Data document, no design. Parts A-G plus Unknowns/Contradictions/Observations.
Headlines:
- A: 12 restore paths. 7 are customer-unassisted (all app-level); every whole-guest
and host-level path is operator-SSH-only.
- B: independent catalog enumeration gives Tier-2 file-leg coverage 7/53 and Tier-3
mandatory coverage 4/53; does not reproduce the shipped C9-F1 figure of 9/53.
Tier-3 captures named-volume tars on every run and no offsite action unpacks them.
- C: three circular dependencies, incl. app-tier restore being conditioned on the
whole-guest tier (encryption.key), and break-glass credentials reachable only
through the hub that DooPlex hosts.
- D1: host state is in no backup of any kind; no host has ever been rebuilt as itself.
- D2: hosts.dr_record_json, host_escrow.directive_json and dr_recipe drives[] are all
empty on the live fleet, and dr_recipe records the PBS namespace as 'root'.
- E: local vzdump shares its physical disk with the guest it backs up (both hosts);
hub.felhom.eu resolves straight to DooPlex's own public IP, not a CF tunnel.
- F: every measured RTO extracted; the unmeasured ones listed, none estimated.
Nothing was changed, deployed or restarted; peti-felhom untouched.
