Debian 13 runtime with restic 0.18.1 pinned outside the OS; restic assumptions re-proven; felhom-samba 1.2.0 (R-1105, R-972)

controller/internal/backup/offbox_proof.go

@@ -51,9 +51,10 @@ import (
 // to write. The spike established what "read-only" actually costs here, by observation rather than by
 // reading the code:
 //
-//   - `restic restore` in 0.14.0 takes NO repository lock (measured on demo-hp with a lock sampler
-//     that was positively controlled first: it saw a lock appear and vanish across a real `check`, and
-//     zero across two restores);
+//   - `restic restore` WITHOUT `--no-lock` DOES write a lock — corrected 2026-10-16 (R-1105): against a
+//     read-only repository both 0.14.0 and 0.18.1 fail on `Save(<lock/…>)`, and both restore with
+//     `--no-lock`. (The 2026-08 sampler on demo-hp saw zero locks across two restores — a short-lived
+//     lock between samples; the read-only repository cannot miss it.) The flag below is what does it;
 //   - `restic check` DOES take one — so the comment claiming the check never writes is wrong (R-407);
 //   - the PRODUCT's restore path writes anyway, because `unlockStale` runs `restic unlock` — a delete
 //     verb against `locks/` — before every restore (`offbox_restore.go`).
@@ -306,9 +307,8 @@ func (m *Manager) nextProofTarget(ctx context.Context) (stack, id, unitPath stri
 // repository.
 //
 // Three differences from `RestoreOffboxScratch`, each deliberate and each named:
-//   - `--no-lock`, so restic does not create a lock file (it does not for `restore` in 0.14.0 anyway
-//     — measured — but the flag makes that a guarantee rather than an observed behaviour of one
-//     version);
+//   - `--no-lock`, so restic does not create a lock file (a plain `restore` DOES, on 0.14.0 and 0.18.1 —
+//     measured against a read-only repository, R-1105; with the flag both versions restore from it);
 //   - no `unlockStale`, so no delete verb is issued against `locks/`;
 //   - `m.runner()` rather than `resticStep`, so the `unlock --remove-all` escalation is unreachable
 //     rather than merely unlikely.