informed-decision/docs/evidence/2026-10-11-purpose-image-release/native-backup-restore-protocol.md

Version2 protected existing-snapshot rescue and conditional continuation

Same proposal INFD-WP-0009-T04/purpose-overlay-v1, trial infd-purpose-20261011-r1. Original version1 founder acceptance approved source bc6494cd1b. Drill-backup completed; drill-copy failed ValueError before any localfile. No image rollout occurred. This exact changed source/plan/helper requires NEW founder acceptance of memo version2 before rescue/continuation; prior approval and technical review do not approve it.

Failure and narrowly selected rescue

Original snapshot main19537920bytes SHA8756cf825df9e7b5b74bb4a0106a5027f5cff2c59ff45d7b48eed8522a7d33f3 is unchanged. Root's metadata-only verification shows WAL0bytes, SHM32768bytes, privateUID10001/mode0600/nlink1, and no local snapshot. The old SQLite connection context manager did not explicitly close; its WAL reader can create SHM indexing, and the next copy rejected that nonzero index. Platform independently reproduced this on synthetic data. No native DB was opened to diagnose the sidecar metadata, and no native sidecar is deleted/checkpointed.

Reuse this exact independently hash-bound frozen main snapshot rather than make another drill backup. The backupadmin exited after creating the uniquely owned private snapshot. Original subsequent snapshot access was readonly; actual service DB is the distinct /data/private/review.sqlite. Original journal has only COMPLETE drill-backup d63182a7-e1a5-4e8e-a5f1-2bf3333cf153 and UNCERTAIN drill-copy329ef190-1692-4246-b953-e6a59664abcc. Its exact SHA d187b02d98d6e97429fe20b4fbe1d309a6c6c4b55232b4ae13ac39873039f1c1, original source/memo/plan identity and outcomes are verified before/after every new phase. No other original action or rollout is allowed.

The explicitly named drill-copy-rescue-r1 creates a separate rescue-execution-journal-r1.json/lock in existing protected ignored custody; it hash-links original attempts and backupresult and never rewrites/synthesizes the old failed phase. Any attempted rescue result, crash or ambiguous output is durable and same-phase retry is refused. Before rescue: local drill.sqlite/cutover.sqlite and existing restore volume must be absent; native originalPodUID/currentoldimage7f5/Argo7db/sealedDeployment/CM/PVC match. The fixed immutable snapshot reader checks recorded digest/private identity/no WALframes before and after schema5/integrity/count validation, retaining unchanged SHM. Nonzero WAL or any identity/hash drift stops rescue. Snapshot binarystdout flows only to a new0600private file, with bounded size/hash and repeat source proof. It never reaches chat/log/Git/StateHub.

Live-WAL and data compatibility boundaries

Live source and writable offline pre/post-admin reads MUST stay mode=ro/query_only and explicitly close SQLite connections. immutable=1 ignores WAL and would lose committed live rows; it is restricted to the proven frozen closed-main snapshot, never the liveDB or writableclone. Before ANY native source or restoredcopy Store/admin open, require stdlib readonly schema5/integrity/counts; refuse oldschemas before automatic migration. Frozen snapshot/clone count equality is exact; currentlive counter changes may reflect concurrent legitimate commits and are retained.

Only after COMPLETE named rescue does offline-verify consume its result via explicit mapping, not the old UNCERTAIN drill-copy. Existing isolated disposablevolume infd-purpose-r1-restore-20261011 must be absent/new nonce-bound. One exact763c UID0/CAP_CHOWN-only initializer receives snapshotstdin into that NEWvolume, networknone/readonlyroot/no-newprivileges/CPU1/128Mi, no host/nativePVC/runtimeconfig/token mounts. It sets folder0700/file0600UID10001, followed by UID10001 pre-open readonly, --entrypoint informed-decision-admin inspect --db /restore/review.sqlite and post-admin readonly fullproof; original protected SHA must remain unchanged. No serviceentrypoint starts. Cleanup only this disposable volume, retaining original native/offcluster snapshots/sidecars.

Conditional remaining phases and release/recovery

Newjournal fixed order: drill-copy-rescue-r1 → offline-verify → cleanup-offline → cutover-backup → cutover-copy → release → verify. cutover-backup uses distinct newcutover.sqlite in originalprivatecase directory, after readonly live schema5/capacity gates, SQLitebackupAPI/admin completion, closed-main immutable proof; do not overwrite originals or retryfailedpaths. Version2 acceptance conditionally approves these exact unchanged remaining operations only after rescue+drillgates. All four committed Kustomize Git blobs/currentHEAD, exact helper/case hashes, CM/PVC/Deployment seals and manualApplication(no automated{} or sourceoverride) must match.

Release retains existing replica1/Recreate/config6c/schema5/PVC/credentials/policies: sourcepin Application.operation serverdryrun/UID+resourceVersion+source CAS, Deployment-only image763c, prune=false. No whole-app sync/adoption. Verify requires succeeded exactscope/controllergeneration/Ready1, installedpolicyhash/modeUID/10syntheticpurposevariants+boundedhealth, same currentliveDB schema5/integrity/counts. Those installedchecks report native_provider=false; actualprovider/PDPauthority evidence remains a separate T04gate.

Rollback after recorded newrelease attempt pins prior7db/7f5 and retains latestschema5DB, without requiring Ready failingcandidate or candidateDBexec. Separate rollback-verify proves oldimageReady1/scopedoperation/readonlyschema5 currentDB integrity. Never restore an older snapshot over postcutoverrecords. Any data recovery beyond this same-schema image rollback needs another decision.

All phases including rescue, verification and recovery must begin before2026-10-12T23:59:59Z. Start early enough; if expired stop and obtain a fresh founder decision, which may delay recovery. No automatic timer/controller/extension. Root freshly authenticates exact confirmed platform-root person ACCEPT memo version2 at fixednativeorigin before every phase; protectedreceiptrelation/freshness120sec is supervisedbookkeeping, not a signed/autonomous grant.

Image763c/policy9d7c/base7f5 and actualunfilteredscan0HIGH/CRITICAL/1fixableMEDIUMzlib remain unchanged, owner INFD-RISK-20261011-ZLIB-85091/T05 dueOct18. The exactbundle directly binds helper/plan/tests plus original count-onlybackup/failure/anchor. Existingpublishedreceipt still binds unchanged rawscan/SBOM/base scan; no suppression. Preserve originalapproved20docpacket/helpers/history in initial-approved-bc6494cd. No version2 native operation has run. EUR0 recurringinfrastructure; private boundedstorage/attendedtime unpriced, no newdrillbackup or autonomygrant.

Native source publication uses exact revision-command.json via /lifecycle/memos/infd-20261011-purpose-overlay-r1/revisions, expected_version1, only after fresh unbound-source readback. No version2 intake/register. Publish/review sourceversion2; new human review-ID is ownversion1, so its confirmed nested disposition memo_version1 is correct. Root actual outcomes query must name SOURCE version2 and exact newreviewID; original review/approval cannot be reused.