# REPORT — v0.324.0: the database password comes back with the data; restic 0.19.1; hardening; three fixes (2026-10-17)

Night brief 2026-10-16 → 17 (operator decisions 1A, 2A). Full report in plain words: felhom.eu `REPORT-night-2026-10-17.md`.
Evidence: felhom.eu `documentation/audits/night-restore-2026-10-17/`.

## 1. What changed

- **R-1106 / R-127 (b) / R-926:** a restore puts back the database password the data was saved with
  (`internal/backup/restore_dbcreds.go`, `restore_unit.go`, `offbox_reconstitute.go`; `internal/appbackup/dbservices.go`;
  `stacks.SetStackSecretValues`). Refusal `err.backup.restore_no_db_password` (HU/EN). Design: felhom.eu `07` §7.4.
- **R-1107:** restic 0.19.1 (Dockerfile ARGs; fixtures `internal/backup/testdata/restic/{0.14.0,0.18.1,0.19.1}`).
- **R-1108** (samba), **R-1065** (Plex claim → wiring), **R-1017** (guard + `userdataKept` fix).
- **R-983** (six items) and **R-976** (two items): `internal/web` auth, family gate, setup gate, claim; templates.

## 2. Tests (each red-proved)

`TestR1106_*` (backup 7, stacks 1; six mutations + one), `TestR1105_*` over three versions, `TestSambaPassword_*`,
`TestPlexClaim_TriggersMediaWiring`, `TestNoBareDrivePathToUserdataDir`, `TestRemoveStack_R800_UserdataKeptOnSystemDrive`,
`TestR983_*`, `TestR976_*`. Full suite green; `controller_gates.py --fast` green. 135 i18n fixtures re-captured, 22 unchanged.

## 3. Live

demo-hp 9201 on rc.1: off-site, on-box, refusal and kept-data restore paths with Rallly and Grimmory; restic three-way
on the real store; headless Chrome through the public address. Released to Tester 1, demo-hp, demo-felhom by per-box
floors (21:52 UTC), box walk green; the night's off-site runs `backup OK` on all three (02:15–02:18 UTC); **global floor
0.324.0 / MinAgent 0.158.1 at 02:46 UTC**, read back from the hub DB and page; per-box floors cleared.

## 4. Observations

1. A share renamed at the same path is never applied to a running samba. FILED: R-1109
2. Two sibling path helpers are called with drive-named arguments, unguarded. FILED: R-1110
3. The share-password and escrow limiters count a try after the password check. FILED: R-1111
4. Family sessions are stored raw, not as a fingerprint. FILED: R-1112
5. Each `/__family/start` pass with a household session creates a new family session. FILED: R-1113
6. `controller_gates.py` cannot pass in a worktree outside `git/`. FILED: R-1114
7. Grimmory's on-box restore after its books were removed refused. NOT-A-FINDING: by design (R-479); its route is „use my kept data", proven.
8. The launcher logs 404s for SVG app logos. NOT-A-FINDING: it falls back to the PNG; the same assets were in 0.322.0.