REPORT — night 2026-10-16 → 17: restore after a reinstall · restic 0.19.1 · small fixes · dashboard hardening

Written in ASD-STE100 Simplified Technical English. Brief: the night task of 2026-10-16 (operator decisions 1A and 2A, 21:57). Design read first: architecture/07-backup-architecture.md §7.4 (now carries the rule), §6.8, the restore table; _recovery-inventory-2026-07-28.md; 02-controller-module-map.md. Evidence: documentation/audits/night-restore-2026-10-17/.

0. Readings I took without asking

The rule „the backup's database password wins" applies only when the restore puts back the database's DATA VOLUME. A backup that holds only a dump goes into the current data folder, which only the current password opens.
„Not on the box" means: the current install is not older than the data. A unit without the password over an install that existed when the backup was taken uses the install's value; over a newer install it is refused.
Grimmory's on-box restore after its books were removed refused by design (R-479: a unit holds settings and database, not the household's files). Its on-box route is „use my kept data", which I proved instead.
Part 6: researched, not changed. Changing five apps' Redis settings on every box needs answers I do not have tonight (the ladder step files, the old volumes left behind, keeping data across the change). R-1096 holds the plan.
The prune with 0.19.1 on demo-hp's real store cannot run tonight: its clean-up window opens after 2026-10-18 14:16 UTC and only the operator can grant one sooner. Proven on a scratch store instead.

1. The restore fix (R-1106, R-127 b, R-926)

Route	Where the database password came from before	Now
On-box restore („Visszaállítás"), update rollback, „use my kept data", off-site at the snapshot's version	the unit (unit wins); O4 GENERATED it when missing	the unit; missing → install older than the data → kept, else refused before any change; never generated
Off-site full restore, same version (the reinstall case)	the current install (the bug)	the snapshot's, written before the database starts, when the snapshot replays the DB volume
`.fab` import	the bundle's app.yaml	unchanged

Drill on demo-hp 9201 (rc.1, the dashboard's own posts), Rallly = Postgres, Grimmory = MariaDB:

Path	Rallly	Grimmory
Off-site full restore after remove + reinstall	marker row back, healthy, 0 auth errors, app's DB login works	marker row + books file (sha256) back, healthy, root and app logins work
On-box restore after remove (backups kept) + reinstall	both marker rows back, healthy, logins work	refused by design (books removed — R-479)
Refusal: unit without the password over a newer install	refused before any change; the app kept running, data untouched	—
„Use my kept data"	—	both passwords from the backup; marker row back; kept file unchanged

Last night the same off-site steps left Rallly crash-looping and Grimmory held. R-926's answer: after a unit restore the page hides a login it had to invent and says to use the old password — correct. On the reinstall path the page would have shown the reinstall's admin login; now it records it as not the app's login. Tests TestR1106_* (8), red-proved by six mutations; catalog gate db-credentials (17 apps, 20 fields, all type: secret).

2. restic 0.19.1 (R-1107)

Notes read 0.18.1 → 0.19.1. One change touches the table: a missing top-level backup path now exits 3 (was 0). The box removes such paths before the call, so only a race reaches it — now a loud failure instead of a silent partial copy. No repository format change.
Pinned like 0.18.1 (official file, signed sums, our two pinned sums). A wrong sum fails the build (proved).
Fixtures for 0.14.0, 0.18.1, 0.19.1 from one store; TestR1105_* runs each against 0.14.0 — all pass.
Both directions on demo-hp's REAL store: copies made by 0.14.0, 0.18.1 and 0.19.1, each restored by all three — byte-identical every time; all three list the same 234 copies. After a 0.19.1 prune: scratch store only (reading 5) — 0.14.0 lists, checks and restores.
Scanner (trivy 0.74.0): critical 3 (2 fixable) → 1 (0); high 122 (52) → 93 (23). restic's own part 50 → 19.

3. Small fixes (Part 3)

R-1108 done — a share added before the first password is served (test red-proved; live smbclient from DooPlex).
R-1065 done — a Plex claim schedules the wiring (test red-proved; no live claim tonight).
R-1017 done — the guard exists and found one more bare drive path (the remove dialog's kept-folders list), fixed.

4. Dashboard hardening (Part 4)

All six R-983 items and both R-976 items done, one red-proved test each. 135 i18n fixtures re-captured (the sign-out control became a form; one minimum-length change), 22 unchanged. Headless Chrome through demo-hp's public address: sign in → /launcher; X-Frame-Options: DENY; sign-out is a POST with CSRF → /login; sign in again; the family-gated Grimmory and the setup-gated Rallly open their own pages.

5. Part 6 — Redis (R-1096)

Seven Redis services: five append-only (romm, docmost, paperless-ngx, immich, nextcloud), two snapshot-only (outline, dawarich). Table and proposed lines: P6/redis-persistence.md. Not changed (reading 4). Also: RomM's file WAS repaired on 2026-09-24 — the row's history was wrong, corrected.

6. Release

0.324.0 built from b695857 (code identical to rc.1 f75b3aa, the README differs), MinAgent 0.158.1 (the hub's declared value — not lowered). Per-box floors at 21:51:39 UTC (303 → floor_set, all three); Tester 1, demo-hp and demo-felhom on 0.324.0 at 21:52 UTC, each through the normal update path. Box walk: no container unhealthy, restarting, exited or created (28 / 9 / 17); restic 0.19.1 in each; dashboards 200; https-only 37 names OK (release/).

Tonight's off-site runs on 0.324.0: demo-hp backup OK 02:18:07 UTC (14 apps, 296 snapshots, 2m59s), demo-felhom 02:15:36 (5 apps, 25), Tester 1 02:17:16 (10 apps, 60) — read at 02:45 UTC on each box and in each log (release/night-offsite-*.txt). Global floor 0.324.0 / MinAgent 0.158.1 at 02:46:24 UTC (303 → flash=floor_set; the brief allowed it tonight); per-box floors cleared. Read back on two channels: one tar of hub.db + -wal + -shm (integrity ok: 0.324.0, 0.324.0=0.158.1, no per-box floor) and the hub's own /configuration page.

7. Rows

Before 177. Opened 7 (R-1109 … R-1115). Closed 8 (R-1106, R-127, R-926, R-1108, R-1065, R-1017, R-983, R-976). Closed 2 more with the floor (R-1105, R-1107). After: 174 (177 + 7 − 10). R-1096 corrected and READY. unproven.py: NOT WALKED 35 of 55, unchanged.

8. Observations

A reinstalled database app restored from the off-site copy came back unusable. NOT-A-FINDING: it is R-1106, closed tonight.
A share renamed at the same path is never applied to a running samba. FILED: R-1109
Two sibling path helpers are called with drive-named arguments, unguarded. FILED: R-1110
The share-password and escrow limiters count a try after the password check. FILED: R-1111
Family sessions are stored raw, not as a fingerprint. FILED: R-1112
Each /__family/start pass with a household session creates a new family session. FILED: R-1113
controller_gates.py cannot pass in a worktree outside git/. FILED: R-1114
A catalog decoy („a credential token rewritten in translation") no longer convicts. FILED: R-1115
Grimmory's on-box restore after its books were removed refused. NOT-A-FINDING: by design (R-479), its route is „use my kept data", proven.
The launcher logs 404s for SVG app logos. NOT-A-FINDING: the page asks for the SVG first and falls back to the PNG; the same 263 assets were in 0.322.0.
Two catalog-wide stacks tests take about 26 s each. NOT-A-FINDING: test duration, no defect.
R-1096's history said RomM's Redis file was not repaired on 2026-09-24. NOT-A-FINDING: the row text is corrected tonight (the file was repaired; the 2026-10-16 cause is unproven).

9. Teardown (three layers)

Machine (demo-hp 9201): Rallly and Grimmory removed through the product (no container, volume, unit, copy or hold left); my marker files and the cover file removed; sharing off, the test share and its folders removed. 9201 runs 0.324.0. The old Kimai hold is not mine and stays.
Host: nothing.
Hub: per-box floors set and cleared; the global floor raised to 0.324.0 / MinAgent 0.158.1 (the release, §6).

8.6 KiB Raw Blame History Unescape Escape