2 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	8569b3d674	fix(backup): the safety backup's audit row names who restored (#5820) ... On the live restore the "before restore" backup.made row read user "unknown": _safety_backup recorded it with no username. It now carries the person who started the restore. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 11:32:08 -04:00
bvandeusenandClaude Opus 5.5	fb99f8b551	feat(backup): restore from Settings → Backups, with restoring mode (#5816, #5817) ... #5816 "Restoring mode": while a backup goes back in, the scheduler holds, ingest and HTMX answer 503 with Retry-After (agents keep their samples), and every page says what is happening. A safety backup of Steward as it stands is made first, to /data/backups and the bucket. The backup's key is put in place, the restore audited, and Steward exits with code 3 so Swarm, compose or systemd starts it fresh. A failed in-place restore changes nothing and says why on Backups; a full replace that fails after the wipe restarts into first-run setup. #5817 "Settings → Backups: Restore": a Restore button on each sent backup and on the file card. The chosen backup is checked (the same comparison as Check, now a shared partial) and held server-side for an hour under a token; it starts only once the admin types "restore", and an older backup also needs "Replace everything" ticked. A newer backup, or one whose key can't open its secrets, gets no button. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 11:03:01 -04:00