- POST /restore/preview stages an upload in the library's folder and
answers what it holds beside the live library, writing nothing live;
DELETE discards it; at most two stages are held (429 too-large).
- POST /restore/apply rechecks the live fingerprint (409 plan-changed) and
starts "Database restore": exclusive, not cancellable, indeterminate. It
waits for request leases, publishes the exact staged bytes, swaps the
database, prunes safety backups and logs counts, repairs and the backup.
- The legacy /restore runs the same stage and publish as an exclusive hold
with its old response, so a restore and the health check, Move library
and every other job refuse each other.
- JobRegistry.lease: Needs review decisions and maintenance and restore
previews are refused while an exclusive job runs, and a restore waits
for them before it switches the file.
- GET /backup holds a guarded slot, verifies a standalone snapshot before
streaming it and removes the closed temp file; GET /backup/status lists
the safety backups on disk and this session's verified download.
Vito Sansevero
f193a3a1ce