# VALIDATION — new-box restore round-trip + old-box archive retirement — 2026-07-10

**Class:** supervised operational validation (small). **Baseline:** controller v0.110.0 on guest 9201
(healthy), offbox escrowed on the NEW pool box (project 15282031, sub-account 269008 /
`u629488-sub1`), quota 50 GB, 4 snapshots, last run ok — re-confirmed live at start.

## Phase 1 — restore from the NEW box (real endpoint, anti-F9)

Both toggled apps restored via `POST /backup/offbox/restore` (async, non-destructive →
`<DataDir>/offbox-restore/<app>`); the live app tree and USB units untouched.

| App | Endpoint result | Duration (residential, incl. polling) | Integrity |
|---|---|---|---|
| immich | restored | ~10 s | 5/5 files sha256-identical vs USB source |
| audiobookshelf | restored | ~11 s | 4/4 files sha256-identical vs USB source |

**9/9 byte-identical**, including the 44 MB `db-dumps/immich-postgres.sql`:
`d78466fcbf595b488ba8b962fcc521f68fbe6f36b8b8e57815a6124bccf4526b` — identical to the overnight
campaign's Track-E hash (two independent restore rounds agree). Restore scratch removed after hashing.

## Phase 2 — retirement decision (Viktor)

**DECISION: RETIRE.** Viktor deletes the `u629193-sub1` sub-account in the OLD project's Hetzner console
himself (one click — revokes access + frees the space). The old box (`PBS-storage-1`) itself stays for
future dev use. The demo's OLD R-blob at the hub (pre-hash, covering the old history) remains — harmless.

## Arc status

**Offsite tier restore-proven on the production pool box; old-box archive retired (console click:
Viktor).** The offsite arc is build-complete (S1–S4 + hardening + C1/C2 self-heal) and its data path is
now proven both directions (backup → box → restore, byte-exact) on the production project. Remaining
operational: the Peti onboarding runbook (session-gated tracks: auto-confirm happy chain, fresh-enable,
live quota-crossing, hub-orchestrated F4/freeze).