felhom.eu/documentation/audits/hub-db-offsite-2026-10-05/partD/restore-procedure/drill.txt

## runbook §3 drill 2026-10-05T14:09:41Z (scratch /var/lib/felhom-hub-backup/sec3.65qk, root 0700)
step 1 restore host/dooplex-hub/2026-10-05T13:50:18Z
restore complete (352.676 MiB processed in 3.9s, average 90.961 MiB/s)    
-rw------- 369807360 hub.db
step 2 the seal key from Secret/offsite-secret-key → /var/lib/felhom-hub-backup/sec3.65qk/k (0600, not printed)
key file bytes: 64
step 3 hubdb-check (same key): hosts=4 console_passwords_opened=4 failed=0 absent=0 rc=0
control (a random key): hosts=4 console_passwords_opened=0 failed=4 absent=0 hubdb-check: FAILED: not every console password opened with this key  rc=0
scratch shredded: gone