From 7c08a10621cb9eb08b7c60ad666f41ebb8047632 Mon Sep 17 00:00:00 2001
From: Dillard Blom <dillard.blom@ensembia.com>
Date: Thu, 8 Oct 2026 00:40:48 +0200
Subject: [PATCH 1/8] Locations: ask for password confirmation before adding

addTarget requires a recent password confirmation, but the form never
asked for one. Within 30 minutes of logging in that went unnoticed; after
that, adding a location failed with a bare 403.
---
 CHANGELOG.md                 | 6 ++++++
 src/components/Locations.vue | 1 +
 2 files changed, 7 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8e3938..d6af94c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ the app store accepts a `-beta` suffix, but Nextcloud servers then only offer th
 beta/daily update channel, which would hide the app from most admins. The stability stage is
 instead carried by the app description, the git tag, the release, and this file.
 
+## [Unreleased]
+
+### Fixed
+- Adding a backup location in the web interface failed with "Request failed with status code 403"
+  when the login was more than 30 minutes old: the form did not ask for password confirmation.
+
 ## [0.9.1-beta.2] - 2026-10-07
 
 Second beta, the first release in the Nextcloud app store (signed).
diff --git a/src/components/Locations.vue b/src/components/Locations.vue
index 1b23cf3..2131c7c 100644
--- a/src/components/Locations.vue
+++ b/src/components/Locations.vue
@@ -104,6 +104,7 @@ async function add() {
 	busy.value = true
 	error.value = ''
 	try {
+		await confirmPassword()
 		await api.addTarget({ name: form.name, backend: backend.value.id, auth: auth.value.id, options: form.options, path: form.path,
 			maxGb: form.maxGb === '' ? null : Number(form.maxGb) })
 		adding.value = false

From 972a52e66596cbc73d2d425433ddef6e403d2e24 Mon Sep 17 00:00:00 2001
From: Dillard Blom <dillard.blom@ensembia.com>
Date: Wed, 7 Oct 2026 23:56:28 +0200
Subject: [PATCH 2/8] Settings: align the tabs with the sections

The tabs had no inline margin, so they sat against the edge while every
NcSettingsSection is inset by 7 grid baselines.
---
 CHANGELOG.md          | 2 ++
 src/AdminSettings.vue | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d6af94c..4bad4d2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,8 @@ instead carried by the app description, the git tag, the release, and this file.
 ### Fixed
 - Adding a backup location in the web interface failed with "Request failed with status code 403"
   when the login was more than 30 minutes old: the form did not ask for password confirmation.
+- Settings page: the "Backup and restore" / "Settings" tabs line up with the sections below them.
+- Backups: the runs table scrolls horizontally on narrow screens instead of running off the page.
 
 ## [0.9.1-beta.2] - 2026-10-07
 
diff --git a/src/AdminSettings.vue b/src/AdminSettings.vue
index 9f0b458..c66dcf7 100644
--- a/src/AdminSettings.vue
+++ b/src/AdminSettings.vue
@@ -82,6 +82,7 @@ onBeforeUnmount(() => clearTimeout(timer))
 .ngb-tabs {
 	display: flex;
 	gap: 8px;
-	margin: 0 0 12px;
+	/* Same inline margin as NcSettingsSection, so the tabs line up with the section content */
+	margin: 0 calc(var(--default-grid-baseline) * 7) 12px;
 }
 </style>

From 695d972785ab6e14a78a08d16bf9bbd9ea1a74e0 Mon Sep 17 00:00:00 2001
From: Dillard Blom <dillard.blom@ensembia.com>
Date: Wed, 7 Oct 2026 23:56:28 +0200
Subject: [PATCH 3/8] Backups: let the runs table scroll on narrow screens

The table could not shrink below its content width and ran off the page,
cutting off the last columns; wrap it in an overflow-x container.
---
 src/components/Backups.vue | 51 ++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 24 deletions(-)

diff --git a/src/components/Backups.vue b/src/components/Backups.vue
index 9baf14f..3a09a28 100644
--- a/src/components/Backups.vue
+++ b/src/components/Backups.vue
@@ -30,30 +30,32 @@
 			</div>
 		</template>
 
-		<table v-if="status.runs.length" class="ngb-table">
-			<thead>
-				<tr>
-					<th>{{ t('ng_backup', 'Started') }}</th>
-					<th>{{ t('ng_backup', 'Location') }}</th>
-					<th>{{ t('ng_backup', 'Kind') }}</th>
-					<th>{{ t('ng_backup', 'Restore point') }}</th>
-					<th>{{ t('ng_backup', 'Status') }}</th>
-					<th>{{ t('ng_backup', 'Files') }}</th>
-					<th>{{ t('ng_backup', 'Uploaded') }}</th>
-				</tr>
-			</thead>
-			<tbody>
-				<tr v-for="run in status.runs" :key="run.id" :title="run.error || ''">
-					<td>{{ new Date(run.startedAt * 1000).toLocaleString() }}</td>
-					<td>{{ targetName(run.targetId) }}</td>
-					<td>{{ run.kind }}</td>
-					<td>{{ run.snapshot ? new Date(run.snapshot.createdAt * 1000).toLocaleString() + (run.snapshot.label ? ' – ' + run.snapshot.label : '') : '' }}</td>
-					<td :class="'ngb-' + run.status">{{ run.status }}{{ run.status === 'running' ? ' (' + run.phase + ')' : '' }}{{ run.error ? ': ' + run.error : '' }}</td>
-					<td>{{ run.stats?.files?.files ?? run.stats?.restored ?? '' }}</td>
-					<td>{{ run.stats?.files ? formatSize(run.stats.files.uploaded) : '' }}</td>
-				</tr>
-			</tbody>
-		</table>
+		<div v-if="status.runs.length" class="ngb-table-wrap">
+			<table class="ngb-table">
+				<thead>
+					<tr>
+						<th>{{ t('ng_backup', 'Started') }}</th>
+						<th>{{ t('ng_backup', 'Location') }}</th>
+						<th>{{ t('ng_backup', 'Kind') }}</th>
+						<th>{{ t('ng_backup', 'Restore point') }}</th>
+						<th>{{ t('ng_backup', 'Status') }}</th>
+						<th>{{ t('ng_backup', 'Files') }}</th>
+						<th>{{ t('ng_backup', 'Uploaded') }}</th>
+					</tr>
+				</thead>
+				<tbody>
+					<tr v-for="run in status.runs" :key="run.id" :title="run.error || ''">
+						<td>{{ new Date(run.startedAt * 1000).toLocaleString() }}</td>
+						<td>{{ targetName(run.targetId) }}</td>
+						<td>{{ run.kind }}</td>
+						<td>{{ run.snapshot ? new Date(run.snapshot.createdAt * 1000).toLocaleString() + (run.snapshot.label ? ' – ' + run.snapshot.label : '') : '' }}</td>
+						<td :class="'ngb-' + run.status">{{ run.status }}{{ run.status === 'running' ? ' (' + run.phase + ')' : '' }}{{ run.error ? ': ' + run.error : '' }}</td>
+						<td>{{ run.stats?.files?.files ?? run.stats?.restored ?? '' }}</td>
+						<td>{{ run.stats?.files ? formatSize(run.stats.files.uploaded) : '' }}</td>
+					</tr>
+				</tbody>
+			</table>
+		</div>
 	</NcSettingsSection>
 </template>
 
@@ -126,6 +128,7 @@ async function saveSchedule() {
 <style scoped>
 .ngb-row { display: flex; gap: 8px; align-items: flex-end; flex-wrap: wrap; margin-bottom: 12px; }
 .ngb-time { max-width: 260px; }
+.ngb-table-wrap { overflow-x: auto; }
 .ngb-table { width: 100%; border-collapse: collapse; }
 .ngb-table th, .ngb-table td { text-align: start; padding: 4px 8px; border-bottom: 1px solid var(--color-border); }
 .ngb-failed { color: var(--color-error-text); }

From fe7ad9b4b505f4268c51abd9d8d65ff78276af9e Mon Sep 17 00:00:00 2001
From: Dillard Blom <dillard.blom@ensembia.com>
Date: Thu, 8 Oct 2026 00:53:31 +0200
Subject: [PATCH 4/8] Verify: report read errors as unreadable, not as
 corrupted

verifyBlob() caught every exception from loading a blob and counted it as
a failed (corrupted or tampered) blob, so a transient network error during
a deep verify over WebDAV looked like data corruption. Read the range
separately, retry it, and report a read that keeps failing as unreadable
with its error; only a blob that was read but does not decrypt or match
its id counts as failed.
---
 CHANGELOG.md                         |  5 +++
 lib/Command/Verify.php               |  7 ++-
 lib/Repository/Repository.php        | 38 +++++++++++++---
 lib/Service/VerifyService.php        |  4 +-
 tests/Unit/Repository/VerifyTest.php | 67 ++++++++++++++++++++++++++++
 5 files changed, 111 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4bad4d2..83ce08c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,11 @@ instead carried by the app description, the git tag, the release, and this file.
   when the login was more than 30 minutes old: the form did not ask for password confirmation.
 - Settings page: the "Backup and restore" / "Settings" tabs line up with the sections below them.
 - Backups: the runs table scrolls horizontally on narrow screens instead of running off the page.
+- `occ backup:verify --deep`: a blob that could not be read (network or storage error) was reported
+  as "corrupted or tampered". Reads are now retried, and a read that keeps failing is reported
+  separately as unreadable, with the error; only a blob that was read but fails decryption or its
+  hash check counts as corrupted. Found on a Hetzner Storage Box over WebDAV, where the blob
+  turned out to be intact.
 
 ## [0.9.1-beta.2] - 2026-10-07
 
diff --git a/lib/Command/Verify.php b/lib/Command/Verify.php
index a9d1a7c..148f476 100644
--- a/lib/Command/Verify.php
+++ b/lib/Command/Verify.php
@@ -66,7 +66,12 @@ HELP);
 		if ($result['failed'] !== []) {
 			$output->writeln('<error>' . count($result['failed']) . ' blob(s) failed verification (corrupted or tampered):</error> ' . implode(', ', $result['failed']));
 		}
-		if ($result['missing'] === [] && $result['failed'] === []) {
+		if ($result['unreadable'] !== []) {
+			$output->writeln('<error>' . count($result['unreadable']) . ' blob(s) could not be read from the location</error> (storage or network error, '
+				. 'not a sign of corruption; run the check again): ' . implode(', ', $result['unreadable']));
+			$output->writeln('Last read error: ' . $result['readError']);
+		}
+		if ($result['missing'] === [] && $result['failed'] === [] && $result['unreadable'] === []) {
 			$output->writeln('<info>OK</info>');
 			return 0;
 		}
diff --git a/lib/Repository/Repository.php b/lib/Repository/Repository.php
index b312d30..be0b35d 100644
--- a/lib/Repository/Repository.php
+++ b/lib/Repository/Repository.php
@@ -28,6 +28,8 @@ final class Repository {
 	public const FORMAT = 1;
 	public const BLOB_SIZE = 4 * 1048576;
 	private const FLAG_DEFLATE = 1;
+	/** Reads per blob in a deep verify before it is reported as unreadable (not corrupted). */
+	private const VERIFY_READ_ATTEMPTS = 3;
 
 	private StreamCipher $cipher;
 	private BlobIndex $index;
@@ -696,8 +698,13 @@ final class Repository {
 	}
 
 	private function loadBlob(string $id): string {
-		[$pack, $offset, $length, $raw, $flags] = $this->index->get($id);
-		$encrypted = $this->backend->getRange('packs/' . substr($pack, 0, 2) . '/' . $pack, $offset, $length);
+		[$pack, $offset, $length] = $this->index->get($id);
+		return $this->decodeBlob($id, $this->backend->getRange('packs/' . substr($pack, 0, 2) . '/' . $pack, $offset, $length));
+	}
+
+	/** Decrypts and checks a blob read from its pack; throws when it is corrupted or tampered with. */
+	private function decodeBlob(string $id, string $encrypted): string {
+		[, , , $raw, $flags] = $this->index->get($id);
 		$payload = $this->cipher->decryptString($encrypted, 'blob:' . $id);
 		$data = ($flags & self::FLAG_DEFLATE) ? gzinflate($payload) : $payload;
 		if ($data === false || strlen($data) !== $raw || $this->keys->blobId($data) !== $id) {
@@ -733,13 +740,13 @@ final class Repository {
 	 *
 	 * @param ?callable $heartbeat called after every blob (shallow) or every blob read (deep);
 	 *        callers use it to keep a time-boxed lease alive during a large audit
-	 * @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>}
+	 * @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string}
 	 */
 	public function verify(string $snapshotId, bool $deep = false, ?callable $heartbeat = null): array {
 		$heartbeat ??= static function (): void {
 		};
 		$this->index->load(true);
-		$stats = ['filesChecked' => 0, 'blobsChecked' => 0, 'bytesChecked' => 0, 'missing' => [], 'failed' => []];
+		$stats = ['filesChecked' => 0, 'blobsChecked' => 0, 'bytesChecked' => 0, 'missing' => [], 'failed' => [], 'unreadable' => [], 'readError' => ''];
 		$seen = [];
 		$packSeen = []; // pack id => exists on the backend; avoids one exists() call per blob
 		foreach ($this->streamEntries($snapshotId) as $entry) {
@@ -778,7 +785,7 @@ final class Repository {
 	 * Same checks as verify(), for a user export: every blob its manifest references must be in
 	 * the freshly re-authenticated index with its pack present; $deep also decrypts each.
 	 *
-	 * @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>}
+	 * @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string}
 	 */
 	public function verifyUserExport(string $manifestPath, bool $deep = false, ?callable $heartbeat = null): array {
 		if (!$this->isRecordedUserExport($manifestPath)) {
@@ -787,7 +794,7 @@ final class Repository {
 		$heartbeat ??= static function (): void {
 		};
 		$this->index->load(true);
-		$stats = ['filesChecked' => 0, 'blobsChecked' => 0, 'bytesChecked' => 0, 'missing' => [], 'failed' => []];
+		$stats = ['filesChecked' => 0, 'blobsChecked' => 0, 'bytesChecked' => 0, 'missing' => [], 'failed' => [], 'unreadable' => [], 'readError' => ''];
 		$seen = [];
 		$packSeen = [];
 		$manifest = json_decode($this->getObject($manifestPath), true, 512, JSON_THROW_ON_ERROR);
@@ -824,8 +831,25 @@ final class Repository {
 		if (!$deep) {
 			return;
 		}
+		// Reading and checking are kept apart: a read that fails (network, storage) says
+		// nothing about the stored data, so it is retried and reported as unreadable,
+		// never as corrupted. Only a blob that was read but does not decrypt or match
+		// its id counts as failed.
+		[, $offset, $length] = $this->index->get($id);
+		$encrypted = null;
+		for ($attempt = 1; $attempt <= self::VERIFY_READ_ATTEMPTS && $encrypted === null; $attempt++) {
+			try {
+				$encrypted = $this->backend->getRange('packs/' . substr($pack, 0, 2) . '/' . $pack, $offset, $length);
+			} catch (\Throwable $e) {
+				$stats['readError'] = $e->getMessage();
+			}
+		}
+		if ($encrypted === null) {
+			$stats['unreadable'][] = $id;
+			return;
+		}
 		try {
-			$stats['bytesChecked'] += strlen($this->loadBlob($id));
+			$stats['bytesChecked'] += strlen($this->decodeBlob($id, $encrypted));
 		} catch (\Throwable) {
 			$stats['failed'][] = $id;
 		}
diff --git a/lib/Service/VerifyService.php b/lib/Service/VerifyService.php
index bef188e..fcfd68e 100644
--- a/lib/Service/VerifyService.php
+++ b/lib/Service/VerifyService.php
@@ -18,12 +18,12 @@ final class VerifyService {
 	) {
 	}
 
-	/** @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>} */
+	/** @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string} */
 	public function verify(Target $target, string $snapshotId, bool $deep = false): array {
 		return $this->run($target, $deep, fn (\OCA\NgBackup\Repository\Repository $repo, callable $heartbeat): array => $repo->verify($snapshotId, $deep, $heartbeat));
 	}
 
-	/** @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>} */
+	/** @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string} */
 	public function verifyUserExport(Target $target, string $manifestPath, bool $deep = false): array {
 		return $this->run($target, $deep, fn (\OCA\NgBackup\Repository\Repository $repo, callable $heartbeat): array => $repo->verifyUserExport($manifestPath, $deep, $heartbeat));
 	}
diff --git a/tests/Unit/Repository/VerifyTest.php b/tests/Unit/Repository/VerifyTest.php
index 7b9ed77..88057e6 100644
--- a/tests/Unit/Repository/VerifyTest.php
+++ b/tests/Unit/Repository/VerifyTest.php
@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace OCA\NgBackup\Tests\Unit\Repository;
 
+use OCA\NgBackup\Backend\BackendException;
+use OCA\NgBackup\Backend\IBackend;
 use OCA\NgBackup\Backend\LocalBackend;
 use OCA\NgBackup\Crypto\KeyRing;
 use OCA\NgBackup\Repository\Repository;
@@ -92,4 +94,69 @@ class VerifyTest extends TestCase {
 
 		$this->assertNotSame([], $result['failed']);
 	}
+
+	public function testDeepVerifyRetriesAReadThatFailsOnce(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$flaky = new FlakyRangeBackend($this->backend, failures: 1);
+
+		$result = Repository::openWithKey($flaky, $this->keys, null, null)->verify($s['snapshot'], deep: true);
+
+		$this->assertSame(200000, $result['bytesChecked']);
+		$this->assertSame([], $result['failed']);
+		$this->assertSame([], $result['unreadable']);
+	}
+
+	public function testDeepVerifyReportsAPersistentReadErrorAsUnreadableNotCorrupted(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$broken = new FlakyRangeBackend($this->backend, failures: PHP_INT_MAX);
+
+		$result = Repository::openWithKey($broken, $this->keys, null, null)->verify($s['snapshot'], deep: true);
+
+		$this->assertSame([], $result['failed']);
+		$this->assertNotSame([], $result['unreadable']);
+		$this->assertSame('connection reset', $result['readError']);
+	}
+}
+
+/** Delegates to a real backend, but getRange() throws for the first $failures calls. */
+final class FlakyRangeBackend implements IBackend {
+	public function __construct(
+		private IBackend $inner,
+		private int $failures,
+	) {
+	}
+
+	public function put(string $path, $stream): void {
+		$this->inner->put($path, $stream);
+	}
+
+	public function get(string $path) {
+		return $this->inner->get($path);
+	}
+
+	public function getRange(string $path, int $offset, int $length): string {
+		if ($this->failures > 0) {
+			$this->failures--;
+			throw new BackendException('connection reset');
+		}
+		return $this->inner->getRange($path, $offset, $length);
+	}
+
+	public function exists(string $path): bool {
+		return $this->inner->exists($path);
+	}
+
+	public function move(string $from, string $to): void {
+		$this->inner->move($from, $to);
+	}
+
+	public function list(string $prefix): array {
+		return $this->inner->list($prefix);
+	}
+
+	public function delete(string $path): void {
+		$this->inner->delete($path);
+	}
 }

From b1d4f6a469c1526694c13555bb16205b81f2e185 Mon Sep 17 00:00:00 2001
From: Dillard Blom <dillard.blom@ensembia.com>
Date: Thu, 8 Oct 2026 01:00:46 +0200
Subject: [PATCH 5/8] README: Hetzner Storage Box over WebDAV and SMB

Tested both on sub-accounts: works end to end; WebDAV needs an existing
root, SMB needs port 445 and the smbclient extension; fixed cost per run
and slow deep verify over remote storage.
---
 README.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/README.md b/README.md
index 5984046..7bd8c75 100644
--- a/README.md
+++ b/README.md
@@ -126,6 +126,18 @@ Contributions welcome via PR — add what you ran into with your own provider.
   verified whether this also applies to a Hetzner Storage Box **main** account (only tested with a
   sub-account so far) — if you've tried a main account, please say so in a PR.
 
+- **Hetzner Storage Box over WebDAV and SMB (sub-accounts, 2026-10-07):** both work end to end
+  (backup, incremental run, restore of a folder, verify), tested from outside the Hetzner network
+  with about 66 MiB of data. WebDAV: host `https://uXXXXX-subN.your-storagebox.de`, and the `root`
+  must be a folder that already exists (or empty): WebDAV does not create missing parent folders,
+  so a root that doesn't exist yet fails `backup:target:add` with `Sabre\HTTP\ClientHttpException:
+  Conflict`. SMB: share = the sub-account name, port 445 must be reachable from your server (it was
+  from a home connection here, but some providers block it), and the `smbclient` PECL extension is
+  required (see the SMB entry below). Both have a noticeable fixed cost per run: an incremental run
+  that uploads nothing took about 20 s over WebDAV and 50 s over SMB. A deep verify is slow over
+  remote storage, since each blob is fetched with its own request (19 minutes for 66 MiB over
+  WebDAV); run it occasionally, not after every backup.
+
 - **FTP, server-dependent absolute-path handling:** files_external's FTP backend always builds
   absolute paths (e.g. `MKD /repo`) for the configured root, never relative ones. `atmoz/sftp`-style
   `vsftpd` test servers (chrooted) can reject that with a generic "create directory operation

From 27eb0b32fc4fa4a0159f359d6fad357ea1a71463 Mon Sep 17 00:00:00 2001
From: Dillard Blom <dillard.blom@ensembia.com>
Date: Thu, 8 Oct 2026 01:00:46 +0200
Subject: [PATCH 6/8] Release 0.9.2-beta.3

---
 CHANGELOG.md     | 8 +++++++-
 README.md        | 2 +-
 appinfo/info.xml | 2 +-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 83ce08c..98d5d67 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,12 @@ the app store accepts a `-beta` suffix, but Nextcloud servers then only offer th
 beta/daily update channel, which would hide the app from most admins. The stability stage is
 instead carried by the app description, the git tag, the release, and this file.
 
-## [Unreleased]
+## [0.9.2-beta.3] - 2026-10-08
+
+Bugfix release.
+
+### Added
+- README: notes on using a Hetzner Storage Box over WebDAV and SMB.
 
 ### Fixed
 - Adding a backup location in the web interface failed with "Request failed with status code 403"
@@ -116,6 +121,7 @@ and not implemented yet.
 - See the "Storage backend experiences" section of the README for provider-specific quirks found
   so far (e.g. Hetzner Storage Box sub-accounts).
 
+[0.9.2-beta.3]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.2-beta.3
 [0.9.1-beta.2]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.1-beta.2
 [0.9.0-beta.1]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.0-beta.1
 [0.1.0-alpha.1]: https://github.com/dillardblom/ng_backup/releases/tag/v0.1.0-alpha.1
diff --git a/README.md b/README.md
index 7bd8c75..43619b9 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ installations and hosted Nextcloud. (Choosing SMB as a storage backend is the on
 see "Storage backend experiences" below — that requirement comes from files_external, not from
 ng_backup, and applies to any Nextcloud app that writes to an SMB share.)
 
-**Status: beta (0.9.1).** Tested thoroughly, usable alongside your current backup, but not yet a
+**Status: beta (0.9.2).** Tested thoroughly, usable alongside your current backup, but not yet a
 drop-in replacement for it. See "Known limitations" below, `PLAN.md` for the design and
 `docs/HOWTO.md` for a step-by-step guide from setup to a tested restore.
 
diff --git a/appinfo/info.xml b/appinfo/info.xml
index fce3237..14e41ff 100644
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -9,7 +9,7 @@ directory to S3, SFTP, WebDAV, FTP, SMB or a local path, with restore of files a
 single users (via user_migration) and of the whole server onto a fresh installation. Tested
 thoroughly and usable alongside your current backup, but not yet a drop-in replacement for it.
 See the README for known limitations and the recovery kit before relying on it.]]></description>
-    <version>0.9.1</version>
+    <version>0.9.2</version>
     <licence>agpl</licence>
     <author>Dillard Blom</author>
     <namespace>NgBackup</namespace>

From f415bab5195a24b8ce5a837a0538770d2ba87029 Mon Sep 17 00:00:00 2001
From: Dillard Blom <dillard.blom@ensembia.com>
Date: Thu, 8 Oct 2026 01:11:21 +0200
Subject: [PATCH 7/8] Verify, README: address review notes

An unreadable blob may still be a truncated pack, so don't rule out damage
in the verify message; README: Hetzner needs WebDAV/SMB and external
reachability enabled for the sub-account.
---
 CHANGELOG.md                  | 3 ++-
 README.md                     | 4 +++-
 lib/Command/Verify.php        | 5 +++--
 lib/Repository/Repository.php | 8 ++++----
 4 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 98d5d67..34f51d0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,7 +21,8 @@ Bugfix release.
 - Backups: the runs table scrolls horizontally on narrow screens instead of running off the page.
 - `occ backup:verify --deep`: a blob that could not be read (network or storage error) was reported
   as "corrupted or tampered". Reads are now retried, and a read that keeps failing is reported
-  separately as unreadable, with the error; only a blob that was read but fails decryption or its
+  separately as unreadable, with the error (run the check again; if the same blobs stay unreadable,
+  their pack may be damaged or truncated). Only a blob that was read but fails decryption or its
   hash check counts as corrupted. Found on a Hetzner Storage Box over WebDAV, where the blob
   turned out to be intact.
 
diff --git a/README.md b/README.md
index 43619b9..d7691f3 100644
--- a/README.md
+++ b/README.md
@@ -128,7 +128,9 @@ Contributions welcome via PR — add what you ran into with your own provider.
 
 - **Hetzner Storage Box over WebDAV and SMB (sub-accounts, 2026-10-07):** both work end to end
   (backup, incremental run, restore of a folder, verify), tested from outside the Hetzner network
-  with about 66 MiB of data. WebDAV: host `https://uXXXXX-subN.your-storagebox.de`, and the `root`
+  with about 66 MiB of data. In the Hetzner Console, enable WebDAV or SMB support for the
+  sub-account, and "External reachability" when your server is not in the Hetzner network.
+  WebDAV: host `https://uXXXXX-subN.your-storagebox.de`, and the `root`
   must be a folder that already exists (or empty): WebDAV does not create missing parent folders,
   so a root that doesn't exist yet fails `backup:target:add` with `Sabre\HTTP\ClientHttpException:
   Conflict`. SMB: share = the sub-account name, port 445 must be reachable from your server (it was
diff --git a/lib/Command/Verify.php b/lib/Command/Verify.php
index 148f476..37997ab 100644
--- a/lib/Command/Verify.php
+++ b/lib/Command/Verify.php
@@ -67,8 +67,9 @@ HELP);
 			$output->writeln('<error>' . count($result['failed']) . ' blob(s) failed verification (corrupted or tampered):</error> ' . implode(', ', $result['failed']));
 		}
 		if ($result['unreadable'] !== []) {
-			$output->writeln('<error>' . count($result['unreadable']) . ' blob(s) could not be read from the location</error> (storage or network error, '
-				. 'not a sign of corruption; run the check again): ' . implode(', ', $result['unreadable']));
+			$output->writeln('<error>' . count($result['unreadable']) . ' blob(s) could not be read from the location</error> (often a temporary storage '
+				. 'or network error: run the check again; if the same blobs stay unreadable, their pack may be damaged or truncated): '
+				. implode(', ', $result['unreadable']));
 			$output->writeln('Last read error: ' . $result['readError']);
 		}
 		if ($result['missing'] === [] && $result['failed'] === [] && $result['unreadable'] === []) {
diff --git a/lib/Repository/Repository.php b/lib/Repository/Repository.php
index be0b35d..f45a4e2 100644
--- a/lib/Repository/Repository.php
+++ b/lib/Repository/Repository.php
@@ -831,10 +831,10 @@ final class Repository {
 		if (!$deep) {
 			return;
 		}
-		// Reading and checking are kept apart: a read that fails (network, storage) says
-		// nothing about the stored data, so it is retried and reported as unreadable,
-		// never as corrupted. Only a blob that was read but does not decrypt or match
-		// its id counts as failed.
+		// Reading and checking are kept apart: a read that fails is usually a network or
+		// storage error, so it is retried and reported as unreadable (a pack that stays
+		// unreadable may still be truncated). Only a blob that was read but does not
+		// decrypt or match its id counts as failed: that is proof of damage.
 		[, $offset, $length] = $this->index->get($id);
 		$encrypted = null;
 		for ($attempt = 1; $attempt <= self::VERIFY_READ_ATTEMPTS && $encrypted === null; $attempt++) {

From 0b50bb6b8128a878991370d4a8ef81385c837867 Mon Sep 17 00:00:00 2001
From: Dillard Blom <dillard.blom@ensembia.com>
Date: Thu, 8 Oct 2026 01:21:15 +0200
Subject: [PATCH 8/8] Verify: retry storage exceptions only, let programming
 errors surface

Catch \Exception (storage adapters throw their own exception types) instead
of \Throwable, so an \Error such as a TypeError is not retried and reported
as an unreadable blob.
---
 lib/Repository/Repository.php        |  2 +-
 tests/Unit/Repository/VerifyTest.php | 12 +++++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/lib/Repository/Repository.php b/lib/Repository/Repository.php
index f45a4e2..9a383ae 100644
--- a/lib/Repository/Repository.php
+++ b/lib/Repository/Repository.php
@@ -840,7 +840,7 @@ final class Repository {
 		for ($attempt = 1; $attempt <= self::VERIFY_READ_ATTEMPTS && $encrypted === null; $attempt++) {
 			try {
 				$encrypted = $this->backend->getRange('packs/' . substr($pack, 0, 2) . '/' . $pack, $offset, $length);
-			} catch (\Throwable $e) {
+			} catch (\Exception $e) { // storage adapters throw their own exceptions; \Error (a bug) is not retried
 				$stats['readError'] = $e->getMessage();
 			}
 		}
diff --git a/tests/Unit/Repository/VerifyTest.php b/tests/Unit/Repository/VerifyTest.php
index 88057e6..117321f 100644
--- a/tests/Unit/Repository/VerifyTest.php
+++ b/tests/Unit/Repository/VerifyTest.php
@@ -118,6 +118,15 @@ class VerifyTest extends TestCase {
 		$this->assertNotSame([], $result['unreadable']);
 		$this->assertSame('connection reset', $result['readError']);
 	}
+
+	public function testDeepVerifyDoesNotHideAProgrammingError(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$buggy = new FlakyRangeBackend($this->backend, failures: PHP_INT_MAX, error: new \TypeError('bug'));
+
+		$this->expectException(\TypeError::class);
+		Repository::openWithKey($buggy, $this->keys, null, null)->verify($s['snapshot'], deep: true);
+	}
 }
 
 /** Delegates to a real backend, but getRange() throws for the first $failures calls. */
@@ -125,6 +134,7 @@ final class FlakyRangeBackend implements IBackend {
 	public function __construct(
 		private IBackend $inner,
 		private int $failures,
+		private ?\Throwable $error = null,
 	) {
 	}
 
@@ -139,7 +149,7 @@ final class FlakyRangeBackend implements IBackend {
 	public function getRange(string $path, int $offset, int $length): string {
 		if ($this->failures > 0) {
 			$this->failures--;
-			throw new BackendException('connection reset');
+			throw $this->error ?? new BackendException('connection reset');
 		}
 		return $this->inner->getRange($path, $offset, $length);
 	}