D63 live: R-1256 H4 + H5 failed stop proven on Tester 1 (test build); D62 proven live; R-1340 filed (hold mail tells the option-C story for any cause); 07 §6.3 [FACT]; evidence audits/d63-2026-10-29/

documentation/architecture/07-backup-architecture.md

@@ -846,6 +846,19 @@ under the backup manager's lock. One `[WARN]` log line and one operator-only eve
 restore date, size; hub `19afefab`) per delete. Controller `e3fce09`, tests `TestD62_*`. **D63** (`09` §3 decision 282):
 H4 and H5's failed stop ship only with a live proof, staged with a fault switch that exists only in a `-tags faultinject`
 test build.
+**`[FACT]` 2026-10-29, Tester 1, test build `0.347.0-rc.1-d63fault` (`audits/d63-2026-10-29/`):** (H4, 08:10 UTC) a
+throwaway Radicale ran the true 3.8.0 (digest `0d60d544…`) while its newest off-site snapshot held 3.8.1's data; the full
+restore said „it comes back at the snapshot's version", the fault failed the definition write after the compose was
+written, the log then read „the live definition is written back before the start" and only then „Starting stack"; the app
+ran 3.8.0 again, no hold, and an event made before the snapshot and one made after it both read back. (H5, 08:18 UTC) a
+created-only container held the data volume („Failed to remove volume … (not written into)"); the restore's own stop
+passed, the put-back's stop failed — „nothing is put back; the copy stays at …; holding the app"; the app page showed the
+hold sentence; on the restore page the held copy's „Törlés most" was off with „Nem törölhető: az alkalmazás le van
+állítva, és ez a másolat az út vissza." (D62, 08:15 UTC) a copy kept because a second restore began inside the first one's
+stable-start window was listed with „visszaállítás: 2026. 10. 29. 09:11 · 37,3 KB · automatikusan törlődik: 2026. 11.
+28."; a wrong typed name → 400, the right one → 200, the copy gone, one `[WARN]` line; the event got HTTP 400 from hub
+0.174.1, which does not know the type yet (hub 0.175.0 does). The release image carries no fault switch (`grep -c "FAULT
+INJECTED"` = 0 on `0.347.0-rc.1`, 2 on the test image).
 **`[FACT]` 2026-10-29 night, scratch 9202 (`audits/night-2026-10-28/r1256-restore/h5-live/`):** vikunja's first volume
 held by a created-only container, the household's restore pressed through the page: „Failed to remove volume
 vikunja_vikunja_data before the restore … (not written into)", the restore failed, the put-back poured the live copy of