Third, independent recovery layer for keep-mode upgrades (Part of #791). PR1's
manifest keeps the sync out of operator paths and the ephemeral /tmp snapshot
rolls back a mid-write crash; this adds the case neither covers — a "successful"
upgrade that a manifest/logic bug silently let touch an operator file.
- install.sh make_durable_snapshot(): before any mutation, copy the operator-owned
surface that exists to $XDG_STATE_HOME/mosaic/backups/pre-update-<UTC-ts>/
(0700 dirs / 0600 files, umask 077 scoped + restored). Fail-open; retention
MOSAIC_BACKUP_RETENTION (default 5).
- install.sh verify_operator_surface(): post-sync, restore any operator file the
upgrade diverged/removed and warn loudly (a divergence = manifest bug). Honors
intentional migration removals; refuses to restore through a symlink (CWE-59);
guards mkdir under set -e.
- mosaic restore (TS): --list (default dry-run), --from <ts> confirmation-gated
restore. Strict timestamp selector (CWE-22), O_NOFOLLOW 0600 writes (CWE-59),
containment + managed-dir checks via secure-file.ts. Counts/paths only — never
emits file contents (secrev).
- Gates: typecheck/lint/format ✓; mosaic vitest 1252; restore.spec 30;
bash gates durable-snapshot 41 / manifest-guard 193 / rollback 28 / migration 21.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
8bee1b65ea