felhom.eu/REPORT-restore-truth-2026-10-25.md

REPORT — a backup is never changed by a new install, a restore downloads first, a restore tells the truth (2026-10-25, unattended, commit only)

Plain words first.

• R-1269 is fixed and proven: a reinstall no longer writes into the old backup. The old backup is set aside whole, listed on the restore page, and restores with its own password (Tandoor and AdventureLog on 9202: the account back).
• D48 download-first on every restore path that starts a definition (the unit restore and with it the second drive's unit and whole restore, both kept-data loads and a set-aside unit; the off-site restore; the second drive's file restore; the no-unit fallback). An unpullable version is refused and the app is never stopped (proven).
• R-1270: a restore whose app does not start says so — never „it worked"; the old copy is kept (proven).
• R-1271: cause — the other box's off-site copy was dated in the future (its clock), and „newest wins" took it; now a copy more than 10 minutes in the future never counts as the newest (proven on a forged copy).
• One question for you: D49 in STATUS — after a restore whose app does not start, keep the data and wait (CC's pick, done) or pour the old data back by itself.

Safest readings taken (also at the head of documentation/audits/restore-truth-2026-10-25/README.md): an install identity field, not the data stamps; the set-aside unit is a D25 kept copy (remove-with-backups deletes it, as it does other kept copies); a „partial write" means one half into another install's unit; R-1270 keeps the data and the undo copy (no new retention rule); D48 tells a deleted version from a busy registry by Docker's answer; 10 minutes of clock skew; the .fab import left to its own row.

Architecture read: 07 §6.3, §6.5, §6.6, §8 (D20/D22, §8.2a D25); 03 (drive identity); 09 §3 decisions 14, 40, 53; rows R-1269–R-1271, R-1206, R-698, R-933, R-1267.

Each proof, before (e1613ae, 9202 on 0.342.0) → after (9202 on 0.343.0-rc.2):

• R-1269: the kept unit's app.yaml rewritten (cbfcb538… → e19d2610…), restore broken → set aside byte for byte, restored, the account back, 0 password errors (Tandoor, AdventureLog).
• R-1270: ok: true over a starting app → ok: false, not_started, the honest sentence, the undo copy kept.
• D48: the first pull after the stop (code order) → an unpullable pin refused, the container's start time unchanged.
• R-1271: the future copy chosen (sweep) → the own copy chosen; alone, the future copy marked and said.

Commits. Controller: 02daebe (D47) CI 2311 ✓, b680db8 (R-1270) 2312 ✓, 2d71270 (D48) 2313 ✓, bd9f4f7 (R-1271) 2314 ✓, 1f9c863 (the kept list without off-site) 2315 ✓, 1f82959 (remove deletes the undo copy) 2316 ✓, e8d2151 (REPORT). felhom.eu: this commit (07 §6.5/§6.6/§8.2d/§8.2e, 09 §3 decisions 256–257, CONTEXT, register, STATUS, STATUS-HISTORY, the audit with its evidence and tools) — CI by hash in the final message. Test images 0.343.0-rc.1 (bd9f4f7) and 0.343.0-rc.2 (1f9c863) in the registry; nothing released.

Teardown. Machine: 9202 only; my throwaway apps removed through the product; two empty folders and one undo copy of mine removed by hand after checking; my rc images removed from its Docker; back on 0.342.0; the apps found running still run. Host: the session's 9202 password and session files shredded. Hub: provisioned nothing. ep0: nothing.

Register: before 217, after 219; opened 2 (R-1278, R-1279), closed 0; R-1269, R-1270, R-1271 → VERIFY (fixed on main, wait for the release); notes on R-1206 (cross-reference) and R-1243 (its dated check done, read-only); R-232's dated check moved one day (this brief: no DooPlex work).

Observations:

• FILED: R-1278 (a volume app's reinstall does not offer its kept backup).
• FILED: R-1279 (the .fab import removes the app's volumes before its pull — D48 does not cover it).
• FIXED without a row (found live, red-proved): the kept-copies list was hidden on a box without off-site (1f9c863); a kept undo copy outlived remove-with-backups (1f82959).
• NOT-A-FINDING: Immich's 404 after the sweep's load — the copy brought its own address (photos.), as every unit restore does; the app was healthy there.
• NOT-A-FINDING: „immich: definition REFUSED by the allow-list" on 9202 — present before this run's image; an earlier session's Immich, not this change.
• NOT-A-FINDING: the D48 refusal reads „Visszaállítás sikertelen: …nem lehet letölteni… Az alkalmazáshoz nem nyúltunk" — the page's failure frame around an honest sentence; true as written.

Secrets: used only through sec; the evidence scanned for the box password and the session tokens (the CSRF token in two saved page snippets was the positive control and is blanked); units compared by sha256 only. System poster: no fact changed. Instruction files: none edited.