Restore-truth run close-out: REPORT (D47, D48, R-1270, R-1271; CI by hash; live proofs on 9202). Commit only.

REPORT.md

@@ -1,21 +1,33 @@
-# REPORT — the restore and backup holes (2026-10-24 night, unattended; commit only, NOT released)
+# REPORT — a backup is never changed by a new install, a restore downloads first, a restore tells the truth (2026-10-25, unattended; commit only, NOT released)
 
-Brief: fix R-1251, R-1252, R-1253 (and R-1254, R-1257 in their repos); live-prove the recovery-code changes; nothing
-released. Full record: felhom.eu `documentation/audits/restore-holes-2026-10-24/README.md`.
+Brief: operator rulings D47 and D48 (2026-10-25 08:38); fix R-1269, D48, R-1270, R-1271; red-proof each; live-prove on
+9202; nothing released — rides v0.343.0 (MinAgent 0.158.1 unchanged). Full record: felhom.eu
+`documentation/audits/restore-truth-2026-10-25/README.md`.
 
-| Commit | What | CI |
+## What changed (each commit pushed; CI green by hash)
+
+| commit | CI job | what |
 |---|---|---|
-| `bb2809d` | R-1251 (P1): a pending put-back blocks every start; H2 a failed put-back holds; H7 Stop still gets the put-back | 2301 / #482 success |
-| `062f9b4` | R-1251: the copy's folders synced before the marker names it (found by the Tester 1 proof: `undo.json.tmp` after a cut); the restore record says the put-back waits | 2302 / #483 success |
-| `518a135` | R-1252 (P2): reconcile only under a valid classification; a rejected block is said and signalled; kept copies stay kept; Remove drops kept records | 2303 / #484 success |
-| `c9b4b82` | R-1253 (P2): a stop-first export refuses while another operation holds the marker | 2304 / #485 success |
-| (close-out) | README, CONTEXT, this report; the interrupted-restore log line names a waiting put-back | final report |
+| `02daebe` | 2311 | **D47 / R-1269:** `stacks.AppConfig.InstallID`; `backup/unit_owner.go` — every unit writer sets another install's unit aside whole (`backups/set-aside/<app>/<stamp>`, a kept copy kind `unit`); the restore page „Visszaállítás" on it (`POST /backup/kept/restore`); remove with backups deletes it |
+| `b680db8` | 2312 | **R-1270:** `backup/restore_verdict.go` — `ErrRestoreNotStarted` on every restore path; undo copy kept; late-start watcher; one operator line |
+| `2d71270` | 2313 | **D48:** `backup/restore_pull.go` — `prepareRestoreImages` before the stop on every restore path, under `dockerexec.HoldImageWork` |
+| `bd9f4f7` | 2314 | **R-1271:** `keptPick` / `KeptNewerAt` — a copy > 10 min in the future is never the newest; alone it is offered, said, not recommended |
+| `1f9c863` | 2315 | D47 follow-up (found live): the kept-copies list shows on a box without off-site too |
+| `1f82959` | 2316 | R-1270 follow-up (found live): remove with backups deletes `backups/restore-undo/<app>` |
 
-**Proofs:** R-1251 on Tester 1 — a local restore of MeTube (1.5 GB volume) cut by powering the VM off, the data disk
-taken off and put back: held while away, put back BEFORE the start, the newest data there, a later restart poured
-nothing. R-1252 on 9202 — the review's audiobookshelf steps: kept after a bogus path. R-1253 on 9202 — the export refused
-during a restore, ran after it. Every rule red-proved (each test names its red-proof).
+## Red-proofs (each test seen failing with its fix switched off)
 
-**Images:** dev images `0.343.0-dev.r1251a/b`, `r1252a`, `r1253a` built locally and loaded into the test guests only;
-never pushed. **Machines:** Tester 1 and 9202 put back (both: the controller on 0.342.0; leftover anonymous volumes of
-the R-1267 class named in the audit). **Release:** Monday — controller v0.343.0 (with R-1250), MinAgent 0.158.1.
+felhom.eu `audits/restore-truth-2026-10-25/redproof/`: `d47-guard-off.txt` (6 of 8 fail), `d47-stacks-adopt-off.txt`,
+`d47-web-form-off.txt`, `d47-kept-list-without-offsite.txt`, `r1270-warn-only.txt` (3 of 5), `r1270-web.txt`,
+`d48-no-prepull.txt` (5 of 6), `r1271-future-ignored.txt` (4), `remove-undo-copy-before.txt`.
+
+## Live proofs (9202, `0.343.0-rc.1` then `-rc.2`; back on 0.342.0 at the end)
+
+Before on 0.342.0 (= `e1613ae` for these files): the kept unit rewritten, the restore `ok: true` over `starting`, 44 + 23
+password errors. After: Tandoor and AdventureLog — set aside byte for byte, restored with the old password, the item
+back, 0 errors; Vikunja — an unpullable pin refused with the container never restarted, an exiting image recorded
+`not_started`; RomM — the own copy chosen over a forged future-dated one, which alone was offered and marked.
+
+## Not done here, filed
+
+R-1278 (a volume app's reinstall does not offer its kept backup), R-1279 (the `.fab` import removes volumes before its pull).