2026-10-24, unattended): two small fixes, commit only
+# REPORT — the restore and backup holes (2026-10-24 night, unattended; commit only, NOT released)
 
-**What:** found by the review round's readers and verified at `file:line` by the main session (felhom.eu
-`documentation/audits/review-round-2-2026-10-24/`). No release; both ride the next normal train (next v0.343.0).
+Brief: fix R-1251, R-1252, R-1253 (and R-1254, R-1257 in their repos); live-prove the recovery-code changes; nothing
+released. Full record: felhom.eu `documentation/audits/restore-holes-2026-10-24/README.md`.
 
-1. **A media restart no longer starts an app the household stopped (R-721).** `restartMediaApps` and
-   `mediaSafeRemoval` recreated every media app (`RestartStack` = `up -d --force-recreate`), skipping only held ones.
-   Now both take `stacks.MediaAppsToRecreate`, which leaves out an app whose recorded intent is „stopped" (logged). Its
-   override is already written, so its next start sees the drives. Tests: `TestMediaAppsToRecreate_SkipsAppsTheHouseholdStopped`
-   (red with the rule off) and `TestR2_MediaRecreateLoopsSkipStoppedApps` (source pin of the two loops; red with
-   `s.mediaApps()` back in the safe removal).
-2. **The file manager's header name file appears whole (R-1100).** `LoadOrCreateFileBrowserSSOHeader` created the file
-   empty and wrote it after; a parallel caller read "" and got an error. Measured on clean `main` `321df1f`: 44 of 300
-   runs of the existing parallel-writers check failed (4 of 50 under `-race`). Now: temp file, sync, hard link into place
-   — 0 of 300, 0 of 50 under `-race`.
+| Commit | What | CI |
+|---|---|---|
+| `bb2809d` | R-1251 (P1): a pending put-back blocks every start; H2 a failed put-back holds; H7 Stop still gets the put-back | 2301 / #482 success |
+| `062f9b4` | R-1251: the copy's folders synced before the marker names it (found by the Tester 1 proof: `undo.json.tmp` after a cut); the restore record says the put-back waits | 2302 / #483 success |
+| `518a135` | R-1252 (P2): reconcile only under a valid classification; a rejected block is said and signalled; kept copies stay kept; Remove drops kept records | 2303 / #484 success |
+| `c9b4b82` | R-1253 (P2): a stop-first export refuses while another operation holds the marker | 2304 / #485 success |
+| (close-out) | README, CONTEXT, this report; the interrupted-restore log line names a waiting put-back | final report |
 
-`go vet ./...` and `go test ./...` green. Design docs read: `15-media-library.md` §10–11 (the restart), `01` §5 / `02`
-(the file manager sign-in).
+**Proofs:** R-1251 on Tester 1 — a local restore of MeTube (1.5 GB volume) cut by powering the VM off, the data disk
+taken off and put back: held while away, put back BEFORE the start, the newest data there, a later restart poured
+nothing. R-1252 on 9202 — the review's audiobookshelf steps: kept after a bogus path. R-1253 on 9202 — the export refused
+during a restore, ran after it. Every rule red-proved (each test names its red-proof).
 
-**Docs (same session):** `REUSE.md` — D22 released in v0.338.0; the `recordInstalledImages` callers; a row for the
-stray-copy seams. felhom.eu `documentation/audits/review-round-2-2026-10-24/EDITS.md` lists every edit.
+**Images:** dev images `0.343.0-dev.r1251a/b`, `r1252a`, `r1253a` built locally and loaded into the test guests only;
+never pushed. **Machines:** Tester 1 and 9202 put back (both: the controller on 0.342.0; leftover anonymous volumes of
+the R-1267 class named in the audit). **Release:** Monday — controller v0.343.0 (with R-1250), MinAgent 0.158.1.