coulomb-social/docs/release/backup-source-installation-execution-review-2026-10-31.md

Supervised inactive backup-source installation

The final wrapper is prepared for CSOC-WP-0012-T08. It installs the previously sealed22-member archive into its exact19 target paths, using the existing transaction library. It neither captures data nor starts/enables a service or timer. Current native preflight refuses; do not execute this packet yet.

Proposal: sha256:8f442bf0ebed8bbf3b7f227b52081df52613f3f5f6874c4a59511cfc2ba06d42.

The digest binds launcher/runtime/transaction/owner-verifier sources, archive and manifest, native target preimages, cluster identity, the fixed capacity profile and the existing telemetry-route execution packet4d848106. No owner route source or frozen SMTP admission packet was changed.

Native findings and disposition

Read-only preflight holds the existing backup and snapshot locks without replacing or truncating them; verifies primary cluster identity, inactive/disabled units, absence of queued starts, and the exact19 target preimages. It then refuses unsafe_state_entry in the existing capacity guard. No installation attempt or target replacement was created.

Metadata inspection found eight exceptions inside the backup state tree: four root-owned0755 release/capsule directories, and four date-operation private entries owned by helper UID/GID10001. The latter are the private directory, result.json, journal.json and execute.lock. Their bodies were not read. These are historical operation evidence, not newly detected backup corruption. The private ancestors matter to exposure; this observation alone is not a claim that their contents were publicly accessible.

Exact metadata is in backup-state-custody-observation-2026-10-31.json. T04 owns reviewed custody/disposition compatible with the capacity guard. Do not chmod/chown/delete/move these historical records opportunistically, skip them from capacity accounting, or loosen the guard to force installation through. Retention, original evidence paths and the terminated helper's ownership contract must be considered in that disposition. No disposition was executed here.

The separate telemetry-route receipt is still absent at this observation. T07's existing founder command remains unchanged. Successful route execution and independent native verification are required before this installation can pass. The installer reuses the pinned owner verifier to compare the full release, resources, runtime config, Ready image and preserved PVC, both before and after installation. A past receipt without the current native checks is insufficient.

Reviewed operation and future terminal entry

Offline proposal (no node access):

python3 /home/worsch/coulomb-social/scripts/install-backup-sources.py

Read-only preflight:

python3 /home/worsch/coulomb-social/scripts/install-backup-sources.py --preflight

Only after T04's custody disposition and T07's verified route, refresh preflight and review any changed source/preimage digest. The founder's future installation command is:

python3 /home/worsch/coulomb-social/scripts/install-backup-sources.py \
  --execute --expect-digest sha256:8f442bf0ebed8bbf3b7f227b52081df52613f3f5f6874c4a59511cfc2ba06d42

It requires a terminal and INSTALL followed by the full digest. That exact confirmation includes admission of the displayed1GiB new-file limit,8GiB local state budget,8GiB free-space floor,1024-inode minimum and16MiB control margin. Capacity admission here does not resolve rolling provider retention, expiry or historical-copy deletion. Existing node/custody/destination/schedule permissions are preserved; no new schedule or notification destination is being requested.

The transaction preserves shared platform helpers and the current snapshot pin. It saves preimages, stages files and journals identities before replacing targets. After daemon reload, every target is read back and units must remain inactive, disabled/static and free of queued jobs. Dependency SDK versions and credential file custody are checked without reading credential values. The outer receipt is at /var/lib/coulomb-social-backup-installations/20261031bacc0001/receipt.json; the nested files/receipt.json and preimages describe the file transaction.

After interruption or a lost connection, inspect both receipts, process state and native files before any further operation. Existing attempts refuse installation; there is no automatic retry or rollback. The explicit founder rollback uses --rollback --expect-digest <same-digest> and confirmation ROLLBACK <same-digest>. It takes the same locks, checks cluster/inactive state, refuses interfering file changes, restores only its own journaled targets, reloads and rechecks inactivity. Rollback retains evidence and does not require an operational email route.

Validation and acceptance boundary

The disposable-filesystem tests exercise the real file transaction plus controller ordering, locked preflight, source/preimage/refusal gates, interrupted reload, preserved preimages, explicit rollback, route loss after installation, enabled/ failed/foreign units, queued starts and nonterminal refusal. Real file-lock tests prove both locks are exclusive and released after partial acquisition, preserve their bytes/inodes, and reject symlinks.

The full regression result and exact source hashes are in backup-supervised-installer-validation-2026-10-31.json. The gate also exposed formatting errors in two previously added mail preparation scripts; these were corrected. The sender preparer's embedded remote Python AST is unchanged, and the send-free return-mail rehearsal passed again. Historical evidence keeps its original source hashes; the new validation binds the current formatted sources.

T08 remains progress until actual installation and independent inactive-state readback. T09 still needs native service/failure/retry/stale/producer-death proof; T10 still needs activation and observation after its existing prerequisites. No full service acceptance, mail delivery or migration verdict follows from source preparation alone.