# ep0 off-site store - BASELINE taken 2026-09-17T00:17:15Z, READ ONLY
# Purpose: the teardown must show the off-site backups STAYED and nothing was removed.
# One listing at the end cannot prove that. This is the "before" half of the pair.
# Nothing was written, nothing pruned, and the .chunks store was deliberately not walked.

host       felhom-hetzner (167.233.158.164, reached from DooPlex)
datastore  felhom-offsite -> /mnt/pbs-datastore

namespaces      demo-felhom, demo-hp, tester-1
backup groups   ns/demo-felhom/ct/9201
                ns/demo-hp/ct/9201
                ns/tester-1/ct/9201        <- tonight's box (tester-1-022354)
snapshots       2 in EACH group, 6 in total
disk            /dev/sdb 98G total, 16G used, 83G available, 16% used

At teardown this listing is repeated. The expected result is that every group and snapshot above is
still present; the tester-1 group may have MORE snapshots if a backup ran, and must never have fewer.

## SECOND READING, taken 2026-09-17T00:36:52Z - immediately BEFORE the hub host delete
  namespaces      demo-felhom, demo-hp, tester-1
  groups          ns/demo-felhom/ct/9201 -> 2 snapshot(s)
                  ns/demo-hp/ct/9201     -> 2 snapshot(s)
                  ns/tester-1/ct/9201    -> 2 snapshot(s)
  disk            98G total, 16G used, 83G available, 16%
IDENTICAL to the 00:17:15Z baseline. Nothing changed on ep0 during the whole teardown of the machine
and the host - which is what "read only" is supposed to mean, and is now shown rather than asserted.

WHY A SECOND READING BEFORE THE DELETE: this project already knows that a delete's single removal
operation can destroy a customer's backup groups, not merely release a token. The single-host delete
handler shows no cascade to ep0 - but a grep that returns nothing is the weakest evidence there is,
and tonight has produced four false conclusions built on exactly that. So the store is read again a
few minutes before the delete, and will be read again after it. If the delete touches ep0, the
damage will be measurable against a reading minutes old instead of an hour old.
