A backup is restored at boot, and never undoes a protective act

PrivaPub admin restore <id> (and soon the administrator's page) checks the backup (same host, a format and newest
migration this build reads, every hash) and writes restore.json; the running service sees it within seconds and stops,
and the next start restores it in MaintenanceGate, before migrations, indexes and hosted services: a pre-restore backup
taken once, every collection dropped and imported raw with its indexes, the media the live directory lacks brought
back, then the protective merge from the pre-restore backup. Followers and follows are the live ones; blocks, mutes,
domain blocks, reserved names, tombstones, reports, filters and OAuth applications are the union; deletions win;
accounts made since become tombstones and local posts made since answer 410; every session ends.

Each attempt redoes everything; one refused before any change is abandoned and recorded, one failed midway exits 1 for
systemd to retry, and after three it exits 75, which the unit no longer restarts. Commands wait (exit 75) while a
restore is pending. RestoreRecord tells what happened (admin restore --status).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

tools/pasture/lib/pasture.sh

@@ -29,7 +29,8 @@ pasture_base_up() {
 	caddy_up
 	local extra=()
 	for setting in ${PRIVAPUB_ENV:-}; do extra+=(-e "$setting"); done
-	podman run -d --replace --name pasture-privapub --network $net -p "127.0.0.1:$port:80" \
+	# --restart=always, as systemd's unit: a restore asked for stops PrivaPub, and the next start carries it out
+	podman run -d --replace --restart=always --name pasture-privapub --network $net -p "127.0.0.1:$port:80" \
 		--sysctl net.ipv4.ip_unprivileged_port_start=0 -e ASPNETCORE_ENVIRONMENT=Pasture "${extra[@]}" -w /app -v "$publish:/app:Z,ro" \
 		-v pasture-privapub-media:/tmp/privapub-media \
 		mcr.microsoft.com/dotnet/runtime-deps:10.0 /app/PrivaPub >/dev/null