# REPORT — night 2026-10-16 → 17: restore after a reinstall · restic 0.19.1 · small fixes · dashboard hardening

Written in ASD-STE100 Simplified Technical English. Brief: the night task of 2026-10-16 (operator decisions 1A and 2A,
21:57). Design read first: `architecture/07-backup-architecture.md` §7.4 (now carries the rule), §6.8, the restore table;
`_recovery-inventory-2026-07-28.md`; `02-controller-module-map.md`. Evidence: `documentation/audits/night-restore-2026-10-17/`.

## 0. Readings I took without asking

1. **The rule „the backup's database password wins" applies only when the restore puts back the database's DATA
   VOLUME.** A backup that holds only a dump goes into the current data folder, which only the current password opens.
2. **„Not on the box" means: the current install is not older than the data.** A unit without the password over an
   install that existed when the backup was taken uses the install's value; over a newer install it is refused.
3. **Grimmory's on-box restore after its books were removed refused by design** (R-479: a unit holds settings and
   database, not the household's files). Its on-box route is „use my kept data", which I proved instead.
4. **Part 6: researched, not changed.** Changing five apps' Redis settings on every box needs answers I do not have
   tonight (the ladder step files, the old volumes left behind, keeping data across the change). R-1096 holds the plan.
5. **The prune with 0.19.1 on demo-hp's real store cannot run tonight:** its clean-up window opens after 2026-10-18 14:16
   UTC and only the operator can grant one sooner. Proven on a scratch store instead.

## 1. The restore fix (R-1106, R-127 b, R-926)

| Route | Where the database password came from before | Now |
|---|---|---|
| On-box restore („Visszaállítás"), update rollback, „use my kept data", off-site at the snapshot's version | the unit (unit wins); O4 GENERATED it when missing | the unit; missing → install older than the data → kept, else **refused before any change**; never generated |
| Off-site full restore, same version (the reinstall case) | the current install (**the bug**) | the snapshot's, written before the database starts, when the snapshot replays the DB volume |
| `.fab` import | the bundle's app.yaml | unchanged |

**Drill on demo-hp 9201 (rc.1, the dashboard's own posts), Rallly = Postgres, Grimmory = MariaDB:**

| Path | Rallly | Grimmory |
|---|---|---|
| Off-site full restore after remove + reinstall | marker row back, healthy, 0 auth errors, app's DB login works | marker row + books file (sha256) back, healthy, root and app logins work |
| On-box restore after remove (backups kept) + reinstall | both marker rows back, healthy, logins work | refused by design (books removed — R-479) |
| Refusal: unit without the password over a newer install | refused before any change; the app kept running, data untouched | — |
| „Use my kept data" | — | both passwords from the backup; marker row back; kept file unchanged |

Last night the same off-site steps left Rallly crash-looping and Grimmory held. **R-926's answer:** after a unit restore
the page hides a login it had to invent and says to use the old password — correct. On the reinstall path the page
would have shown the reinstall's admin login; now it records it as not the app's login. Tests `TestR1106_*` (8),
red-proved by six mutations; catalog gate `db-credentials` (17 apps, 20 fields, all `type: secret`).

## 2. restic 0.19.1 (R-1107)

- **Notes read** 0.18.1 → 0.19.1. One change touches the table: a missing top-level backup path now exits 3 (was 0).
  The box removes such paths before the call, so only a race reaches it — now a loud failure instead of a silent partial
  copy. No repository format change.
- **Pinned** like 0.18.1 (official file, signed sums, our two pinned sums). A wrong sum fails the build (proved).
- **Fixtures** for 0.14.0, 0.18.1, 0.19.1 from one store; `TestR1105_*` runs each against 0.14.0 — all pass.
- **Both directions on demo-hp's REAL store:** copies made by 0.14.0, 0.18.1 and 0.19.1, each restored by all three —
  byte-identical every time; all three list the same 234 copies. **After a 0.19.1 prune:** scratch store only (reading 5) —
  0.14.0 lists, checks and restores.
- **Scanner** (trivy 0.74.0): critical 3 (2 fixable) → **1 (0)**; high 122 (52) → **93 (23)**. restic's own part 50 → 19.

## 3. Small fixes (Part 3)

- **R-1108** done — a share added before the first password is served (test red-proved; live `smbclient` from DooPlex).
- **R-1065** done — a Plex claim schedules the wiring (test red-proved; no live claim tonight).
- **R-1017** done — the guard exists and found one more bare drive path (the remove dialog's kept-folders list), fixed.

## 4. Dashboard hardening (Part 4)

All six R-983 items and both R-976 items done, one red-proved test each. 135 i18n fixtures re-captured (the sign-out
control became a form; one minimum-length change), 22 unchanged. **Headless Chrome through demo-hp's public address:**
sign in → `/launcher`; `X-Frame-Options: DENY`; sign-out is a POST with CSRF → `/login`; sign in again; the
family-gated Grimmory and the setup-gated Rallly open their own pages.

## 5. Part 6 — Redis (R-1096)

Seven Redis services: five append-only (romm, docmost, paperless-ngx, immich, nextcloud), two snapshot-only (outline,
dawarich). Table and proposed lines: `P6/redis-persistence.md`. Not changed (reading 4). Also: RomM's file WAS repaired on
2026-09-24 — the row's history was wrong, corrected.

## 6. Release

**0.324.0** built from `b695857` (code identical to rc.1 `f75b3aa`, the README differs), MinAgent 0.158.1 (the hub's
declared value — not lowered). Per-box floors at 21:51:39 UTC (`303` → `floor_set`, all three); **Tester 1, demo-hp and
demo-felhom on 0.324.0 at 21:52 UTC**, each through the normal update path. Box walk: no container unhealthy, restarting,
exited or created (28 / 9 / 17); restic 0.19.1 in each; dashboards 200; https-only 37 names OK (`release/`).

**Tonight's off-site runs on 0.324.0:** demo-hp `backup OK` 02:18:07 UTC (14 apps, 296 snapshots, 2m59s), demo-felhom
02:15:36 (5 apps, 25), Tester 1 02:17:16 (10 apps, 60) — read at 02:45 UTC on each box and in each log
(`release/night-offsite-*.txt`). **Global floor 0.324.0 / MinAgent 0.158.1 at 02:46:24 UTC** (`303` → `flash=floor_set`;
the brief allowed it tonight); per-box floors cleared. Read back on two channels: one `tar` of `hub.db` + `-wal` + `-shm`
(integrity ok: `0.324.0`, `0.324.0=0.158.1`, no per-box floor) and the hub's own `/configuration` page.

## 7. Rows

**Before 177. Opened 7** (R-1109 … R-1115). **Closed 8** (R-1106, R-127, R-926, R-1108, R-1065, R-1017, R-983, R-976).
**Closed 2 more with the floor** (R-1105, R-1107). **After: 174** (177 + 7 − 10). R-1096 corrected and READY. `unproven.py`: NOT WALKED 35 of 55, unchanged.

## 8. Observations

1. A reinstalled database app restored from the off-site copy came back unusable. NOT-A-FINDING: it is R-1106, closed tonight.
2. A share renamed at the same path is never applied to a running samba. FILED: R-1109
3. Two sibling path helpers are called with drive-named arguments, unguarded. FILED: R-1110
4. The share-password and escrow limiters count a try after the password check. FILED: R-1111
5. Family sessions are stored raw, not as a fingerprint. FILED: R-1112
6. Each `/__family/start` pass with a household session creates a new family session. FILED: R-1113
7. `controller_gates.py` cannot pass in a worktree outside `git/`. FILED: R-1114
8. A catalog decoy („a credential token rewritten in translation") no longer convicts. FILED: R-1115
9. Grimmory's on-box restore after its books were removed refused. NOT-A-FINDING: by design (R-479), its route is „use my kept data", proven.
10. The launcher logs 404s for SVG app logos. NOT-A-FINDING: the page asks for the SVG first and falls back to the PNG; the same 263 assets were in 0.322.0.
11. Two catalog-wide stacks tests take about 26 s each. NOT-A-FINDING: test duration, no defect.
12. R-1096's history said RomM's Redis file was not repaired on 2026-09-24. NOT-A-FINDING: the row text is corrected tonight (the file was repaired; the 2026-10-16 cause is unproven).

## 9. Teardown (three layers)

- **Machine (demo-hp 9201):** Rallly and Grimmory removed through the product (no container, volume, unit, copy or hold
  left); my marker files and the cover file removed; sharing off, the test share and its folders removed. 9201 runs
  0.324.0. The old Kimai hold is not mine and stays.
- **Host:** nothing.
- **Hub:** per-box floors set and cleared; the global floor raised to 0.324.0 / MinAgent 0.158.1 (the release, §6).