A restore on the live pasture: its own scenario, and two fixes it found

tools/pasture/scenarios/restore.sh backs the pasture up from the administrator's endpoint, then alice_restore deletes a
post and makes another, mastouser follows her, she blocks bob_restore and carol_restore is made; the restore, asked for
from the endpoint, keeps every protective act (19 checks). town.sh renew <peer> signs a peer's town accounts in again,
since a restore ends every session.

It found that a backup listed media files already missing when it was made, so verifying it failed and the restore was
refused: a manifest now lists only the files it holds (refusals are cut to five lines). And a local post made after the
backup now comes back as a deleted row, as a deletion leaves it, so it answers 410 and its id is never given again;
DeletedObject holds remote tombstones only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub.Tests/Infrastructure/BackupTests.cs

@@ -158,7 +158,7 @@ namespace PrivaPub.Tests.Infrastructure
 			Assert.Equal("preview", await File.ReadAllTextAsync(Path.Combine(media, "2026", "10", "live-preview.jpg"), Token));
 			Assert.Equal("moving", await File.ReadAllTextAsync(Path.Combine(media, "2026", "10", "moving.jpg"), Token));
 			Assert.False(File.Exists(Path.Combine(media, "2026", "10", "trashed.jpg")));
-			Assert.Equal(["2026/10/gone.jpg", "2026/10/live-preview.jpg", "2026/10/live.jpg", "2026/10/moving.jpg"], backup.Manifest.Media.List);
+			Assert.Equal(["2026/10/live-preview.jpg", "2026/10/live.jpg", "2026/10/moving.jpg"], backup.Manifest.Media.List);
 			Assert.Equal((3, 1), (backup.Manifest.Media.Files, backup.Manifest.Media.Missing));
 
 			// a link, not a copy: the live file deleted, the backup's stays
@@ -168,8 +168,9 @@ namespace PrivaPub.Tests.Infrastructure
 			// db-only lists them and links none
 			var (listed, _) = await ServerBackup.Create(Context(), "pre-deploy", dbOnly: true, Token);
 			Assert.False(Directory.Exists(Path.Combine(Backups, listed.Id, "media")));
-			Assert.Equal(backup.Manifest.Media.List, listed.Manifest.Media.List);
+			Assert.Equal(["2026/10/live-preview.jpg", "2026/10/moving.jpg"], listed.Manifest.Media.List);
 			Assert.Empty(await ServerBackup.Verify(Backups, listed.Id, Token));
+			Assert.Empty(await ServerBackup.Verify(Backups, backup.Id, Token));
 		}
 
 		[Fact]

PrivaPub.Tests/Infrastructure/RestoreTests.cs

@@ -132,7 +132,9 @@ namespace PrivaPub.Tests.Infrastructure
 		{
 			// lost: what was merely made or changed since
 			Assert.Equal("first words", (await One("Post", Id(_editedPost)))["Text"].AsString);
-			Assert.Null(await One("Post", Id(_laterPost)));
+			var later = await One("Post", Id(_laterPost));
+			Assert.False(later["DeletedAt"].IsBsonNull);
+			Assert.True(later["Text"].IsBsonNull);
 			Assert.Empty(await All("PersonaList"));
 			Assert.Equal(16, (await One("_migration_history_", new BsonDocument()))["Number"].ToInt32());
 
@@ -142,9 +144,7 @@ namespace PrivaPub.Tests.Infrastructure
 			Assert.True(deleted["Text"].IsBsonNull);
 			Assert.Null(await One("TimelineEntry", new BsonDocument("PostId", _deletedPost.ToString())));
 			Assert.False((await One("MediaAttachment", Id(_deletedMedia)))["TrashedAt"].IsBsonNull);
-			Assert.NotNull(await One("DeletedObject", new BsonDocument("ObjectURI", Uri(_laterPost))));
-			var later = await One("MediaAttachment", Id(_laterMedia));
-			Assert.Equal("restore: made after the backup", later["TrashReason"].AsString);
+			Assert.Equal("restore: made after the backup", (await One("MediaAttachment", Id(_laterMedia)))["TrashReason"].AsString);
 			Assert.Equal(["https://elsewhere.example/users/came"], (await All("Follower")).Select(f => f["ActorURI"].AsString));
 			Assert.NotNull(await One("Block", new BsonDocument("TargetActorURI", "https://elsewhere.example/users/troll")));
 			Assert.NotNull(await One("DomainBlock", new BsonDocument("Domain", "evil.example")));