60 lines
4.9 KiB
Markdown
60 lines
4.9 KiB
Markdown
# REPORT — a backup is never changed by a new install, a restore downloads first, a restore tells the truth (2026-10-25, unattended, commit only)
|
||
|
||
**Plain words first.**
|
||
- **R-1269 is fixed and proven:** a reinstall no longer writes into the old backup. The old backup is set aside whole,
|
||
listed on the restore page, and restores with its own password (Tandoor and AdventureLog on 9202: the account back).
|
||
- **D48 download-first on every restore path that starts a definition (the unit restore and with it the second
|
||
drive's unit and whole restore, both kept-data loads and a set-aside unit; the off-site restore; the second drive's
|
||
file restore; the no-unit fallback).** An unpullable version is refused and the app is never stopped (proven).
|
||
- **R-1270:** a restore whose app does not start says so — never „it worked"; the old copy is kept (proven).
|
||
- **R-1271:** cause — the other box's off-site copy was dated in the future (its clock), and „newest wins" took it;
|
||
now a copy more than 10 minutes in the future never counts as the newest (proven on a forged copy).
|
||
- **One question for you:** D49 in STATUS — after a restore whose app does not start, keep the data and wait (CC's
|
||
pick, done) or pour the old data back by itself.
|
||
|
||
**Safest readings taken** (also at the head of `documentation/audits/restore-truth-2026-10-25/README.md`): an install
|
||
identity field, not the data stamps; the set-aside unit is a D25 kept copy (remove-with-backups deletes it, as it does
|
||
other kept copies); a „partial write" means one half into another install's unit; R-1270 keeps the data and the undo
|
||
copy (no new retention rule); D48 tells a deleted version from a busy registry by Docker's answer; 10 minutes of clock
|
||
skew; the `.fab` import left to its own row.
|
||
|
||
**Architecture read:** `07` §6.3, §6.5, §6.6, §8 (D20/D22, §8.2a D25); `03` (drive identity); `09` §3 decisions 14,
|
||
40, 53; rows R-1269–R-1271, R-1206, R-698, R-933, R-1267.
|
||
|
||
**Each proof, before (`e1613ae`, 9202 on 0.342.0) → after (9202 on 0.343.0-rc.2):**
|
||
- R-1269: the kept unit's `app.yaml` rewritten (`cbfcb538…` → `e19d2610…`), restore broken → set aside byte for byte,
|
||
restored, the account back, 0 password errors (Tandoor, AdventureLog).
|
||
- R-1270: `ok: true` over a `starting` app → `ok: false`, `not_started`, the honest sentence, the undo copy kept.
|
||
- D48: the first pull after the stop (code order) → an unpullable pin refused, the container's start time unchanged.
|
||
- R-1271: the future copy chosen (sweep) → the own copy chosen; alone, the future copy marked and said.
|
||
|
||
**Commits.** Controller: `02daebe` (D47) CI 2311 ✓, `b680db8` (R-1270) 2312 ✓, `2d71270` (D48) 2313 ✓, `bd9f4f7`
|
||
(R-1271) 2314 ✓, `1f9c863` (the kept list without off-site) 2315 ✓, `1f82959` (remove deletes the undo copy) 2316 ✓,
|
||
`e8d2151` (REPORT). felhom.eu: this commit (`07` §6.5/§6.6/§8.2d/§8.2e, `09` §3 decisions 256–257, CONTEXT, register,
|
||
STATUS, STATUS-HISTORY, the audit with its evidence and tools) — CI by hash in the final message. Test images
|
||
`0.343.0-rc.1` (`bd9f4f7`) and `0.343.0-rc.2` (`1f9c863`) in the registry; nothing released.
|
||
|
||
**Teardown.** Machine: 9202 only; my throwaway apps removed through the product; two empty folders and one undo copy of
|
||
mine removed by hand after checking; my rc images removed from its Docker; back on 0.342.0; the apps found running still
|
||
run. Host: the session's 9202 password and session files shredded. Hub: provisioned nothing. ep0: nothing.
|
||
|
||
**Register:** before 217, after 219; opened 2 (R-1278, R-1279), closed 0; R-1269, R-1270, R-1271 → VERIFY (fixed on
|
||
main, wait for the release); notes on R-1206 (cross-reference) and R-1243 (its dated check done, read-only); R-232's
|
||
dated check moved one day (this brief: no DooPlex work).
|
||
|
||
**Observations:**
|
||
- FILED: R-1278 (a volume app's reinstall does not offer its kept backup).
|
||
- FILED: R-1279 (the `.fab` import removes the app's volumes before its pull — D48 does not cover it).
|
||
- FIXED without a row (found live, red-proved): the kept-copies list was hidden on a box without off-site (`1f9c863`);
|
||
a kept undo copy outlived remove-with-backups (`1f82959`).
|
||
- NOT-A-FINDING: Immich's 404 after the sweep's load — the copy brought its own address (`photos.`), as every unit
|
||
restore does; the app was healthy there.
|
||
- NOT-A-FINDING: „immich: definition REFUSED by the allow-list" on 9202 — present before this run's image; an earlier
|
||
session's Immich, not this change.
|
||
- NOT-A-FINDING: the D48 refusal reads „Visszaállítás sikertelen: …nem lehet letölteni… Az alkalmazáshoz nem
|
||
nyúltunk" — the page's failure frame around an honest sentence; true as written.
|
||
|
||
**Secrets:** used only through `sec`; the evidence scanned for the box password and the session tokens (the CSRF token
|
||
in two saved page snippets was the positive control and is blanked); units compared by sha256 only. **System poster:**
|
||
no fact changed. **Instruction files:** none edited.
|