A backup is restored at boot, and never undoes a protective act

PrivaPub admin restore <id> (and soon the administrator's page) checks the backup (same host, a format and newest
migration this build reads, every hash) and writes restore.json; the running service sees it within seconds and stops,
and the next start restores it in MaintenanceGate, before migrations, indexes and hosted services: a pre-restore backup
taken once, every collection dropped and imported raw with its indexes, the media the live directory lacks brought
back, then the protective merge from the pre-restore backup. Followers and follows are the live ones; blocks, mutes,
domain blocks, reserved names, tombstones, reports, filters and OAuth applications are the union; deletions win;
accounts made since become tombstones and local posts made since answer 410; every session ends.

Each attempt redoes everything; one refused before any change is abandoned and recorded, one failed midway exits 1 for
systemd to retry, and after three it exits 75, which the unit no longer restarts. Commands wait (exit 75) while a
restore is pending. RestoreRecord tells what happened (admin restore --status).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

CLAUDE.md

@@ -504,6 +504,28 @@ group www-data and reaches the private mongod; `sudo -u www-data` works too.
   rotation keeps 7 daily and 4 weekly nightly backups, 3 pre-deploy, 3 pre-restore, and manual and uploaded ones until
   deleted. CLI: `PrivaPub admin backup [--kind manual|pre-deploy] [--db-only]`, `admin backups`, `admin backup verify
   <id>`; these run before migrations, so the deploy's backup is of the database as the live build left it.
+- **Restores** (`ServerRestore`, `ProtectiveMerge`; owner decision 2026-10-07). Asking (`PrivaPub admin restore <id>`, or
+  the administrator's page) checks the backup (same host, a format and newest migration this build reads, every hash)
+  and writes `restore.json` in the backups' root; the running service sees it within seconds (`RestoreWatcher`) and
+  stops, and systemd starts it again. `MaintenanceGate` (in `Program`, right after the build, before migrations, indexes
+  and hosted services) carries it out:
+  1. a pre-restore backup P, taken once (a retry reuses it, never a half-restored database);
+  2. every collection the backup holds dropped and imported raw with its indexes, every other one dropped, except what a
+     backup never holds, which stays as it is;
+  3. media files the live directory lacks linked back from the backup (or moved from the trash); a restore deletes no file;
+  4. **the protective merge from P: a restore never undoes a protective act.** Followers and follows are P's; blocks,
+     mutes, domain blocks, being blocked, reserved names, `DeletedObject`, reports, filters and OAuth applications are
+     the union, P's row winning; roots, personas, groups, posts and remote accounts deleted since are deleted again, with
+     what their deletion takes away; P's moderation of a persona and a root's password, e-mail, ban and policies stay;
+     roots, personas and groups made since become tombstones (deleted, names kept), local posts made since answer 410,
+     media made or trashed since go to the trash;
+  5. every session ends (a new `SessionStamp` for each root, persona tokens deleted), circuits close, and a
+     `RestoreRecord` (never in a backup) tells what happened (`admin restore --status`).
+
+  Each attempt redoes everything. Refused before anything changed, it is abandoned and recorded, and the server boots as
+  it was; failed midway, the process exits 1 and the next start tries again; after 3 failures it exits 75, which the
+  unit's `RestartPreventExitStatus` leaves down for someone to look. While `restore.json` exists, commands exit 75 (but
+  `admin restore --status`) and the deploy refuses to run.
 
 ## Code style