2.6 KiB
REPORT — a backup is never changed by a new install, a restore downloads first, a restore tells the truth (2026-10-25, unattended; commit only, NOT released)
Brief: operator rulings D47 and D48 (2026-10-25 08:38); fix R-1269, D48, R-1270, R-1271; red-proof each; live-prove on
9202; nothing released — rides v0.343.0 (MinAgent 0.158.1 unchanged). Full record: felhom.eu
documentation/audits/restore-truth-2026-10-25/README.md.
What changed (each commit pushed; CI green by hash)
| commit | CI job | what |
|---|---|---|
02daebe |
2311 | D47 / R-1269: stacks.AppConfig.InstallID; backup/unit_owner.go — every unit writer sets another install's unit aside whole (backups/set-aside/<app>/<stamp>, a kept copy kind unit); the restore page „Visszaállítás" on it (POST /backup/kept/restore); remove with backups deletes it |
b680db8 |
2312 | R-1270: backup/restore_verdict.go — ErrRestoreNotStarted on every restore path; undo copy kept; late-start watcher; one operator line |
2d71270 |
2313 | D48: backup/restore_pull.go — prepareRestoreImages before the stop on every restore path, under dockerexec.HoldImageWork |
bd9f4f7 |
2314 | R-1271: keptPick / KeptNewerAt — a copy > 10 min in the future is never the newest; alone it is offered, said, not recommended |
1f9c863 |
2315 | D47 follow-up (found live): the kept-copies list shows on a box without off-site too |
1f82959 |
2316 | R-1270 follow-up (found live): remove with backups deletes backups/restore-undo/<app> |
Red-proofs (each test seen failing with its fix switched off)
felhom.eu audits/restore-truth-2026-10-25/redproof/: d47-guard-off.txt (6 of 8 fail), d47-stacks-adopt-off.txt,
d47-web-form-off.txt, d47-kept-list-without-offsite.txt, r1270-warn-only.txt (3 of 5), r1270-web.txt,
d48-no-prepull.txt (5 of 6), r1271-future-ignored.txt (4), remove-undo-copy-before.txt.
Live proofs (9202, 0.343.0-rc.1 then -rc.2; back on 0.342.0 at the end)
Before on 0.342.0 (= e1613ae for these files): the kept unit rewritten, the restore ok: true over starting, 44 + 23
password errors. After: Tandoor and AdventureLog — set aside byte for byte, restored with the old password, the item
back, 0 errors; Vikunja — an unpullable pin refused with the container never restarted, an exiting image recorded
not_started; RomM — the own copy chosen over a forged future-dated one, which alone was offered and marked.
Not done here, filed
R-1278 (a volume app's reinstall does not offer its kept backup), R-1279 (the .fab import removes volumes before its pull).