The server backs itself up: every collection byte for byte, the media linked

A backup is a directory <stamp>-<kind> under Backups:Root (/var/lib/privapub/backups, 2770, files 0640), written as
.partial and renamed once whole: a manifest (host, build, newest migration, each collection's count, size, sha256 and
indexes, what was left out and why, the media list), each collection as gzipped canonical Extended JSON read raw, and
hard links to the files of untrashed media rows (copies where a link can't be made). On a replica set every collection
is read in one snapshot session. Never in a backup: the statistics salt, jobs, recovery codes, sessions, the
maintenance lock and the configuration's copy with its SMTP password.

One backup or restore at a time (MaintenanceLock, a heartbeat document), and the janitor purges nothing meanwhile.
BackupScheduler backs up nightly at 03:30 UTC (or at once after missing a night); rotation keeps 7 daily, 4 weekly,
3 pre-deploy and 3 pre-restore backups. CLI: admin backup [--kind] [--db-only], admin backups, admin backup verify;
these run before migrations, so the deploy's own pre-deploy backup, which replaces mongodump, is of the database as the
live build left it. EntityMaps.Warm runs once under a lock, since test hosts now boot side by side.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub/Infrastructure/Backup/RestoreMarker.cs

@@ -0,0 +1,56 @@
+using System.Text.Json;
+
+namespace PrivaPub.Infrastructure.Backup
+{
+	// A restore asked for (by the administrator's page or the CLI) and carried out at the next boot, before anything
+	// else (Program, MaintenanceGate): restore.json in the backups' directory, written whole or not at all.
+	public sealed class RestoreMarker
+	{
+		public const string FileName = "restore.json";
+		public const int MaxAttempts = 3;
+
+		public string Backup { get; set; }//the backup restored
+		public string PreRestore { get; set; }//the backup taken just before, what the protective merge reads
+		public string State { get; set; } = "pending";//pending, then running
+		public int Attempts { get; set; }
+		public DateTime RequestedAt { get; set; } = DateTime.UtcNow;
+		public string Error { get; set; }
+
+		public static string PathIn(string backupsRoot) => Path.Combine(backupsRoot, FileName);
+
+		public static RestoreMarker Read(string backupsRoot)
+		{
+			var path = PathIn(backupsRoot);
+			if (!File.Exists(path))
+				return default;
+			try
+			{
+				return JsonSerializer.Deserialize<RestoreMarker>(File.ReadAllText(path));
+			}
+			catch (JsonException)
+			{
+				return default;
+			}
+		}
+
+		public void Write(string backupsRoot)
+		{
+			Directory.CreateDirectory(backupsRoot);
+			var path = PathIn(backupsRoot);
+			var part = path + ".part";
+			using (var file = new FileStream(part, FileMode.Create, FileAccess.Write))
+			{
+				JsonSerializer.Serialize(file, this);
+				file.Flush(flushToDisk: true);
+			}
+			File.Move(part, path, overwrite: true);
+		}
+
+		public static void Clear(string backupsRoot)
+		{
+			var path = PathIn(backupsRoot);
+			if (File.Exists(path))
+				File.Delete(path);
+		}
+	}
+}