Debian 13 runtime with restic 0.18.1 pinned outside the OS; restic assumptions re-proven; felhom-samba 1.2.0 (R-1105, R-972)

CHANGELOG.md

@@ -1,3 +1,31 @@
+## v0.323.0 — Debian 13 with restic pinned outside the OS, re-proven; felhom-samba 1.2.0 on Alpine 3.24.2 (2026-10-16)
+
+**MinAgent: 0.158.1** — the floor's, carried. Nothing here calls the agent. No golden (`09` §3 decision 250). Task:
+„the controller on Debian 13 with a pinned restic, re-proven; the Samba image rebuilt" (felhom.eu
+`REPORT-debian13-restic-2026-10-16.md`).
+
+- **R-1105 — restic is pinned by itself: the official 0.18.1 release binary, no longer Debian's package.** A new
+  `restic` build stage downloads `restic_0.18.1_linux_<arch>.bz2`, checks restic's `SHA256SUMS` signature with the
+  vendored release key (`third_party/restic/`, fingerprint CF8F 18F2 8445 7597 3F79 D4E1 91A6 868B D3F7 A907 — no
+  keyserver at build time), the published sum, and the sum pinned in the Dockerfile; any mismatch fails the build. The
+  runtime copies only that binary. `TestR1105_ResticIsPinnedOutsideTheOS`, red-proved by four single mutations.
+- **Every restic assumption re-proven on 0.18.1** against real outputs of both binaries (`internal/backup/testdata/
+  restic/`): the failure classes (wrong password, no repository, refused port, refused key, unreachable host, dead
+  rclone ssh, both lock forms, a damaged pack), the init race, the snapshot/size/progress JSON — all unchanged.
+  **One moved:** since restic 0.17 a `--keep-monthly` window with unused slots also keeps each group's OLDEST snapshot,
+  so the clean-up plan removes a SUBSET of what 0.14.0 removed (41-day history: 60 vs 62; 230-day: identical). Only
+  ever more kept, and old — the fake-snapshot guard's verdict holds. `TestR1105_*` (4), red-proved by six mutations.
+  Comment corrected: a plain `restore` DOES write a lock on both versions; the nightly proof's `--no-lock` is what
+  keeps it write-free.
+- **Runtime `debian:13.7-slim`**, pinned by digest; the Docker apt repo's codename now comes from `/etc/os-release`
+  (it was hard-coded `bookworm`).
+- **Removed packages the binary never runs:** `postgresql-client`, `default-mysql-client` (every dump and import runs
+  inside the app's database container), `sqlite3`, `fdisk`, `e2fsprogs`, `parted` (disk work is the agent's since
+  v0.37.0), `sshpass` (its ssh-copy-id install was replaced by the hub's key registrar in v0.289.0).
+- **R-972 — felhom-samba 1.2.0:** Alpine 3.21 → 3.24.2 (digest-pinned), same packages (Samba 4.23.8). `SambaImage`
+  bumped. `build-samba-image.sh` now refuses a tag already in the registry, a registry it cannot ask, and a dirty or
+  unpushed tree — like `build.sh`; `scripts/test_samba_build_push_once.sh` (6 cases, 4 fail on the old script).
+
 ## v0.322.0 — the hub key opens no route on the box; Go 1.27.2; two Data tab leftovers; the install form's dead branches (2026-10-16)
 
 **MinAgent: 0.158.1** — the floor's, carried. Nothing here calls the agent. No golden (`09` §3 decision 250). Task: