Merge pull request #10 : Release 0.9.5-beta.6

SFTP: open the channel first, replace dropped connections; run takeover; index cache in one transaction; faster checks with progress
Test: no random_bytes(0) in the batched SFTP read test
2026-10-12 15:05:59 +02:00 · 2026-10-12 14:59:31 +02:00 · 2026-10-12 14:50:56 +02:00 · 2026-10-12 14:27:39 +02:00 · 2026-10-12 11:32:42 +02:00 · 2026-10-12 01:58:54 +02:00
81 changed files with 6253 additions and 268 deletions
@@ -17,6 +17,8 @@ jobs:
        php: ['8.2', '8.3', '8.4']
    steps:
      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
      - uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php }}
@@ -29,6 +31,8 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
      - uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'
@@ -48,6 +52,8 @@ jobs:
        database: ['sqlite', 'mariadb', 'pgsql']
    steps:
      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
      - name: Round trip on Nextcloud ${{ matrix.nextcloud }} / ${{ matrix.database }}
        run: tests/integration/matrix.sh "${{ matrix.nextcloud }}" "${{ matrix.database }}"

@@ -58,5 +64,43 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
      - name: Round trip against S3 and SFTP
        run: tests/integration/targets-matrix.sh
+
+  integration-user:
+    # Per-user backup/restore via user_migration (occ backup:user:backup / backup:user:restore),
+    # an optional dependency installed from the app store. It calls user_migration's internal
+    # UserMigrationService, whose API can change between Nextcloud versions, so this runs on every
+    # supported version (not the database, which the main integration job already covers).
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        nextcloud: ['32', '33', '34', '35']
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Set up a fresh Nextcloud instance
+        run: |
+          docker run -d --name ngbu -e SQLITE_DATABASE=nextcloud -e NEXTCLOUD_ADMIN_USER=admin \
+            -e NEXTCLOUD_ADMIN_PASSWORD=admin-user-roundtrip -e NEXTCLOUD_TRUSTED_DOMAINS=localhost \
+            -v "$PWD:/var/www/html/custom_apps/ng_backup:ro" nextcloud:${{ matrix.nextcloud }}-apache
+          for i in $(seq 1 90); do docker exec -u www-data ngbu php occ status 2>/dev/null | grep -q "installed: true" && break; sleep 4; done
+          docker exec ngbu chown www-data:www-data /var/www/html/custom_apps
+      - name: Per-user backup/restore round trip on Nextcloud ${{ matrix.nextcloud }}
+        run: tests/integration/user-roundtrip.sh "docker exec -u www-data ngbu" /var/www/html/data
+
+  integration-full-restore:
+    # Disaster recovery (occ backup:restore:full) on a SECOND, fresh Nextcloud instance that
+    # never saw the first one, sharing only the backup location. Does not depend on the database
+    # beyond what the main integration job already covers, so this runs once, on one NC version.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Full restore round trip
+        run: tests/integration/full-restore-roundtrip.sh 35-apache
@@ -2,9 +2,182 @@

 All notable changes to NG Backup are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning follows the stages in
-`PLAN.md` section 9. The `<version>` in `appinfo/info.xml` is plain SemVer-numeric (Nextcloud's
-own `info.xsd` doesn't allow a `-alpha`/`-beta`/`-rc` suffix there); the stability stage is instead
-carried by the git tag, the release, and this file.
+`PLAN.md` section 9. The `<version>` in `appinfo/info.xml` is plain SemVer-numeric on purpose:
+the app store accepts a `-beta` suffix, but Nextcloud servers then only offer the release on the
+beta/daily update channel, which would hide the app from most admins. The stability stage is
+instead carried by the app description, the git tag, the release, and this file.
+
+## [0.9.5-beta.6] - 2026-10-12
+
+Bugfix release for SFTP locations and large repositories. Tested on a production instance with a
+1 TB repository on a Hetzner Storage Box over SFTP: a check in 5.5 minutes, a deep check of all
+316,529 blobs (815 GiB) in 11 hours, and an incremental backup in under 8 minutes.
+
+### Added
+- Progress of a running backup in the web interface and `occ backup:status`, e.g.
+  "running (files) 68%". The total is the size of the previous snapshot; for a first backup it
+  is estimated from Nextcloud's file cache (users' files, versions and trash) and shown as
+  "~68%".
+- Edit a backup location (web interface and `occ backup:target:edit`): change the password, host,
+  folder, connection type or name without losing its history. Before this the only option was a
+  new location, which starts an empty repository and, with a retention lock at the provider,
+  keeps paying for the old one. The new settings are only saved when they lead to the same
+  repository; stored passwords are never sent to the browser, and an empty password field keeps
+  the stored one. Administrators are notified of the change.
+- `occ backup:verify` reports how far it is every 30 seconds, and `occ backup:status` shows the
+  progress of a running check and how the last check of each location ended. On a large
+  repository a check takes hours, a deep one days.
+
+### Changed
+- Checking and opening a large repository over SFTP is much faster: the index files (one per
+  pack, 27,547 for 1 TB) are downloaded 32 at a time instead of one after the other, 114 instead
+  of 6 files per second to a Hetzner Storage Box (about 4 minutes instead of 77 for 1 TB). A check
+  of a repository with more than 256 packs also lists the pack folders (256 requests) instead of
+  asking for every pack.
+- App store listing: the author's e-mail address is shown.
+- App store listing: the homepage link points to the GitHub repository instead of back to the
+  app store page itself.
+- The notification for a location without a successful backup read "No successful backup to …
+  since never" when there had never been one; it now reads "No successful backup to … yet".
+
+### Fixed
+- 0.9.4 could not open a repository at the root of an SFTP location (empty path): its faster
+  SFTP reads sent their first request before phpseclib had opened the SFTP channel, which only
+  happens on the first SFTP call after login. Every backup then failed with "No repository at
+  this location". The channel is now opened first.
+- A check (`occ backup:verify`) did not renew its hold on the location while it downloaded the
+  index; on a large repository that takes longer than the hold lasts, so a weekly cleanup could
+  have started during the check.
+- A long first backup could end as failed although its snapshot was complete: when its final
+  step took longer than the step's lease (150 s with `occ backup:run`), the background job took
+  the run over, finished it a second time and failed on the snapshot it had already recorded,
+  overwriting the result. The lease now lasts at least 15 minutes, a step writes the run only if
+  no other process wrote it since the step loaded it (in one database statement), and recording
+  a snapshot that is already recorded is no longer an error.
+- `occ backup:verify` on a large repository failed with "SFTP connection failed while opening
+  snapshots/…" or "Not found: snapshots/…". A Hetzner Storage Box drops an SFTP connection that
+  carried a lot of data (some 40 MB) and then stayed quiet for a few minutes, and the check went
+  quiet after downloading the index: it refreshed the local index cache, first in 29 minutes (a
+  pass over all blobs for every pack: 27,547 packs, 400,000 blobs for 1 TB), then still in more
+  than 6 minutes (a database transaction per pack on PostgreSQL). Nextcloud's SFTP storage keeps
+  using a dropped connection, on which every file looks missing. Now:
+  - an SFTP connection that was not used for a minute is checked first, and one that turns out
+    to be dead after a failed request is replaced, once per request; uploads, moves and deletes
+    are only checked first, never repeated;
+  - the index cache is written in one transaction (27,547 packs in 11 seconds on a test server,
+    against about a minute row by row);
+  - after a check the cache holds the index files as they are: before, a blob that was in two
+    packs was only cached for one of them.
+
+## [0.9.4-beta.5] - 2026-10-09
+
+Bugfix release: faster restores.
+
+### Fixed
+- Restores and `occ backup:verify --deep` fetched every blob with its own request, so on a
+  remote location they ran far below the speed of the connection. The blobs of a pack are now
+  read from one open stream, in the order they were written. Restoring 86 MB in 202 files from a
+  Hetzner Storage Box over SMB went from 0.78 MB/s to 4.2 MB/s, the speed of reading the packs
+  as plain files over that connection.
+- Reading from an SFTP location waited a full round trip for every 256 KiB, whatever the line
+  speed. Reads now keep up to 8 requests in flight. Restoring 1.97 GB in 500 files from a Hetzner
+  Storage Box (47 ms away) took 694 s before the fix above, 499 s with it and 142 s with both
+  (2.8 → 3.9 → 13.9 MB/s); a full 51 GB restore ran at 13.0 MB/s. When a server error
+  interrupts such a read, it goes on from the same position with Nextcloud's own SFTP stream;
+  after three failing files in a row, or on a Nextcloud whose SFTP library lacks what this needs,
+  only Nextcloud's own stream is used.
+- README: a WebDAV location on a slow upload needs a higher `davstorage.request_timeout`.
+
+## [0.9.3-beta.4] - 2026-10-08
+
+Bugfix release.
+
+### Fixed
+- A backup failed with "cannot execute INSERT in a read-only transaction" on PostgreSQL as soon
+  as the database dump filled a whole pack (32 MiB): the pack's index cache row was written
+  inside the read-only dump transaction. On other databases that row was rolled back silently.
+- Backups to a remote location slowed down as the repository grew: every backup step listed the
+  repository's index with a round trip per file. Over SFTP to a Hetzner Storage Box a 60 GiB
+  repository already lost a large part of each step to it; backing up continuously
+  (`occ backup:run`) went from 45 KiB/s to 5.8 MB/s with the fix.
+
+## [0.9.2-beta.3] - 2026-10-08
+
+Bugfix release.
+
+### Added
+- README: notes on using a Hetzner Storage Box over WebDAV and SMB.
+
+### Fixed
+- Adding a backup location in the web interface failed with "Request failed with status code 403"
+  when the login was more than 30 minutes old: the form did not ask for password confirmation.
+- Settings page: the "Backup and restore" / "Settings" tabs line up with the sections below them.
+- Backups: the runs table scrolls horizontally on narrow screens instead of running off the page.
+- `occ backup:verify --deep`: a blob that could not be read (network or storage error) was reported
+  as "corrupted or tampered". Reads are now retried, and a read that keeps failing is reported
+  separately as unreadable, with the error (run the check again; if the same blobs stay unreadable,
+  their pack may be damaged or truncated). Only a blob that was read but fails decryption or its
+  hash check counts as corrupted. Found on a Hetzner Storage Box over WebDAV, where the blob
+  turned out to be intact.
+
+## [0.9.1-beta.2] - 2026-10-07
+
+Second beta, the first release in the Nextcloud app store (signed).
+
+### Added
+- App store listing: screenshots, website, repository and documentation link in `appinfo/info.xml`.
+
+### Fixed
+- Restore: the "new folder" option showed `"Restored "` without the date pattern.
+- Restore: the restore-point dropdown cut off the time.
+- Settings: the passphrase actions are on one line instead of stacked.
+- `docs/HOWTO.md`: the SFTP example used a non-existent auth mechanism (`sftp::password`
+  instead of `password::password`).
+
+## [0.9.0-beta.1] - 2026-10-07
+
+First beta. Tested thoroughly and usable **alongside** your current backup, but **not yet a
+drop-in replacement** for it. We test what we can ourselves (Nextcloud 32–35, SQLite, MariaDB and
+PostgreSQL, S3, SFTP, FTP, SMB and NFS), but we need field experience from other setups: please
+report what works and what doesn't, especially on large instances and on storage providers not
+listed in the README.
+
+### Added
+- Disaster recovery: `occ backup:key:import` and `occ backup:restore:full` restore the database,
+  data directory and config onto a fresh installation of the same major version.
+- Per-user backup and restore via user_migration: `occ backup:user:backup` and
+  `occ backup:user:restore` (replace the account after a safety export, or restore as
+  `<uid>-bak`), also onto a server where the user does not exist yet. The commands ask before
+  installing user_migration (or take `--install-user-migration`).
+- Checksum audit: `occ backup:verify`, shallow or `--deep`, for snapshots and per-user exports.
+- Retention for per-user exports: `occ backup:retention --user-last=N`.
+- FTP and SMB covered by the integration tests; NFS through the `local` backend on a mounted share.
+- `docs/HOWTO.md`: step by step from setup to a tested restore.
+- Warnings when a backup finishes with unreadable files or folders, or with files that kept
+  changing while being read (log, `occ`, notification, snapshot).
+
+### Changed
+- `backup:restore:full` refuses on an installation with more than one user and asks first;
+  `backup:user:restore --mode=replace` asks before deleting an existing account (`--force` for
+  scripts in both cases).
+- A failed scheduled backup is retried at most three times a day, an hour apart.
+- The recovery kit carries the deletion delay; the kit file is created owner-only.
+- Adding a location through the web API needs password confirmation.
+
+### Fixed
+- Exports of users whose id contains `.part-` could be deleted by cleanup on remote locations.
+- Cleanup no longer frees the data of a per-user export whose manifest is missing.
+- Crash safety of moving snapshots to and from the trash, of catalog writes by concurrent
+  backups and per-user exports, and of short uploads.
+- A file that keeps changing no longer makes a backup restart forever.
+- Long restores and exports keep their lock on the location alive.
+- Floating-point database columns are dumped exactly.
+
+### Known limitations
+See "Known limitations" in the README: memory use on very large instances, never two servers
+writing to one location, removing a passphrase slot does not revoke access, no rollback detection
+before a disaster recovery, and a few smaller points. None of them block the road to 1.0.0; they
+are on the backlog in `PLAN.md`.

 ## [0.1.0-alpha.1] - 2026-10-05

@@ -42,3 +215,11 @@ and not implemented yet.
 - No FTP/SMB coverage in CI yet, and no verification/checksum-audit command yet (phase 2).
 - See the "Storage backend experiences" section of the README for provider-specific quirks found
  so far (e.g. Hetzner Storage Box sub-accounts).
+
+[0.9.5-beta.6]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.5-beta.6
+[0.9.4-beta.5]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.4-beta.5
+[0.9.3-beta.4]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.3-beta.4
+[0.9.2-beta.3]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.2-beta.3
+[0.9.1-beta.2]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.1-beta.2
+[0.9.0-beta.1]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.0-beta.1
+[0.1.0-alpha.1]: https://github.com/dillardblom/ng_backup/releases/tag/v0.1.0-alpha.1
@@ -276,7 +276,7 @@ onderdelen wel en niet terugkomen, op basis van de geregistreerde migrators.
 | `backup:list [--target=]` | herstelpunten |
 | `backup:verify <snapshot> [--deep]` | checksums controleren, optioneel alles ontsleutelen |
 | `backup:restore:file <snapshot> <user> <pad> [--to=]` | bestand/map terugzetten |
-| `backup:restore:user <snapshot> <user> [--to-user=]` | gebruiker terugzetten via user_migration (fase 2) |
+| `backup:user:restore <snapshot> <user> [--to-user=]` | gebruiker terugzetten via user_migration (fase 2) |
 | `backup:restore:full <snapshot>` | volledige restore (fase 2, verse installatie) |
 | `backup:target:add/list/remove/test` | opslagdoelen beheren en testen |
 | `backup:key:export / import` | herstelkit |
@@ -338,6 +338,49 @@ een backup-app die niet betrouwbaar is, is erger dan geen backup-app.
 Volgorde: fase 1 grondig testen, reviewen en debuggen; dan nadenken over 0.1.0-alpha.1. Een
 minimale volledige restore (`occ backup:restore:full` op een verse installatie) komt vóór de beta.

+**Roadmap-indeling fase 2 (besluit 2026-10-05):** naar v1.2.0 toewerken met in fase 2:
+1. `backup:restore:full` (disaster recovery, verse installatie) — **klaar** (2026-10-05)
+2. FTP/SMB-ondersteuning — **klaar** (2026-10-06): beide liepen al via files_external's generieke
+   adapter zonder enige ng_backup-code; alleen testdekking toegevoegd
+   (`tests/integration/targets-matrix.sh`) + bevindingen in README ("Storage backend experiences").
+   SMB vereist de `smbclient` PECL-extensie (niet standaard in de Nextcloud-image, in CI nu
+   on-the-fly gebouwd). NFS is geen eigen backend: lokaal mounten + `local`-backend erop richten.
+3. Verificatie/checksum-audit-commando — **klaar** (2026-10-05)
+4. Retentie/prune voor user-exports — **klaar** (2026-10-06): `occ backup:retention --user-last=N`
+   (standaard 3, per installatie, net als de bestaande snapshot-policy), toegepast door
+   `occ backup:prune` (geen prullenbak voor user-exports, in tegenstelling tot snapshots — on-demand,
+   niet het primaire vangnet).
+5. Automatische user-export in het reguliere schema — **naar backlog** (niet voor deze release; on-demand blijft)
+9. SMB-roundtrip (protocol, niet een specifieke server) — **klaar** (2026-10-06): CI-matrix, 2 GB-roundtrip en
+   user-export via SMB; NFS via de OMV-share getest (`local`-backend op een gemounte share, 2026-10-06)
+10. `backup:user:restore` zonder user_migration: vraagt om toestemming om de app te installeren en te activeren (of
+   `--install-user-migration`) — **klaar** (2026-10-06); waarschuwing over de settings-allowlist — **klaar**;
+   agenda/contacten bij migratie naar een server zonder die gebruiker — **getest** (2026-10-06, naar `migrated-personal`/`migrated-contacts`)
+    Backlog: (a) de originele weergavenaam herstellen (het label uit de export is niet getest als
+    weergavenaam); (b) de interne `migrated-`-naam hernoemen (vereist directe databasewijziging, niet voor de beta).
+
+**Backlog uit de pre-beta review (2026-10-07)** — geen belemmering voor 0.9.0-beta of 1.0.0, staat
+in README "Known limitations":
+1. Geheugen bij grote instanties (>1 TB, miljoenen bestanden): blob-index, prune-set, browse van een
+   snapshot in de web-UI, `trashExtras` bij restore en het manifest van een user-export staan volledig
+   in het geheugen; streaming/paginering nodig.
+2. Twee servers op één locatie: catalogus kan breken (generatie overschreven, of anchor >200 generaties
+   achter). Docs-waarschuwing staat er; mogelijk later een echte put-if-absent per backend.
+3. Sleutelrotatie: een slot verwijderen trekt geen toegang in (master-key blijft gelijk).
+4. Rollback vóór DR niet detecteerbaar: referentie-generatie en -hash in de kit opnemen of tonen.
+5. Kit-velden buiten `wrapped_key` (o.a. `delete_delay_days`) zijn niet geauthenticeerd; nu alleen getoond.
+6. Repository-id in de AD van objecten (formaatwijziging).
+7. Wachtwoorden van locaties via `--option-file` of omgevingsvariabele i.p.v. de commandoregel.
+8. Tijdelijke restore-bestanden niet via de Files-API verwijderen (komen nu in de prullenbak).
+9. DB-restore in foreign-key-volgorde (cascades).
+10. Packs zonder index (index-upload mislukt) opruimen.
+11. `backup:restore:full` in onderhoudsmodus en hervatbaar maken; nu: opnieuw draaien met `--force`.
+12. Config/rename op FTP/SMB-servers die geen rename over een bestaand bestand toestaan.
+
+Doorgeschoven naar **v1.3.0** (fase 3, niet meer fase 2): in-place volledige restore
+(eigen restore-modus i.p.v. onderhoudsmodus) en zelfbediening voor gebruikers (eigen bestanden
+terugzetten vanuit de Files-app).
+
 **Let op (ontdekt 2026-10-05):** Nextcloud's eigen `info.xsd` staat voor `<version>` alleen
 `[0-9]+(\.[0-9]+){0,2}` toe — geen `-alpha`/`-beta`/`-rc`-achtervoegsel. De stabiliteitsaanduiding
 uit deze tabel gaat dus niet in `info.xml` (dat blijft gewoon oplopend, bijv. `0.1.0`), maar in de
@@ -2,10 +2,14 @@

 Encrypted, incremental backups of Nextcloud (database, configuration and data) with restore
 from the web interface. Works without shell access: no external programs, no extra PHP
-extensions beyond sodium. Runs on Nextcloud All-in-One, regular installations and hosted
-Nextcloud.
+extensions beyond sodium for ng_backup itself. Runs on Nextcloud All-in-One, regular
+installations and hosted Nextcloud. (Choosing SMB as a storage backend is the one exception:
+see "Storage backend experiences" below — that requirement comes from files_external, not from
+ng_backup, and applies to any Nextcloud app that writes to an SMB share.)

-**Status: in development (phase 1). Not ready for production use.** See `PLAN.md` for the design.
+**Status: beta (0.9.5).** Tested thoroughly, usable alongside your current backup, but not yet a
+drop-in replacement for it. See "Known limitations" below, `PLAN.md` for the design and
+`docs/HOWTO.md` for a step-by-step guide from setup to a tested restore.

 License: AGPL-3.0-or-later.

@@ -28,7 +32,7 @@ License: AGPL-3.0-or-later.
 occ backup:key:init --label="Safe"                 # first passphrase, deletion delay (default 7 days)
 occ backup:key:slot:add --label="CTO"              # optional second and third passphrase
 occ backup:key:slot:add --label="Head of IT"
-occ backup:key:kit --output=/root/ng_backup-kit.json
+occ backup:key:kit --output=/var/tmp/ng_backup-kit.json
 occ backup:key:confirm
 occ backup:target:add offsite amazons3 -a amazons3::accesskey -o bucket=... -o key=... -o secret=...
 occ backup:run
@@ -59,7 +63,8 @@ All backups of an installation are encrypted with one master key.
  a single slot is possible, but then that one passphrase is a single point of failure.
 - When a holder leaves, give their slot a new passphrase (`occ backup:key:slot:replace`), download
  the new kit and confirm it. Note: an old kit together with the old passphrase still opens the
-  same master key; to revoke it completely, start new locations with a new key.
+  same master key; to revoke it completely, start new locations with a new key. This is noted on
+  the backlog and will be addressed in a future version (key rotation).
 - Downloading the kit, and every change to the slots, requires the administrator's password, is
  written to the audit log and is announced to all administrators.

@@ -104,7 +109,9 @@ What you should do on the location (strongly recommended):
 - **Files and folders** of a user: in the web interface or `occ backup:restore`, into a new folder
  ("Restored <date>"), merged into the original place, or replacing it.
 - **Raw restore** of any path (for example `config/`) to a local directory: `occ backup:restore ... --to-directory=DIR`.
- **Whole server** (disaster recovery onto a fresh installation): planned for phase 2.
+- **Whole server** (disaster recovery onto a fresh installation): `occ backup:restore:full`, see the how-to.
+- **One user** (account, settings, files, calendars, contacts via user_migration): `occ backup:user:backup` and
+  `occ backup:user:restore`, replacing the account or restoring it as `<uid>-bak`. See the how-to.

 ## Storage backend experiences

@@ -119,13 +126,78 @@ Contributions welcome via PR — add what you ran into with your own provider.
  verified whether this also applies to a Hetzner Storage Box **main** account (only tested with a
  sub-account so far) — if you've tried a main account, please say so in a PR.

+- **Hetzner Storage Box over WebDAV and SMB (sub-accounts, 2026-10-07):** both work end to end
+  (backup, incremental run, restore of a folder, verify), tested from outside the Hetzner network
+  with about 66 MiB of data. In the Hetzner Console, enable WebDAV or SMB support for the
+  sub-account, and "External reachability" when your server is not in the Hetzner network.
+  WebDAV: host `https://uXXXXX-subN.your-storagebox.de`, and the `root`
+  must be a folder that already exists (or empty): WebDAV does not create missing parent folders,
+  so a root that doesn't exist yet fails `backup:target:add` with `Sabre\HTTP\ClientHttpException:
+  Conflict`. SMB: share = the sub-account name, port 445 must be reachable from your server (it was
+  from a home connection here, but some providers block it), and the `smbclient` PECL extension is
+  required (see the SMB entry below). Both have a noticeable fixed cost per run: an incremental run
+  that uploads nothing took about 20 s over WebDAV and 50 s over SMB. Over WebDAV, Nextcloud gives
+  every request at most 30 s by default, also an upload of a whole 32 MiB pack: on an upload
+  slower than about 9 Mbit/s a backup fails with `cURL error 28: Operation timed out`. Raise the
+  limit with `occ config:system:set davstorage.request_timeout --value=600 --type=integer`.
+
+- **FTP, server-dependent absolute-path handling:** files_external's FTP backend always builds
+  absolute paths (e.g. `MKD /repo`) for the configured root, never relative ones. `atmoz/sftp`-style
+  `vsftpd` test servers (chrooted) can reject that with a generic "create directory operation
+  failed", even though a plain `ftp_mkdir()` with a *relative* path on the same server succeeds;
+  `pure-ftpd` accepts the absolute form fine. If a working FTP server rejects ng_backup's writes,
+  try a different FTP server implementation before assuming the backend itself is broken.
+
+- **SMB/CIFS *lists* as available with just the `smbclient` CLI binary, but does not actually
+  work for ng_backup without the `smbclient` PECL extension too.** files_external falls back to a
+  shell-wrapped `smbclient` process when the native extension is missing, which registers the
+  backend in `occ backup:target:backends` fine, but that fallback's stream cannot seek. ng_backup
+  reads blobs back by byte range while backing up, so even the very first (small) backup fails
+  with `Seek failed in packs/...`. Install the extension (`libsmbclient-dev` + `pecl install
+  smbclient` + `docker-php-ext-enable smbclient` on Debian-based images), not just the CLI tool —
+  the backend being listed is not proof it will work here. Once the extension is present it works
+  the same as any other backend; no ng_backup-specific config beyond host/share/user/password.
+
+- **NFS is not a files_external backend at all.** Mount the NFS export on the server yourself
+  (e.g. via `/etc/fstab` or a systemd `.mount` unit) and point ng_backup's `local` backend at the
+  mount point; ng_backup never mounts or unmounts anything on its own, so an NFS mount dropping
+  mid-run behaves like any other local-path failure (the run resumes). See PLAN.md 3.5 for why NFS
+  can't be driven from PHP directly.
+
+## Known limitations
+
+On the backlog; none of these block the beta or 1.0.0, but know them before you rely on it:
+
+- **Very large instances** (well over 1 TB, millions of files): the blob index, cleanup, browsing a
+  snapshot in the web interface and per-user export manifests are held in memory. Expect high
+  memory use there; reports from such instances are very welcome.
+- **One location, one server.** Never let two Nextcloud servers write to the same location (for
+  example a disaster recovery test server pointed at the production location): they can break each
+  other's catalog, and the location is then refused as possibly tampered with. Test a disaster
+  recovery against a copy of the location, or only read from it.
+- **Removing a passphrase slot does not revoke access.** The master key stays the same, so someone
+  with an old recovery kit and that slot's passphrase can still decrypt the location if they can
+  read it. Key rotation is not available yet.
+- **Rollback before a disaster recovery is not detected.** A fresh server has no record of the
+  newest catalog generation, so a location rolled back to an older state looks valid there.
+- Location passwords passed with `-o password=...` are visible in the process list and shell
+  history while the command runs.
+- Temporary files of a restore into a user's files end up in that user's trash.
+- Restoring the database does not order tables by foreign keys; apps with cascading foreign keys
+  could lose rows (Nextcloud core does not use them).
+- A pack whose index upload failed stays on the location until removed by hand.
+
 ## Commands

 | Command | Purpose |
 |---|---|
 | `backup:key:init`, `backup:key:kit`, `backup:key:confirm` | create the key, recovery kit, confirmation |
 | `backup:key:slots`, `backup:key:slot:add/replace/remove` | passphrase slots |
-| `backup:target:backends/add/list/remove/append-only` | backup locations |
+| `backup:target:backends/add/edit/list/remove/append-only` | backup locations |
 | `backup:run`, `backup:status`, `backup:list` | back up, status, restore points |
 | `backup:browse`, `backup:restore` | browse and restore |
 | `backup:retention`, `backup:prune`, `backup:trash`, `backup:trash:restore` | retention, cleanup, trash |
+| `backup:verify` | checksum audit of a restore point (`--deep` downloads and decrypts everything) |
+| `backup:restore:full` | whole-server restore onto a fresh installation (after `backup:key:import`) |
+| `backup:key:import` | import a recovery kit on a fresh installation |
+| `backup:user:backup`, `backup:user:restore` | one user via user_migration (asks before installing it) |
@@ -4,17 +4,25 @@
    <id>ng_backup</id>
    <name>NG Backup</name>
    <summary>Encrypted, incremental backups of your Nextcloud with restore from the web interface</summary>
-    <description><![CDATA[Alpha: feature-complete for scheduled, encrypted, incremental backups to
-S3/SFTP/WebDAV/local, with restore of files and folders from the web interface and occ. Meant for
-testing on a copy of production (dev, test, staging) -- not yet for production use, and full
-disaster recovery is not implemented yet. See the recovery kit section of the README before
-relying on this for anything.]]></description>
-    <version>0.1.0</version>
+    <description><![CDATA[Beta: scheduled, encrypted, incremental backups of the database, config and data
+directory to S3, SFTP, WebDAV, FTP, SMB or a local path, with restore of files and folders, of
+single users (via user_migration) and of the whole server onto a fresh installation. Tested
+thoroughly and usable alongside your current backup, but not yet a drop-in replacement for it.
+See the README for known limitations and the recovery kit before relying on it.]]></description>
+    <version>0.9.5</version>
    <licence>agpl</licence>
-    <author>Dillard Blom</author>
+    <author mail="dillard.blom@ensembia.com">Dillard Blom</author>
    <namespace>NgBackup</namespace>
+    <documentation>
+        <admin>https://github.com/dillardblom/ng_backup/blob/main/docs/HOWTO.md</admin>
+    </documentation>
    <category>tools</category>
+    <website>https://github.com/dillardblom/ng_backup</website>
    <bugs>https://github.com/dillardblom/ng_backup/issues</bugs>
+    <repository type="git">https://github.com/dillardblom/ng_backup</repository>
+    <screenshot>https://raw.githubusercontent.com/dillardblom/ng_backup/main/screenshots/1-backups.png</screenshot>
+    <screenshot>https://raw.githubusercontent.com/dillardblom/ng_backup/main/screenshots/2-restore.png</screenshot>
+    <screenshot>https://raw.githubusercontent.com/dillardblom/ng_backup/main/screenshots/3-settings.png</screenshot>
    <dependencies>
        <php min-version="8.1"/>
        <lib>sodium</lib>
@@ -29,6 +37,7 @@ relying on this for anything.]]></description>
        <command>OCA\NgBackup\Command\KeyConfirm</command>
        <command>OCA\NgBackup\Command\TargetBackends</command>
        <command>OCA\NgBackup\Command\TargetAdd</command>
+        <command>OCA\NgBackup\Command\TargetEdit</command>
        <command>OCA\NgBackup\Command\TargetList</command>
        <command>OCA\NgBackup\Command\TargetRemove</command>
        <command>OCA\NgBackup\Command\RunBackup</command>
@@ -47,6 +56,11 @@ relying on this for anything.]]></description>
        <command>OCA\NgBackup\Command\KeySlotAdd</command>
        <command>OCA\NgBackup\Command\KeySlotReplace</command>
        <command>OCA\NgBackup\Command\KeySlotRemove</command>
+        <command>OCA\NgBackup\Command\BackupUser</command>
+        <command>OCA\NgBackup\Command\RestoreUser</command>
+        <command>OCA\NgBackup\Command\KeyImport</command>
+        <command>OCA\NgBackup\Command\RestoreFull</command>
+        <command>OCA\NgBackup\Command\Verify</command>
    </commands>
    <settings>
        <admin>OCA\NgBackup\Settings\Admin</admin>
@@ -18,6 +18,8 @@ return [
 		['name' => 'AdminApi#untrash', 'url' => '/api/targets/{targetId}/trash/{snapshotId}', 'verb' => 'POST'],
 		['name' => 'AdminApi#backends', 'url' => '/api/backends', 'verb' => 'GET'],
 		['name' => 'AdminApi#addTarget', 'url' => '/api/targets', 'verb' => 'POST'],
+		['name' => 'AdminApi#targetSettings', 'url' => '/api/targets/{id}/settings', 'verb' => 'GET'],
+		['name' => 'AdminApi#updateTarget', 'url' => '/api/targets/{id}', 'verb' => 'PUT'],
 		['name' => 'AdminApi#removeTarget', 'url' => '/api/targets/{id}', 'verb' => 'DELETE'],
 		['name' => 'AdminApi#testTarget', 'url' => '/api/targets/{id}/test', 'verb' => 'POST'],
 		['name' => 'AdminApi#setTargetLimit', 'url' => '/api/targets/{id}/limit', 'verb' => 'PUT'],
@@ -0,0 +1,166 @@
+# NG Backup how-to
+
+Step by step: from first install to a tested restore. All commands run as the web user
+(`sudo -u www-data php occ ...`, or `docker exec -u www-data <container> php occ ...` in
+All-in-One and Docker setups). Replace names in `<angle brackets>` with your own.
+
+## 1. Create the key and the recovery kit
+
+```
+occ backup:key:init --label="Main" --delete-delay-days=7
+occ backup:key:kit --output=/var/tmp/ng_backup-kit.json
+occ backup:key:confirm -u <your-admin-uid> --code=<code shown> --confirm="Yes, I confirm"
+```
+
+- The passphrase protects the backup. Keep it somewhere other than this server.
+- Optional: extra passphrases for other people with `occ backup:key:slot:add --label="..."`.
+  Any one passphrase is enough to restore. Removing a slot later does not revoke access for someone
+  who kept an old kit and that passphrase (see "Known limitations" in the README).
+- The recovery kit (`/var/tmp/ng_backup-kit.json` above) is also required for disaster recovery. The web
+  user writes it there; then move it off the server as root, next to the passphrase, and delete the
+  copy in `/var/tmp`. Without the kit and a passphrase, the backup cannot be read.
+
+## 2. Add a backup location
+
+NG Backup uses Nextcloud's External storage backends. Check what your server supports first:
+
+```
+occ backup:target:backends
+```
+
+Examples:
+
+```
+occ backup:target:add offsite amazons3 -a amazons3::accesskey -o bucket=<bucket> -o key=<key> -o secret=<secret>
+occ backup:target:add nas sftp -a password::password -o host=<host> -o user=<user> -o password=<pw> -o root=home
+occ backup:target:add local local -a null::null -o datadir=/mnt/backup
+```
+
+- **SFTP on a Hetzner Storage Box sub-account:** use `-o root=home`, not `/` (see README).
+- **FTP:** use a server that accepts absolute paths (for example `pure-ftpd`).
+- **SMB:** requires the native `smbclient` PHP extension. The CLI binary alone is not enough (see README).
+  `backup:target:add` refuses SMB when the extension is missing.
+- **NFS:** not a backend of its own. Mount the export on the server and use the `local` backend
+  with the mount point as `datadir`.
+
+Verify the location before relying on it:
+
+```
+occ backup:target:list
+occ backup:status
+```
+
+Changed password, new host name, or moved the repository? Edit the location instead of adding a
+new one, so its history stays (in the web interface: **Edit** next to the location). The new
+settings must lead to the same repository; options you do not pass keep their value:
+
+```
+occ backup:target:edit nas -o password=<new pw>
+```
+
+## 3. Run the first backup
+
+```
+occ backup:run offsite -l first
+occ backup:list
+```
+
+Later runs upload only changed data. An unchanged run uploads (almost) nothing; the output shows
+the number of uploaded bytes, so check that value when you test incremental behaviour.
+
+Schedule `occ backup:run` from system cron (or use the Administration settings, if you prefer).
+
+## 4. Check the backup regularly
+
+```
+occ backup:verify offsite <snapshot>          # shallow: all blocks are present
+occ backup:verify offsite <snapshot> --deep   # also downloads and decrypts every block
+```
+
+Run the deep check at least once after setting up a location, and after changing it.
+
+## 5. Restore files and folders
+
+In the web interface, or with occ:
+
+```
+occ backup:browse offsite <snapshot>
+occ backup:restore offsite <snapshot> data/<uid>/files/Docs --mode=new-folder
+occ backup:restore offsite <snapshot> data/<uid>/files/Docs --mode=merge
+occ backup:restore offsite <snapshot> data/<uid>/files/Docs --mode=replace
+occ backup:restore offsite <snapshot> config --to-directory=/var/tmp/restore-config
+```
+
+- `new-folder` (default): puts the files in "Restored <date>" next to the original. Safest choice.
+- `merge`: adds missing files, keeps current ones.
+- `replace`: overwrites the folder. Replaced files keep their old content as a version, and removed
+  files go to the trash.
+- `--to-directory`: writes raw files to a local directory (for example `config/`).
+
+## 6. Back up and restore one user
+
+Needs the `user_migration` app. NG Backup asks before installing it:
+
+```
+occ backup:user:backup offsite <uid>
+occ backup:user:restore offsite users/<uid>/<exportId>               # replace (default)
+occ backup:user:restore offsite users/<uid>/<exportId> --mode=as-backup
+```
+
+- If `user_migration` is missing, the command asks to install and enable it. For non-interactive
+  use, add `--install-user-migration` to approve that explicitly. The command stops after the
+  installation; run it once more.
+- `replace` first makes a safety export of the current account, then recreates the user under the
+  same id. When the account exists, the command asks first; in scripts, add `--force`. Shares to
+  others and data of apps without a user_migration migrator are not restored, so prefer
+  `as-backup` when in doubt: it restores into `<uid>-bak` and leaves the original untouched.
+- A restore onto a server where the user does not exist works. Calendars and address books get an
+  internal name with the prefix `migrated-` (for example `migrated-personal`). That prefix comes from
+  user_migration and cannot be turned off. The user can change the display name of these calendars and
+  address books in the app as usual; the internal name stays as it is.
+- **Settings:** on restore, `user_migration` imports only the app settings on its own allowlist
+  (for example calendar view and reminder settings). Other app settings of the user are skipped.
+  NG Backup reuses `user_migration`'s importer, so this list is not extended.
+- Keep the last few exports per user: `occ backup:retention --user-last=3`.
+
+## 7. Disaster recovery: restore the whole server
+
+Use a fresh Nextcloud installation of the same major version, with NG Backup installed and
+the same location available. For a test, use a **copy** of the location: two servers writing to one
+location break each other's catalog.
+
+```
+occ backup:key:import /path/ng_backup-kit.json --passphrase-file=/path/passphrase
+occ backup:target:add offsite <backend> ...          # same details as on the original server
+occ backup:list offsite                              # the snapshots must be listed
+occ backup:restore:full offsite <snapshot>
+```
+
+The command refuses on an installation that already has more than one user, and asks before it
+starts; `--force` skips both (also needed to rerun it after it stopped halfway).
+
+Afterwards, check that users, files and the database are complete, and run a backup of the restored
+server. The restored installation keeps its own app configuration and secret.
+
+## 8. Retention
+
+```
+occ backup:retention --last=3 --daily=7 --weekly=4 --monthly=12
+occ backup:prune offsite --dry-run   # show first
+occ backup:prune offsite             # apply the policy; forgotten snapshots go to the trash first
+occ backup:trash                  # list the trash
+occ backup:trash:restore offsite <id>
+```
+
+Snapshots are kept according to the policy, and their data is deleted only after the deletion delay
+(set with `backup:key:init --delete-delay-days`). `occ backup:prune offsite --dry-run` shows what would be
+removed without changing anything.
+
+## 9. Checklist before you rely on it
+
+- [ ] Key created, passphrase stored off-server, recovery kit stored off-server
+- [ ] Location added; `backup:status` shows it reachable
+- [ ] First backup done and listed in `backup:list`
+- [ ] `backup:verify --deep` succeeds
+- [ ] One file restore tested (`new-folder`)
+- [ ] Disaster recovery tested on a second, fresh installation (or in a test environment)
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Backend;
+
+/** IBackend::getMany() for a backend where reading files one after the other costs nothing extra. */
+trait GetsOneByOne {
+	/**
+	 * @param list<string> $paths
+	 * @return \Generator<string, string>
+	 */
+	public function getMany(array $paths): \Generator {
+		foreach ($paths as $path) {
+			$fh = $this->get($path);
+			try {
+				$data = stream_get_contents($fh);
+			} finally {
+				fclose($fh);
+			}
+			if ($data === false) {
+				throw new BackendException('Read failed for ' . $path);
+			}
+			yield $path => $data;
+		}
+	}
+}
@@ -22,6 +22,16 @@ interface IBackend {
 	/** @return resource readable stream of the whole object */
 	public function get(string $path);

+	/**
+	 * Many small objects whole, in the order given (the repository's index files). A backend
+	 * where every request costs a round trip can fetch them several at a time.
+	 *
+	 * @param list<string> $paths
+	 * @return \Generator<string, string> contents by path
+	 * @throws BackendException for an object that cannot be read
+	 */
+	public function getMany(array $paths): \Generator;
+
 	/** @return string bytes [$offset, $offset + $length) of the object (used to fetch single blobs from a pack) */
 	public function getRange(string $path, int $offset, int $length): string;

@@ -37,5 +47,15 @@ interface IBackend {
 	/** @return list<string> object paths below $prefix (recursive) */
 	public function list(string $prefix): array;

+	/**
+	 * Object paths directly in $dir, for a folder that only holds objects (index/, snapshots/,
+	 * catalog/, trash/info/). One listing, without checking the type of every entry: on a remote
+	 * storage list() costs a round trip per entry, which for index/ (one file per pack) grows
+	 * with the size of the repository.
+	 *
+	 * @return list<string>
+	 */
+	public function listFiles(string $dir): array;
+
 	public function delete(string $path): void;
 }
@@ -8,6 +8,8 @@ declare(strict_types=1);
 namespace OCA\NgBackup\Backend;

 final class LocalBackend implements IBackend {
+	use GetsOneByOne;
+
 	public function __construct(
 		private string $root,
 	) {
@@ -33,11 +35,16 @@ final class LocalBackend implements IBackend {
 			if ($out === false) {
 				throw new BackendException('Cannot write ' . $path);
 			}
+			$expected = StorageBackend::remaining($stream);
 			if (stream_copy_to_stream($stream, $out) === false || !fflush($out)) {
 				throw new BackendException('Write failed for ' . $path);
 			}
 			fclose($out);
 			$out = false;
+			clearstatcache(true, $tmp);
+			if ($expected !== null && filesize($tmp) !== $expected) {
+				throw new BackendException('Incomplete write for ' . $path);
+			}
 			if (!rename($tmp, $target)) {
 				throw new BackendException('Cannot finalise ' . $path);
 			}
@@ -94,7 +101,7 @@ final class LocalBackend implements IBackend {
 		$result = [];
 		$it = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($base, \FilesystemIterator::SKIP_DOTS));
 		foreach ($it as $file) {
-			if ($file->isFile() && !str_contains($file->getFilename(), '.part-')) {
+			if ($file->isFile() && !StorageBackend::isTemporary($file->getFilename())) {
 				$result[] = ltrim(substr($file->getPathname(), strlen($this->root)), '/');
 			}
 		}
@@ -102,6 +109,25 @@ final class LocalBackend implements IBackend {
 		return $result;
 	}

+	public function listFiles(string $dir): array {
+		$base = $this->abs($dir);
+		if (!is_dir($base)) {
+			return [];
+		}
+		$result = [];
+		$names = scandir($base);
+		if ($names === false) {
+			throw new BackendException('Cannot list ' . $dir);
+		}
+		foreach ($names as $name) {
+			if ($name !== '.' && $name !== '..' && !StorageBackend::isTemporary($name)) {
+				$result[] = trim($dir, '/') . '/' . $name;
+			}
+		}
+		sort($result);
+		return $result;
+	}
+
 	public function delete(string $path): void {
 		@unlink($this->abs($path));
 	}
@@ -0,0 +1,628 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Backend;
+
+/**
+ * Read stream for files_external's SFTP storage that keeps several READ requests in flight.
+ *
+ * files_external's own read stream asks for the next 256 KiB only after the previous one has
+ * arrived, so every request costs a full round trip: about 5 MB/s at 47 ms to a Hetzner Storage
+ * Box, whatever the line speed. With 8 requests in flight the same connection reached 15 MB/s.
+ * phpseclib's get() pipelines too, but only into memory or a local file, and only from offset 0.
+ *
+ * Talks to the storage's phpseclib connection through the same internal methods files_external's
+ * read stream uses (_send_sftp_packet, _get_sftp_packet, _realpath); open() returns null when the
+ * connection does not offer them (phpseclib 3 does not), and StorageBackend then falls back to the
+ * storage's own stream. A restore must rather be slow than fail: when a read fails halfway, the
+ * stream goes on from the same position with the storage's own stream. After MAX_FAILURES streams
+ * in a row failed, open() returns null for the rest of the process; one that works resets the count.
+ * Like that stream, it owns the connection while open: no other request may go over the same
+ * connection until it is closed (PackReaderGuard takes care of that for the repository).
+ */
+final class SftpReadStream {
+	private const PROTOCOL = 'ngbsftpread';
+	/** Requests in flight once a stream reads sequentially; it starts at one and doubles. */
+	public const DEPTH = 8;
+	/** Files read at once by readMany(): each holds a handle on the server while its batch runs. */
+	public const BATCH = 32;
+	/** Larger files are left to the usual read by readMany(), which holds every file in memory. */
+	private const MANY_MAX_BYTES = 16 * 1048576;
+	/** OpenSSH and the Hetzner Storage Box both answer at most 255 KiB per READ. */
+	private const CHUNK = 261120;
+	/** Every SFTP server must handle packets of this size (draft-ietf-secsh-filexfer-02, section 3). */
+	private const MIN_CHUNK = 32768;
+
+	private const FXP_OPEN = 3;
+	private const FXP_CLOSE = 4;
+	private const FXP_READ = 5;
+	private const FXP_STATUS = 101;
+	private const FXP_HANDLE = 102;
+	private const FXP_DATA = 103;
+	private const FXF_READ = 1;
+	private const FX_OK = 0;
+	private const FX_EOF = 1;
+
+	/**
+	 * READ size per connection, lowered when a server answers less than asked and then goes on, so
+	 * later streams over that connection ask for no more than it gives.
+	 *
+	 * @var \WeakMap<object, int>|null
+	 */
+	private static ?\WeakMap $chunks = null;
+	private static int $requestId = 0x4e470000;
+	/**
+	 * Connections whose server did not confirm closing a batch's files: readMany() is not used on
+	 * them again, so handles cannot pile up.
+	 *
+	 * @var \WeakMap<object, true>|null
+	 */
+	private static ?\WeakMap $noBatches = null;
+	/** Streams in a row that failed; at MAX_FAILURES only the storage's own stream is used. */
+	private static int $failures = 0;
+	public const MAX_FAILURES = 3;
+	/** Set by stream_open() when the connection failed rather than the file. */
+	private static bool $openBroke = false;
+	/** Why the last stream_open() failed on the connection. */
+	private static string $openCause = '';
+
+	/** @var resource|null set by PHP for stream wrappers */
+	public $context;
+
+	/**
+	 * The phpseclib connection. PHP creates stream wrappers without constructor arguments; it is
+	 * set in stream_open(), and no other method is called when that fails.
+	 *
+	 * @psalm-suppress PropertyNotSetInConstructor
+	 */
+	private object $sftp;
+	/** The storage and the path on it, to fall back to the storage's own stream. */
+	private ?object $storage = null;
+	private string $file = '';
+	/** @var resource|null the storage's own stream, once this one has failed */
+	private $fallback = null;
+	private string $handle = '';
+	/** Position of the reader: the first byte of $buffer. */
+	private int $pos = 0;
+	/** Offset of the next READ to send. */
+	private int $next = 0;
+	private string $buffer = '';
+	/** @var list<array{int, int, int}> request id, offset, length, in the order sent */
+	private array $inFlight = [];
+	private int $depth = 1;
+	private bool $eof = false;
+	/** This stream gave up on its own requests. */
+	private bool $failed = false;
+	/** The connection is in an unknown state: nothing more is sent over it or read from it. */
+	private bool $broken = false;
+	/** Length of the last short answer, until the next answer tells whether it was the end of the file. */
+	private ?int $shortAnswer = null;
+
+	/**
+	 * @param object $storage files_external's SFTP storage (getConnection(), getRoot())
+	 * @return resource|false|null the stream, false when the file cannot be opened, null when the
+	 *                             connection does not offer what this stream needs
+	 * @throws BackendException when the connection failed after the OPEN request went out: the
+	 *                          storage's own stream must not be tried on it, as it would take a
+	 *                          late answer to that request for its own
+	 */
+	public static function open(object $storage, string $path) {
+		if (self::$failures >= self::MAX_FAILURES) {
+			return null;
+		}
+		try {
+			$sftp = self::connection($storage);
+			if ($sftp === null) {
+				return null;
+			}
+			if (!in_array(self::PROTOCOL, stream_get_wrappers(), true)) {
+				stream_wrapper_register(self::PROTOCOL, self::class);
+			}
+			$root = rtrim((string)$storage->getRoot(), '/');
+			$context = stream_context_create([self::PROTOCOL => [
+				'session' => $sftp,
+				'path' => $root . '/' . ltrim($path, '/'),
+				'storage' => $storage,
+				'file' => $path,
+			]]);
+			self::$openBroke = false;
+			$fh = @fopen(self::PROTOCOL . '://file', 'r', false, $context);
+		} catch (\Throwable) {
+			// nothing was sent yet
+			self::$failures++;
+			return null;
+		}
+		if ($fh === false && self::openBroke()) {
+			throw new BackendException('SFTP connection failed while opening ' . $path . ': ' . self::$openCause);
+		}
+		return $fh;
+	}
+
+	/**
+	 * The storage's phpseclib connection, with its SFTP channel open, when it offers what these
+	 * streams need; null otherwise.
+	 */
+	private static function connection(object $storage): ?object {
+		if (!is_callable([$storage, 'getConnection']) || !is_callable([$storage, 'getRoot'])) {
+			return null;
+		}
+		$sftp = $storage->getConnection();
+		// is_callable and get_object_vars from here only see what is public: phpseclib 3 has
+		// methods of these names neither public nor at all.
+		if (!is_object($sftp) || !is_callable([$sftp, '_send_sftp_packet']) || !is_callable([$sftp, '_get_sftp_packet'])
+			|| !is_callable([$sftp, '_realpath']) || !is_callable([$sftp, 'pwd'])
+			|| !array_key_exists('packet_type', get_object_vars($sftp))) {
+			return null;
+		}
+		// phpseclib opens the SFTP channel on its first SFTP call, not at login: on a fresh
+		// connection a packet sent directly would go nowhere. pwd() opens it like any call does.
+		if ($sftp->pwd() === false) {
+			return null;
+		}
+		return $sftp;
+	}
+
+	/**
+	 * Read many small files whole, BATCH at a time: the OPEN, READ and CLOSE requests of a batch
+	 * all go out before their answers are read, so a batch costs a few round trips instead of
+	 * four per file. Meant for files of up to a few hundred KiB (the repository's index files):
+	 * every file is held in memory.
+	 *
+	 * @param list<string> $paths below the storage's root
+	 * @return array<string, string|null>|null contents by path; null for a file this could not
+	 *                                         read (missing, or a server error), so the caller
+	 *                                         reads it the usual way; null for all when the
+	 *                                         connection does not offer what this needs
+	 * @throws BackendException when the connection failed while requests were out: the storage's
+	 *                          own stream must not be tried on it
+	 */
+	public static function readMany(object $storage, array $paths): ?array {
+		if (self::$failures >= self::MAX_FAILURES) {
+			return null;
+		}
+		try {
+			$sftp = self::connection($storage);
+			$root = $sftp === null ? '' : rtrim((string)$storage->getRoot(), '/');
+		} catch (\Throwable) {
+			self::$failures++;
+			return null;
+		}
+		if ($sftp === null || self::$noBatches?->offsetExists($sftp) === true) {
+			return null;
+		}
+		$result = array_fill_keys($paths, null);
+		foreach (array_chunk($paths, self::BATCH) as $batch) {
+			try {
+				[$read, $closed] = self::readBatch($sftp, $root, $batch);
+			} catch (\Throwable $e) {
+				self::$failures++;
+				// Answers to requests already sent may still arrive, and files_external would take
+				// them for its own: end the connection rather than leave it out of step.
+				self::disconnect($sftp);
+				throw $e instanceof BackendException ? $e : new BackendException('SFTP connection failed while reading ' . count($batch) . ' files: ' . $e->getMessage(), 0, $e);
+			}
+			foreach ($read as $path => $contents) {
+				$result[$path] = $contents;
+			}
+			if (!$closed) {
+				// The server did not confirm closing these files: no more batches on this
+				// connection, so handles cannot pile up. The rest is read the usual way.
+				self::noMoreBatches($sftp);
+				break;
+			}
+		}
+		self::$failures = 0;
+		return $result;
+	}
+
+	private static function noMoreBatches(object $sftp): void {
+		self::$noBatches ??= new \WeakMap();
+		self::$noBatches[$sftp] = true;
+	}
+
+	private static function disconnect(object $sftp): void {
+		try {
+			if (is_callable([$sftp, 'disconnect'])) {
+				$sftp->disconnect();
+			}
+		} catch (\Throwable) {
+		}
+	}
+
+	/** Requests of one kind for a whole batch, then their answers in order. @return list<array{int, string}> */
+	private static function exchange(object $sftp, int $type, array $packets): array {
+		$ids = [];
+		foreach ($packets as $packet) {
+			$id = self::nextId();
+			if (!$sftp->_send_sftp_packet($type, $packet, $id)) {
+				throw new BackendException('SFTP connection failed while sending a request');
+			}
+			$ids[] = $id;
+		}
+		$answers = [];
+		foreach ($ids as $id) {
+			$response = $sftp->_get_sftp_packet($id);
+			if (!is_string($response)) {
+				throw new BackendException('SFTP connection failed while waiting for an answer');
+			}
+			$answers[] = [$sftp->packet_type, $response];
+		}
+		return $answers;
+	}
+
+	/**
+	 * @param list<string> $batch
+	 * @return array{0: array<string, string>, 1: bool} the files read whole, and whether the
+	 *                                                  server confirmed closing every handle
+	 */
+	private static function readBatch(object $sftp, string $root, array $batch): array {
+		$opens = [];
+		$openPaths = [];
+		foreach ($batch as $path) {
+			$remote = $sftp->_realpath($root . '/' . ltrim($path, '/'));
+			if (is_string($remote)) {
+				$opens[] = pack('Na*N2', strlen($remote), $remote, self::FXF_READ, 0);
+				$openPaths[] = $path;
+			}
+			// a path that cannot be resolved is left to the caller's usual read
+		}
+		$handles = []; // path => handle
+		foreach (self::exchange($sftp, self::FXP_OPEN, $opens) as $i => [$type, $response]) {
+			if ($type === self::FXP_HANDLE) {
+				$handles[$openPaths[$i]] = substr($response, 4);
+			}
+			// any other answer (missing, no permission): the caller reads it the usual way
+		}
+		$data = array_fill_keys(array_keys($handles), '');
+		$reading = $handles;
+		while ($reading !== []) {
+			$length = self::chunk($sftp);
+			$reads = [];
+			foreach ($reading as $path => $handle) {
+				$offset = strlen($data[$path]);
+				$reads[] = pack('Na*N3', strlen($handle), $handle, intdiv($offset, 4294967296), $offset % 4294967296, $length);
+			}
+			$paths = array_keys($reading);
+			foreach (self::exchange($sftp, self::FXP_READ, $reads) as $i => [$type, $response]) {
+				$path = $paths[$i];
+				$declared = strlen($response) >= 4 ? unpack('N', $response) : false;
+				if ($type === self::FXP_DATA && is_array($declared) && $declared[1] > 0 && $declared[1] === strlen($response) - 4
+					&& $declared[1] <= $length && strlen($data[$path]) + $declared[1] <= self::MANY_MAX_BYTES) {
+					$data[$path] .= substr($response, 4); // more may follow: read on from there
+					continue;
+				}
+				unset($reading[$path]);
+				$status = $type === self::FXP_STATUS && is_array($declared) ? $declared[1] : null;
+				if ($status !== self::FX_EOF) {
+					// a server error, a malformed answer or a file too large for this: the caller
+					// reads it the usual way
+					unset($data[$path]);
+				}
+			}
+		}
+		$closes = [];
+		foreach ($handles as $handle) {
+			$closes[] = pack('Na*', strlen($handle), $handle);
+		}
+		$closed = true;
+		foreach (self::exchange($sftp, self::FXP_CLOSE, $closes) as [$type, $response]) {
+			$status = $type === self::FXP_STATUS && strlen($response) >= 4 ? unpack('N', $response) : false;
+			if (!is_array($status) || $status[1] !== self::FX_OK) {
+				$closed = false;
+			}
+		}
+		return [$data, $closed];
+	}
+
+	/** Test hook: forget the learned READ sizes and earlier failures. */
+	public static function reset(): void {
+		self::$chunks = null;
+		self::$noBatches = null;
+		self::$failures = 0;
+	}
+
+	public function stream_open(string $url, string $mode, int $options, ?string &$openedPath): bool {
+		$options = stream_context_get_options($this->context ?? stream_context_get_default())[self::PROTOCOL] ?? [];
+		if (!isset($options['session'], $options['path']) || !is_object($options['session'])) {
+			return false;
+		}
+		$this->sftp = $options['session'];
+		$storage = $options['storage'] ?? null;
+		$this->storage = is_object($storage) ? $storage : null;
+		$this->file = (string)($options['file'] ?? '');
+		try {
+			$remote = $this->sftp->_realpath((string)$options['path']);
+			if (!is_string($remote)) {
+				return false;
+			}
+			$id = self::nextId();
+			if (!$this->sftp->_send_sftp_packet(self::FXP_OPEN, pack('Na*N2', strlen($remote), $remote, self::FXF_READ, 0), $id)) {
+				return $this->connectionFailed('the request could not be sent');
+			}
+			$response = $this->sftp->_get_sftp_packet($id);
+		} catch (\Throwable $e) {
+			return $this->connectionFailed(get_class($e) . ': ' . $e->getMessage());
+		}
+		if (!is_string($response)) {
+			return $this->connectionFailed('no answer');
+		}
+		if ($this->sftp->packet_type !== self::FXP_HANDLE) {
+			return false; // an answer, but no handle: the file cannot be opened
+		}
+		$this->handle = substr($response, 4);
+		return true;
+	}
+
+	/** Not a missing file but a connection that does not behave as expected. */
+	private function connectionFailed(string $cause): bool {
+		self::$failures++;
+		self::$openBroke = true;
+		self::$openCause = $cause . self::connectionState($this->sftp);
+		// unknown state: closed, so that nothing else uses it (and the backend can build a new one)
+		self::disconnect($this->sftp);
+		return false;
+	}
+
+	/** What phpseclib knows about the connection, for an error message. */
+	private static function connectionState(object $sftp): string {
+		$state = [];
+		try {
+			if (is_callable([$sftp, 'isConnected'])) {
+				$state[] = 'connected: ' . ($sftp->isConnected() ? 'yes' : 'no');
+			}
+			if (is_callable([$sftp, 'getLastError'])) {
+				$last = (string)$sftp->getLastError();
+				if ($last !== '') {
+					$state[] = 'ssh: ' . $last;
+				}
+			}
+			if (is_callable([$sftp, 'getLastSFTPError'])) {
+				$last = (string)$sftp->getLastSFTPError();
+				if ($last !== '') {
+					$state[] = 'sftp: ' . $last;
+				}
+			}
+		} catch (\Throwable) {
+		}
+		return $state === [] ? '' : ' (' . implode('; ', $state) . ')';
+	}
+
+	/** Whether the last stream_open() failed on the connection; a call, as fopen() sets it. */
+	private static function openBroke(): bool {
+		return self::$openBroke;
+	}
+
+	public function stream_read(int $count): string|false {
+		if ($this->fallback !== null) {
+			return fread($this->fallback, $count);
+		}
+		while (strlen($this->buffer) < $count && !$this->eof) {
+			if (!$this->receive()) {
+				return $this->useFallback() ? $this->stream_read($count) : false;
+			}
+		}
+		$data = substr($this->buffer, 0, $count);
+		$this->buffer = substr($this->buffer, strlen($data));
+		$this->pos += strlen($data);
+		return $data;
+	}
+
+	public function stream_eof(): bool {
+		if ($this->fallback !== null) {
+			return feof($this->fallback);
+		}
+		return $this->eof && $this->buffer === '';
+	}
+
+	public function stream_tell(): int {
+		if ($this->fallback !== null) {
+			$pos = ftell($this->fallback);
+			return $pos === false ? $this->pos : $pos;
+		}
+		return $this->pos;
+	}
+
+	public function stream_seek(int $offset, int $whence = SEEK_SET): bool {
+		if ($this->fallback !== null) {
+			return fseek($this->fallback, $offset, $whence) === 0;
+		}
+		if ($whence === SEEK_CUR) {
+			$offset += $this->pos;
+		} elseif ($whence !== SEEK_SET) {
+			return false; // the size is never asked for, to save a round trip
+		}
+		if ($offset < 0) {
+			return false;
+		}
+		if ($this->failed) {
+			$this->pos = $offset;
+			return $this->useFallback();
+		}
+		if ($offset >= $this->pos && $offset - $this->pos <= strlen($this->buffer)) {
+			$this->buffer = substr($this->buffer, $offset - $this->pos);
+		} else {
+			$this->drain();
+			$this->buffer = '';
+			$this->next = $offset;
+			$this->eof = false;
+			$this->depth = 1;
+			$this->shortAnswer = null;
+		}
+		$this->pos = $offset;
+		return true;
+	}
+
+	/** @return array<int|string, int> */
+	public function stream_stat(): array {
+		return [];
+	}
+
+	public function stream_close(): void {
+		if (!$this->failed) {
+			self::$failures = 0;
+		}
+		$fallback = $this->fallback;
+		$this->fallback = null;
+		if ($fallback !== null) {
+			fclose($fallback);
+		}
+		$this->closeHandle();
+	}
+
+	/**
+	 * Go on with the storage's own stream from the current position, after a server error on this
+	 * one. The data still buffered is dropped and read again. False after a connection error, or
+	 * when that stream cannot be opened or positioned: then the read fails as it would have
+	 * without this class. Reopening by path is safe for a repository: packs and index files are
+	 * never rewritten, and every object is authenticated when it is decrypted.
+	 */
+	private function useFallback(): bool {
+		$this->closeHandle();
+		$this->buffer = '';
+		// files_external's stream takes whatever answer comes next on the connection: after a
+		// connection error, answers to this stream's requests may still be on their way.
+		if ($this->broken || $this->storage === null || !is_callable([$this->storage, 'fopen'])) {
+			return false;
+		}
+		try {
+			$fh = $this->storage->fopen($this->file, 'r');
+			if (!is_resource($fh)) {
+				return false;
+			}
+			if ($this->pos > 0 && fseek($fh, $this->pos) !== 0) {
+				fclose($fh);
+				return false;
+			}
+		} catch (\Throwable) {
+			return false;
+		}
+		$this->fallback = $fh;
+		return true;
+	}
+
+	private function closeHandle(): void {
+		$this->drain();
+		if ($this->handle !== '' && !$this->broken) {
+			try {
+				$id = self::nextId();
+				if (!$this->sftp->_send_sftp_packet(self::FXP_CLOSE, pack('Na*', strlen($this->handle), $this->handle), $id)
+					|| !is_string($this->sftp->_get_sftp_packet($id))) {
+					$this->broken = true;
+				}
+			} catch (\Throwable) {
+				$this->broken = true;
+			}
+			if ($this->broken) {
+				self::disconnect($this->sftp);
+			}
+		}
+		$this->handle = '';
+	}
+
+	/** Keep the pipeline full, then take the oldest answer. False on a connection or server error. */
+	private function receive(): bool {
+		if ($this->failed) {
+			return false;
+		}
+		try {
+			return $this->receiveOne();
+		} catch (\Throwable) {
+			$this->broken = true;
+			return $this->fail();
+		}
+	}
+
+	private function receiveOne(): bool {
+		while (count($this->inFlight) < $this->depth) {
+			$id = self::nextId();
+			$length = self::chunk($this->sftp);
+			$packet = pack('Na*N3', strlen($this->handle), $this->handle, intdiv($this->next, 4294967296), $this->next % 4294967296, $length);
+			if (!$this->sftp->_send_sftp_packet(self::FXP_READ, $packet, $id)) {
+				$this->broken = true;
+				return $this->fail();
+			}
+			$this->inFlight[] = [$id, $this->next, $length];
+			$this->next += $length;
+		}
+		[$id, $offset, $length] = array_shift($this->inFlight);
+		$response = $this->sftp->_get_sftp_packet($id);
+		if (!is_string($response)) {
+			$this->broken = true;
+			return $this->fail();
+		}
+		if ($this->sftp->packet_type === self::FXP_DATA) {
+			$data = substr($response, 4);
+			if ($data === '') {
+				return $this->fail();
+			}
+			$this->buffer .= $data;
+			$this->depth = min(self::DEPTH, $this->depth * 2);
+			if ($this->shortAnswer !== null) {
+				// More data after a short answer: that one was the server's cap, not the end.
+				// Never below what every server must support: a one-off small answer is no cap.
+				self::$chunks ??= new \WeakMap();
+				self::$chunks[$this->sftp] = max(self::MIN_CHUNK, min(self::chunk($this->sftp), $this->shortAnswer));
+				$this->shortAnswer = null;
+			}
+			if (strlen($data) < $length) {
+				// Fewer bytes than asked: the end of the file, or a server that caps a READ. The
+				// requests behind this one assumed a full answer, so drop them and ask again from here.
+				$this->drain();
+				$this->next = $offset + strlen($data);
+				$this->shortAnswer = strlen($data);
+			}
+			return true;
+		}
+		$status = $this->sftp->packet_type === self::FXP_STATUS ? unpack('N', $response) : false;
+		if (is_array($status) && ($status[1] ?? null) === self::FX_EOF) {
+			$this->eof = true;
+			$this->shortAnswer = null;
+			$this->drain();
+			return true;
+		}
+		return $this->fail();
+	}
+
+	private function fail(): bool {
+		$this->drain();
+		if (!$this->failed) {
+			self::$failures++;
+		}
+		$this->failed = true;
+		return false;
+	}
+
+	/** Read and drop the answers still on their way, so the connection is free again. */
+	private function drain(): void {
+		$inFlight = $this->inFlight;
+		$this->inFlight = [];
+		try {
+			foreach ($this->broken ? [] : $inFlight as [$id]) {
+				if (!is_string($this->sftp->_get_sftp_packet($id))) {
+					$this->broken = true;
+					break;
+				}
+			}
+		} catch (\Throwable) {
+			$this->broken = true;
+		}
+		if ($this->broken) {
+			// unknown state: closed, so that nothing else uses it (and the backend can build a new one)
+			self::disconnect($this->sftp);
+		}
+	}
+
+	private static function chunk(object $sftp): int {
+		$learned = self::$chunks?->offsetExists($sftp) === true ? self::$chunks->offsetGet($sftp) : null;
+		return is_int($learned) ? $learned : self::CHUNK;
+	}
+
+	private static function nextId(): int {
+		self::$requestId = self::$requestId >= 0x7fffffff ? 0x4e470000 : self::$requestId + 1;
+		return self::$requestId;
+	}
+}
@@ -17,20 +17,43 @@ use OCP\Files\Storage\IWriteStreamStorage;
 final class StorageBackend implements IBackend {
 	/** Object stores write whole objects atomically; other storages get a temp name + rename. */
 	private bool $atomicPut;
+	/** SFTP: read through SftpReadStream, which keeps several requests in flight. */
+	private bool $sftpReads;
+	/** Seconds without a request after which an SFTP connection is checked before it is used. */
+	public const IDLE_CHECK = 60;
+	private float $lastUsed;
+	/** Times the storage was built anew after its connection died (for tests and diagnostics). */
+	public int $reconnects = 0;

+	/**
+	 * @param (\Closure():IStorage)|null $reconnect builds the same storage anew, with a new
+	 *                                             connection
+	 */
 	public function __construct(
 		private IStorage $storage,
 		private string $base = '',
+		bool $createBase = true,
+		private ?\Closure $reconnect = null,
 	) {
+		$this->lastUsed = microtime(true);
 		$this->base = trim($base, '/');
 		self::validate($this->base, true);
 		$this->atomicPut = $storage->instanceOfStorage(\OCA\Files_External\Lib\Storage\AmazonS3::class);
-		if ($this->base !== '') {
+		$this->sftpReads = $storage->instanceOfStorage(\OCA\Files_External\Lib\Storage\SFTP::class);
+		if ($createBase && $this->base !== '') {
 			$this->mkdirs($this->base);
 		}
 	}

+	/** A temporary upload of put(): "<name>.part-<8 hex>". */
+	public static function isTemporary(string $name): bool {
+		return preg_match('/\.part-[0-9a-f]{8}$/', $name) === 1;
+	}
+
 	public function put(string $path, $stream): void {
+		// not repeated on a new connection: the stream is (partly) read
+		$this->idleCheck();
+		$expected = self::remaining($stream);
 		$target = $this->abs($path);
 		$this->mkdirs(dirname($target));
 		$writeTo = $this->atomicPut ? $target : $target . '.part-' . bin2hex(random_bytes(4));
@@ -54,6 +77,10 @@ final class StorageBackend implements IBackend {
 			if (is_resource($stream)) {
 				fclose($stream);
 			}
+			// Some adapters report success after a short write or a failed flush: check the size.
+			if ($expected !== null && $this->storage->filesize($writeTo) !== $expected) {
+				throw new BackendException('Incomplete write for ' . $path);
+			}
 			if ($writeTo !== $target && !$this->storage->rename($writeTo, $target)) {
 				throw new BackendException('Cannot finalise ' . $path);
 			}
@@ -69,6 +96,19 @@ final class StorageBackend implements IBackend {
 	}

 	public function get(string $path) {
+		return $this->call(fn () => $this->open($path));
+	}
+
+	/** @return resource */
+	private function open(string $path) {
+		if ($this->sftpReads) {
+			$fh = SftpReadStream::open($this->storage, $this->abs($path));
+			if (is_resource($fh)) {
+				return $fh;
+			}
+			// null: not supported or failing for now; false: not opened, which need not mean
+			// missing. Either way the storage's own stream decides.
+		}
 		$fh = $this->storage->fopen($this->abs($path), 'r');
 		if ($fh === false) {
 			throw new BackendException('Not found: ' . $path);
@@ -76,7 +116,40 @@ final class StorageBackend implements IBackend {
 		return $fh;
 	}

+	/** Over SFTP several at a time (SftpReadStream::readMany()); elsewhere one after the other. */
+	public function getMany(array $paths): \Generator {
+		foreach (array_chunk($paths, 8 * SftpReadStream::BATCH) as $chunk) {
+			$fast = null;
+			if ($this->sftpReads) {
+				$abs = array_map(fn (string $p): string => $this->abs($p), $chunk);
+				$fast = $this->call(fn () => SftpReadStream::readMany($this->storage, $abs));
+				$fast = $fast === null ? null : array_combine($chunk, array_map(fn (string $a): ?string => $fast[$a] ?? null, $abs));
+			}
+			foreach ($chunk as $path) {
+				$data = $fast[$path] ?? null;
+				if ($data === null) {
+					// not read in the batch (or no batches here): the usual way, which also
+					// reports a missing file as such
+					$fh = $this->get($path);
+					try {
+						$data = stream_get_contents($fh);
+					} finally {
+						fclose($fh);
+					}
+					if ($data === false) {
+						throw new BackendException('Read failed for ' . $path);
+					}
+				}
+				yield $path => $data;
+			}
+		}
+	}
+
 	public function getRange(string $path, int $offset, int $length): string {
+		return $this->call(fn () => $this->readRange($path, $offset, $length));
+	}
+
+	private function readRange(string $path, int $offset, int $length): string {
 		$fh = $this->get($path);
 		try {
 			if (fseek($fh, $offset) !== 0) {
@@ -99,23 +172,40 @@ final class StorageBackend implements IBackend {
 		}
 	}

+	/** Whether the storage accepts the connection settings (files_external's own check). */
+	public function canConnect(): bool {
+		try {
+			return !method_exists($this->storage, 'test') || $this->storage->test();
+		} catch (\Throwable) {
+			return false;
+		}
+	}
+
 	public function exists(string $path): bool {
-		return $this->storage->file_exists($this->abs($path));
+		$abs = $this->abs($path);
+		return $this->call(fn () => $this->storage->file_exists($abs), fn (bool $found) => !$found);
 	}

 	public function list(string $prefix): array {
-		$result = [];
-		$this->listInto($this->abs($prefix), $result);
+		$abs = $this->abs($prefix);
+		$result = $this->call(function () use ($abs): array {
+			$result = [];
+			$this->listInto($abs, $result);
+			return $result;
+		}, fn (array $found) => $found === []);
 		sort($result);
 		$cut = $this->base === '' ? 0 : strlen($this->base) + 1;
 		return array_map(fn ($p) => substr($p, $cut), $result);
 	}

 	public function delete(string $path): void {
+		$this->idleCheck();
 		$this->storage->unlink($this->abs($path));
 	}

 	public function move(string $from, string $to): void {
+		// not repeated on a new connection: the server may have done it before the connection died
+		$this->idleCheck();
 		$target = $this->abs($to);
 		$this->mkdirs(dirname($target));
 		if (!$this->storage->rename($this->abs($from), $target)) {
@@ -123,6 +213,121 @@ final class StorageBackend implements IBackend {
 		}
 	}

+	public function listFiles(string $dir): array {
+		$abs = $this->abs($dir);
+		return $this->call(fn () => $this->filesIn($dir, $abs), fn (array $found) => $found === []);
+	}
+
+	/** @return list<string> */
+	private function filesIn(string $dir, string $abs): array {
+		if (!$this->storage->is_dir($abs)) {
+			return []; // not created yet
+		}
+		$dh = $this->storage->opendir($abs);
+		if ($dh === false) {
+			// An existing folder read as empty would look like a new repository.
+			throw new BackendException('Cannot list ' . $dir);
+		}
+		$cut = $this->base === '' ? 0 : strlen($this->base) + 1;
+		$result = [];
+		while (($name = readdir($dh)) !== false) {
+			if ($name !== '.' && $name !== '..' && !self::isTemporary($name)) {
+				$result[] = substr($abs . '/' . $name, $cut);
+			}
+		}
+		closedir($dh);
+		sort($result);
+		return $result;
+	}
+
+	/**
+	 * Run $op; when it throws, or $failed says its result may come from a dead connection, and
+	 * the SFTP connection turns out to be dead, run it once more on a new connection.
+	 *
+	 * @template T
+	 * @param \Closure():T $op
+	 * @param (\Closure(T):bool)|null $failed
+	 * @return T
+	 */
+	private function call(\Closure $op, ?\Closure $failed = null): mixed {
+		$this->idleCheck();
+		try {
+			$result = $op();
+		} catch (\Throwable $e) {
+			if (!$this->reopenIfDead()) {
+				throw $e;
+			}
+			return $op();
+		}
+		if ($failed !== null && $failed($result) && $this->reopenIfDead()) {
+			return $op();
+		}
+		return $result;
+	}
+
+	/**
+	 * A Hetzner Storage Box drops an SFTP connection that carried a lot of data and then stayed
+	 * quiet for a few minutes, while phpseclib still takes it for open; files_external never
+	 * builds a new one, and every request on it fails as if the file were missing. So after
+	 * such a pause the connection is checked (one round trip) before it is used again.
+	 */
+	private function idleCheck(): void {
+		$now = microtime(true);
+		if ($this->reconnect !== null && $this->sftpReads && $now - $this->lastUsed >= self::IDLE_CHECK
+			&& $this->alive(true) === false) {
+			$this->reopen();
+		}
+		$this->lastUsed = microtime(true);
+	}
+
+	private function reopenIfDead(): bool {
+		if ($this->reconnect === null || !$this->sftpReads || $this->alive(false) !== false) {
+			return false;
+		}
+		$this->reopen();
+		return true;
+	}
+
+	/**
+	 * Whether the storage's SFTP connection is alive; null when it cannot tell.
+	 * $ask: send a request instead of trusting what phpseclib saw last.
+	 */
+	private function alive(bool $ask): ?bool {
+		try {
+			if (!is_callable([$this->storage, 'getConnection'])) {
+				return null;
+			}
+			$sftp = $this->storage->getConnection();
+			if (!is_object($sftp) || !is_callable([$sftp, 'isConnected'])) {
+				return null;
+			}
+			if (!$sftp->isConnected()) {
+				return false;
+			}
+			if (!$ask || !is_callable([$sftp, 'stat'])) {
+				return true;
+			}
+			if (is_callable([$sftp, 'clearStatCache'])) {
+				$sftp->clearStatCache(); // or stat() answers from memory
+			}
+			$sftp->stat('.');
+			return (bool)$sftp->isConnected();
+		} catch (\Throwable) {
+			return false;
+		}
+	}
+
+	private function reopen(): void {
+		/** @var \Closure():IStorage $reconnect */
+		$reconnect = $this->reconnect;
+		$this->storage = $reconnect();
+		$this->reconnects++;
+		$this->lastUsed = microtime(true);
+		if (function_exists('OCP\Log\logger')) {
+			\OCP\Log\logger('ng_backup')->info('The SFTP connection to the backup location was lost; reconnected');
+		}
+	}
+
 	private function listInto(string $dir, array &$result): void {
 		if (!$this->storage->is_dir($dir)) {
 			return;
@@ -132,19 +337,39 @@ final class StorageBackend implements IBackend {
 			return;
 		}
 		while (($name = readdir($dh)) !== false) {
-			if ($name === '.' || $name === '..' || str_contains($name, '.part-')) {
+			if ($name === '.' || $name === '..') {
 				continue;
 			}
 			$child = $dir . '/' . $name;
 			if ($this->storage->is_dir($child)) {
 				$this->listInto($child, $result);
-			} else {
+			} elseif (!self::isTemporary($name)) {
 				$result[] = $child;
 			}
 		}
 		closedir($dh);
 	}

+	/**
+	 * Bytes left to read in a local $stream (php://temp, php://memory or a plain file), or null:
+	 * stream wrappers of remote storages do not report a reliable size.
+	 */
+	public static function remaining(mixed $stream): ?int {
+		if (!is_resource($stream)) {
+			return null;
+		}
+		$meta = stream_get_meta_data($stream);
+		if (!($meta['seekable'] ?? false) || !in_array($meta['wrapper_type'] ?? '', ['PHP', 'plainfile'], true)) {
+			return null;
+		}
+		$stat = fstat($stream);
+		$pos = ftell($stream);
+		if ($stat === false || $pos === false) {
+			return null;
+		}
+		return max(0, $stat['size'] - $pos);
+	}
+
 	private function mkdirs(string $dir): void {
 		if ($dir === '' || $dir === '.' || $this->storage->is_dir($dir)) {
 			return;
@@ -38,13 +38,19 @@ final class BackupJob extends TimedJob {
 		$this->setTimeSensitivity(IJob::TIME_SENSITIVE);
 	}

+	private const MAX_DAILY_ATTEMPTS = 3;
+
 	protected function run($argument): void {
 		$budget = PHP_SAPI === 'cli' ? 240.0 : 20.0;
 		$deadline = microtime(true) + $budget;
 		$this->startScheduled();
 		foreach ($this->runs->findRunning(null, BackupService::KIND_FULL) as $run) {
 			while (microtime(true) < $deadline && $run->getStatus() === 'running') {
-				$run = $this->backups->step($run, min($deadline, microtime(true) + $budget));
+				$next = $this->backups->step($run, min($deadline, microtime(true) + $budget));
+				if ($next === $run) {
+					break; // step() hands back the same object when another process holds the run's lease
+				}
+				$run = $next;
 			}
 		}
 		$this->failStaleRestores();
@@ -67,10 +73,15 @@ final class BackupJob extends TimedJob {
 		}
 	}

-	/** Once a week (after Sunday's backup), apply the retention policy to non-append-only locations. */
+	/**
+	 * Once a week, apply the retention policy to non-append-only locations: from Sunday on, at the
+	 * first moment no backup is running, so a long Sunday backup only delays it instead of skipping
+	 * the week.
+	 */
 	private function weeklyPrune(): void {
 		$lastWeek = $this->appConfig->getValueString(Application::APP_ID, 'last_prune_week', '');
-		if (date('N') !== '7' || $lastWeek === date('o-W') || $this->runs->findRunning(null, BackupService::KIND_FULL) !== []) {
+		$due = date('N') === '7' ? date('o-W') : date('o-W', (int)strtotime('last sunday'));
+		if (strcmp($lastWeek, $due) >= 0 || $this->runs->findRunning(null, BackupService::KIND_FULL) !== []) {
 			return;
 		}
 		foreach ($this->targets->list() as $t) {
@@ -83,7 +94,7 @@ final class BackupJob extends TimedJob {
 				$this->logger->warning('NG Backup: cleanup of ' . $t->getName() . ' failed: ' . $e->getMessage());
 			}
 		}
-		$this->appConfig->setValueString(Application::APP_ID, 'last_prune_week', date('o-W'));
+		$this->appConfig->setValueString(Application::APP_ID, 'last_prune_week', $due);
 	}

 	/** Daily schedule: appconfig ng_backup/schedule_time "HH:MM" (server time); empty = no schedule. */
@@ -92,7 +103,7 @@ final class BackupJob extends TimedJob {
 		if (!preg_match('/^([01]\d|2[0-3]):[0-5]\d$/', $at)) {
 			return;
 		}
-		$todayAt = strtotime(date('Y-m-d') . ' ' . $at);
+		$todayAt = (int)strtotime(date('Y-m-d') . ' ' . $at);
 		if (time() < $todayAt) {
 			return;
 		}
@@ -101,6 +112,12 @@ final class BackupJob extends TimedJob {
 			if ($this->runs->findRunning($t->getId(), BackupService::KIND_FULL) !== [] || ($last !== null && $last->getStartedAt() >= $todayAt)) {
 				continue;
 			}
+			// After a failure: retry at most MAX_DAILY_ATTEMPTS times a day, an hour apart, instead
+			// of starting (and notifying about) a new full run every five minutes all day.
+			$today = $this->runs->startedSince($t->getId(), BackupService::KIND_FULL, $todayAt);
+			if (count($today) >= self::MAX_DAILY_ATTEMPTS || ($today !== [] && time() - (int)$today[0]->getFinishedAt() < 3600)) {
+				continue;
+			}
 			try {
 				$this->backups->start($t, 'scheduled');
 			} catch (\Throwable $e) {
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Command;
+
+use OCA\NgBackup\Service\TargetService;
+use OCA\NgBackup\Service\UserBackupService;
+use OCA\NgBackup\UserMigration\UserMigrationInstaller;
+use OCP\IUserManager;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+
+final class BackupUser extends Command {
+	public function __construct(
+		private TargetService $targets,
+		private UserBackupService $userBackup,
+		private IUserManager $userManager,
+		private UserMigrationInstaller $installer,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this->setName('backup:user:backup')
+			->setDescription('Back up one user via user_migration (account, settings, files and everything else a migrator covers)')
+			->addArgument('target', InputArgument::REQUIRED, 'Location name or id')
+			->addArgument('user', InputArgument::REQUIRED, 'User id')
+			->addOption('install-user-migration', null, InputOption::VALUE_NONE, 'Install and enable user_migration if it is missing (non-interactive consent)')
+			->setHelp(<<<'HELP'
+Streams a user_migration export straight into the encrypted repository: no zip, no copy in the
+user's own storage. Shares data with the regular backup; this needs the user_migration app
+enabled. The manifest path this prints is what occ backup:user:restore expects.
+
+Example:
+  occ backup:user:backup offsite alice
+HELP);
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$uid = (string)$input->getArgument('user');
+		$user = $this->userManager->get($uid);
+		if ($user === null) {
+			$output->writeln("<error>No such user: $uid</error>");
+			return 1;
+		}
+		try {
+			$target = $this->targets->get($input->getArgument('target'));
+			$this->installer->ensureEnabled($input, $output);
+			$manifest = $this->userBackup->backupUser($target, $user);
+		} catch (\Throwable $e) {
+			$output->writeln('<error>' . $e->getMessage() . '</error>');
+			return 1;
+		}
+		$output->writeln("Backed up <info>$uid</info> to $manifest.");
+		return 0;
+	}
+}
@@ -0,0 +1,85 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Command;
+
+use OCA\NgBackup\Service\KeyService;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Question\Question;
+
+final class KeyImport extends Command {
+	public function __construct(
+		private KeyService $keys,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this->setName('backup:key:import')
+			->setDescription('Disaster recovery: adopt the backup key from a recovery kit on a fresh installation')
+			->addArgument('kit-file', InputArgument::REQUIRED, 'The recovery kit file (occ backup:key:kit on the original installation)')
+			->addOption('passphrase-file', null, InputOption::VALUE_REQUIRED, 'Read the passphrase from this file instead of asking')
+			->setHelp(<<<'HELP'
+For a fresh installation only (occ backup:key:init must not have been run here yet). Reads one
+of the kit's passphrase slots to recover the original master key, so occ backup:target:add opens
+the existing repository on the location instead of creating a new, empty one.
+
+Example:
+  occ backup:key:import /root/ng_backup-recovery-kit.json
+  occ backup:target:add offsite sftp -a password::password -o host=... -o user=... -o password=...
+  occ backup:restore:full offsite <snapshot>
+HELP);
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		if ($this->keys->isInitialized()) {
+			$output->writeln('<error>A backup key already exists here (fingerprint ' . $this->keys->fingerprint() . '). occ backup:key:import is only for a fresh installation.</error>');
+			return 1;
+		}
+		$kitFile = (string)$input->getArgument('kit-file');
+		$raw = @file_get_contents($kitFile);
+		if ($raw === false) {
+			$output->writeln("<error>Cannot read $kitFile</error>");
+			return 1;
+		}
+		try {
+			$kit = json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
+		} catch (\JsonException $e) {
+			$output->writeln('<error>Not a valid recovery kit file: ' . $e->getMessage() . '</error>');
+			return 1;
+		}
+		$file = $input->getOption('passphrase-file');
+		if ($file !== null) {
+			$raw = @file_get_contents($file);
+			if ($raw === false) {
+				$output->writeln('<error>Cannot read the passphrase file</error>');
+				return 1;
+			}
+			$pass = rtrim($raw, "\r\n");
+		} else {
+			$helper = $this->getHelper('question');
+			$q = (new Question('Passphrase of one of the kit\'s slots: '))->setHidden(true)->setHiddenFallback(false);
+			$pass = (string)$helper->ask($input, $output, $q);
+		}
+		try {
+			$this->keys->importRecoveryKit($kit, $pass);
+		} catch (\Throwable $e) {
+			$output->writeln('<error>' . $e->getMessage() . '</error>');
+			return 1;
+		}
+		$output->writeln('Backup key imported, fingerprint <info>' . $this->keys->fingerprint() . '</info>.');
+		// Read from the kit file, which is not authenticated beyond the wrapped key: show it so a
+		// wrong or altered value stands out.
+		$output->writeln('Deletion delay for forgotten snapshots: <info>' . $this->keys->deleteDelayDays() . '</info> days (from the kit).');
+		$output->writeln('Next: connect the backup location with the same details as before (<info>occ backup:target:add</info>), then <info>occ backup:list</info> and <info>occ backup:restore:full</info>.');
+		return 0;
+	}
+}
@@ -39,11 +39,24 @@ final class KeyKit extends Command {
 			$output->write($json, false, OutputInterface::OUTPUT_RAW);
 			return 0;
 		}
-		if (file_put_contents($file, $json) === false) {
+		// Created owner-only from the start (no window where it is world-readable), never over an
+		// existing file or symlink someone else may have placed at a predictable path.
+		$old = umask(0077);
+		try {
+			$fh = @fopen($file, 'xb');
+		} finally {
+			umask($old);
+		}
+		if ($fh === false) {
+			$output->writeln("<error>Cannot create $file (it must not exist yet)</error>");
+			return 1;
+		}
+		$ok = fwrite($fh, $json) === strlen($json);
+		if (!fclose($fh) || !$ok) {
+			@unlink($file);
 			$output->writeln("<error>Cannot write $file</error>");
 			return 1;
 		}
-		@chmod($file, 0600);
 		$output->writeln("Recovery kit written to <info>$file</info>. Copy it off this server, then run <info>occ backup:key:confirm</info>.");
 		return 0;
 	}
@@ -37,6 +37,22 @@ final class Prune extends Command {
 		$output->writeln('Policy: ' . json_encode($this->prune->policy()->toArray()) . ($dry ? ' (dry run)' : ''));
 		$rc = 0;
 		foreach ($targets as $t) {
+			// User exports first: Repository::prune()'s blob garbage collection (run as part of
+			// apply() below) scans the users/ manifests still on the location at that point, so
+			// forgetting one here lets its now-unused blobs be freed in this same pass.
+			try {
+				$ru = $this->prune->applyUserExports($t, $dry);
+			} catch (\Throwable $e) {
+				// Snapshot retention is independent of this: report and carry on with it.
+				$output->writeln('<error>' . $t->getName() . ' (user exports): ' . $e->getMessage() . '</error>');
+				$rc = 1;
+				$ru = ['forgotten' => []];
+			}
+			if ($ru['forgotten'] !== []) {
+				$affected = count(array_unique(array_map(static fn (string $path): string => explode('/', $path)[1] ?? '', $ru['forgotten'])));
+				$output->writeln(sprintf('<info>%s</info>: %s %d user export(s) for %d user(s)',
+					$t->getName(), $dry ? 'would forget' : 'forgot', count($ru['forgotten']), $affected));
+			}
 			try {
 				$r = $this->prune->apply($t, $dry);
 			} catch (\Throwable $e) {
@@ -0,0 +1,97 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Command;
+
+use OCA\NgBackup\Service\RestoreFullService;
+use OCA\NgBackup\Service\TargetService;
+use OCP\IUserManager;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Helper\QuestionHelper;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Question\ConfirmationQuestion;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+final class RestoreFull extends Command {
+	public function __construct(
+		private TargetService $targets,
+		private RestoreFullService $restoreFull,
+		private IUserManager $userManager,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this->setName('backup:restore:full')
+			->setDescription('Disaster recovery: restore the database, data directory and config on a fresh installation')
+			->addArgument('target', InputArgument::REQUIRED, 'Location name or id')
+			->addArgument('snapshot', InputArgument::REQUIRED, 'Snapshot id (see backup:list)')
+			->addOption('force', null, InputOption::VALUE_NONE, 'Also on an installation that already has more than one user, and without asking')
+			->setHelp(<<<'HELP'
+For a FRESH Nextcloud installation only, same major version as the backup, right after
+occ maintenance:install, occ backup:key:import and occ backup:target:add -- before anyone else
+uses this instance.
+
+Every app that was enabled when the snapshot was taken must already be installed here (its
+database tables must exist before the restore can write into them); the command lists what is
+missing and refuses to continue rather than guess.
+
+Steps: the database is replaced (consistent, in one transaction); the data directory is restored
+directly in place; config.php is merged in -- everything from the backup except the database
+connection and data directory settings, which stay as occ maintenance:install configured them
+here. Other files under config/ (if any) are not restored.
+
+Afterwards: check trusted_domains and overwritehost/overwriteprotocol match this server, and
+occ maintenance:repair.
+
+Example:
+  occ backup:restore:full offsite 537bf7e9c1a4...
+HELP);
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$force = (bool)$input->getOption('force');
+		// A whole-server restore replaces the database and data directory of THIS instance. On
+		// anything but a fresh install (only the admin from occ maintenance:install) that is
+		// almost certainly a mistake, so it needs --force.
+		$users = $this->userManager->countUsersTotal(2);
+		if (!$force && ($users === false || $users > 1)) {
+			$output->writeln('<error>This installation already has more than one user: backup:restore:full would replace its whole database and data directory. It is meant for a fresh installation. Use --force if this really is what you want.</error>');
+			return 1;
+		}
+		if (!$force && $input->isInteractive()) {
+			$q = new ConfirmationQuestion('This replaces the database, the data directory and config.php of this installation. Continue? [y/N] ', false);
+			if (!(new QuestionHelper())->ask($input, $output, $q)) {
+				$output->writeln('Cancelled.');
+				return 1;
+			}
+		}
+		try {
+			$target = $this->targets->get($input->getArgument('target'));
+			$snapshot = (string)$input->getArgument('snapshot');
+			$result = $this->restoreFull->restoreFull($target, $snapshot);
+		} catch (\Throwable $e) {
+			$output->writeln('<error>' . $e->getMessage() . '</error>');
+			$output->writeln('If this happened after the restore had started, the instance may be partly restored: fix the cause and run the same command again with --force.');
+			return 1;
+		}
+		$output->writeln(sprintf(
+			'Database restored (<info>%d</info> tables, <info>%d</info> unchanged), config merged (<info>%d</info> keys), <info>%d</info> data files restored.',
+			count($result['dbReport']['restored']),
+			count($result['dbReport']['skipped']),
+			$result['configKeys'],
+			$result['dataFiles'],
+		));
+		if (!$result['dbConsistent']) {
+			$output->writeln('<comment>Warning: this snapshot\'s database dump was made over several steps (web cron), so it is not one consistent point in time. Check the instance carefully; prefer a snapshot made with system cron.</comment>');
+		}
+		$output->writeln('Next: check trusted_domains and overwritehost/overwriteprotocol match this server, then occ maintenance:repair.');
+		return 0;
+	}
+}
@@ -0,0 +1,82 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Command;
+
+use OCA\NgBackup\Service\TargetService;
+use OCA\NgBackup\Service\UserRestoreService;
+use OCA\NgBackup\UserMigration\UserMigrationInstaller;
+use OCP\IUserManager;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Helper\QuestionHelper;
+use Symfony\Component\Console\Question\ConfirmationQuestion;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+
+final class RestoreUser extends Command {
+	public function __construct(
+		private TargetService $targets,
+		private UserRestoreService $userRestore,
+		private UserMigrationInstaller $installer,
+		private IUserManager $userManager,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this->setName('backup:user:restore')
+			->setDescription('Restore a user from a user_migration export (see backup:user:backup)')
+			->addArgument('target', InputArgument::REQUIRED, 'Location name or id')
+			->addArgument('manifest', InputArgument::REQUIRED, 'Manifest path printed by backup:user:backup (users/<uid>/<exportId>)')
+			->addOption('mode', 'm', InputOption::VALUE_REQUIRED, 'replace or as-backup', UserRestoreService::MODE_REPLACE)
+			->addOption('force', null, InputOption::VALUE_NONE, 'Replace an existing account without asking (required when not interactive)')
+			->addOption('install-user-migration', null, InputOption::VALUE_NONE, 'Install and enable user_migration if it is missing (non-interactive consent)')
+			->setHelp(<<<'HELP'
+Never imports over a live account. Modes:
+  replace    (default) safety-exports the current account first, then deletes and recreates it
+             fresh from the backup, under the same user id
+  as-backup  restores into a new account "<uid>-bak" (or "-bak-2", ...) instead, so an admin can
+             compare and transfer by hand; Nextcloud cannot rename a user id, so the backup gets
+             the new name, never the existing account
+
+Example:
+  occ backup:user:restore offsite users/alice/20261005T120000Z-ab12cd34
+  occ backup:user:restore offsite users/alice/20261005T120000Z-ab12cd34 --mode=as-backup
+HELP);
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$mode = (string)$input->getOption('mode');
+		$uid = explode('/', (string)$input->getArgument('manifest'))[1] ?? '';
+		if ($mode === UserRestoreService::MODE_REPLACE && $uid !== '' && $this->userManager->userExists($uid) && !$input->getOption('force')) {
+			// Replace deletes the live account (after a safety export). Shares to others and data of
+			// apps without a user_migration migrator do not come back, so never do it unasked.
+			if (!$input->isInteractive()) {
+				$output->writeln("<error>$uid exists: --mode=replace deletes and recreates it. Add --force, or use --mode=as-backup.</error>");
+				return 1;
+			}
+			$q = new ConfirmationQuestion("$uid exists and will be deleted and recreated from the backup (a safety export is made first; its shares to others and data of apps without a migrator are not restored). Continue? [y/N] ", false);
+			if (!(new QuestionHelper())->ask($input, $output, $q)) {
+				$output->writeln('Cancelled.');
+				return 1;
+			}
+		}
+		try {
+			$output->writeln('<comment>Note: on restore, user_migration only imports the app settings on its own allowlist (e.g. calendar view and reminder settings); other app settings of this user are skipped. Reason: NG Backup uses user_migration\'s importer; widening the list would mean building a settings importer of our own.</comment>');
+			$target = $this->targets->get($input->getArgument('target'));
+			$this->installer->ensureEnabled($input, $output);
+			$user = $this->userRestore->restoreUser($target, (string)$input->getArgument('manifest'), $mode);
+		} catch (\Throwable $e) {
+			$output->writeln('<error>' . $e->getMessage() . '</error>');
+			return 1;
+		}
+		$output->writeln('Restored <info>' . $user->getUID() . '</info>.');
+		return 0;
+	}
+}
@@ -28,10 +28,15 @@ final class Retention extends Command {
 			->addOption('daily', null, InputOption::VALUE_REQUIRED, 'Keep one per day for the last N days with a backup')
 			->addOption('weekly', null, InputOption::VALUE_REQUIRED, 'Keep one per week for N weeks')
 			->addOption('monthly', null, InputOption::VALUE_REQUIRED, 'Keep one per month for N months')
-			->setHelp("Example: occ backup:retention --last=3 --daily=7 --weekly=4 --monthly=12");
+			->addOption('user-last', null, InputOption::VALUE_REQUIRED, 'Keep the newest N of each user\'s own exports (occ backup:user:backup)')
+			->setHelp("Example: occ backup:retention --last=3 --daily=7 --weekly=4 --monthly=12 --user-last=3");
 	}

 	protected function execute(InputInterface $input, OutputInterface $output): int {
+		if ($input->getOption('user-last') !== null && !ctype_digit((string)$input->getOption('user-last'))) {
+			$output->writeln('<error>--user-last must be a whole number</error>');
+			return 1;
+		}
 		$p = $this->prune->policy()->toArray();
 		$changed = false;
 		foreach (['last', 'daily', 'weekly', 'monthly'] as $k) {
@@ -48,7 +53,16 @@ final class Retention extends Command {
 				return 1;
 			}
 		}
+		if ($input->getOption('user-last') !== null) {
+			try {
+				$this->prune->setUserExportRetention((int)$input->getOption('user-last'));
+			} catch (\InvalidArgumentException $e) {
+				$output->writeln('<error>' . $e->getMessage() . '</error>');
+				return 1;
+			}
+		}
 		$output->writeln(sprintf('Keep the last %d, plus one per day for %d days, per week for %d weeks, per month for %d months.', $p['last'], $p['daily'], $p['weekly'], $p['monthly']));
+		$output->writeln(sprintf('Keep the newest %d of each user\'s own exports.', $this->prune->userExportRetention()));
 		return 0;
 	}
 }
@@ -75,6 +75,13 @@ HELP);
 			});
 			if ($run->getStatus() === Run::DONE) {
 				$output->writeln(sprintf('  done in %.0fs', microtime(true) - $start));
+				$f = json_decode($run->getStats() ?? '{}', true)['files'] ?? [];
+				if (($f['unreadable'] ?? 0) > 0) {
+					$output->writeln(sprintf('<comment>  warning: %d unreadable files or folders are missing from this backup (see the server log)</comment>', $f['unreadable']));
+				}
+				if (($f['changing'] ?? 0) > 0) {
+					$output->writeln(sprintf('<comment>  warning: %d files kept changing and were saved as read (see the server log)</comment>', $f['changing']));
+				}
 			} else {
 				$output->writeln('<error>  ' . $run->getStatus() . ': ' . $run->getError() . '</error>');
 				$failed++;
@@ -10,6 +10,7 @@ namespace OCA\NgBackup\Command;
 use OCA\NgBackup\Db\RunMapper;
 use OCA\NgBackup\Service\KeyService;
 use OCA\NgBackup\Service\TargetService;
+use OCA\NgBackup\Service\VerifyService;
 use Symfony\Component\Console\Command\Command;
 use Symfony\Component\Console\Helper\Table;
 use Symfony\Component\Console\Input\InputInterface;
@@ -20,6 +21,7 @@ final class Status extends Command {
 		private KeyService $keys,
 		private TargetService $targets,
 		private RunMapper $runs,
+		private VerifyService $verify,
 	) {
 		parent::__construct();
 	}
@@ -44,13 +46,23 @@ final class Status extends Command {
 		$rows = [];
 		foreach ($this->runs->findRecent(10) as $r) {
 			$s = json_decode($r->getStats() ?? '{}', true)['files'] ?? [];
-			$rows[] = [$r->getId(), $names[$r->getTargetId()] ?? '#' . $r->getTargetId(), $r->getKind(), $r->getStatus() . ($r->getStatus() === 'running' ? ' (' . $r->getPhase() . ')' : ''),
+			$rows[] = [$r->getId(), $names[$r->getTargetId()] ?? '#' . $r->getTargetId(), $r->getKind(), $r->getStatus() . ($r->getStatus() === 'running' ? ' (' . $r->getPhase() . self::percent($r) . ')' : ''),
 				date('Y-m-d H:i', $r->getStartedAt()), $r->getFinishedAt() ? gmdate('H:i:s', $r->getFinishedAt() - $r->getStartedAt()) : '',
 				$s['files'] ?? '', isset($s['uploaded']) ? sprintf('%.1f MiB', $s['uploaded'] / 1048576) : '', mb_strimwidth((string)$r->getError(), 0, 50, '…')];
 		}
 		if ($rows !== []) {
 			(new Table($output))->setHeaders(['run', 'location', 'kind', 'status', 'started', 'took', 'files', 'uploaded', 'error'])->setRows($rows)->render();
 		}
+		foreach ($this->verify->progress() as $targetId => $state) {
+			$output->writeln(sprintf('Verify of %s on %s: %s', mb_strimwidth((string)($state['what'] ?? ''), 0, 40, '…'),
+				$names[$targetId] ?? '#' . $targetId, VerifyService::describe($state)));
+		}
 		return 0;
 	}
+
+	/** " 68%", or " ~68%" when estimated from the file cache; empty without an estimate */
+	private static function percent(\OCA\NgBackup\Db\Run $r): string {
+		$p = \OCA\NgBackup\Job\BackupRun::progressOf($r);
+		return $p === null ? '' : sprintf(' %s%d%%', $p['approximate'] ? '~' : '', (int)floor($p['fraction'] * 100.0));
+	}
 }
@@ -0,0 +1,71 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Command;
+
+use OCA\NgBackup\Service\AlertService;
+use OCA\NgBackup\Service\TargetService;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+
+final class TargetEdit extends Command {
+	public function __construct(
+		private TargetService $targets,
+		private AlertService $alerts,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this->setName('backup:target:edit')
+			->setDescription('Change the connection settings or the name of a backup location, keeping its backups')
+			->addArgument('target', InputArgument::REQUIRED, 'Location name or id')
+			->addOption('name', null, InputOption::VALUE_REQUIRED, 'New name')
+			->addOption('backend', 'b', InputOption::VALUE_REQUIRED, 'New files_external backend id (see backup:target:backends)')
+			->addOption('auth', 'a', InputOption::VALUE_REQUIRED, 'New auth mechanism id')
+			->addOption('option', 'o', InputOption::VALUE_REQUIRED | InputOption::VALUE_IS_ARRAY, 'Option key=value to change (repeatable); other options keep their value')
+			->addOption('path', 'p', InputOption::VALUE_REQUIRED, 'New folder on the location')
+			->setHelp(<<<'HELP'
+The new settings must lead to the same repository as before, so the history of the location is
+kept. Use it after a password change, a new host name, or after moving the repository.
+
+Example:
+  occ backup:target:edit nas -o password=new-secret
+HELP);
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		try {
+			$t = $this->targets->get($input->getArgument('target'));
+			$options = $this->targets->options($t);
+			if ($input->getOption('backend') !== null || $input->getOption('auth') !== null) {
+				$options = []; // a different connection type has its own options
+			}
+			foreach ($input->getOption('option') as $pair) {
+				if (!str_contains($pair, '=')) {
+					$output->writeln("<error>Option '$pair' must be key=value</error>");
+					return 1;
+				}
+				$k = (string)strstr($pair, '=', true);
+				$v = substr($pair, strlen($k) + 1);
+				$options[$k] = match (strtolower($v)) { 'true' => true, 'false' => false, default => $v };
+			}
+			$before = $t->getName();
+			$t = $this->targets->update($t, $input->getOption('name') ?? $t->getName(), $input->getOption('backend') ?? $t->getBackend(),
+				$input->getOption('auth') ?? $t->getAuth(), $options, $input->getOption('path') ?? $t->getBasePath());
+		} catch (\Throwable $e) {
+			$output->writeln('<error>' . $e->getMessage() . '</error>');
+			return 1;
+		}
+		$this->alerts->securityEvent('target_changed', ['target' => $before]);
+		$output->writeln(sprintf('Location <info>%s</info> updated; repository %s found with the new settings.', $t->getName(), (string)$t->getRepositoryId()));
+		return 0;
+	}
+}
@@ -0,0 +1,87 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Command;
+
+use OCA\NgBackup\Service\TargetService;
+use OCA\NgBackup\Service\VerifyService;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+
+final class Verify extends Command {
+	public function __construct(
+		private TargetService $targets,
+		private VerifyService $verify,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this->setName('backup:verify')
+			->setDescription('Checksum audit of a snapshot: every blob it needs must be in the (freshly re-checked) index and its pack present')
+			->addArgument('target', InputArgument::REQUIRED, 'Location name or id')
+			->addArgument('snapshot', InputArgument::REQUIRED, 'Snapshot id (see backup:list)')
+			->addOption('deep', null, InputOption::VALUE_NONE, 'Also download and decrypt every blob (verifies its authentication tag and content hash, not just that it is listed); much slower')
+			->setHelp(<<<'HELP'
+Without --deep this re-downloads and re-authenticates the index (never trusting the local cache)
+and confirms every blob the snapshot needs is listed and its pack is present -- fast, no blob
+content is read, so it cannot by itself catch a truncated or bit-rotted pack. With --deep every
+blob is also downloaded and decrypted, which fails loudly on exactly that even if the index still
+lists it -- the same verification an actual restore would do, run here deliberately instead of
+waiting to find out during one.
+
+While it runs it prints how far it is every 30 seconds; occ backup:status shows the same, and
+how the last check of each location ended.
+
+Run this periodically (cron, picking a sample of recent snapshots) rather than only right before
+you'd need to rely on a restore.
+
+Examples:
+  occ backup:verify offsite 537bf7e9c1a4...
+  occ backup:verify offsite 537bf7e9c1a4... --deep
+HELP);
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		try {
+			$target = $this->targets->get($input->getArgument('target'));
+			$ref = (string)$input->getArgument('snapshot');
+			$deep = (bool)$input->getOption('deep');
+			$onProgress = static function (array $state) use ($output): void {
+				$output->writeln(date('H:i:s') . ' ' . VerifyService::describe($state));
+			};
+			$result = str_starts_with($ref, 'users/')
+				? $this->verify->verifyUserExport($target, $ref, $deep, $onProgress)
+				: $this->verify->verify($target, $ref, $deep, $onProgress);
+		} catch (\Throwable $e) {
+			$output->writeln('<error>' . $e->getMessage() . '</error>');
+			return 1;
+		}
+		$output->writeln(sprintf('%d files, %d blobs checked%s.', $result['filesChecked'], $result['blobsChecked'],
+			$deep ? sprintf(' (%.1f MiB decrypted)', $result['bytesChecked'] / 1048576) : ''));
+		if ($result['missing'] !== []) {
+			$output->writeln('<error>' . count($result['missing']) . ' blob(s) missing from the index:</error> ' . implode(', ', $result['missing']));
+		}
+		if ($result['failed'] !== []) {
+			$output->writeln('<error>' . count($result['failed']) . ' blob(s) failed verification (corrupted or tampered):</error> ' . implode(', ', $result['failed']));
+		}
+		if ($result['unreadable'] !== []) {
+			$output->writeln('<error>' . count($result['unreadable']) . ' blob(s) could not be read from the location</error> (often a temporary storage '
+				. 'or network error: run the check again; if the same blobs stay unreadable, their pack may be damaged or truncated): '
+				. implode(', ', $result['unreadable']));
+			$output->writeln('Last read error: ' . $result['readError']);
+		}
+		if ($result['missing'] === [] && $result['failed'] === [] && $result['unreadable'] === []) {
+			$output->writeln('<info>OK</info>');
+			return 0;
+		}
+		return 1;
+	}
+}
@@ -168,6 +168,7 @@ final class AdminApiController extends Controller {
 		return new JSONResponse($this->targets->availableBackends());
 	}

+	#[PasswordConfirmationRequired]
 	public function addTarget(string $name, string $backend, string $auth, array $options = [], string $path = 'ng_backup', ?float $maxGb = null): JSONResponse {
 		try {
 			$r = $this->targets->add($name, $backend, $auth, $options, $path);
@@ -180,6 +181,28 @@ final class AdminApiController extends Controller {
 		return new JSONResponse(['id' => $r['target']->getId(), 'created' => $r['created']]);
 	}

+	/** The stored settings for the edit form; password values are left out (null). */
+	#[PasswordConfirmationRequired]
+	public function targetSettings(int $id): JSONResponse {
+		$t = $this->targets->get((string)$id);
+		return new JSONResponse(['name' => $t->getName(), 'backend' => $t->getBackend(), 'auth' => $t->getAuth(),
+			'options' => $this->targets->editableOptions($t), 'path' => $t->getBasePath()]);
+	}
+
+	/** Options with a null value keep their stored value. */
+	#[PasswordConfirmationRequired]
+	public function updateTarget(int $id, string $name, string $backend, string $auth, array $options = [], string $path = 'ng_backup'): JSONResponse {
+		try {
+			$t = $this->targets->get((string)$id);
+			$before = $t->getName();
+			$t = $this->targets->update($t, $name, $backend, $auth, $options, $path);
+		} catch (\Throwable $e) {
+			return new JSONResponse(['error' => $e->getMessage()], Http::STATUS_BAD_REQUEST);
+		}
+		$this->alerts->securityEvent('target_changed', ['target' => $before]);
+		return new JSONResponse(['id' => $t->getId()]);
+	}
+
 	/** Size limit in GiB; null or 0 = unlimited. */
 	#[PasswordConfirmationRequired]
 	public function setTargetLimit(int $id, ?float $maxGb = null): JSONResponse {
@@ -282,6 +305,6 @@ final class AdminApiController extends Controller {
 		return ['id' => $r->getId(), 'targetId' => $r->getTargetId(), 'kind' => $r->getKind(), 'status' => $r->getStatus(),
 			'phase' => $r->getPhase(), 'snapshotId' => $r->getSnapshotId(), 'snapshot' => $snapshot, 'startedAt' => $r->getStartedAt(),
 			'updatedAt' => $r->getUpdatedAt(), 'finishedAt' => $r->getFinishedAt(), 'error' => $r->getError(),
-			'stats' => json_decode($r->getStats() ?? 'null', true)];
+			'stats' => json_decode($r->getStats() ?? 'null', true), 'progress' => \OCA\NgBackup\Job\BackupRun::progressOf($r)];
 	}
 }
@@ -96,6 +96,12 @@ final class KeyRing {
 	/** @param array{v:int, salt:string, ops:int, mem:int, nonce:string, key:string} $wrapped */
 	public static function unwrap(array $wrapped, #[\SensitiveParameter] string $passphrase): self {
 		$b64 = static fn (string $s): string => sodium_base642bin($s, SODIUM_BASE64_VARIANT_ORIGINAL);
+		// ops/mem come from unauthenticated JSON (kit file, repository config): bound them, so a
+		// damaged or crafted file cannot make the KDF use unbounded memory or time.
+		if ($wrapped['ops'] < SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE || $wrapped['ops'] > SODIUM_CRYPTO_PWHASH_OPSLIMIT_SENSITIVE
+			|| $wrapped['mem'] < SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE || $wrapped['mem'] > SODIUM_CRYPTO_PWHASH_MEMLIMIT_SENSITIVE) {
+			throw new CryptoException('Unsupported key derivation parameters (damaged or foreign key file)');
+		}
 		$kek = sodium_crypto_pwhash(SODIUM_CRYPTO_SECRETBOX_KEYBYTES, $passphrase, $b64($wrapped['salt']),
 			$wrapped['ops'], $wrapped['mem'], SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13);
 		$master = sodium_crypto_secretbox_open($b64($wrapped['key']), $b64($wrapped['nonce']), $kek);
@@ -122,6 +122,7 @@ final class StreamCipher {
 	/** fread() may return short reads on network streams; keep reading until $length or EOF. */
 	private static function readFull($in, int $length): string {
 		$buffer = '';
+		$empty = 0;
 		while (strlen($buffer) < $length && !feof($in)) {
 			$chunk = fread($in, $length - strlen($buffer));
 			if ($chunk === false) {
@@ -132,8 +133,15 @@ final class StreamCipher {
 				if (feof($in)) {
 					break;
 				}
+				// A stalled network stream returns '' without EOF forever: back off, then give up
+				// (about a minute) instead of spinning at full CPU until the lease expires.
+				if (++$empty > 600) {
+					throw new CryptoException('Read stalled');
+				}
+				usleep(100000);
 				continue;
 			}
+			$empty = 0;
 			$buffer .= $chunk;
 		}
 		return $buffer;
@@ -72,50 +72,57 @@ final class DbDumper {
 	public function dumpStep(Repository $repo, array $state, float $deadline, array &$stats): array {
 		$state['steps']++;
 		$sm = $this->db->createSchemaManager();
-		$this->db->setTransactionIsolation(TransactionIsolationLevel::REPEATABLE_READ);
-		$this->db->beginTransaction();
+		// A pack that fills up during the dump is uploaded right away; its index cache row must
+		// wait until the read-only transaction is over.
+		$repo->holdIndexCache();
 		try {
-			if ($this->db->getDatabasePlatform() instanceof \Doctrine\DBAL\Platforms\PostgreSQLPlatform) {
-				$this->db->executeStatement('SET TRANSACTION READ ONLY');
-			}
-			while ($state['i'] < count($state['tables'])) {
-				$table = $state['tables'][$state['i']];
-				$schema = $sm->introspectTable($table);
-				$writer = $repo->blobWriter($stats);
-				$hash = $state['hash'] !== null ? unserialize(base64_decode($state['hash']), ['allowed_classes' => [\HashContext::class]]) : hash_init('sha256');
-				if ($state['after'] === null && $state['segments'] === []) {
-					$writer->write($this->header($schema) . "\n");
+			$this->db->setTransactionIsolation(TransactionIsolationLevel::REPEATABLE_READ);
+			$this->db->beginTransaction();
+			try {
+				if ($this->db->getDatabasePlatform() instanceof \Doctrine\DBAL\Platforms\PostgreSQLPlatform) {
+					$this->db->executeStatement('SET TRANSACTION READ ONLY');
 				}
-				$complete = true;
-				foreach ($this->rowLines($schema, $state['after']) as [$key, $line]) {
-					$writer->write($line . "\n");
-					hash_update($hash, $line . "\n");
-					$state['rows']++;
-					$state['after'] = $key;
-					if (microtime(true) >= $deadline) {
-						$complete = false;
+				while ($state['i'] < count($state['tables'])) {
+					$table = $state['tables'][$state['i']];
+					$schema = $sm->introspectTable($table);
+					$writer = $repo->blobWriter($stats);
+					$hash = $state['hash'] !== null ? unserialize(base64_decode($state['hash']), ['allowed_classes' => [\HashContext::class]]) : hash_init('sha256');
+					if ($state['after'] === null && $state['segments'] === []) {
+						$writer->write($this->header($schema) . "\n");
+					}
+					$complete = true;
+					foreach ($this->rowLines($schema, $state['after']) as [$key, $line]) {
+						$writer->write($line . "\n");
+						hash_update($hash, $line . "\n");
+						$state['rows']++;
+						$state['after'] = $key;
+						if (microtime(true) >= $deadline) {
+							$complete = false;
+							break;
+						}
+					}
+					$state['segments'][] = $writer->finish();
+					$state['bytes'] += $writer->bytes();
+					if (!$complete) {
+						$state['hash'] = base64_encode(serialize($hash));
+						break;
+					}
+					$state['result'][$table] = ['blobs' => array_merge(...$state['segments']), 'rows' => $state['rows'],
+						'bytes' => $state['bytes'], 'sha256' => hash_final($hash)];
+					$state = array_merge($state, ['i' => $state['i'] + 1, 'after' => null, 'segments' => [], 'rows' => 0, 'bytes' => 0, 'hash' => null]);
+					if (microtime(true) >= $deadline && $state['i'] < count($state['tables'])) {
 						break;
 					}
 				}
-				$state['segments'][] = $writer->finish();
-				$state['bytes'] += $writer->bytes();
-				if (!$complete) {
-					$state['hash'] = base64_encode(serialize($hash));
-					break;
+				if ($state['i'] >= count($state['tables'])) {
+					$state['sequences'] = $this->sequenceStates($state['tables']);
+					$state['done'] = true;
 				}
-				$state['result'][$table] = ['blobs' => array_merge(...$state['segments']), 'rows' => $state['rows'],
-					'bytes' => $state['bytes'], 'sha256' => hash_final($hash)];
-				$state = array_merge($state, ['i' => $state['i'] + 1, 'after' => null, 'segments' => [], 'rows' => 0, 'bytes' => 0, 'hash' => null]);
-				if (microtime(true) >= $deadline && $state['i'] < count($state['tables'])) {
-					break;
-				}
-			}
-			if ($state['i'] >= count($state['tables'])) {
-				$state['sequences'] = $this->sequenceStates($state['tables']);
-				$state['done'] = true;
+			} finally {
+				$this->db->rollBack();
 			}
 		} finally {
-			$this->db->rollBack();
+			$repo->releaseIndexCache();
 		}
 		$repo->flushPacks();
 		return $state;
@@ -132,7 +139,7 @@ final class DbDumper {
 	 *
 	 * @param array{tables: array<string, array{blobs: list<string>, rows: int}>} $manifest
 	 */
-	public function restore(Repository $repo, array $manifest, ?array &$report = null): int {
+	public function restore(Repository $repo, array $manifest, ?array &$report = null, ?callable $heartbeat = null): int {
 		$sm = $this->db->createSchemaManager();
 		$existing = array_flip($sm->listTableNames());
 		$total = 0;
@@ -175,6 +182,9 @@ final class DbDumper {
 					if (count($batch) >= self::INSERT_ROWS) {
 						$total += $this->insertBatch($table, $columns, $batch, $binary);
 						$batch = [];
+						if ($heartbeat !== null) {
+							$heartbeat();
+						}
 					}
 				}
 				if ($batch !== []) {
@@ -253,7 +263,11 @@ final class DbDumper {
 					} elseif (is_string($row[$i]) && !mb_check_encoding($row[$i], 'UTF-8')) {
 						// Keep invalid UTF-8 byte-exact instead of substituting characters.
 						$row[$i] = ['$b' => base64_encode($row[$i])];
-					} elseif (is_int($row[$i]) || is_float($row[$i]) || is_bool($row[$i])) {
+					} elseif (is_float($row[$i])) {
+						// var_export uses serialize_precision (shortest exact form), not the lossy
+						// 14-digit 'precision' of a (string) cast.
+						$row[$i] = var_export($row[$i], true);
+					} elseif (is_int($row[$i]) || is_bool($row[$i])) {
 						// Normalise: drivers differ in returning numbers as int or string.
 						$row[$i] = (string)(is_bool($row[$i]) ? (int)$row[$i] : $row[$i]);
 					}
@@ -30,19 +30,84 @@ final class DbIndexCache implements IIndexCache {
 	}

 	public function put(string $repositoryId, string $packId, array $entries): void {
+		try {
+			$this->insert($repositoryId, $packId, $entries);
+		} catch (Exception $e) {
+			if ($e->getReason() !== Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
+				throw $e;
+			}
+		}
+	}
+
+	/**
+	 * In one transaction: on PostgreSQL with its default settings every statement of its own
+	 * waits for a disk sync, which made 27,547 rows take more than 6 minutes. Rows already there
+	 * are replaced. Should the transaction fail (another process writing the same rows), the
+	 * rows are written one by one, keeping rows that are already there.
+	 */
+	public function putMany(string $repositoryId, array $packs): void {
+		if ($packs === []) {
+			return;
+		}
+		try {
+			$this->transaction(function () use ($repositoryId, $packs): void {
+				$this->remove($repositoryId, array_keys($packs));
+				$this->insertAll($repositoryId, $packs);
+			});
+		} catch (\Throwable $e) {
+			if ($this->db->inTransaction()) {
+				throw $e; // a transaction of the caller's, which may be spoilt now
+			}
+			foreach ($packs as $packId => $entries) {
+				$this->put($repositoryId, $packId, $entries);
+			}
+		}
+	}
+
+	/** All or nothing: when it fails, the cache stays as it was. */
+	public function replaceAll(string $repositoryId, array $packs): void {
+		$this->transaction(function () use ($repositoryId, $packs): void {
+			$qb = $this->db->getQueryBuilder();
+			$qb->delete('ngb_index')->where($qb->expr()->eq('repository_id', $qb->createNamedParameter($repositoryId)));
+			$qb->executeStatement();
+			$this->insertAll($repositoryId, $packs);
+		});
+	}
+
+	/** Run $write in a transaction of its own, or as part of the caller's when there is one. */
+	private function transaction(\Closure $write): void {
+		if ($this->db->inTransaction()) {
+			$write();
+			return;
+		}
+		$this->db->beginTransaction();
+		try {
+			$write();
+			$this->db->commit();
+		} catch (\Throwable $e) {
+			if ($this->db->inTransaction()) {
+				$this->db->rollBack();
+			}
+			throw $e;
+		}
+	}
+
+	/** @param array<string, list<array{id:string, offset:int, length:int, raw:int, flags:int}>> $packs */
+	private function insertAll(string $repositoryId, array $packs): void {
+		foreach ($packs as $packId => $entries) {
+			$this->insert($repositoryId, $packId, $entries);
+		}
+	}
+
+	/** @param list<array{id:string, offset:int, length:int, raw:int, flags:int}> $entries */
+	private function insert(string $repositoryId, string $packId, array $entries): void {
 		$qb = $this->db->getQueryBuilder();
 		$qb->insert('ngb_index')->values([
 			'repository_id' => $qb->createNamedParameter($repositoryId),
 			'pack_id' => $qb->createNamedParameter($packId),
 			'entries' => $qb->createNamedParameter(json_encode($entries, JSON_THROW_ON_ERROR)),
 		]);
-		try {
-			$qb->executeStatement();
-		} catch (Exception $e) {
-			if ($e->getReason() !== Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
-				throw $e;
-			}
-		}
+		$qb->executeStatement();
 	}

 	public function remove(string $repositoryId, array $packIds): void {
@@ -17,6 +17,36 @@ final class RunMapper extends QBMapper {
 		parent::__construct($db, 'ngb_runs', Run::class);
 	}

+	/**
+	 * Write $run only if it is still running and unchanged since it was loaded (updated_at
+	 * $loadedAt), in one statement: two processes that loaded the same run cannot both write it.
+	 * The new updated_at is always later than $loadedAt, so every write is seen as a change.
+	 *
+	 * @return Run|null the written run, or null when another process wrote it first
+	 */
+	public function updateIfUnchanged(Run $run, int $loadedAt): ?Run {
+		$run->setUpdatedAt(max(time(), $loadedAt + 1));
+		$types = $run->getFieldTypes();
+		$qb = $this->db->getQueryBuilder();
+		$qb->update($this->getTableName());
+		foreach (array_keys($run->getUpdatedFields()) as $field) {
+			if ($field === 'id') {
+				continue;
+			}
+			$value = $run->{'get' . ucfirst($field)}();
+			$type = ($types[$field] ?? 'string') === 'integer' ? IQueryBuilder::PARAM_INT : IQueryBuilder::PARAM_STR;
+			$qb->set($run->propertyToColumn($field), $qb->createNamedParameter($value, $value === null ? IQueryBuilder::PARAM_NULL : $type));
+		}
+		$qb->where($qb->expr()->eq('id', $qb->createNamedParameter($run->getId(), IQueryBuilder::PARAM_INT)))
+			->andWhere($qb->expr()->eq('status', $qb->createNamedParameter(Run::RUNNING)))
+			->andWhere($qb->expr()->eq('updated_at', $qb->createNamedParameter($loadedAt, IQueryBuilder::PARAM_INT)));
+		if ($qb->executeStatement() !== 1) {
+			return null;
+		}
+		$run->resetUpdatedFields();
+		return $run;
+	}
+
 	public function find(int $id): Run {
 		$qb = $this->db->getQueryBuilder();
 		$qb->select('*')->from($this->getTableName())->where($qb->expr()->eq('id', $qb->createNamedParameter($id, IQueryBuilder::PARAM_INT)));
@@ -43,6 +73,17 @@ final class RunMapper extends QBMapper {
 		return $this->findEntities($qb);
 	}

+	/** @return list<Run> runs of $kind started at or after $since, newest first */
+	public function startedSince(int $targetId, string $kind, int $since): array {
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('*')->from($this->getTableName())
+			->where($qb->expr()->eq('target_id', $qb->createNamedParameter($targetId, IQueryBuilder::PARAM_INT)))
+			->andWhere($qb->expr()->eq('kind', $qb->createNamedParameter($kind)))
+			->andWhere($qb->expr()->gte('started_at', $qb->createNamedParameter($since, IQueryBuilder::PARAM_INT)))
+			->orderBy('id', 'DESC');
+		return $this->findEntities($qb);
+	}
+
 	public function lastFinished(int $targetId, string $kind): ?Run {
 		$qb = $this->db->getQueryBuilder();
 		$qb->select('*')->from($this->getTableName())
@@ -49,9 +49,11 @@ final class BackupRun {
 	public static function step(Repository $repo, array $state, float $deadline): array {
 		$state['steps']++;
 		if ($state['phase'] === 'files') {
-			$walker = new TreeWalker($state['roots'], $state['exclude']);
-			$parent = new ParentCursor($repo, $state['parent'], $state['parentPos']);
 			$stats = $state['stats'];
+			$walker = new TreeWalker($state['roots'], $state['exclude'], function (string $logical) use (&$state, &$stats): void {
+				self::recordUnreadable($state, $stats, $logical);
+			});
+			$parent = new ParentCursor($repo, $state['parent'], $state['parentPos']);
 			$lines = [];
 			$finishedWalk = true;

@@ -68,15 +70,20 @@ final class BackupRun {
 					$stats['reused']++;
 				} else {
 					$cur = $state['cur'];
-					if ($cur === null || $cur['path'] !== $logical || $cur['version'] !== $version) {
-						if ($cur !== null && $cur['path'] === $logical) {
-							$stats['retried'] = ($stats['retried'] ?? 0) + 1; // changed since the previous step
+					if ($cur !== null && $cur['path'] === $logical && $cur['version'] !== $version) {
+						// Changed since the previous step: start over, unless it keeps changing.
+						if (self::countRetry($state, $stats, $logical)) {
+							$cur['version'] = $version;
+						} else {
+							$cur = null;
 						}
+					}
+					if ($cur === null || $cur['path'] !== $logical) {
 						$cur = ['path' => $logical, 'offset' => 0, 'blobs' => [], 'version' => $version];
 					}
-					$fh = fopen($path, 'rb');
+					$fh = @fopen($path, 'rb');
 					if ($fh === false) {
-						$stats['unreadable'] = ($stats['unreadable'] ?? 0) + 1;
+						self::recordUnreadable($state, $stats, $logical);
 						$state['cur'] = null;
 						continue;
 					}
@@ -91,12 +98,17 @@ final class BackupRun {
 						}
 					}
 					fclose($fh);
-					if (Repository::fileVersion($path) !== $cur['version']) {
-						// Changed while reading: read it again from the start (now or next step).
-						$stats['retried'] = ($stats['retried'] ?? 0) + 1;
-						$state['cur'] = null;
-						$finishedWalk = false;
-						break;
+					$now = Repository::fileVersion($path);
+					if ($now !== $cur['version']) {
+						if (!self::countRetry($state, $stats, $logical)) {
+							// Changed while reading: read it again from the start (now or next step).
+							$state['cur'] = null;
+							$finishedWalk = false;
+							break;
+						}
+						// Keeps changing (a live database, VM image or log): keep what was read,
+						// like any copy of a file in use, and report it instead of retrying forever.
+						$cur['version'] = $now;
 					}
 					if (!$complete) {
 						$state['cur'] = $cur;
@@ -104,6 +116,7 @@ final class BackupRun {
 						break;
 					}
 					$blobs = $cur['blobs'];
+					$size = $cur['offset'];
 					$state['cur'] = null;
 					$stats['read']++;
 				}
@@ -133,19 +146,98 @@ final class BackupRun {

 		if ($state['phase'] === 'finish') {
 			$segments = $state['segments'];
-			$repo->writeSnapshot($state['snapshot'],
+			$repo->putSnapshot($state['snapshot'],
 				['time' => $state['started'], 'parent' => $state['parent'], 'label' => $state['label'],
-					'roots' => array_keys($state['roots']), 'stats' => $state['stats']] + $state['meta'],
+					'roots' => array_keys($state['roots']), 'stats' => $state['stats'],
+					'warnings' => self::warnings($state)] + $state['meta'],
 				(function () use ($repo, $segments) {
 					foreach ($segments as $blobs) {
 						yield from $repo->readLines($blobs);
 					}
 				})());
-			$state['phase'] = 'done';
+			$state['phase'] = 'commit';
 		}
 		return $state;
 	}

+	/**
+	 * Progress of the files phase as a fraction (at most 0.99 until it is done), or null without an
+	 * estimate. Bytes of a large file that is still being read count too.
+	 *
+	 * @return array{fraction: float, approximate: bool}|null
+	 */
+	public static function progress(array $state): ?array {
+		$estimate = $state['estimate'] ?? null;
+		if (($state['phase'] ?? null) !== 'files' || !is_array($estimate) || ($estimate['bytes'] ?? 0) <= 0) {
+			return null;
+		}
+		$done = (int)($state['stats']['bytes'] ?? 0) + (int)($state['cur']['offset'] ?? 0);
+		return ['fraction' => min(0.99, $done / (int)$estimate['bytes']), 'approximate' => (bool)($estimate['approximate'] ?? true)];
+	}
+
+	/**
+	 * progress() of a run, while it is in its files phase.
+	 *
+	 * @return array{fraction: float, approximate: bool}|null
+	 */
+	public static function progressOf(\OCA\NgBackup\Db\Run $run): ?array {
+		if ($run->getStatus() !== \OCA\NgBackup\Db\Run::RUNNING || $run->getPhase() !== 'files') {
+			return null;
+		}
+		try {
+			$state = json_decode($run->getState(), true, 512, JSON_THROW_ON_ERROR);
+		} catch (\JsonException) {
+			return null;
+		}
+		return is_array($state['files'] ?? null) ? self::progress($state['files']) : null;
+	}
+
+	/**
+	 * A file or directory that could not be read: it is missing from this snapshot. Remembered (first
+	 * 1000, deduplicated across steps) so the run can report it instead of silently succeeding.
+	 */
+	private static function recordUnreadable(array &$state, array &$stats, string $logical): void {
+		if (isset($state['unreadable'][$logical])) {
+			return;
+		}
+		if (count($state['unreadable'] ?? []) < 1000) {
+			$state['unreadable'][$logical] = true;
+		}
+		$stats['unreadable'] = ($stats['unreadable'] ?? 0) + 1;
+	}
+
+	/** @return array{unreadable: list<string>, changing: list<string>} examples for the report (first 50 each) */
+	public static function warnings(array $state): array {
+		return [
+			'unreadable' => array_slice(array_map('strval', array_keys($state['unreadable'] ?? [])), 0, 50),
+			'changing' => array_slice(array_map('strval', array_values($state['changing'] ?? [])), 0, 50),
+		];
+	}
+
+	/** Retries of one file that changes while it is read, before its last read is kept anyway. */
+	public const MAX_RETRIES = 3;
+
+	/**
+	 * Count a retry of $logical. Returns true once it has changed MAX_RETRIES times: the caller then
+	 * keeps the data it read, and the file is listed in $state['changing'] (first 50) for the report.
+	 */
+	private static function countRetry(array &$state, array &$stats, string $logical): bool {
+		$stats['retried'] = ($stats['retried'] ?? 0) + 1;
+		$n = (($state['retryPath'] ?? null) === $logical ? (int)($state['retryCount'] ?? 0) : 0) + 1;
+		$state['retryPath'] = $logical;
+		$state['retryCount'] = $n;
+		if ($n < self::MAX_RETRIES) {
+			return false;
+		}
+		if ($n === self::MAX_RETRIES) {
+			$stats['changing'] = ($stats['changing'] ?? 0) + 1;
+			if (count($state['changing'] ?? []) < 50) {
+				$state['changing'][] = $logical;
+			}
+		}
+		return true;
+	}
+
 	private static function readFull($fh, int $length): string {
 		$buffer = '';
 		while (strlen($buffer) < $length && !feof($fh)) {
@@ -23,6 +23,8 @@ final class TreeWalker {
 	public function __construct(
 		private array $roots,
 		private array $exclude = [],
+		/** Called with the logical path of a directory that cannot be listed. */
+		private ?\Closure $onUnreadable = null,
 	) {
 	}

@@ -57,6 +59,9 @@ final class TreeWalker {
 		}
 		$names = @scandir($abs);
 		if ($names === false) {
+			if ($this->onUnreadable !== null) {
+				($this->onUnreadable)($logical === '' ? '/' : $logical);
+			}
 			return;
 		}
 		$names = array_values(array_diff($names, ['.', '..']));
@@ -42,12 +42,19 @@ final class Notifier implements INotifier {
 					: $l->t('Backup to %s failed', [$p['target']]));
 				$notification->setParsedMessage((string)($p['error'] ?? ''));
 				break;
+			case 'run_warnings':
+				$notification->setParsedSubject($l->t('Backup to %1$s finished with warnings: %2$s unreadable, %3$s changed while being read', [$p['target'], $p['unreadable'], $p['changing']]));
+				$notification->setParsedMessage($l->t('Unreadable files and folders are missing from this backup (check their permissions). Files that kept changing were saved as they were while being read. Examples: %s', [$p['examples'] ?? '']));
+				break;
 			case 'quota_warning':
 				$notification->setParsedSubject($l->t('Backup location %1$s is at %2$s%% of its limit (%3$s of %4$s)', [$p['target'], $p['percent'], $p['used'], $p['limit']]));
 				$notification->setParsedMessage($l->t('Backups stop when the limit is reached. Raise the limit, or let the retention policy remove older backups.'));
 				break;
 			case 'backup_stale':
-				$notification->setParsedSubject($l->t('No successful backup to %1$s since %2$s', [$p['target'], $p['since']]));
+				// 'never' was stored by 0.9.4 and earlier
+				$notification->setParsedSubject(in_array($p['since'] ?? '', ['', 'never'], true)
+					? $l->t('No successful backup to %s yet', [$p['target']])
+					: $l->t('No successful backup to %1$s since %2$s', [$p['target'], $p['since']]));
 				$notification->setParsedMessage($l->t('Check the backup settings and the server log.'));
 				break;
 			case 'security_event':
@@ -55,6 +62,7 @@ final class Notifier implements INotifier {
 				$notification->setParsedSubject(match ($p['event'] ?? '') {
 					'kit_downloaded' => $l->t('%s downloaded the backup recovery kit', [$who]),
 					'target_removed' => $l->t('%1$s removed backup location %2$s', [$who, $p['target'] ?? '']),
+					'target_changed' => $l->t('%1$s changed the connection settings of backup location %2$s', [$who, $p['target'] ?? '']),
 					'append_only_off' => $l->t('%1$s turned off append-only for backup location %2$s', [$who, $p['target'] ?? '']),
 					'retention_changed' => $l->t('%1$s changed the backup retention to %2$s', [$who, $p['policy'] ?? '']),
 					'snapshots_forgotten' => $l->t('%1$s moved %2$s snapshots of %3$s to the trash; they are deleted permanently after %4$s unless restored', [$who, $p['count'] ?? '', $p['target'] ?? '', $p['until'] ?? '']),
@@ -62,6 +70,8 @@ final class Notifier implements INotifier {
 					'catalog_trusted' => $l->t('%1$s accepted an older state of backup location %2$s (catalog generation %3$s)', [$who, $p['target'] ?? '', $p['generation'] ?? '']),
 					'slot_added' => $l->t('%1$s added backup passphrase slot %2$s (%3$s); download and confirm the new recovery kit', [$who, $p['slot'] ?? '', $p['label'] ?? '']),
 					'slot_replaced' => $l->t('%1$s set a new passphrase for backup key slot %2$s (%3$s); download and confirm the new recovery kit', [$who, $p['slot'] ?? '', $p['label'] ?? '']),
+					'user_export_retention_changed' => $l->t('%1$s changed how many exports per user are kept to %2$s', [$who, $p['keep'] ?? '']),
+					'user_exports_forgotten' => $l->t('%1$s removed %2$s per-user exports from %3$s', [$who, $p['count'] ?? '', $p['target'] ?? '']),
 					'slot_removed' => $l->t('%1$s removed backup passphrase slot %2$s; download and confirm the new recovery kit', [$who, $p['slot'] ?? '']),
 					default => $l->t('NG Backup security event'),
 				});
@@ -25,7 +25,11 @@ final class BlobIndex {
 	private array $pending = [];

 	private ?IIndexCache $cache = null;
+	/** @var list<\Closure():void>|null cache writes held back by holdCache(), or null when writing directly */
+	private ?array $heldCacheWrites = null;
 	private string $repositoryId = '';
+	/** Index files written to the cache per database transaction while loading. */
+	private const CACHE_LOT = 256;
 	/** @var int index files downloaded by the last load() (for tests and diagnostics) */
 	public int $downloaded = 0;

@@ -40,52 +44,120 @@ final class BlobIndex {
 		$this->repositoryId = $repositoryId;
 	}

+	/**
+	 * Hold back cache writes until releaseCache(). The database dump reads inside a read-only
+	 * transaction on the same connection that the cache writes to: a write there fails on
+	 * PostgreSQL and would be rolled back with the dump transaction elsewhere.
+	 */
+	public function holdCache(): void {
+		$this->heldCacheWrites ??= [];
+	}
+
+	/** Write the cache changes held back since holdCache(). */
+	public function releaseCache(): void {
+		$writes = $this->heldCacheWrites ?? [];
+		$this->heldCacheWrites = null;
+		foreach ($writes as $write) {
+			$write();
+		}
+	}
+
+	/** @param list<array{id:string, offset:int, length:int, raw:int, flags:int}> $entries */
+	private function cachePut(string $packId, array $entries): void {
+		if ($this->heldCacheWrites !== null) {
+			$this->heldCacheWrites[] = function () use ($packId, $entries): void {
+				$this->cache?->put($this->repositoryId, $packId, $entries);
+			};
+			return;
+		}
+		$this->cache?->put($this->repositoryId, $packId, $entries);
+	}
+
+	/** @param list<string> $packIds */
+	private function cacheRemove(array $packIds): void {
+		if ($this->heldCacheWrites !== null) {
+			$this->heldCacheWrites[] = function () use ($packIds): void {
+				$this->cache?->remove($this->repositoryId, $packIds);
+			};
+			return;
+		}
+		$this->cache?->remove($this->repositoryId, $packIds);
+	}
+
 	/**
 	 * Load the index: one listing of index/, entries from the local cache where available,
 	 * and only the index files that are not cached yet are downloaded. Cached packs that no
 	 * longer exist on the backend are dropped from the cache.
 	 */
-	public function load(bool $verify = false): void {
+	public function load(bool $verify = false, ?callable $progress = null): void {
 		$this->blobs = [];
 		$cached = $verify ? [] : ($this->cache?->all($this->repositoryId) ?? []);
 		$present = [];
 		$this->downloaded = 0;
-		foreach ($this->backend->list('index') as $path) {
+		$order = []; // pack ids in listing order: where a blob is in two packs, the last listed wins
+		$fetch = [];
+		foreach ($this->backend->listFiles('index') as $path) {
 			$packId = basename($path);
 			$present[$packId] = true;
-			if (isset($cached[$packId])) {
-				$entries = $cached[$packId];
-			} else {
-				$fh = $this->backend->get($path);
-				$entries = json_decode($this->cipher->decryptString((string)stream_get_contents($fh), 'index:' . $packId), true, 512, JSON_THROW_ON_ERROR);
-				fclose($fh);
-				$this->downloaded++;
-				$this->cache?->put($this->repositoryId, $packId, $entries);
-			}
-			foreach ($entries as $e) {
-				$this->blobs[$e['id']] = [$packId, $e['offset'], $e['length'], $e['raw'], $e['flags']];
+			$order[] = $packId;
+			if (!isset($cached[$packId])) {
+				$fetch[] = $path;
 			}
 		}
-		if ($verify && $this->cache !== null) {
-			// Refresh the cache from what was just verified.
-			$this->cache->remove($this->repositoryId, array_keys($this->cache->all($this->repositoryId)));
-			foreach ($this->packs() as $packId => $_) {
-				$entries = [];
-				foreach ($this->blobs as $id => [$pack, $offset, $length, $raw, $flags]) {
-					if ($pack === $packId) {
-						$entries[] = ['id' => $id, 'offset' => $offset, 'length' => $length, 'raw' => $raw, 'flags' => $flags];
-					}
+		// The rest is downloaded several at a time where the location allows it: on a large
+		// repository these are tens of thousands of small files. getMany() keeps their order, so
+		// the cached packs listed before each one are added first.
+		$next = 0;
+		$total = count($fetch);
+		$toCache = []; // written to the cache a few hundred at a time, each lot in one transaction
+		foreach ($this->backend->getMany($fetch) as $path => $data) {
+			$packId = basename($path);
+			$entries = json_decode($this->cipher->decryptString($data, 'index:' . $packId), true, 512, JSON_THROW_ON_ERROR);
+			$this->downloaded++;
+			if ($this->cache !== null) {
+				$toCache[$packId] = $entries;
+				// a check writes the whole cache afresh at the end
+				if (!$verify && count($toCache) >= self::CACHE_LOT) {
+					$this->cache->putMany($this->repositoryId, $toCache);
+					$toCache = [];
 				}
-				$this->cache->put($this->repositoryId, $packId, $entries);
 			}
+			for (; $next < count($order) && $order[$next] !== $packId; $next++) {
+				$this->add($order[$next], $cached[$order[$next]] ?? []);
+			}
+			$this->add($packId, $entries);
+			$next++;
+			if ($progress !== null) {
+				$progress($this->downloaded, $total);
+			}
+		}
+		for (; $next < count($order); $next++) {
+			$this->add($order[$next], $cached[$order[$next]] ?? []);
+		}
+		if ($verify && $this->cache !== null) {
+			// Refresh the cache from what was just verified, as the index files list it: a blob in
+			// two packs is in both rows, so that removing one of the packs leaves the other right.
+			// In one transaction: one row at a time took more than 6 minutes on a 1 TB repository
+			// (27,547 packs), long enough for the location to drop the connection.
+			$this->cache->replaceAll($this->repositoryId, $toCache);
 			return;
 		}
+		if ($toCache !== []) {
+			$this->cache?->putMany($this->repositoryId, $toCache);
+		}
 		$stale = array_keys(array_diff_key($cached, $present));
 		if ($stale !== []) {
 			$this->cache?->remove($this->repositoryId, $stale);
 		}
 	}

+	/** @param list<array{id:string, offset:int, length:int, raw:int, flags:int}> $entries */
+	private function add(string $packId, array $entries): void {
+		foreach ($entries as $e) {
+			$this->blobs[$e['id']] = [$packId, $e['offset'], $e['length'], $e['raw'], $e['flags']];
+		}
+	}
+
 	public function has(string $id): bool {
 		return isset($this->blobs[$id]) || isset($this->pending[$id]);
 	}
@@ -112,7 +184,7 @@ final class BlobIndex {
 		fwrite($stream, $this->cipher->encryptString(json_encode($entries, JSON_THROW_ON_ERROR), 'index:' . $packId));
 		rewind($stream);
 		$this->backend->put('index/' . $packId, $stream);
-		$this->cache?->put($this->repositoryId, $packId, $entries);
+		$this->cachePut($packId, $entries);
 		foreach ($entries as $e) {
 			$this->blobs[$e['id']] = [$packId, $e['offset'], $e['length'], $e['raw'], $e['flags']];
 			unset($this->pending[$e['id']]);
@@ -131,7 +203,7 @@ final class BlobIndex {
 	/** Forget a pack: delete its index file and cache row. Blobs that now live elsewhere are kept. */
 	public function removePack(string $packId): void {
 		$this->backend->delete('index/' . $packId);
-		$this->cache?->remove($this->repositoryId, [$packId]);
+		$this->cacheRemove([$packId]);
 		foreach ($this->blobs as $id => $loc) {
 			if ($loc[0] === $packId) {
 				unset($this->blobs[$id]);
@@ -139,6 +211,15 @@ final class BlobIndex {
 		}
 	}

+	/** Number of packs that hold blobs of the index. */
+	public function packCount(): int {
+		$packs = [];
+		foreach ($this->blobs as [$pack]) {
+			$packs[$pack] = true;
+		}
+		return count($packs);
+	}
+
 	/** Bytes of all blobs in the index (encrypted size, i.e. what is stored in packs). */
 	public function storedBytes(): int {
 		$total = 0;
@@ -28,6 +28,8 @@ final class Catalog {
 	public array $snapshots = [];
 	/** @var array<string, true> */
 	public array $trash = [];
+	/** @var array<string, true> manifest path => true, for a per-user export (users/<uid>/<exportId>) */
+	public array $userExports = [];
 	public string $hash = '';

 	public function __construct(
@@ -39,7 +41,7 @@ final class Catalog {
 	}

 	/** Load and verify the newest catalog; create the first one for repositories that have none. */
-	public function load(callable $listSnapshots, callable $listTrash): void {
+	public function load(callable $listSnapshots, callable $listTrash, callable $listUserExports): void {
 		$gens = $this->generations();
 		if ($gens === []) {
 			// First use (new or pre-catalog repository): adopt the current state as generation 1.
@@ -49,6 +51,7 @@ final class Catalog {
 			}
 			$this->snapshots = array_fill_keys($listSnapshots(), true);
 			$this->trash = array_fill_keys($listTrash(), true);
+			$this->userExports = array_fill_keys($listUserExports(), true);
 			$this->write();
 			return;
 		}
@@ -76,14 +79,23 @@ final class Catalog {
 		$this->hash = $hash;
 		$this->snapshots = array_fill_keys($data['snapshots'], true);
 		$this->trash = array_fill_keys($data['trash'], true);
+		// Catalogs written before user exports existed have no such key: default to empty rather
+		// than adopting the location's current users/ listing (that would skip verification).
+		$this->userExports = array_fill_keys($data['userExports'] ?? [], true);
 		$this->anchor?->set($this->repositoryId, $this->gen, $this->hash);
 	}

 	/** Write the next generation after the in-memory state was changed. */
 	public function write(): void {
 		$next = $this->gen + 1;
+		// Two writers starting from the same generation would otherwise overwrite each other
+		// silently and break the chain for whichever server anchored the lost write.
+		if ($this->backend->exists($this->path($next))) {
+			throw new RepositoryException("Catalog generation $next was written by another process at the same time; try again");
+		}
 		$plain = json_encode(['repository' => $this->repositoryId, 'gen' => $next, 'time' => gmdate('c'), 'prev' => $this->hash,
-			'snapshots' => array_keys($this->snapshots), 'trash' => array_keys($this->trash)], JSON_THROW_ON_ERROR);
+			'snapshots' => array_keys($this->snapshots), 'trash' => array_keys($this->trash),
+			'userExports' => array_keys($this->userExports)], JSON_THROW_ON_ERROR);
 		$encrypted = $this->cipher->encryptString($plain, $this->ad($next));
 		$stream = fopen('php://memory', 'w+b');
 		fwrite($stream, $encrypted);
@@ -116,7 +128,7 @@ final class Catalog {

 	/** @return list<int> */
 	private function generations(): array {
-		return array_map(fn ($p) => (int)basename($p), $this->backend->list('catalog'));
+		return array_map(fn ($p) => (int)basename($p), $this->backend->listFiles('catalog'));
 	}

 	private function path(int $gen): string {
@@ -15,6 +15,20 @@ interface IIndexCache {
 	/** @param list<array{id:string, offset:int, length:int, raw:int, flags:int}> $entries */
 	public function put(string $repositoryId, string $packId, array $entries): void;

+	/**
+	 * put() for many packs at once (one database transaction).
+	 *
+	 * @param array<string, list<array{id:string, offset:int, length:int, raw:int, flags:int}>> $packs packId => entries
+	 */
+	public function putMany(string $repositoryId, array $packs): void;
+
+	/**
+	 * Replace everything cached for the repository with $packs (one database transaction).
+	 *
+	 * @param array<string, list<array{id:string, offset:int, length:int, raw:int, flags:int}>> $packs packId => entries
+	 */
+	public function replaceAll(string $repositoryId, array $packs): void;
+
 	/** @param list<string> $packIds */
 	public function remove(string $repositoryId, array $packIds): void;
 }
@@ -0,0 +1,97 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Repository;
+
+use OCA\NgBackup\Backend\IBackend;
+
+/**
+ * Reads blobs from packs. Restores and deep verifies read the blobs of a snapshot in the order
+ * they were written, so the stream of the pack read last is kept open and read on from where it
+ * is: one request per pack instead of one per blob (a round trip each, and on most remote
+ * storages a new connection or file handle too). Anything else opens the pack at the offset,
+ * as a single read always did.
+ *
+ * The open stream must not overlap other requests on the location (SFTP cannot read and write
+ * on one connection at once): Repository reaches the location through a PackReaderGuard, which
+ * closes it first.
+ */
+final class PackReader {
+	/** A gap up to this size in the open stream is read past instead of opening the pack again. */
+	private const SKIP_MAX = 8 * 1048576;
+	private const CHUNK = 1048576;
+
+	/** @var resource|null */
+	private $stream = null;
+	private string $pack = '';
+	private int $pos = 0;
+
+	public function __construct(
+		private IBackend $backend,
+	) {
+	}
+
+	public function read(string $pack, int $offset, int $length): string {
+		if ($this->stream !== null && $this->pack === $pack && $offset >= $this->pos && $offset - $this->pos <= self::SKIP_MAX) {
+			try {
+				$this->skipTo($offset);
+				return $this->readExactly($length);
+			} catch (\Exception) {
+				// The open stream broke (e.g. a timeout); open the pack again below.
+			}
+		}
+		$this->close();
+		$fh = $this->backend->get('packs/' . substr($pack, 0, 2) . '/' . $pack);
+		$this->stream = $fh;
+		$this->pack = $pack;
+		$this->pos = 0;
+		try {
+			if ($offset > 0 && (stream_get_meta_data($fh)['seekable'] ?? false) && fseek($fh, $offset) === 0) {
+				$this->pos = $offset;
+			}
+			$this->skipTo($offset); // a stream that cannot seek is read up to the offset
+			return $this->readExactly($length);
+		} catch (\Exception $e) {
+			$this->close();
+			throw $e;
+		}
+	}
+
+	public function close(): void {
+		$fh = $this->stream;
+		$this->stream = null;
+		if ($fh !== null) {
+			@fclose($fh);
+		}
+	}
+
+	public function __destruct() {
+		$this->close();
+	}
+
+	private function skipTo(int $offset): void {
+		while ($this->pos < $offset) {
+			$this->readExactly(min($offset - $this->pos, self::CHUNK));
+		}
+	}
+
+	/** Read $length bytes from the open stream; a short read closes it. */
+	private function readExactly(int $length): string {
+		$fh = $this->stream ?? throw new RepositoryException('No open pack stream');
+		$data = '';
+		while (strlen($data) < $length) {
+			$chunk = fread($fh, min($length - strlen($data), self::CHUNK));
+			if ($chunk === false || $chunk === '') {
+				$this->close();
+				throw new RepositoryException('Short read in pack ' . $this->pack);
+			}
+			$data .= $chunk;
+		}
+		$this->pos += $length;
+		return $data;
+	}
+}
@@ -0,0 +1,65 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Repository;
+
+use OCA\NgBackup\Backend\IBackend;
+
+/** The location as Repository sees it: closes the PackReader's open stream before every other request. */
+final class PackReaderGuard implements IBackend {
+	public function __construct(
+		private IBackend $inner,
+		private PackReader $reader,
+	) {
+	}
+
+	/** @param resource $stream */
+	public function put(string $path, $stream): void {
+		$this->reader->close();
+		$this->inner->put($path, $stream);
+	}
+
+	public function get(string $path) {
+		$this->reader->close();
+		return $this->inner->get($path);
+	}
+
+	public function getMany(array $paths): \Generator {
+		$this->reader->close();
+		return $this->inner->getMany($paths);
+	}
+
+	public function getRange(string $path, int $offset, int $length): string {
+		$this->reader->close();
+		return $this->inner->getRange($path, $offset, $length);
+	}
+
+	public function exists(string $path): bool {
+		$this->reader->close();
+		return $this->inner->exists($path);
+	}
+
+	public function move(string $from, string $to): void {
+		$this->reader->close();
+		$this->inner->move($from, $to);
+	}
+
+	public function list(string $prefix): array {
+		$this->reader->close();
+		return $this->inner->list($prefix);
+	}
+
+	public function listFiles(string $dir): array {
+		$this->reader->close();
+		return $this->inner->listFiles($dir);
+	}
+
+	public function delete(string $path): void {
+		$this->reader->close();
+		$this->inner->delete($path);
+	}
+}
@@ -28,12 +28,17 @@ final class Repository {
 	public const FORMAT = 1;
 	public const BLOB_SIZE = 4 * 1048576;
 	private const FLAG_DEFLATE = 1;
+	/** Reads per blob in a deep verify before it is reported as unreadable (not corrupted). */
+	private const VERIFY_READ_ATTEMPTS = 3;

 	private StreamCipher $cipher;
 	private BlobIndex $index;
 	private ?PackWriter $runPacks = null;
 	private ?int $maxBytes = null;
 	private Catalog $catalog;
+	private PackReader $packReader;
+	/** verify() lists the pack folders from this many packs on (see presentPacks()); tests lower it. */
+	public int $listPacksAbove = 256;

 	private function __construct(
 		private IBackend $backend,
@@ -41,7 +46,9 @@ final class Repository {
 		private string $repositoryId,
 	) {
 		$this->cipher = new StreamCipher($keys);
-		$this->index = new BlobIndex($backend, $this->cipher);
+		$this->packReader = new PackReader($backend);
+		$this->backend = new PackReaderGuard($backend, $this->packReader);
+		$this->index = new BlobIndex($this->backend, $this->cipher);
 	}

 	public static function init(IBackend $backend, #[\SensitiveParameter] string $passphrase): self {
@@ -90,8 +97,9 @@ final class Repository {
 	private function loadCatalog(?ICatalogAnchor $anchor): void {
 		$this->catalog = new Catalog($this->backend, $this->cipher, $this->repositoryId, $anchor);
 		$this->catalog->load(
-			fn () => array_map('basename', $this->backend->list('snapshots')),
-			fn () => array_map('basename', $this->backend->list('trash/info')));
+			fn () => array_map('basename', $this->backend->listFiles('snapshots')),
+			fn () => array_map('basename', $this->backend->listFiles('trash/info')),
+			fn () => $this->backend->list('users'));
 	}

 	/** Refuse uploads that would make the stored data larger than this (null = no limit). */
@@ -189,8 +197,15 @@ final class Repository {
 		return ['snapshot' => $snapshotId] + $stats;
 	}

-	/** Restore a snapshot (or only paths starting with $prefix) into a local directory. */
-	public function restore(string $snapshotId, string $target, string $prefix = ''): int {
+	/**
+	 * Restore a snapshot (or only paths starting with $prefix) into a local directory.
+	 *
+	 * @param bool $stripPrefix write "$target/<path without $prefix>" instead of
+	 *             "$target/<full logical path>" (disaster recovery: restoring e.g. "data/" or
+	 *             "config/" directly into the real data/config directory, not a subdirectory
+	 *             named after the prefix). Ignored when $prefix is '' (nothing to strip).
+	 */
+	public function restore(string $snapshotId, string $target, string $prefix = '', bool $stripPrefix = false, ?callable $heartbeat = null): int {
 		if ($prefix !== '' && !self::isSafePath(rtrim($prefix, '/'))) {
 			throw new RepositoryException('Invalid path prefix');
 		}
@@ -199,7 +214,8 @@ final class Repository {
 			if ($prefix !== '' && !str_starts_with($entry['p'], $prefix)) {
 				continue;
 			}
-			$dest = rtrim($target, '/') . '/' . $entry['p'];
+			$relPath = ($stripPrefix && $prefix !== '') ? substr($entry['p'], strlen(rtrim($prefix, '/')) + 1) : $entry['p'];
+			$dest = rtrim($target, '/') . '/' . $relPath;
 			if (!is_dir(dirname($dest))) {
 				mkdir(dirname($dest), 0700, true);
 			}
@@ -218,14 +234,22 @@ final class Repository {
 			}
 			foreach ($entry['b'] as $id) {
 				fwrite($out, $this->loadBlob($id));
+				if ($heartbeat !== null) {
+					$heartbeat();
+				}
 			}
 			fclose($out);
 			if (filesize($tmp) !== $entry['s']) {
 				unlink($tmp);
 				throw new RepositoryException('Size mismatch restoring ' . $entry['p']);
 			}
-			rename($tmp, $dest);
-			touch($dest, $entry['m']);
+			if (!rename($tmp, $dest)) {
+				@unlink($tmp);
+				throw new RepositoryException('Cannot put the restored file in place: ' . $entry['p']);
+			}
+			if (!touch($dest, $entry['m'])) {
+				throw new RepositoryException('Cannot set the modification time of ' . $entry['p']);
+			}
 			$count++;
 		}
 		return $count;
@@ -243,6 +267,15 @@ final class Repository {
 		});
 	}

+	/** See BlobIndex::holdCache(): no database writes until releaseIndexCache(). */
+	public function holdIndexCache(): void {
+		$this->index->holdCache();
+	}
+
+	public function releaseIndexCache(): void {
+		$this->index->releaseCache();
+	}
+
 	public function flushPacks(): void {
 		$this->runPacks?->flush();
 	}
@@ -279,6 +312,17 @@ final class Repository {
 	 * @param iterable<string> $lines
 	 */
 	public function writeSnapshot(string $snapshotId, array $meta, iterable $lines): void {
+		$this->putSnapshot($snapshotId, $meta, $lines);
+		$this->recordSnapshot($snapshotId);
+	}
+
+	/**
+	 * Store a snapshot object without touching the catalog. Use recordSnapshot() afterwards, from a
+	 * repository opened inside the catalog lock, so the catalog write builds on the latest generation.
+	 *
+	 * @param iterable<string> $lines
+	 */
+	public function putSnapshot(string $snapshotId, array $meta, iterable $lines): void {
 		$tree = fopen('php://temp/maxmemory:' . (4 * 1048576), 'w+b');
 		fwrite($tree, json_encode(['snapshot' => $snapshotId] + $meta, JSON_THROW_ON_ERROR) . "\n");
 		foreach ($lines as $line) {
@@ -292,6 +336,9 @@ final class Repository {
 		fclose($tree);
 		rewind($encrypted);
 		$this->backend->put('snapshots/' . $snapshotId, $encrypted);
+	}
+
+	public function recordSnapshot(string $snapshotId): void {
 		$this->catalog->snapshots[$snapshotId] = true;
 		$this->catalog->write();
 	}
@@ -349,31 +396,105 @@ final class Repository {
 			// must be decrypted and re-encrypted under the new path, not moved as raw bytes.
 			$dbInTrash = 'trash/' . $meta['db'];
 			$this->putObject($dbInTrash, $this->getObject($meta['db']));
-			$this->backend->delete($meta['db']);
 		}
-		// The snapshot object is bound to its id (not its path), so it can be moved as raw bytes.
-		$this->backend->move('snapshots/' . $snapshotId, 'trash/snapshots/' . $snapshotId);
+		// Copy first, switch the catalog, delete the originals last: a crash at any point leaves
+		// either the old state or the new one plus unreferenced leftovers, never a catalog entry
+		// pointing at a missing object. The snapshot object is bound to its id (not its path),
+		// so it can be copied as raw bytes.
+		$this->copyRaw('snapshots/' . $snapshotId, 'trash/snapshots/' . $snapshotId);
 		$this->putObject('trash/info/' . $snapshotId, json_encode(['forgottenAt' => time(), 'by' => $by, 'db' => $meta['db'] ?? null,
 			'dbInTrash' => $dbInTrash, 'time' => $meta['time'] ?? null, 'label' => $meta['label'] ?? ''], JSON_THROW_ON_ERROR));
 		unset($this->catalog->snapshots[$snapshotId]);
 		$this->catalog->trash[$snapshotId] = true;
 		$this->catalog->write();
+		if ($dbInTrash !== null) {
+			$this->backend->delete($meta['db']);
+		}
+		$this->backend->delete('snapshots/' . $snapshotId);
 	}

 	/** Undo forget(): move a snapshot back from the trash. */
 	public function untrash(string $snapshotId): void {
 		$info = $this->trashInfo($snapshotId);
-		if ($info['dbInTrash'] !== null && $this->backend->exists($info['dbInTrash'])) {
+		$restoreDb = $info['dbInTrash'] !== null && $this->backend->exists($info['dbInTrash']);
+		if ($restoreDb) {
 			$this->putObject($info['db'], $this->getObject($info['dbInTrash']));
-			$this->backend->delete($info['dbInTrash']);
 		}
-		$this->backend->move('trash/snapshots/' . $snapshotId, 'snapshots/' . $snapshotId);
+		// Same order as forget(): copy, switch the catalog, then delete the trash copies.
+		$this->copyRaw('trash/snapshots/' . $snapshotId, 'snapshots/' . $snapshotId);
 		$this->catalog->snapshots[$snapshotId] = true;
 		unset($this->catalog->trash[$snapshotId]);
 		$this->catalog->write();
+		if ($restoreDb) {
+			$this->backend->delete($info['dbInTrash']);
+		}
+		$this->backend->delete('trash/snapshots/' . $snapshotId);
 		$this->backend->delete('trash/info/' . $snapshotId);
 	}

+	/** Copy an object as raw bytes, buffered locally (remote read streams cannot be uploaded directly everywhere). */
+	private function copyRaw(string $from, string $to): void {
+		$in = $this->backend->get($from);
+		$buffer = fopen('php://temp/maxmemory:' . (4 * 1048576), 'w+b');
+		if ($buffer === false) {
+			fclose($in);
+			throw new RepositoryException("Cannot buffer $from");
+		}
+		try {
+			if (stream_copy_to_stream($in, $buffer) === false) {
+				throw new RepositoryException("Cannot read $from");
+			}
+		} finally {
+			fclose($in);
+		}
+		rewind($buffer);
+		$this->backend->put($to, $buffer);
+	}
+
+	/** Record a user_migration export's manifest in the catalog (rollback-protected like a snapshot). */
+	public function recordUserExport(string $manifestPath): void {
+		$this->catalog->userExports[$manifestPath] = true;
+		$this->catalog->write();
+	}
+
+	/**
+	 * User export manifests according to the verified catalog, newest first. A manifest the
+	 * catalog lists but the location no longer has means it was deleted or hidden behind NG
+	 * Backup's back, same as a missing snapshot (see listSnapshots()).
+	 *
+	 * @return list<string>
+	 */
+	public function listUserExports(?string $uid = null): array {
+		$prefix = $uid !== null ? 'users/' . $uid . '/' : 'users/';
+		$out = [];
+		foreach (array_keys($this->catalog->userExports) as $path) {
+			if (!str_starts_with($path, $prefix)) {
+				continue;
+			}
+			if (!$this->backend->exists($path)) {
+				throw new RepositoryException("User export $path is missing on the location (deleted or hidden outside NG Backup)");
+			}
+			$out[] = $path;
+		}
+		sort($out, SORT_STRING);
+		return array_reverse($out);
+	}
+
+	/** Whether $manifestPath is a user export the verified catalog actually recorded. */
+	public function isRecordedUserExport(string $manifestPath): bool {
+		return isset($this->catalog->userExports[$manifestPath]);
+	}
+
+	/** Permanently delete a user export. Its blobs are freed by the next prune() like any other. */
+	public function forgetUserExport(string $manifestPath): void {
+		if (!isset($this->catalog->userExports[$manifestPath])) {
+			throw new RepositoryException("$manifestPath is not a recorded user export");
+		}
+		unset($this->catalog->userExports[$manifestPath]);
+		$this->catalog->write();
+		$this->backend->delete($manifestPath);
+	}
+
 	/** @return array<string, array{forgottenAt:int, by:string, db:?string, dbInTrash:?string, time:?string, label:string}> */
 	public function trash(): array {
 		$out = [];
@@ -389,23 +510,26 @@ final class Repository {

 	/** Permanently delete trash entries older than $delaySeconds. @return list<string> purged snapshot ids */
 	public function purgeTrash(int $delaySeconds): array {
-		$purged = [];
+		$doomed = [];
 		foreach ($this->trash() as $id => $info) {
 			if (time() - $info['forgottenAt'] < $delaySeconds) {
 				continue;
 			}
+			$doomed[$id] = $info;
+			unset($this->catalog->trash[$id]);
+		}
+		if ($doomed === []) {
+			return [];
+		}
+		$this->catalog->write();
+		foreach ($doomed as $id => $info) {
 			if ($info['dbInTrash'] !== null) {
 				$this->backend->delete($info['dbInTrash']);
 			}
 			$this->backend->delete('trash/snapshots/' . $id);
 			$this->backend->delete('trash/info/' . $id);
-			unset($this->catalog->trash[$id]);
-			$purged[] = $id;
 		}
-		if ($purged !== []) {
-			$this->catalog->write();
-		}
-		return $purged;
+		return array_keys($doomed);
 	}

 	private function trashInfo(string $snapshotId): array {
@@ -457,7 +581,10 @@ final class Repository {
 				}
 			}
 		}
-		foreach ($this->backend->list('users') as $path) {
+		// listUserExports() throws when a recorded export's manifest is missing: then stop, since
+		// freeing its blobs would turn a tampering or storage alarm into irreversible deletion.
+		$exports = array_unique(array_merge($this->listUserExports(), $this->backend->list('users')));
+		foreach ($exports as $path) {
 			foreach (json_decode($this->getObject($path), true, 512, JSON_THROW_ON_ERROR)['entries'] as $e) {
 				foreach ($e['b'] ?? [] as $b) {
 					$used[$b] = true;
@@ -521,7 +648,7 @@ final class Repository {
 	 * @return list<string>
 	 */
 	public function listSnapshots(): array {
-		$present = array_flip(array_map('basename', $this->backend->list('snapshots')));
+		$present = array_flip(array_map('basename', $this->backend->listFiles('snapshots')));
 		$listed = array_keys($this->catalog->snapshots);
 		foreach ($listed as $id) {
 			if (!isset($present[$id])) {
@@ -585,8 +712,13 @@ final class Repository {
 	}

 	private function loadBlob(string $id): string {
-		[$pack, $offset, $length, $raw, $flags] = $this->index->get($id);
-		$encrypted = $this->backend->getRange('packs/' . substr($pack, 0, 2) . '/' . $pack, $offset, $length);
+		[$pack, $offset, $length] = $this->index->get($id);
+		return $this->decodeBlob($id, $this->packReader->read($pack, $offset, $length));
+	}
+
+	/** Decrypts and checks a blob read from its pack; throws when it is corrupted or tampered with. */
+	private function decodeBlob(string $id, string $encrypted): string {
+		[, , , $raw, $flags] = $this->index->get($id);
 		$payload = $this->cipher->decryptString($encrypted, 'blob:' . $id);
 		$data = ($flags & self::FLAG_DEFLATE) ? gzinflate($payload) : $payload;
 		if ($data === false || strlen($data) !== $raw || $this->keys->blobId($data) !== $id) {
@@ -609,6 +741,184 @@ final class Repository {
 		return $this->streamEntries($snapshotId);
 	}

+	/**
+	 * Checksum audit of a snapshot: every blob it references (files and the database dump, when
+	 * the snapshot has one) must be in the index, freshly re-downloaded and re-authenticated from
+	 * the location rather than trusted from the local cache (same reasoning as prune()), and its
+	 * pack must still be present. With $deep, each blob is also downloaded and decrypted, which
+	 * verifies its AEAD authentication tag and its content hash against the blob id (loadBlob()
+	 * already does both on every real read -- this just does it for everything in the snapshot,
+	 * deliberately, rather than relying on it to come up during a later restore). A blob
+	 * referenced by more than one file is only checked once; a missing database manifest is a
+	 * failure, not something to silently skip over.
+	 *
+	 * @param ?callable(array{phase:string, done:int, total:?int, blobs?:int, bytes?:int}):void $heartbeat
+	 *        called often during the check, with how far it is: phase "index" (index files
+	 *        downloaded), "packs" (pack folders listed), "files" and "database" (files of the
+	 *        snapshot checked); callers use it to keep a time-boxed lease alive and to report
+	 * @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string}
+	 */
+	public function verify(string $snapshotId, bool $deep = false, ?callable $heartbeat = null): array {
+		$heartbeat ??= static function (array $progress): void {
+		};
+		$meta = $this->snapshotMeta($snapshotId);
+		$filesTotal = isset($meta['stats']['files']) ? (int)$meta['stats']['files'] : null;
+		$this->index->load(true, static function (int $done, int $total) use ($heartbeat): void {
+			$heartbeat(['phase' => 'index', 'done' => $done, 'total' => $total]);
+		});
+		$stats = ['filesChecked' => 0, 'blobsChecked' => 0, 'bytesChecked' => 0, 'missing' => [], 'failed' => [], 'unreadable' => [], 'readError' => ''];
+		$seen = [];
+		[$packSeen, $listedDirs] = $this->presentPacks($heartbeat);
+		foreach ($this->streamEntries($snapshotId) as $entry) {
+			$stats['filesChecked']++;
+			foreach ($entry['b'] as $id) {
+				if (isset($seen[$id])) {
+					continue;
+				}
+				$seen[$id] = true;
+				$this->verifyBlob($id, $deep, $stats, $packSeen, $listedDirs);
+				$heartbeat(['phase' => 'files', 'done' => $stats['filesChecked'], 'total' => $filesTotal,
+					'blobs' => $stats['blobsChecked'], 'bytes' => $stats['bytesChecked']]);
+			}
+		}
+		if (isset($meta['db']) && is_string($meta['db'])) {
+			if (!$this->backend->exists($meta['db'])) {
+				$stats['missing'][] = $meta['db'];
+			} else {
+				$dbManifest = json_decode($this->getObject($meta['db']), true, 512, JSON_THROW_ON_ERROR);
+				foreach ($dbManifest['tables'] as $info) {
+					foreach ($info['blobs'] as $id) {
+						if (isset($seen[$id])) {
+							continue;
+						}
+						$seen[$id] = true;
+						$this->verifyBlob($id, $deep, $stats, $packSeen, $listedDirs);
+						$heartbeat(['phase' => 'database', 'done' => $stats['filesChecked'], 'total' => $filesTotal,
+							'blobs' => $stats['blobsChecked'], 'bytes' => $stats['bytesChecked']]);
+					}
+				}
+			}
+		}
+		return $stats;
+	}
+
+	/**
+	 * Which packs are on the location, from one listing per pack folder instead of a request per
+	 * pack. A folder that cannot be listed, or comes back empty (which a storage also reports when
+	 * it could not look), is left out: its packs are then checked one by one. With no more packs
+	 * than folders nothing is listed: a request per pack is fewer requests then, and on FTP every
+	 * request takes a data connection, of which a server may have only a few.
+	 *
+	 * @return array{0: array<string, bool>, 1: array<string, true>} pack id => present, and the
+	 *                                                              folders that were listed
+	 */
+	private function presentPacks(callable $heartbeat): array {
+		$present = [];
+		$listed = [];
+		if ($this->index->packCount() <= $this->listPacksAbove) {
+			return [$present, $listed];
+		}
+		for ($i = 0; $i < 256; $i++) {
+			$dir = sprintf('%02x', $i);
+			try {
+				$files = $this->backend->listFiles('packs/' . $dir);
+			} catch (BackendException) {
+				$files = [];
+			}
+			foreach ($files as $path) {
+				$present[basename($path)] = true;
+			}
+			if ($files !== []) {
+				$listed[$dir] = true;
+			}
+			$heartbeat(['phase' => 'packs', 'done' => $i + 1, 'total' => 256]);
+		}
+		return [$present, $listed];
+	}
+
+	/**
+	 * Same checks as verify(), for a user export: every blob its manifest references must be in
+	 * the freshly re-authenticated index with its pack present; $deep also decrypts each.
+	 *
+	 * @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string}
+	 */
+	public function verifyUserExport(string $manifestPath, bool $deep = false, ?callable $heartbeat = null): array {
+		if (!$this->isRecordedUserExport($manifestPath)) {
+			throw new RepositoryException("$manifestPath is not a recorded user export for this location");
+		}
+		$heartbeat ??= static function (array $progress): void {
+		};
+		$this->index->load(true, static function (int $done, int $total) use ($heartbeat): void {
+			$heartbeat(['phase' => 'index', 'done' => $done, 'total' => $total]);
+		});
+		$stats = ['filesChecked' => 0, 'blobsChecked' => 0, 'bytesChecked' => 0, 'missing' => [], 'failed' => [], 'unreadable' => [], 'readError' => ''];
+		$seen = [];
+		$packSeen = [];
+		$manifest = json_decode($this->getObject($manifestPath), true, 512, JSON_THROW_ON_ERROR);
+		foreach ($manifest['entries'] as $entry) {
+			if (($entry['t'] ?? '') !== 'f') {
+				continue;
+			}
+			$stats['filesChecked']++;
+			foreach ($entry['b'] ?? [] as $id) {
+				if (isset($seen[$id])) {
+					continue;
+				}
+				$seen[$id] = true;
+				$this->verifyBlob($id, $deep, $stats, $packSeen);
+				$heartbeat(['phase' => 'files', 'done' => $stats['filesChecked'], 'total' => null,
+					'blobs' => $stats['blobsChecked'], 'bytes' => $stats['bytesChecked']]);
+			}
+		}
+		return $stats;
+	}
+
+	/**
+	 * @param array<string, bool> $packSeen pack id => present; filled in as packs are checked
+	 * @param array<string, true> $listedDirs pack folders whose listing is in $packSeen: a pack
+	 *                                        not in it is not there
+	 */
+	private function verifyBlob(string $id, bool $deep, array &$stats, array &$packSeen, array $listedDirs = []): void {
+		if (!$this->index->has($id)) {
+			$stats['missing'][] = $id;
+			return;
+		}
+		[$pack] = $this->index->get($id);
+		$packExists = $packSeen[$pack] ??= isset($listedDirs[substr($pack, 0, 2)])
+			? false
+			: $this->backend->exists('packs/' . substr($pack, 0, 2) . '/' . $pack);
+		if (!$packExists) {
+			$stats['missing'][] = $id;
+			return;
+		}
+		$stats['blobsChecked']++;
+		if (!$deep) {
+			return;
+		}
+		// Reading and checking are kept apart: a read that fails is usually a network or
+		// storage error, so it is retried and reported as unreadable (a pack that stays
+		// unreadable may still be truncated). Only a blob that was read but does not
+		// decrypt or match its id counts as failed: that is proof of damage.
+		[, $offset, $length] = $this->index->get($id);
+		$encrypted = null;
+		for ($attempt = 1; $attempt <= self::VERIFY_READ_ATTEMPTS && $encrypted === null; $attempt++) {
+			try {
+				$encrypted = $this->packReader->read($pack, $offset, $length);
+			} catch (\Exception $e) { // storage adapters throw their own exceptions; \Error (a bug) is not retried
+				$stats['readError'] = $e->getMessage();
+			}
+		}
+		if ($encrypted === null) {
+			$stats['unreadable'][] = $id;
+			return;
+		}
+		try {
+			$stats['bytesChecked'] += strlen($this->decodeBlob($id, $encrypted));
+		} catch (\Exception) { // damage; an \Error is a bug and must not be reported as damage
+			$stats['failed'][] = $id;
+		}
+	}
+
 	/** The meta record (first line) of a snapshot. */
 	public function snapshotMeta(string $snapshotId): array {
 		$plain = fopen('php://temp/maxmemory:' . (4 * 1048576), 'w+b');
@@ -54,6 +54,13 @@ final class AlertService {
 			['kind' => $run->getKind(), 'target' => $targetName, 'error' => mb_strimwidth((string)$run->getError(), 0, 300, '…')]);
 	}

+	/** A backup that finished but is missing unreadable files, or holds files that changed while read. */
+	public function runWarnings(Run $run, string $targetName, int $unreadable, int $changing, array $examples): void {
+		$this->notifyAdmins('run_warnings', 'run-' . $run->getId(), ['target' => $targetName,
+			'unreadable' => (string)$unreadable, 'changing' => (string)$changing,
+			'examples' => mb_strimwidth(implode(', ', array_merge($examples['unreadable'], $examples['changing'])), 0, 300, '…')]);
+	}
+
 	/**
 	 * Remember how much is stored on a location (for the settings page) and warn administrators
 	 * once a day when it is at 80% of its limit or more.
@@ -97,7 +104,7 @@ final class AlertService {
 		}
 		$this->appConfig->setValueString(Application::APP_ID, $key, date('Y-m-d'));
 		$this->notifyAdmins('backup_stale', 'stale-' . $target->getId() . '-' . date('Y-m-d'),
-			['target' => $target->getName(), 'since' => $last ? date('Y-m-d H:i', $lastTime) : 'never']);
+			['target' => $target->getName(), 'since' => $last ? date('Y-m-d H:i', $lastTime) : '']);
 	}

 	private function notifyAdmins(string $subject, string $objectId, array $params): void {
@@ -14,8 +14,11 @@ use OCA\NgBackup\Db\Snapshot;
 use OCA\NgBackup\Db\SnapshotMapper;
 use OCA\NgBackup\Db\Target;
 use OCA\NgBackup\Job\BackupRun;
+use OCA\NgBackup\Repository\RepositoryException;
+use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\App\IAppManager;
 use OCP\IConfig;
+use OCP\DB\QueryBuilder\IQueryBuilder;
 use OCP\IDBConnection;
 use OCP\Lock\ILockingProvider;
 use OCP\Lock\LockedException;
@@ -67,6 +70,46 @@ final class BackupService {
 		}
 	}

+	/**
+	 * The expected size of the files phase, for the progress shown while it runs: the size of the
+	 * previous snapshot, or for a first backup the users' files, versions and trash as Nextcloud's
+	 * file cache knows them (approximate: other data in the data directory is not counted).
+	 *
+	 * @return array{bytes: int, approximate: bool}
+	 */
+	private function estimateBytes(Run $run, array $files): array {
+		if (($files['parent'] ?? null) !== null) {
+			try {
+				return ['bytes' => $this->snapshots->findOne($run->getTargetId(), (string)$files['parent'])->getBytes() ?? 0, 'approximate' => false];
+			} catch (\Throwable) {
+			}
+		}
+		try {
+			$qb = $this->db->getQueryBuilder();
+			$qb->select('numeric_id')->from('storages')
+				->where($qb->expr()->like('id', $qb->createNamedParameter('home::%')))
+				->orWhere($qb->expr()->like('id', $qb->createNamedParameter('object::user:%')));
+			$result = $qb->executeQuery();
+			$storages = [];
+			while (($id = $result->fetchOne()) !== false) {
+				$storages[] = (int)$id;
+			}
+			$result->closeCursor();
+			$bytes = 0;
+			foreach (array_chunk($storages, 500) as $chunk) {
+				$qb = $this->db->getQueryBuilder();
+				$qb->select($qb->func()->sum('size'))->from('filecache')
+					->where($qb->expr()->in('storage', $qb->createNamedParameter($chunk, IQueryBuilder::PARAM_INT_ARRAY)))
+					->andWhere($qb->expr()->in('path_hash', $qb->createNamedParameter(array_map('md5', ['files', 'files_versions', 'files_trashbin']), IQueryBuilder::PARAM_STR_ARRAY)))
+					->andWhere($qb->expr()->gt('size', $qb->createNamedParameter(0, IQueryBuilder::PARAM_INT)));
+				$bytes += (int)$qb->executeQuery()->fetchOne();
+			}
+			return ['bytes' => $bytes, 'approximate' => true];
+		} catch (\Throwable) {
+			return ['bytes' => 0, 'approximate' => true];
+		}
+	}
+
 	private function createRun(Target $target, string $label): Run {
 		$running = $this->runs->findRunning($target->getId(), self::KIND_FULL);
 		if ($running !== []) {
@@ -104,7 +147,10 @@ final class BackupService {
 	 */
 	public function step(Run $run, float $deadline): Run {
 		// Leases expire on their own: a step killed by a time limit or OOM blocks nothing for long.
-		$ttl = (int)min(3600, max(120, $deadline - microtime(true) + 120));
+		// A step can run well past its deadline (the commit of a large snapshot writes its tree and
+		// index), so the lease holds at least 15 minutes; should it still expire and another process
+		// take the run over, the checks below keep the two from overwriting each other.
+		$ttl = (int)min(3600, max(900, $deadline - microtime(true) + 600));
 		try {
 			$runLease = $this->leases->acquire('run/' . $run->getId(), LeaseService::EXCLUSIVE, $ttl);
 		} catch (LockedException) {
@@ -117,11 +163,13 @@ final class BackupService {
 			$this->leases->release($runLease);
 			return $run;
 		}
+		$loadedAt = null;
 		try {
 			$run = $this->runs->find($run->getId()); // fresh state after acquiring the lock
 			if ($run->getStatus() !== Run::RUNNING || $run->getKind() !== self::KIND_FULL) {
 				return $run;
 			}
+			$loadedAt = $run->getUpdatedAt();
 			$target = $this->targets->get((string)$run->getTargetId());
 			$repo = $this->targets->repository($target);
 			$state = json_decode($run->getState(), true, 512, JSON_THROW_ON_ERROR);
@@ -146,10 +194,37 @@ final class BackupService {
 					$state['dump'] = $dump;
 				}
 			} else {
+				$state['files']['estimate'] ??= $this->estimateBytes($run, $state['files']);
 				$state['files'] = BackupRun::step($repo, $state['files'], $deadline);
+				if ($state['files']['phase'] === 'commit') {
+					// Catalog write under the catalog lock, from a repository opened inside it: a per-user
+					// export or restore may have written the catalog since this step opened $repo.
+					try {
+						$this->leases->with(PruneService::catalogLockKey($target), LeaseService::EXCLUSIVE, 300,
+							fn () => $this->targets->repository($target)->recordSnapshot((string)$state['files']['snapshot']));
+						$state['files']['phase'] = 'done';
+					} catch (LockedException|RepositoryException) {
+						// Another catalog write is in progress (or just raced us to the next
+						// generation): the next step retries this commit on the fresh catalog.
+					}
+				}
 				if ($state['files']['phase'] === 'done') {
 					$this->recordSnapshot($run, $state['files']);
-					$this->alerts->storedBytes($target, $repo->storedBytes());
+					// The snapshot is committed: what follows only reports on it and must not turn
+					// the run into a failure.
+					try {
+						$this->alerts->storedBytes($target, $repo->storedBytes());
+						$stats = $state['files']['stats'];
+						if (($stats['unreadable'] ?? 0) > 0 || ($stats['changing'] ?? 0) > 0) {
+							$warnings = BackupRun::warnings($state['files']);
+							$this->logger->warning(sprintf('NG Backup run %d to %s: %d unreadable (missing from the snapshot): %s; %d changed while being read: %s',
+								$run->getId(), $target->getName(), $stats['unreadable'] ?? 0, implode(', ', $warnings['unreadable']),
+								$stats['changing'] ?? 0, implode(', ', $warnings['changing'])));
+							$this->alerts->runWarnings($run, $target->getName(), (int)($stats['unreadable'] ?? 0), (int)($stats['changing'] ?? 0), $warnings);
+						}
+					} catch (\Throwable $e) {
+						$this->logger->warning('NG Backup run ' . $run->getId() . ': reporting on the finished backup failed: ' . $e->getMessage(), ['exception' => $e]);
+					}
 					$run->setStatus(Run::DONE);
 					$run->setPhase('done');
 					$run->setFinishedAt(time());
@@ -157,15 +232,27 @@ final class BackupService {
 			}
 			$run->setState(json_encode($state, JSON_THROW_ON_ERROR));
 			$run->setStats(json_encode(['db' => $state['dbStats'] ?? null, 'files' => $state['files']['stats']], JSON_THROW_ON_ERROR));
-			$run->setUpdatedAt(time());
-			return $this->runs->update($run);
+			// Another process may have taken the run over after this step's lease expired: then its
+			// writes stand and this step's are dropped.
+			return $this->runs->updateIfUnchanged($run, $loadedAt) ?? $this->runs->find($run->getId());
 		} catch (\Throwable $e) {
-			$this->logger->error('NG Backup run ' . $run->getId() . ' failed: ' . $e->getMessage(), ['exception' => $e]);
+			if ($loadedAt === null) {
+				// The run could not even be loaded: there is nothing fresh to mark as failed, and
+				// the caller's copy may be stale.
+				$this->logger->error('NG Backup run ' . $run->getId() . ': step could not load the run: ' . $e->getMessage(), ['exception' => $e]);
+				return $run;
+			}
 			$run->setStatus(Run::FAILED);
 			$run->setError($e->getMessage());
 			$run->setFinishedAt(time());
-			$run->setUpdatedAt(time());
-			$run = $this->runs->update($run);
+			$failed = $this->runs->updateIfUnchanged($run, $loadedAt);
+			if ($failed === null) {
+				// Another process that took the run over may have finished it: its result stands.
+				$this->logger->warning('NG Backup run ' . $run->getId() . ': a step that another process had taken over ended with: ' . $e->getMessage());
+				return $this->runs->find($run->getId());
+			}
+			$run = $failed;
+			$this->logger->error('NG Backup run ' . $run->getId() . ' failed: ' . $e->getMessage(), ['exception' => $e]);
 			try {
 				$this->alerts->runFailed($run, isset($target) ? $target->getName() : '#' . $run->getTargetId());
 			} catch (\Throwable) {
@@ -203,6 +290,11 @@ final class BackupService {
 	}

 	private function recordSnapshot(Run $run, array $files): void {
+		try {
+			$this->snapshots->findOne($run->getTargetId(), $files['snapshot']);
+			return; // already recorded, by an earlier attempt at this step
+		} catch (DoesNotExistException) {
+		}
 		$s = new Snapshot();
 		$s->setTargetId($run->getTargetId());
 		$s->setSnapshotId($files['snapshot']);
@@ -211,7 +303,19 @@ final class BackupService {
 		$s->setCreatedAt(time());
 		$s->setFiles($files['stats']['files']);
 		$s->setBytes($files['stats']['bytes']);
-		$this->snapshots->insert($s);
+		try {
+			$this->snapshots->insert($s);
+		} catch (\OCP\DB\Exception $e) {
+			// Recorded by another process between the check above and this insert?
+			if ($e->getReason() !== \OCP\DB\Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
+				throw $e;
+			}
+			try {
+				$this->snapshots->findOne($run->getTargetId(), $files['snapshot']);
+			} catch (DoesNotExistException) {
+				throw $e;
+			}
+		}
 	}

 	/** @return list<string> */
@@ -71,6 +71,86 @@ final class KeyService {
 		$this->cached = $keys;
 	}

+	/**
+	 * Disaster recovery on a fresh installation: adopt the master key from a recovery kit
+	 * (occ backup:key:kit on the original installation) instead of generating a new one.
+	 * Afterwards occ backup:target:add opens the existing repository on the location with this
+	 * key, instead of creating a new, empty one.
+	 *
+	 * @param array<string, mixed> $kit as produced by recoveryKit()
+	 * @throws \OCA\NgBackup\Crypto\CryptoException wrong passphrase, or a damaged/foreign kit
+	 */
+	public function importRecoveryKit(array $kit, #[\SensitiveParameter] string $passphrase): void {
+		if ($this->isInitialized()) {
+			throw new \RuntimeException('A backup key already exists');
+		}
+		if (!isset($kit['wrapped_key'])) {
+			throw new \InvalidArgumentException('Not a NG Backup recovery kit file');
+		}
+		$keys = KeyRing::unwrapAny($kit['wrapped_key'], $passphrase);
+		$this->appConfig->setValueString(Application::APP_ID, self::KEY_MASTER,
+			$this->crypto->encrypt(base64_encode($keys->exportMasterKey())), true, true);
+		$this->cached = $keys;
+		$this->appConfig->setValueString(Application::APP_ID, self::KEY_WRAPPED, json_encode($kit['wrapped_key'], JSON_THROW_ON_ERROR), true, true);
+		$this->appConfig->setValueString(Application::APP_ID, self::KEY_FINGERPRINT, $this->fingerprintOf($keys), true);
+		// Kits from before this field existed fall back to the default.
+		$delay = (int)($kit['delete_delay_days'] ?? self::DEFAULT_DELETE_DELAY);
+		$this->appConfig->setValueInt(Application::APP_ID, self::KEY_DELETE_DELAY, ($delay >= 1 && $delay <= 365) ? $delay : self::DEFAULT_DELETE_DELAY, true);
+		$this->appConfig->setValueInt(Application::APP_ID, self::KEY_KIT_VERSION, (int)($kit['kit_version'] ?? 1), true);
+		// Having and successfully using a real kit file is stronger proof than the normal
+		// download-and-confirm flow it replaces.
+		$this->confirmRecoveryKit('cli-import');
+	}
+
+	/**
+	 * The master key and the recovery kit code are stored encrypted with Nextcloud's own
+	 * instance secret (ICrypto), not with themselves; the wrapped key is not (it is sealed with
+	 * the admin's passphrase instead), but Nextcloud's own AppConfig additionally encrypts any
+	 * "sensitive" value with the instance secret regardless, underneath whatever we store. So
+	 * changing that secret (occ backup:restore:full merging config.php) would otherwise leave
+	 * all three permanently undecryptable. Call $applySecretChange (which must be the only thing
+	 * that changes the secret) through here instead: all three are decrypted first, then
+	 * re-encrypted under whatever secret is active once $applySecretChange returns.
+	 *
+	 * Not crash-safe: a process kill between the delete and the re-save of one of these keys
+	 * would leave it missing rather than merely stale. Disaster recovery is run once, by hand,
+	 * right after occ maintenance:install; a dedicated two-phase write is not justified yet for
+	 * that narrow a window.
+	 */
+	public function reencryptForSecretRotation(callable $applySecretChange): mixed {
+		$master = $this->appConfig->getValueString(Application::APP_ID, self::KEY_MASTER, '', true);
+		$wrapped = $this->appConfig->getValueString(Application::APP_ID, self::KEY_WRAPPED, '', true);
+		$kitCodeRaw = $this->appConfig->getValueString(Application::APP_ID, self::KEY_KIT_CODE, '', true);
+		$kitCode = $kitCodeRaw !== '' ? json_decode($kitCodeRaw, true, 512, JSON_THROW_ON_ERROR) : null;
+		$masterPlain = $master !== '' ? $this->crypto->decrypt($master) : null;
+		$kitCodePlain = $kitCode !== null && isset($kitCode['code']) ? $this->crypto->decrypt($kitCode['code']) : null;
+
+		$result = $applySecretChange();
+		$this->cached = null; // the master key is about to be re-saved; do not keep the pre-rotation copy
+
+		// Nextcloud's own AppConfig additionally encrypts a "sensitive" value itself (tied to
+		// the same secret, underneath our own encrypt() above); setValueString() on an existing
+		// key reads the old value first to compare, which would try to decrypt it with the new
+		// secret and fail the same way. Delete first so there is nothing to compare against.
+		if ($masterPlain !== null) {
+			$this->appConfig->deleteKey(Application::APP_ID, self::KEY_MASTER);
+			$this->appConfig->setValueString(Application::APP_ID, self::KEY_MASTER, $this->crypto->encrypt($masterPlain), true, true);
+		}
+		if ($wrapped !== '') {
+			// Already plaintext JSON here: getValueString() above transparently undid
+			// AppConfig's own sensitive-value encryption; there is no encrypt() of our own to
+			// redo (wrapping is sealed with the passphrase, not the instance secret).
+			$this->appConfig->deleteKey(Application::APP_ID, self::KEY_WRAPPED);
+			$this->appConfig->setValueString(Application::APP_ID, self::KEY_WRAPPED, $wrapped, true, true);
+		}
+		if ($kitCodePlain !== null) {
+			$kitCode['code'] = $this->crypto->encrypt($kitCodePlain);
+			$this->appConfig->deleteKey(Application::APP_ID, self::KEY_KIT_CODE);
+			$this->appConfig->setValueString(Application::APP_ID, self::KEY_KIT_CODE, json_encode($kitCode, JSON_THROW_ON_ERROR), true, true);
+		}
+		return $result;
+	}
+
 	public function keyRing(): KeyRing {
 		if ($this->cached === null) {
 			$enc = $this->appConfig->getValueString(Application::APP_ID, self::KEY_MASTER, '', true);
@@ -182,13 +262,14 @@ final class KeyService {
 		return $this->appConfig->getValueString(Application::APP_ID, self::KEY_FINGERPRINT, '', true);
 	}

-	/** @return array{version:int, app:string, fingerprint:string, created:string, wrapped_key:array, instructions:string} */
+	/** @return array{version:int, app:string, fingerprint:string, kit_version:int, delete_delay_days:int, confirmation_code:string, created:string, wrapped_key:array, slots:list<array{slot:int, label:string, created:int}>, instructions:string} */
 	public function recoveryKit(): array {
 		return [
 			'version' => 1,
 			'app' => 'NG Backup',
 			'fingerprint' => $this->fingerprint(),
 			'kit_version' => $this->kitVersion(),
+			'delete_delay_days' => $this->deleteDelayDays(),
 			'confirmation_code' => $this->kitCode(),
 			'created' => gmdate('c'),
 			'wrapped_key' => $this->wrappedKey(),
@@ -76,6 +76,17 @@ final class LeaseService {
 		$qb->executeStatement();
 	}

+	/** Wraps $refresh so calling it often (per file, per row batch) only touches the database every $seconds. */
+	public static function throttled(callable $refresh, int $seconds = 60): \Closure {
+		$last = time();
+		return static function () use ($refresh, $seconds, &$last): void {
+			if (time() - $last >= $seconds) {
+				$refresh();
+				$last = time();
+			}
+		};
+	}
+
 	/** Run $fn under a lease; $refresh() can be called during long work. */
 	public function with(string $name, string $mode, int $ttl, callable $fn): mixed {
 		$id = $this->acquire($name, $mode, $ttl);
@@ -98,6 +98,83 @@ final class PruneService {
 		return 'ng_backup/target/' . $target->getId();
 	}

+	/**
+	 * A separate, short-lived exclusive lock serializing writes to the catalog itself. The
+	 * per-target lock above only keeps readers/writers out while a cleanup runs; it does not
+	 * stop two SHARED holders (e.g. two concurrent per-user backups, or one alongside a full
+	 * backup) from both reading the same catalog generation and racing to write the next one,
+	 * silently dropping whichever's change loses. The full-backup path avoids this today only
+	 * because a Run row makes concurrent runs for the same target mutually exclusive; per-user
+	 * backup/restore has no such row, so it takes this lock around the catalog write itself.
+	 */
+	public static function catalogLockKey(Target $target): string {
+		return self::lockKey($target) . '/catalog';
+	}
+
+	/** How many of each user's own exports (occ backup:user:backup) to keep, newest first. */
+	public function userExportRetention(): int {
+		return $this->appConfig->getValueInt(Application::APP_ID, 'user_export_retention', 3);
+	}
+
+	public function setUserExportRetention(int $keep): void {
+		if ($keep < 1) {
+			throw new \InvalidArgumentException('Keep at least the last export');
+		}
+		$old = $this->userExportRetention();
+		$this->appConfig->setValueInt(Application::APP_ID, 'user_export_retention', $keep);
+		if ($old !== $keep) {
+			$this->alerts->securityEvent('user_export_retention_changed', ['keep' => (string)$keep]);
+		}
+	}
+
+	/**
+	 * Forgets a user's older exports once more than userExportRetention() exist for them,
+	 * newest first; no trash, unlike a full snapshot (occ backup:user:backup is on-demand, not
+	 * yet the primary safety net the deletion delay protects).
+	 *
+	 * @return array{kept: array<string, list<string>>, forgotten: list<string>}
+	 */
+	public function applyUserExports(Target $target, bool $dryRun = false): array {
+		if ($target->getAppendOnly()) {
+			throw new \RuntimeException('Location ' . $target->getName() . ' is append-only: NG Backup does not delete anything there');
+		}
+		$lease = $this->lockExclusive($target, 1800);
+		try {
+			$repo = $this->targets->repository($target);
+			$keep = $this->userExportRetention();
+			$byUser = [];
+			foreach ($repo->listUserExports() as $path) {
+				$uid = explode('/', $path)[1] ?? '';
+				$manifest = json_decode($repo->getObject($path), true, 512, JSON_THROW_ON_ERROR);
+				$byUser[$uid][$path] = (int)strtotime((string)($manifest['time'] ?? '@0'));
+			}
+			$kept = [];
+			$forget = [];
+			foreach ($byUser as $uid => $times) {
+				arsort($times);
+				$i = 0;
+				foreach (array_keys($times) as $path) {
+					if ($i++ < $keep) {
+						$kept[$uid][] = $path;
+					} else {
+						$forget[] = $path;
+					}
+				}
+			}
+			if (!$dryRun) {
+				foreach ($forget as $path) {
+					$repo->forgetUserExport($path);
+				}
+				if ($forget !== []) {
+					$this->alerts->securityEvent('user_exports_forgotten', ['target' => $target->getName(), 'count' => (string)count($forget)], false);
+				}
+			}
+			return ['kept' => $kept, 'forgotten' => $forget];
+		} finally {
+			$this->leases->release($lease);
+		}
+	}
+
 	public function policy(): RetentionPolicy {
 		return RetentionPolicy::fromArray(json_decode($this->appConfig->getValueString(Application::APP_ID, 'retention', '{}'), true) ?: []);
 	}
@@ -0,0 +1,228 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Service;
+
+use OCA\NgBackup\Db\DbDumper;
+use OCA\NgBackup\Db\Target;
+use OCP\App\IAppManager;
+use OCP\IConfig;
+use OCP\IDBConnection;
+use OCP\Lock\LockedException;
+
+/**
+ * Disaster recovery on a fresh Nextcloud installation (same major version): replace the
+ * database, restore the data directory and merge the backed-up config.php, see PLAN.md 3.7.
+ *
+ * Deliberately NOT handled yet (phase 3): restoring in place over a live, already-used
+ * installation. The admin is expected to run this once, right after occ maintenance:install and
+ * occ backup:key:import/backup:target:add, before anyone else touches the instance.
+ */
+final class RestoreFullService {
+	/**
+	 * Config keys that must keep pointing at THIS installation's actual, already-working
+	 * database and data directory (set by occ maintenance:install), never at the old server's.
+	 */
+	private const CONNECTION_KEYS = [
+		'dbtype', 'dbhost', 'dbport', 'dbname', 'dbuser', 'dbpassword', 'dbpersistent',
+		'dbtableprefix', 'dbdriveroptions', 'datadirectory',
+	];
+
+	public function __construct(
+		private TargetService $targets,
+		private RestoreService $restore,
+		private LeaseService $leases,
+		private IConfig $config,
+		private IDBConnection $db,
+		private IAppManager $appManager,
+		private KeyService $keys,
+	) {
+	}
+
+	/**
+	 * Whether this installation can receive $snapshotId: same Nextcloud major version, and every
+	 * app that was enabled at backup time already installed here (its tables must exist before
+	 * the database restore can write into them).
+	 *
+	 * @return array{ok:bool, currentMajor:string, snapshotMajor:string, missingApps:list<string>}
+	 */
+	public function checkCompatibility(Target $target, string $snapshotId): array {
+		$meta = $this->targets->repository($target)->snapshotMeta($snapshotId);
+		$currentMajor = explode('.', $this->config->getSystemValueString('version'))[0];
+		$snapshotMajor = explode('.', (string)($meta['nextcloud'] ?? ''))[0];
+		$enabled = array_flip($this->appManager->getEnabledApps());
+		$missingApps = array_values(array_diff(array_keys($meta['apps'] ?? []), array_keys($enabled)));
+		return [
+			'ok' => $currentMajor === $snapshotMajor && $missingApps === [],
+			'currentMajor' => $currentMajor,
+			'snapshotMajor' => $snapshotMajor,
+			'missingApps' => $missingApps,
+		];
+	}
+
+	/** @return array{dbReport:array, dataFiles:int, configKeys:int, dbConsistent:bool} */
+	public function restoreFull(Target $target, string $snapshotId): array {
+		$check = $this->checkCompatibility($target, $snapshotId);
+		if (!$check['ok']) {
+			throw new \RuntimeException($this->describeBlockers($check));
+		}
+		return $this->withSharedLock($target, function (callable $refresh) use ($target, $snapshotId) {
+			$beat = LeaseService::throttled($refresh);
+			$repo = $this->targets->repository($target);
+			$meta = $repo->snapshotMeta($snapshotId);
+
+			$dbReport = null;
+			$manifest = [];
+			if (isset($meta['db'])) {
+				$manifest = json_decode($repo->getObject($meta['db']), true, 512, JSON_THROW_ON_ERROR);
+				$prefix = $this->config->getSystemValueString('dbtableprefix', 'oc_');
+				// ng_backup's own tables (and its own rows in the shared appconfig table) must
+				// survive this restore untouched: they describe the backup/key/target that is
+				// actively performing it right now, on THIS installation, not the one that was
+				// backed up. Overwriting them mid-restore would pull the rug from under it.
+				foreach (array_keys($manifest['tables']) as $table) {
+					/** @var string $table */
+					if (str_starts_with($table, $prefix . 'ngb_')) {
+						unset($manifest['tables'][$table]);
+					}
+				}
+				// Sequences are keyed separately from tables; excluding a table does not exclude
+				// its sequence, which would otherwise rewind a retained ngb_* table's sequence
+				// below its current ids (PostgreSQL only -- see DbDumper::restoreSequences()).
+				foreach (array_keys($manifest['sequences'] ?? []) as $seq) {
+					/** @var string $seq */
+					if (str_starts_with((string)($manifest['sequences'][$seq]['table'] ?? ''), $prefix . 'ngb_')) {
+						unset($manifest['sequences'][$seq]);
+					}
+				}
+				$ownAppConfig = $this->preserveOwnAppConfig();
+				$dumper = new DbDumper($this->db->getInner(), $prefix);
+				try {
+					$dumper->restore($repo, $manifest, $dbReport, $beat);
+				} finally {
+					$this->restoreOwnAppConfig($ownAppConfig);
+				}
+			}
+
+			// Read (but do not yet apply) the backed-up config.php before touching the data
+			// directory: once applied, 'secret' may differ from what ng_backup's own Target
+			// options were encrypted with (see restoreFull()'s docblock), and every further
+			// repository access through $this->targets would fail to decrypt them.
+			/** @var array<string, mixed> $backupConfig */
+			$backupConfig = $this->fetchBackupConfig($target, $snapshotId);
+
+			$dataDir = rtrim($this->config->getSystemValueString('datadirectory'), '/');
+			$dataFiles = $this->restore->restoreToDirectory($target, $snapshotId, 'data', $dataDir, stripPrefix: true, heartbeat: $beat);
+
+			// Last step: nothing after this may need $this->targets->repository($target) again.
+			if ($backupConfig !== []) {
+				$this->targets->reencryptOptionsAround(
+					fn (): mixed => $this->keys->reencryptForSecretRotation(fn (): mixed => $this->config->setSystemValues($backupConfig)),
+				);
+			}
+
+			return ['dbReport' => $dbReport ?? ['skipped' => [], 'restored' => []], 'dataFiles' => $dataFiles, 'configKeys' => count($backupConfig),
+				'dbConsistent' => (bool)($manifest['consistent'] ?? true)];
+		});
+	}
+
+	/** @return array<string, mixed> config.php's $CONFIG from the backup, minus the connection keys */
+	private function fetchBackupConfig(Target $target, string $snapshotId): array {
+		$tmp = sys_get_temp_dir() . '/ngb-restore-config-' . bin2hex(random_bytes(6));
+		try {
+			$this->restore->restoreToDirectory($target, $snapshotId, 'config', $tmp, stripPrefix: true);
+			$path = $tmp . '/config.php';
+			if (!is_file($path)) {
+				return []; // nothing to merge; the live config.php stays as occ maintenance:install made it
+			}
+			$backupConfig = (static function () use ($path): array {
+				$CONFIG = [];
+				include $path;
+				return $CONFIG;
+			})();
+			foreach (self::CONNECTION_KEYS as $key) {
+				unset($backupConfig[$key]);
+			}
+			return $backupConfig;
+		} finally {
+			$this->rmrf($tmp);
+		}
+	}
+
+	/** @return list<array<string, mixed>> raw appconfig rows (appid, configkey, configvalue, type, lazy) */
+	private function preserveOwnAppConfig(): array {
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('*')->from('appconfig')
+			->where($qb->expr()->eq('appid', $qb->createNamedParameter(\OCA\NgBackup\AppInfo\Application::APP_ID)));
+		/** @var list<array<string, mixed>> */
+		return $qb->executeQuery()->fetchAll();
+	}
+
+	/**
+	 * @param list<array<string, mixed>> $rows raw appconfig rows, as returned by preserveOwnAppConfig()
+	 *
+	 * Runs in its own transaction (DbDumper::restore() already committed its own by the time
+	 * this is called): not a full guarantee against a crash spanning both, but means this step
+	 * itself cannot leave ng_backup's appconfig rows half deleted, half reinserted.
+	 */
+	private function restoreOwnAppConfig(array $rows): void {
+		$this->db->beginTransaction();
+		try {
+			$qb = $this->db->getQueryBuilder();
+			$qb->delete('appconfig')
+				->where($qb->expr()->eq('appid', $qb->createNamedParameter(\OCA\NgBackup\AppInfo\Application::APP_ID)));
+			$qb->executeStatement();
+			foreach ($rows as $row) {
+				$ins = $this->db->getQueryBuilder();
+				$ins->insert('appconfig')->values([
+					'appid' => $ins->createNamedParameter($row['appid']),
+					'configkey' => $ins->createNamedParameter($row['configkey']),
+					'configvalue' => $ins->createNamedParameter($row['configvalue']),
+					'type' => $ins->createNamedParameter($row['type'], \OCP\DB\QueryBuilder\IQueryBuilder::PARAM_INT),
+					'lazy' => $ins->createNamedParameter($row['lazy'], \OCP\DB\QueryBuilder\IQueryBuilder::PARAM_INT),
+				]);
+				$ins->executeStatement();
+			}
+			$this->db->commit();
+		} catch (\Throwable $e) {
+			$this->db->rollBack();
+			throw $e;
+		}
+	}
+
+	private function rmrf(string $dir): void {
+		if (!is_dir($dir)) {
+			return;
+		}
+		foreach (new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($dir, \FilesystemIterator::SKIP_DOTS), \RecursiveIteratorIterator::CHILD_FIRST) as $f) {
+			$f->isDir() ? rmdir($f->getPathname()) : unlink($f->getPathname());
+		}
+		rmdir($dir);
+	}
+
+	private function describeBlockers(array $check): string {
+		$parts = [];
+		if ($check['currentMajor'] !== $check['snapshotMajor']) {
+			$parts[] = "this installation is Nextcloud {$check['currentMajor']}, the backup is from {$check['snapshotMajor']} (same major version required)";
+		}
+		if ($check['missingApps'] !== []) {
+			$parts[] = 'install these apps first (their tables must exist before the database restore can use them): '
+				. implode(', ', array_map(fn (string $a) => "occ app:install $a", $check['missingApps']));
+		}
+		return implode('; ', $parts);
+	}
+
+	private function withSharedLock(Target $target, callable $fn): mixed {
+		try {
+			// Refreshed during the database and data restore (per row batch, per blob), so a
+			// cleanup cannot take over the location while a long restore is still reading it.
+			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 7200, $fn);
+		} catch (LockedException) {
+			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');
+		}
+	}
+}
@@ -149,15 +149,30 @@ final class RestoreService {
 		return ['restored' => $restored, 'trashed' => $trashed, 'target' => $uid . ':' . $userFolder->getRelativePath($dest->getPath())];
 	}

-	/** Raw restore of any snapshot path to a local directory (administrators, disaster recovery). */
-	public function restoreToDirectory(Target $target, string $snapshotId, string $prefix, string $directory): int {
+	/**
+	 * Raw restore of any snapshot path to a local directory (administrators, disaster recovery).
+	 *
+	 * @param bool $stripPrefix write into $directory itself instead of $directory/$prefix (see
+	 *             Repository::restore()); used to restore "data/" or "config/" straight into the
+	 *             real data/config directory for occ backup:restore:full.
+	 */
+	public function restoreToDirectory(Target $target, string $snapshotId, string $prefix, string $directory, bool $stripPrefix = false, ?callable $heartbeat = null): int {
 		if ($prefix !== '' && !Repository::isSafePath($prefix)) {
 			throw new \InvalidArgumentException('Invalid path: ' . $prefix);
 		}
 		if (!is_dir($directory) && !mkdir($directory, 0750, true) && !is_dir($directory)) {
 			throw new \RuntimeException("Cannot create $directory");
 		}
-		return $this->withSharedLock($target, fn () => $this->targets->repository($target)->restore($snapshotId, $directory, trim($prefix, '/') === '' ? '' : trim($prefix, '/') . '/'), 3600);
+		return $this->withSharedLock($target, function (callable $refresh) use ($target, $snapshotId, $prefix, $directory, $stripPrefix, $heartbeat): int {
+			$own = LeaseService::throttled($refresh);
+			$beat = static function () use ($own, $heartbeat): void {
+				$own();
+				if ($heartbeat !== null) {
+					$heartbeat();
+				}
+			};
+			return $this->targets->repository($target)->restore($snapshotId, $directory, trim($prefix, '/') === '' ? '' : trim($prefix, '/') . '/', $stripPrefix, $beat);
+		}, 3600);
 	}

 	private function writeFile(Repository $repo, Folder $dest, string $relPath, array $entry): void {
@@ -10,10 +10,14 @@ namespace OCA\NgBackup\Service;
 use OCA\NgBackup\Backend\ExternalStorageFactory;
 use OCA\NgBackup\Backend\IBackend;
 use OCA\NgBackup\Backend\StorageBackend;
+use OCA\NgBackup\Db\Snapshot;
+use OCA\NgBackup\Db\SnapshotMapper;
 use OCA\NgBackup\Db\Target;
 use OCA\NgBackup\Db\TargetMapper;
 use OCA\NgBackup\Repository\Repository;
 use OCP\App\IAppManager;
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\Files\Storage\IStorage;
 use OCP\Security\ICrypto;
 use OCP\Server;

@@ -30,10 +34,11 @@ final class TargetService {
 		private IAppManager $appManager,
 		private \OCA\NgBackup\Db\DbIndexCache $indexCache,
 		private \OCA\NgBackup\Db\AppConfigCatalogAnchor $anchor,
+		private SnapshotMapper $snapshots,
 	) {
 	}

-	/** @return list<array{id:string, name:string, auth:list<string>, parameters:array}> */
+	/** @return list<array{id:string, name:string, auth:list<array{id:string, name:string, parameters:array}>, parameters:array}> */
 	public function availableBackends(): array {
 		return $this->factory()->describeBackends();
 	}
@@ -46,14 +51,8 @@ final class TargetService {
 	 * @return array{target: Target, created: bool}
 	 */
 	public function add(string $name, string $backend, string $auth, array $options, string $basePath): array {
-		if (!preg_match('/^[A-Za-z0-9][A-Za-z0-9 _.-]{0,63}$/', $name)) {
-			throw new \InvalidArgumentException('Name: letters, digits, space, _ . - (max 64)');
-		}
-		try {
-			$this->mapper->findByName($name);
-			throw new \InvalidArgumentException("A target named '$name' already exists");
-		} catch (\OCP\AppFramework\Db\DoesNotExistException) {
-		}
+		$this->validateName($name);
+		$this->requireUsableBackend($backend);
 		$keys = $this->keys->keyRing();
 		$storageBackend = $this->buildBackend($backend, $auth, $options, $basePath);
 		if ($storageBackend->exists('config')) {
@@ -78,7 +77,159 @@ final class TargetService {
 		$target->setBasePath(trim($basePath, '/'));
 		$target->setRepositoryId($repo->id());
 		$target->setCreatedAt(time());
-		return ['target' => $this->mapper->insert($target), 'created' => $created];
+		$target = $this->mapper->insert($target);
+		if (!$created) {
+			// Disaster recovery: occ backup:list reads this local cache, not the repository
+			// directly, so a snapshot made by another installation must be backfilled here too.
+			$this->adoptSnapshots($target, $repo);
+		}
+		return ['target' => $target, 'created' => $created];
+	}
+
+	/**
+	 * Change how an existing location is reached (credentials, host, folder, even the connection
+	 * type) or its name. The new settings must lead to the same repository: the history stays
+	 * and a typo cannot silently start a new, empty repository. A null option value keeps the
+	 * stored one, so the web interface never has to send stored passwords back.
+	 *
+	 * @param array<string, mixed> $options
+	 */
+	public function update(Target $target, string $name, string $backend, string $auth, array $options, string $basePath): Target {
+		$this->validateName($name, $target->getId());
+		$this->requireUsableBackend($backend);
+		$stored = $this->options($target);
+		foreach ($options as $key => $value) {
+			if ($value === null) {
+				if (array_key_exists($key, $stored)) {
+					$options[$key] = $stored[$key];
+				} else {
+					unset($options[$key]);
+				}
+			}
+		}
+		// Do not create the folder: a typo in the path must not leave an empty folder behind.
+		$storageBackend = $this->buildBackend($backend, $auth, $options, $basePath, false);
+		if (!$storageBackend->exists('config')) {
+			if (!$storageBackend->canConnect()) {
+				throw new \InvalidArgumentException('Cannot connect with these settings. Check the host, user name and password');
+			}
+			throw new \InvalidArgumentException("No NG Backup repository found in folder '" . trim($basePath, '/') . "'. To start an empty repository, add a new location instead");
+		}
+		$repo = Repository::openWithKey($storageBackend, $this->keys->keyRing(), $this->indexCache, $this->anchor);
+		if ($target->getRepositoryId() !== null && $repo->id() !== $target->getRepositoryId()) {
+			throw new \InvalidArgumentException('These settings lead to a different repository than the one of this location');
+		}
+		$target->setName($name);
+		$target->setBackend($backend);
+		$target->setAuth($auth);
+		$target->setOptions($this->crypto->encrypt(json_encode($options, JSON_THROW_ON_ERROR)));
+		$target->setBasePath(trim($basePath, '/'));
+		return $this->mapper->update($target);
+	}
+
+	/**
+	 * The stored options for an edit form: password-type values are replaced by null, which
+	 * update() reads as "keep the stored value".
+	 *
+	 * @return array<string, mixed>
+	 */
+	public function editableOptions(Target $target): array {
+		$secret = [];
+		foreach ($this->availableBackends() as $b) {
+			if ($b['id'] !== $target->getBackend()) {
+				continue;
+			}
+			$params = $b['parameters'];
+			foreach ($b['auth'] as $a) {
+				if ($a['id'] === $target->getAuth()) {
+					$params += $a['parameters'];
+				}
+			}
+			foreach ($params as $key => $p) {
+				if (($p['type'] ?? 0) === 2) {
+					$secret[$key] = true;
+				}
+			}
+		}
+		$options = $this->options($target);
+		foreach ($options as $key => $value) {
+			if (isset($secret[$key])) {
+				$options[$key] = null;
+			}
+		}
+		return $options;
+	}
+
+	private function validateName(string $name, ?int $ownId = null): void {
+		if (!preg_match('/^[A-Za-z0-9][A-Za-z0-9 _.-]{0,63}$/', $name)) {
+			throw new \InvalidArgumentException('Name: letters, digits, space, _ . - (max 64)');
+		}
+		try {
+			$other = $this->mapper->findByName($name);
+		} catch (DoesNotExistException) {
+			return;
+		}
+		if ($other->getId() !== $ownId) {
+			throw new \InvalidArgumentException("A target named '$name' already exists");
+		}
+	}
+
+	private function requireUsableBackend(string $backend): void {
+		// Without the native extension files_external falls back to the smbclient binary, which
+		// registers fine but cannot seek: the first backup then fails with "Seek failed". Refuse
+		// up front instead of letting the admin find out from a failed run.
+		if ($backend === 'smb' && !extension_loaded('smbclient')) {
+			throw new \InvalidArgumentException('The SMB backend needs the PHP smbclient extension (pecl install smbclient); the smbclient binary alone cannot seek and every backup would fail');
+		}
+	}
+
+	/**
+	 * A target's options are encrypted with Nextcloud's own instance secret (ICrypto), not
+	 * ng_backup's key, so changing that secret (occ backup:restore:full merging config.php)
+	 * would otherwise leave every target permanently undecryptable. Call $applySecretChange
+	 * (which must be the only thing that changes the secret) through here instead: every
+	 * target's options are decrypted first, then re-encrypted under whatever secret is active
+	 * once $applySecretChange returns.
+	 */
+	public function reencryptOptionsAround(callable $applySecretChange): mixed {
+		$plain = [];
+		foreach ($this->mapper->findAll() as $target) {
+			$plain[$target->getId()] = $this->options($target);
+		}
+		$result = $applySecretChange();
+		foreach ($this->mapper->findAll() as $target) {
+			if (!isset($plain[$target->getId()])) {
+				continue; // added by $applySecretChange itself; nothing to re-encrypt
+			}
+			$target->setOptions($this->crypto->encrypt(json_encode($plain[$target->getId()], JSON_THROW_ON_ERROR)));
+			$this->mapper->update($target);
+		}
+		return $result;
+	}
+
+	private function adoptSnapshots(Target $target, Repository $repo): void {
+		foreach ($repo->listSnapshots() as $snapshotId) {
+			try {
+				$this->snapshots->findOne($target->getId(), $snapshotId);
+				continue; // already known locally
+			} catch (DoesNotExistException) {
+			}
+			// One unreadable/corrupt snapshot must not stop the rest of the location's
+			// snapshots from being backfilled, nor abort adding the target itself.
+			try {
+				$meta = $repo->snapshotMeta($snapshotId);
+				$s = new Snapshot();
+				$s->setTargetId($target->getId());
+				$s->setSnapshotId($snapshotId);
+				$s->setKind((string)($meta['kind'] ?? 'full'));
+				$s->setLabel(($meta['label'] ?? '') !== '' ? $meta['label'] : null);
+				$s->setCreatedAt((int)strtotime((string)($meta['time'] ?? 'now')));
+				$s->setFiles((int)($meta['stats']['files'] ?? 0));
+				$s->setBytes((int)($meta['stats']['bytes'] ?? 0));
+				$this->snapshots->insert($s);
+			} catch (\Throwable) {
+			}
+		}
 	}

 	/** @return list<Target> */
@@ -87,7 +238,11 @@ final class TargetService {
 	}

 	public function get(string $nameOrId): Target {
-		return ctype_digit($nameOrId) ? $this->mapper->find((int)$nameOrId) : $this->mapper->findByName($nameOrId);
+		try {
+			return ctype_digit($nameOrId) ? $this->mapper->find((int)$nameOrId) : $this->mapper->findByName($nameOrId);
+		} catch (DoesNotExistException) {
+			throw new \InvalidArgumentException("No such location: $nameOrId");
+		}
 	}

 	/** Size limit for the data stored on this location (null = none). */
@@ -124,8 +279,9 @@ final class TargetService {
 		return json_decode($this->crypto->decrypt($target->getOptions()), true, 512, JSON_THROW_ON_ERROR);
 	}

-	private function buildBackend(string $backend, string $auth, array $options, string $basePath): StorageBackend {
-		return new StorageBackend($this->factory()->create($backend, $auth, $options), $basePath);
+	private function buildBackend(string $backend, string $auth, array $options, string $basePath, bool $createBase = true): StorageBackend {
+		$create = fn (): IStorage => $this->factory()->create($backend, $auth, $options);
+		return new StorageBackend($create(), $basePath, $createBase, $create);
 	}

 	private ?ExternalStorageFactory $factory = null;
@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Service;
+
+use OCA\NgBackup\Db\Target;
+use OCA\NgBackup\UserMigration\RepositoryExportDestination;
+use OCA\NgBackup\UserMigration\UserMigrationServiceLocator;
+use OCP\IUser;
+use OCP\Lock\LockedException;
+use OCP\UserMigration\UserMigrationException;
+
+/**
+ * Per-user backup via user_migration: every registered migrator's export streams straight into
+ * the encrypted repository (no zip, no copy in the user's own storage, see
+ * RepositoryExportDestination). Shares blobs with the full backup; prune() keeps a user export's
+ * blobs referenced through its manifest under users/<uid>/.
+ *
+ * user_migration is an optional dependency (unlike files_external): without it, only this
+ * per-user backup/restore is unavailable, the full backup still works.
+ */
+final class UserBackupService {
+	public function __construct(
+		private TargetService $targets,
+		private LeaseService $leases,
+		private UserMigrationServiceLocator $locator,
+	) {
+	}
+
+	/** @throws UserMigrationException when user_migration is not enabled, or the export itself fails */
+	public function backupUser(Target $target, IUser $user): string {
+		$service = $this->locator->get();
+		return $this->withSharedLock($target, function (callable $refresh) use ($target, $user, $service) {
+			$repo = $this->targets->repository($target);
+			$dest = new RepositoryExportDestination($repo, $user->getUID(), LeaseService::throttled($refresh));
+			$service->export($dest, $user);
+			// A short exclusive lock around the catalog write only: the shared lock above
+			// allows another concurrent backup (full or per-user) to be writing the catalog at
+			// the same time. The repository is reopened inside the lock, so the write builds on
+			// the latest catalog generation instead of the one loaded before the lock was taken.
+			$this->withCatalogLock($target, fn () => $this->targets->repository($target)->recordUserExport($dest->manifestPath()));
+			return $dest->manifestPath();
+		});
+	}
+
+	private function withSharedLock(Target $target, callable $fn): mixed {
+		try {
+			// Refreshed by RepositoryExportDestination as it writes data, so a long export keeps it.
+			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 3600, $fn);
+		} catch (LockedException) {
+			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');
+		}
+	}
+
+	private function withCatalogLock(Target $target, callable $fn): mixed {
+		try {
+			return $this->leases->with(PruneService::catalogLockKey($target), LeaseService::EXCLUSIVE, 300, $fn);
+		} catch (LockedException) {
+			throw new \RuntimeException('Another catalog write for ' . $target->getName() . ' is in progress; try again');
+		}
+	}
+}
@@ -0,0 +1,137 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Service;
+
+use OCA\NgBackup\Db\Target;
+use OCA\NgBackup\UserMigration\RepositoryExportDestination;
+use OCA\NgBackup\UserMigration\RepositoryImportSource;
+use OCA\NgBackup\UserMigration\UserMigrationServiceLocator;
+use OCP\EventDispatcher\IEventDispatcher;
+use OCP\Files\Events\Node\FilesystemTornDownEvent;
+use OCP\IUser;
+use OCP\IUserManager;
+use OCP\Lock\LockedException;
+use OCP\Security\ISecureRandom;
+use OCP\UserMigration\UserMigrationException;
+
+/**
+ * Restoring a user from a user_migration export (see UserBackupService), never over an existing
+ * account:
+ *  - replace: a safety export of the current state goes into the repository first, then the
+ *    account is deleted and recreated fresh from the backup, under the same uid;
+ *  - as-backup: the backup is restored into a new account "<uid>-bak" (or "-bak-2", ...) instead,
+ *    so an admin can compare and transfer by hand. Nextcloud cannot rename a uid, so the *backup*
+ *    gets the new name, never the existing account.
+ */
+final class UserRestoreService {
+	public const MODE_REPLACE = 'replace';
+	public const MODE_AS_BACKUP = 'as-backup';
+
+	public function __construct(
+		private TargetService $targets,
+		private LeaseService $leases,
+		private UserMigrationServiceLocator $locator,
+		private IUserManager $userManager,
+		private ISecureRandom $random,
+		private IEventDispatcher $events,
+	) {
+	}
+
+	/** @throws UserMigrationException when user_migration is not enabled, or the restore itself fails */
+	public function restoreUser(Target $target, string $manifestPath, string $mode = self::MODE_REPLACE): IUser {
+		$service = $this->locator->get();
+		return $this->withSharedLock($target, function (callable $refresh) use ($target, $manifestPath, $mode, $service): IUser {
+			$repo = $this->targets->repository($target);
+			// Only ever read a manifest the verified catalog actually recorded: a path alone
+			// (even one this app generated before) proves nothing about it still being current
+			// or genuine once the catalog's rollback protection is supposed to vouch for it.
+			if (!$repo->isRecordedUserExport($manifestPath)) {
+				throw new \InvalidArgumentException("$manifestPath is not a recorded user export for this location");
+			}
+			$beat = LeaseService::throttled($refresh);
+			$source = new RepositoryImportSource($repo, $manifestPath, $beat);
+			$originalUid = $source->getOriginalUid();
+
+			if ($mode === self::MODE_AS_BACKUP) {
+				$backupUid = $this->freeBackupUid($originalUid);
+				$user = $this->userManager->createUser($backupUid, $this->random->generate(32));
+				if ($user === false) {
+					throw new \RuntimeException("Could not create the account $backupUid");
+				}
+				try {
+					return $service->import($source, $user);
+				} catch (\Throwable $e) {
+					// A partially-imported, never-used account left behind is strictly worse
+					// than no account at all; the original source account was never touched.
+					$user->delete();
+					throw $e;
+				}
+			}
+
+			if ($mode !== self::MODE_REPLACE) {
+				throw new \InvalidArgumentException("Unknown restore mode: $mode");
+			}
+			$existing = $this->userManager->get($originalUid);
+			$safetyManifestPath = null;
+			if ($existing !== null) {
+				// Never import over a live account: export its current state first, so nothing
+				// is lost if the restore turns out to be the wrong choice.
+				$safety = new RepositoryExportDestination($repo, $originalUid, $beat);
+				$service->export($safety, $existing);
+				$safetyManifestPath = $safety->manifestPath();
+				// Same race as UserBackupService::backupUser(): reopen the repository inside the
+				// catalog lock so the write builds on the latest generation.
+				$this->withCatalogLock($target, fn () => $this->targets->repository($target)->recordUserExport($safetyManifestPath));
+				if (!$existing->delete()) {
+					throw new \RuntimeException("Could not delete the existing account $originalUid before restoring; its safety export is at $safetyManifestPath");
+				}
+				// IRootFolder caches a Folder per uid for the lifetime of this process; without
+				// this it would still hand the just-deleted account's (now storage-less) folder
+				// to the import below, and every write would fail.
+				$this->events->dispatchTyped(new FilesystemTornDownEvent());
+			}
+			try {
+				return $service->import($source, null);
+			} catch (\Throwable $e) {
+				// The original account is already gone at this point (or never existed); a
+				// failure here can only be reported, not undone in place. Its safety export
+				// (if any) is the recovery path, already recorded above.
+				throw new UserMigrationException(
+					"Could not restore $originalUid" . ($safetyManifestPath !== null ? "; its safety export is at $safetyManifestPath" : '') . ': ' . $e->getMessage(),
+					0,
+					$e,
+				);
+			}
+		});
+	}
+
+	private function freeBackupUid(string $uid): string {
+		$candidate = $uid . '-bak';
+		for ($n = 2; $this->userManager->userExists($candidate); $n++) {
+			$candidate = $uid . '-bak-' . $n;
+		}
+		return $candidate;
+	}
+
+	private function withSharedLock(Target $target, callable $fn): mixed {
+		try {
+			// Refreshed while the safety export writes and the import reads (see UserBackupService::withSharedLock()).
+			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 3600, $fn);
+		} catch (LockedException) {
+			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');
+		}
+	}
+
+	private function withCatalogLock(Target $target, callable $fn): mixed {
+		try {
+			return $this->leases->with(PruneService::catalogLockKey($target), LeaseService::EXCLUSIVE, 300, $fn);
+		} catch (LockedException) {
+			throw new \RuntimeException('Another catalog write for ' . $target->getName() . ' is in progress; try again');
+		}
+	}
+}
@@ -0,0 +1,158 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Service;
+
+use OCA\NgBackup\AppInfo\Application;
+use OCA\NgBackup\Db\Target;
+use OCP\IAppConfig;
+use OCP\Lock\LockedException;
+
+/**
+ * Checksum audit of a snapshot (occ backup:verify), see Repository::verify(). On a large
+ * repository a check takes hours (a deep one days), so how far it is gets stored every
+ * PROGRESS_SECONDS, together with how it ended: `occ backup:status` shows it.
+ */
+final class VerifyService {
+	public const PROGRESS_SECONDS = 30;
+	private const KEY_PREFIX = 'verify_progress_';
+
+	public function __construct(
+		private TargetService $targets,
+		private LeaseService $leases,
+		private IAppConfig $appConfig,
+	) {
+	}
+
+	/**
+	 * @param ?callable(array):void $onProgress called with the stored progress every PROGRESS_SECONDS
+	 * @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string}
+	 */
+	public function verify(Target $target, string $snapshotId, bool $deep = false, ?callable $onProgress = null): array {
+		return $this->run($target, $snapshotId, $deep, $onProgress, fn (\OCA\NgBackup\Repository\Repository $repo, callable $heartbeat): array => $repo->verify($snapshotId, $deep, $heartbeat));
+	}
+
+	/**
+	 * @param ?callable(array):void $onProgress called with the stored progress every PROGRESS_SECONDS
+	 * @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string}
+	 */
+	public function verifyUserExport(Target $target, string $manifestPath, bool $deep = false, ?callable $onProgress = null): array {
+		return $this->run($target, $manifestPath, $deep, $onProgress, fn (\OCA\NgBackup\Repository\Repository $repo, callable $heartbeat): array => $repo->verifyUserExport($manifestPath, $deep, $heartbeat));
+	}
+
+	/** One line on a check's progress or outcome, for occ (see progress()). */
+	public static function describe(array $s): string {
+		$size = static fn (int $b): string => $b >= 1073741824 ? sprintf('%.1f GiB', (float)$b / 1073741824.0) : sprintf('%.1f MiB', (float)$b / 1048576.0);
+		$count = static fn (int $done, mixed $total): string => number_format($done)
+			. (is_int($total) && $total > 0 ? '/' . number_format($total) . sprintf(' (%d%%)', intdiv(100 * $done, $total)) : '');
+		$deep = ($s['deep'] ?? false) === true;
+		$kind = $deep ? 'deep check' : 'check';
+		if (($s['status'] ?? '') === 'running') {
+			$phase = match ($s['phase'] ?? '') {
+				'index' => 'index files ' . $count((int)$s['done'], $s['total'] ?? null),
+				'packs' => 'pack folders ' . $count((int)$s['done'], $s['total'] ?? null),
+				'files', 'database' => 'files ' . $count((int)$s['done'], $s['total'] ?? null) . ', ' . number_format((int)($s['blobs'] ?? 0)) . ' blobs'
+					. ($deep ? ', ' . $size((int)($s['bytes'] ?? 0)) . ' decrypted' : ''),
+				default => 'starting',
+			};
+			$age = time() - (int)($s['updated'] ?? 0);
+			return sprintf('%s running since %s: %s; updated %s ago%s', $kind, date('Y-m-d H:i', (int)$s['started']), $phase,
+				$age < 120 ? $age . ' s' : intdiv($age, 60) . ' min',
+				$age > 600 ? ' (no progress for a while: the process may have stopped)' : '');
+		}
+		$took = gmdate('H:i:s', max(0, (int)($s['finished'] ?? 0) - (int)($s['started'] ?? 0)));
+		return match ($s['status'] ?? '') {
+			'ok' => sprintf('%s OK on %s (took %s): %s files, %s blobs%s', $kind, date('Y-m-d H:i', (int)$s['finished']), $took,
+				number_format((int)($s['files'] ?? 0)), number_format((int)($s['blobs'] ?? 0)), $deep ? ', ' . $size((int)($s['bytes'] ?? 0)) . ' decrypted' : ''),
+			'problems' => sprintf('%s found PROBLEMS on %s: %d missing, %d failed, %d unreadable blob(s); run occ backup:verify again for the details',
+				$kind, date('Y-m-d H:i', (int)$s['finished']), (int)($s['missing'] ?? 0), (int)($s['failedBlobs'] ?? 0), (int)($s['unreadable'] ?? 0)),
+			default => sprintf('%s FAILED on %s: %s', $kind, date('Y-m-d H:i', (int)($s['finished'] ?? 0)), (string)($s['error'] ?? 'unknown error')),
+		};
+	}
+
+	/**
+	 * The stored state of the last check per location: running (with how far it is) or how it
+	 * ended.
+	 *
+	 * @return array<int, array<string, mixed>> by location id
+	 */
+	public function progress(): array {
+		$result = [];
+		foreach ($this->appConfig->getKeys(Application::APP_ID) as $key) {
+			if (!str_starts_with($key, self::KEY_PREFIX)) {
+				continue;
+			}
+			$state = json_decode($this->appConfig->getValueString(Application::APP_ID, $key, '', lazy: true), true);
+			if (is_array($state)) {
+				$result[(int)substr($key, strlen(self::KEY_PREFIX))] = $state;
+			}
+		}
+		ksort($result);
+		return $result;
+	}
+
+	private function run(Target $target, string $what, bool $deep, ?callable $onProgress, callable $fn): array {
+		$ttl = $deep ? 600 : 300;
+		$state = ['what' => $what, 'deep' => $deep, 'status' => 'running', 'started' => time(), 'updated' => time(),
+			'pid' => getmypid(), 'phase' => 'starting', 'done' => 0, 'total' => null, 'blobs' => 0, 'bytes' => 0];
+		try {
+			$this->store($target, $state);
+		} catch (\Throwable) {
+			// progress reports are a convenience; the check itself goes ahead
+		}
+		try {
+			$result = $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, $ttl, function (callable $refresh) use ($target, $ttl, $fn, $onProgress, &$state): array {
+				$lastRefresh = time();
+				$lastStore = time();
+				$heartbeat = function (?array $progress = null) use ($refresh, $ttl, $target, $onProgress, &$lastRefresh, &$lastStore, &$state): void {
+					$now = time();
+					if ($now - $lastRefresh >= intdiv($ttl, 2)) {
+						$refresh();
+						$lastRefresh = $now;
+					}
+					if ($progress !== null && $now - $lastStore >= self::PROGRESS_SECONDS) {
+						$state = array_merge($state, $progress, ['updated' => $now]);
+						try {
+							$this->store($target, $state);
+						} catch (\Throwable) {
+							// a progress report that cannot be stored must not stop the check
+						}
+						$lastStore = $now;
+						if ($onProgress !== null) {
+							$onProgress($state);
+						}
+					}
+				};
+				return $fn($this->targets->repository($target), $heartbeat);
+			});
+		} catch (LockedException) {
+			$this->finish($target, $state, 'failed', ['error' => 'A cleanup of the location was in progress']);
+			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');
+		} catch (\Throwable $e) {
+			$this->finish($target, $state, 'failed', ['error' => $e->getMessage()]);
+			throw $e;
+		}
+		$problems = count($result['missing']) + count($result['failed']) + count($result['unreadable']);
+		$this->finish($target, $state, $problems === 0 ? 'ok' : 'problems', [
+			'phase' => 'done', 'files' => $result['filesChecked'], 'blobs' => $result['blobsChecked'], 'bytes' => $result['bytesChecked'],
+			'missing' => count($result['missing']), 'failedBlobs' => count($result['failed']), 'unreadable' => count($result['unreadable']),
+		]);
+		return $result;
+	}
+
+	private function finish(Target $target, array $state, string $status, array $extra): void {
+		try {
+			$this->store($target, array_merge($state, $extra, ['status' => $status, 'updated' => time(), 'finished' => time()]));
+		} catch (\Throwable) {
+			// the check's own result counts; its stored summary is a convenience
+		}
+	}
+
+	private function store(Target $target, array $state): void {
+		$this->appConfig->setValueString(Application::APP_ID, self::KEY_PREFIX . $target->getId(), json_encode($state, JSON_THROW_ON_ERROR), lazy: true);
+	}
+}
@@ -28,6 +28,8 @@ final class RepositoryExportDestination implements IExportDestination {
 	public function __construct(
 		private Repository $repo,
 		private string $uid,
+		/** Called while data is written (per chunk), to keep the location lease alive. */
+		private ?\Closure $heartbeat = null,
 	) {
 		$this->exportId = gmdate('Ymd\THis\Z') . '-' . bin2hex(random_bytes(4));
 	}
@@ -36,6 +38,7 @@ final class RepositoryExportDestination implements IExportDestination {
 		$writer = $this->repo->blobWriter($this->stats);
 		$writer->write($content);
 		$this->entries[self::norm($path)] = ['t' => 'f', 'b' => $writer->finish(), 's' => strlen($content)];
+		$this->beat();
 	}

 	public function addFileAsStream(string $path, $stream): void {
@@ -46,6 +49,7 @@ final class RepositoryExportDestination implements IExportDestination {
 				throw new UserMigrationException('Read error while exporting ' . $path);
 			}
 			$writer->write($chunk);
+			$this->beat();
 		}
 		$this->entries[self::norm($path)] = ['t' => 'f', 'b' => $writer->finish(), 's' => $writer->bytes()];
 	}
@@ -65,8 +69,11 @@ final class RepositoryExportDestination implements IExportDestination {
 				if ($stream === false) {
 					throw new \RuntimeException('Cannot read ' . $node->getPath());
 				}
-				$this->addFileAsStream($target, $stream);
-				fclose($stream);
+				try {
+					$this->addFileAsStream($target, $stream);
+				} finally {
+					fclose($stream);
+				}
 			}
 		}
 	}
@@ -89,6 +96,12 @@ final class RepositoryExportDestination implements IExportDestination {
 		return $this->stats;
 	}

+	private function beat(): void {
+		if ($this->heartbeat !== null) {
+			($this->heartbeat)();
+		}
+	}
+
 	private static function norm(string $path): string {
 		return trim($path, '/');
 	}
@@ -20,6 +20,8 @@ final class RepositoryImportSource implements IImportSource {
 	public function __construct(
 		private Repository $repo,
 		string $manifestPath,
+		/** Called while blobs are read, to keep the location lease alive. */
+		private ?\Closure $heartbeat = null,
 	) {
 		$this->manifest = json_decode($repo->getObject($manifestPath), true, 512, JSON_THROW_ON_ERROR);
 	}
@@ -40,6 +42,9 @@ final class RepositoryImportSource implements IImportSource {
 			throw new UserMigrationException('Cannot buffer ' . $path);
 		}
 		foreach ($this->repo->readBlobs($entry['b']) as $data) {
+			if ($this->heartbeat !== null) {
+				($this->heartbeat)();
+			}
 			for ($done = 0, $len = strlen($data); $done < $len; $done += $n) {
 				$n = fwrite($stream, $done === 0 ? $data : substr($data, $done));
 				if ($n === false || $n === 0) {
@@ -109,7 +114,14 @@ final class RepositoryImportSource implements IImportSource {
 						$destination->newFile($name, $stream);
 					}
 				} finally {
-					fclose($stream);
+					// putContent()/newFile() already close the stream once they've consumed it:
+					// despite the @return resource docblock above, $stream is no longer a
+					// resource by the time we get here (verified against a real storage; a
+					// double fclose() throws a TypeError on PHP 8).
+					/** @psalm-suppress RedundantConditionGivenDocblockType */
+					if (is_resource($stream)) {
+						fclose($stream);
+					}
 				}
 			}
 		}
@@ -0,0 +1,77 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\UserMigration;
+
+use OCP\App\AppPathNotFoundException;
+use OCP\App\IAppManager;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Helper\QuestionHelper;
+use Symfony\Component\Console\Question\ConfirmationQuestion;
+
+/**
+ * Installs or enables the optional user_migration app, but only when the administrator asked for it
+ * (occ prompt or --install-user-migration). Runs occ in a child process, as the admin would.
+ */
+final class UserMigrationInstaller {
+	private const APP = 'user_migration';
+
+	public function __construct(
+		private IAppManager $appManager,
+	) {
+	}
+
+	public function isEnabled(): bool {
+		return $this->appManager->isEnabledForAnyone(self::APP);
+	}
+
+	private function codeIsPresent(): bool {
+		try {
+			$this->appManager->getAppPath(self::APP);
+			return true;
+		} catch (AppPathNotFoundException) {
+			return false;
+		}
+	}
+
+	/** Installs (from the app store, if missing) and enables user_migration; throws on failure. */
+	public function install(): void {
+		$args = $this->codeIsPresent() ? ['app:enable', self::APP] : ['app:install', self::APP];
+		/** @psalm-suppress UndefinedClass */
+		$occ = \OC::$SERVERROOT . '/occ';
+		$command = implode(' ', array_map('escapeshellarg', [PHP_BINARY, $occ, ...$args])) . ' 2>&1';
+		exec($command, $lines, $code);
+		if ($code !== 0) {
+			throw new \RuntimeException("occ " . implode(' ', $args) . " failed:\n" . implode("\n", $lines));
+		}
+	}
+
+	/**
+	 * Returns when user_migration is enabled. Otherwise asks the administrator (interactive shell) or
+	 * requires --install-user-migration, and throws when neither gives consent.
+	 *
+	 * @throws \RuntimeException
+	 */
+	public function ensureEnabled(InputInterface $input, OutputInterface $output): void {
+		if ($this->isEnabled()) {
+			return;
+		}
+		$consent = $input->getOption('install-user-migration') === true;
+		if (!$consent && $input->isInteractive()) {
+			$consent = (new QuestionHelper())->ask($input, $output, new ConfirmationQuestion(
+				'The user_migration app is not enabled. Install and enable it now? [y/N] ', false)) === true;
+		}
+		if (!$consent) {
+			throw new \RuntimeException('The user_migration app is not enabled; per-user backup/restore needs it. Run "occ '
+				. 'app:install ' . self::APP . '" and "occ app:enable ' . self::APP . '", or repeat with --install-user-migration');
+		}
+		$output->writeln('Installing and enabling user_migration (approved by the administrator)...');
+		$this->install();
+		throw new \RuntimeException('user_migration is installed and enabled; run this command again');
+	}
+}
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\UserMigration;
+
+use OCP\App\IAppManager;
+use OCP\Server;
+use OCP\UserMigration\UserMigrationException;
+
+/**
+ * Resolves user_migration's own (internal, non-public) UserMigrationService on demand.
+ *
+ * Unlike files_external, user_migration is an optional dependency: without it, only per-user
+ * backup/restore is unavailable, the full backup still works. The class is never autoloaded by
+ * composer; everything that touches it is behind this one class.
+ */
+final class UserMigrationServiceLocator {
+	public function __construct(
+		private IAppManager $appManager,
+	) {
+	}
+
+	/** @throws UserMigrationException when user_migration is not enabled anywhere */
+	public function get(): object {
+		if (!$this->appManager->isEnabledForAnyone('user_migration')) {
+			throw new UserMigrationException('The user_migration app is not enabled; per-user backup/restore is unavailable');
+		}
+		$this->appManager->loadApp('user_migration');
+		return Server::get(\OCA\UserMigration\Service\UserMigrationService::class);
+	}
+}
@@ -49,6 +49,11 @@
      <code><![CDATA[ask]]></code>
    </UndefinedInterfaceMethod>
  </file>
+  <file src="lib/Command/KeyImport.php">
+    <UndefinedInterfaceMethod>
+      <code><![CDATA[ask]]></code>
+    </UndefinedInterfaceMethod>
+  </file>
  <file src="lib/Command/KeyInit.php">
    <UndefinedInterfaceMethod>
      <code><![CDATA[ask]]></code>
@@ -219,14 +224,9 @@
    <MissingParamType>
      <code><![CDATA[$fh]]></code>
    </MissingParamType>
-    <PossiblyNullIterator>
-      <code><![CDATA[$segments]]></code>
-    </PossiblyNullIterator>
    <PossiblyUndefinedArrayOffset>
      <code><![CDATA[$mtime]]></code>
-      <code><![CDATA[$state['cur']]]></code>
      <code><![CDATA[$state['phase']]]></code>
-      <code><![CDATA[$state['segments']]]></code>
      <code><![CDATA[$state['stats']]]></code>
    </PossiblyUndefinedArrayOffset>
  </file>
@@ -395,7 +395,7 @@
  </file>
  <file src="lib/Service/BackupService.php">
    <InvalidOperand>
-      <code><![CDATA[$deadline - microtime(true) + 120]]></code>
+      <code><![CDATA[$deadline - microtime(true) + 600]]></code>
    </InvalidOperand>
    <UndefinedClass>
      <code><![CDATA[\OC]]></code>
@@ -409,24 +409,6 @@
    <ArgumentTypeCoercion>
      <code><![CDATA[array_diff(range(1, self::MAX_SLOTS), $used)]]></code>
    </ArgumentTypeCoercion>
-    <InvalidReturnStatement>
-      <code><![CDATA[[
-			'version' => 1,
-			'app' => 'NG Backup',
-			'fingerprint' => $this->fingerprint(),
-			'kit_version' => $this->kitVersion(),
-			'confirmation_code' => $this->kitCode(),
-			'created' => gmdate('c'),
-			'wrapped_key' => $this->wrappedKey(),
-			'slots' => $this->slots(),
-			'instructions' => 'Keep this file safe, outside this server. Any one of the passphrases of the slots listed here opens it. '
-				. 'To restore on a new server: install NG Backup, add the backup location and enter this kit with one passphrase. '
-				. 'Without the kit (or the location) and a passphrase, the backups cannot be decrypted.',
-		]]]></code>
-    </InvalidReturnStatement>
-    <InvalidReturnType>
-      <code><![CDATA[array{version:int, app:string, fingerprint:string, created:string, wrapped_key:array, instructions:string}]]></code>
-    </InvalidReturnType>
    <LessSpecificReturnStatement>
      <code><![CDATA[array_map(fn ($s) => ['slot' => $s['slot'], 'label' => $s['label'], 'created' => $s['created']], $this->wrappedKey()['slots'])]]></code>
    </LessSpecificReturnStatement>
@@ -455,6 +437,17 @@
      <code><![CDATA[array{kept: array<string, list<string>>, forgotten: list<string>, purged: list<string>, prune: array}]]></code>
    </MoreSpecificReturnType>
  </file>
+  <file src="lib/Service/RestoreFullService.php">
+    <EmptyArrayAccess>
+      <code><![CDATA[$backupConfig[$key]]]></code>
+    </EmptyArrayAccess>
+    <UndefinedInterfaceMethod>
+      <code><![CDATA[getInner]]></code>
+    </UndefinedInterfaceMethod>
+    <UnresolvableInclude>
+      <code><![CDATA[include $path]]></code>
+    </UnresolvableInclude>
+  </file>
  <file src="lib/Service/RestoreService.php">
    <LessSpecificReturnStatement>
      <code><![CDATA[array_values($children)]]></code>
@@ -481,12 +474,6 @@
    </RedundantCastGivenDocblockType>
  </file>
  <file src="lib/Service/TargetService.php">
-    <InvalidReturnStatement>
-      <code><![CDATA[$this->factory()->describeBackends()]]></code>
-    </InvalidReturnStatement>
-    <InvalidReturnType>
-      <code><![CDATA[list<array{id:string, name:string, auth:list<string>, parameters:array}>]]></code>
-    </InvalidReturnType>
    <UndefinedDocblockClass>
      <code><![CDATA[Server::get(\OCA\Files_External\Service\BackendService::class)]]></code>
    </UndefinedDocblockClass>
@@ -31,8 +31,17 @@
            <errorLevel type="suppress">
                <!-- Provided by files_external at runtime; not a composer dependency (PLAN.md 3.5). -->
                <referencedClass name="OCA\Files_External\**" />
+                <!-- Provided by user_migration at runtime, an optional dependency (PLAN.md 3.8). -->
+                <referencedClass name="OCA\UserMigration\**" />
            </errorLevel>
        </UndefinedClass>
+        <UndefinedDocblockClass>
+            <errorLevel type="suppress">
+                <!-- Server::get()'s templated return type resolving the users_migration class-string
+                     constant below; same reason as the UndefinedClass suppression above. -->
+                <referencedClass name="OCA\UserMigration\**" />
+            </errorLevel>
+        </UndefinedDocblockClass>
        <!-- The #[\Override] attribute convention (PHP 8.3+) adds no behaviour; this app supports
             PHP 8.1+, and applying it to every interface-implementing method project-wide is pure
             ceremony with no bug-catching value, so it's suppressed rather than papered over. -->
@@ -82,6 +82,7 @@ onBeforeUnmount(() => clearTimeout(timer))
 .ngb-tabs {
 	display: flex;
 	gap: 8px;
-	margin: 0 0 12px;
+	/* Same inline margin as NcSettingsSection, so the tabs line up with the section content */
+	margin: 0 calc(var(--default-grid-baseline) * 7) 12px;
 }
 </style>
@@ -27,6 +27,8 @@ export default {
 	confirmKit: (accepted, phrase, code) => call('post', '/key/confirm', { accepted, phrase, code }),
 	backends: () => call('get', '/backends'),
 	addTarget: (target) => call('post', '/targets', target),
+	targetSettings: (id) => call('get', `/targets/${id}/settings`),
+	updateTarget: (id, target) => call('put', `/targets/${id}`, target),
 	removeTarget: (id) => call('delete', `/targets/${id}`),
 	testTarget: (id) => call('post', `/targets/${id}/test`),
 	setTargetLimit: (id, maxGb) => call('put', `/targets/${id}/limit`, { maxGb }),
@@ -30,30 +30,32 @@
 			</div>
 		</template>

-		<table v-if="status.runs.length" class="ngb-table">
-			<thead>
-				<tr>
-					<th>{{ t('ng_backup', 'Started') }}</th>
-					<th>{{ t('ng_backup', 'Location') }}</th>
-					<th>{{ t('ng_backup', 'Kind') }}</th>
-					<th>{{ t('ng_backup', 'Restore point') }}</th>
-					<th>{{ t('ng_backup', 'Status') }}</th>
-					<th>{{ t('ng_backup', 'Files') }}</th>
-					<th>{{ t('ng_backup', 'Uploaded') }}</th>
-				</tr>
-			</thead>
-			<tbody>
-				<tr v-for="run in status.runs" :key="run.id" :title="run.error || ''">
-					<td>{{ new Date(run.startedAt * 1000).toLocaleString() }}</td>
-					<td>{{ targetName(run.targetId) }}</td>
-					<td>{{ run.kind }}</td>
-					<td>{{ run.snapshot ? new Date(run.snapshot.createdAt * 1000).toLocaleString() + (run.snapshot.label ? ' – ' + run.snapshot.label : '') : '' }}</td>
-					<td :class="'ngb-' + run.status">{{ run.status }}{{ run.status === 'running' ? ' (' + run.phase + ')' : '' }}{{ run.error ? ': ' + run.error : '' }}</td>
-					<td>{{ run.stats?.files?.files ?? run.stats?.restored ?? '' }}</td>
-					<td>{{ run.stats?.files ? formatSize(run.stats.files.uploaded) : '' }}</td>
-				</tr>
-			</tbody>
-		</table>
+		<div v-if="status.runs.length" class="ngb-table-wrap">
+			<table class="ngb-table">
+				<thead>
+					<tr>
+						<th>{{ t('ng_backup', 'Started') }}</th>
+						<th>{{ t('ng_backup', 'Location') }}</th>
+						<th>{{ t('ng_backup', 'Kind') }}</th>
+						<th>{{ t('ng_backup', 'Restore point') }}</th>
+						<th>{{ t('ng_backup', 'Status') }}</th>
+						<th>{{ t('ng_backup', 'Files') }}</th>
+						<th>{{ t('ng_backup', 'Uploaded') }}</th>
+					</tr>
+				</thead>
+				<tbody>
+					<tr v-for="run in status.runs" :key="run.id" :title="run.error || ''">
+						<td>{{ new Date(run.startedAt * 1000).toLocaleString() }}</td>
+						<td>{{ targetName(run.targetId) }}</td>
+						<td>{{ run.kind }}</td>
+						<td>{{ run.snapshot ? new Date(run.snapshot.createdAt * 1000).toLocaleString() + (run.snapshot.label ? ' – ' + run.snapshot.label : '') : '' }}</td>
+						<td :class="'ngb-' + run.status">{{ run.status }}{{ run.status === 'running' ? ' (' + run.phase + percent(run) + ')' : '' }}{{ run.error ? ': ' + run.error : '' }}</td>
+						<td>{{ run.stats?.files?.files ?? run.stats?.restored ?? '' }}</td>
+						<td>{{ run.stats?.files ? formatSize(run.stats.files.uploaded) : '' }}</td>
+					</tr>
+				</tbody>
+			</table>
+		</div>
 	</NcSettingsSection>
 </template>

@@ -99,6 +101,8 @@ async function untrash(target, item) {
 	}
 }

+// " 68%", or " ~68%" when the total is estimated from Nextcloud's file cache (first backup)
+const percent = (run) => run.progress ? ' ' + (run.progress.approximate ? '~' : '') + Math.floor(run.progress.fraction * 100) + '%' : ''
 const isRunning = (targetId) => props.status.runs.some(r => r.targetId === targetId && r.kind === 'full' && r.status === 'running')
 const targetName = (id) => props.status.targets.find(tg => tg.id === id)?.name ?? '#' + id

@@ -126,6 +130,7 @@ async function saveSchedule() {
 <style scoped>
 .ngb-row { display: flex; gap: 8px; align-items: flex-end; flex-wrap: wrap; margin-bottom: 12px; }
 .ngb-time { max-width: 260px; }
+.ngb-table-wrap { overflow-x: auto; }
 .ngb-table { width: 100%; border-collapse: collapse; }
 .ngb-table th, .ngb-table td { text-align: start; padding: 4px 8px; border-bottom: 1px solid var(--color-border); }
 .ngb-failed { color: var(--color-error-text); }
@@ -36,7 +36,7 @@
 						<td>{{ t('ng_backup', 'Slot {n}', { n: slot.slot }) }}</td>
 						<td><strong>{{ slot.label }}</strong></td>
 						<td class="ngb-muted">{{ slot.created ? new Date(slot.created * 1000).toLocaleDateString() : '' }}</td>
-						<td>
+						<td class="ngb-actions">
 							<NcButton variant="tertiary" @click="openSlotForm(slot)">{{ t('ng_backup', 'New passphrase') }}</NcButton>
 							<NcButton v-if="status.key.slots.length > 1" variant="tertiary" @click="removeSlot(slot)">{{ t('ng_backup', 'Remove') }}</NcButton>
 						</td>
@@ -162,5 +162,6 @@ const confirm = () => guarded(async () => {
 .ngb-form, .ngb-confirm { display: flex; flex-direction: column; gap: 12px; max-width: 600px; margin: 8px 0; }
 .ngb-row { display: flex; gap: 8px; }
 .ngb-table td { padding: 2px 12px 2px 0; }
+.ngb-actions { display: flex; gap: 4px; }
 h3 { margin-top: 16px; font-weight: bold; }
 </style>
@@ -14,12 +14,16 @@
 					{{ tests[target.id].ok ? t('ng_backup', 'OK, {n} snapshots', { n: tests[target.id].snapshots }) : tests[target.id].error }}
 				</span>
 				<NcButton variant="tertiary" @click="test(target)">{{ t('ng_backup', 'Test') }}</NcButton>
+				<NcButton variant="tertiary" @click="startEdit(target)">{{ t('ng_backup', 'Edit') }}</NcButton>
 				<NcButton variant="tertiary" @click="remove(target)">{{ t('ng_backup', 'Remove') }}</NcButton>
 			</li>
 		</ul>

-		<NcButton v-if="!adding" @click="startAdd">{{ t('ng_backup', 'Add location') }}</NcButton>
-		<form v-else class="ngb-form" @submit.prevent="add">
+		<NcButton v-if="!adding" @click="startAdd()">{{ t('ng_backup', 'Add location') }}</NcButton>
+		<form v-else class="ngb-form" @submit.prevent="save">
+			<NcNoteCard v-if="editing" type="info">
+				{{ t('ng_backup', 'Editing "{name}". The new settings must lead to the same repository, so its backups and history are kept. Leave a password field empty to keep the stored password.', { name: editing.name }) }}
+			</NcNoteCard>
 			<NcTextField v-model="form.name" :label="t('ng_backup', 'Name')" />
 			<NcSelect v-model="backend" :options="backends" label="name" :input-label="t('ng_backup', 'Type')" :clearable="false" />
 			<NcSelect v-if="backend" v-model="auth" :options="backend.auth" label="name" :input-label="t('ng_backup', 'Authentication')" :clearable="false" />
@@ -32,8 +36,8 @@
 			<NcTextField v-model="form.maxGb" type="number" min="0" :label="t('ng_backup', 'Maximum size in GiB')"
 				:helper-text="form.maxGb ? t('ng_backup', 'Backups stop at this size; administrators are warned at 80%.') : t('ng_backup', 'Empty = unlimited: everything stored is billed by your provider, and nothing stops a backup that keeps growing.')" />
 			<div class="ngb-row">
-				<NcButton type="submit" variant="primary" :disabled="busy || !form.name || !backend || !auth">{{ t('ng_backup', 'Connect and add') }}</NcButton>
-				<NcButton @click="adding = false">{{ t('ng_backup', 'Cancel') }}</NcButton>
+				<NcButton type="submit" variant="primary" :disabled="busy || !form.name || !backend || !auth">{{ editing ? t('ng_backup', 'Connect and save') : t('ng_backup', 'Connect and add') }}</NcButton>
+				<NcButton @click="adding = false; editing = null">{{ t('ng_backup', 'Cancel') }}</NcButton>
 			</div>
 		</form>
 		<NcNoteCard v-if="error" type="error">{{ error }}</NcNoteCard>
@@ -41,7 +45,7 @@
 </template>

 <script setup>
-import { computed, reactive, ref, watch } from 'vue'
+import { computed, nextTick, reactive, ref, watch } from 'vue'
 import { t } from '@nextcloud/l10n'
 import NcButton from '@nextcloud/vue/components/NcButton'
 import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
@@ -58,6 +62,7 @@ defineProps({ status: { type: Object, required: true } })
 const emit = defineEmits(['changed'])

 const adding = ref(false)
+const editing = ref(null) // the target being edited, or null while adding
 const busy = ref(false)
 const error = ref('')
 const backends = ref([])
@@ -83,34 +88,83 @@ const toFields = (params) => Object.entries(params || {})
 	.map(([key, p]) => ({ key, label: p.value, type: p.type, optional: !!(p.flags & 1) }))
 const fields = computed(() => [...toFields(backend.value?.parameters), ...toFields(auth.value?.parameters)])

+let prefilling = false
 watch(backend, (b) => {
+	if (prefilling) {
+		return
+	}
 	auth.value = b?.auth?.[0] ?? null
 	form.options = {}
 })

-async function startAdd() {
-	adding.value = true
-	error.value = ''
+async function loadBackends() {
 	if (!backends.value.length) {
-		try {
-			backends.value = await api.backends()
-		} catch (e) {
-			error.value = e.message
-		}
+		backends.value = await api.backends()
 	}
 }

-async function add() {
-	busy.value = true
+async function startAdd() {
+	error.value = ''
+	editing.value = null
+	Object.assign(form, { name: '', path: 'ng_backup', options: {}, maxGb: '' })
+	backend.value = null
+	adding.value = true
+	try {
+		await loadBackends()
+	} catch (e) {
+		error.value = e.message
+	}
+}
+
+async function startEdit(target) {
 	error.value = ''
 	try {
-		await api.addTarget({ name: form.name, backend: backend.value.id, auth: auth.value.id, options: form.options, path: form.path,
-			maxGb: form.maxGb === '' ? null : Number(form.maxGb) })
+		await confirmPassword()
+		await loadBackends()
+		const settings = await api.targetSettings(target.id)
+		prefilling = true
+		backend.value = backends.value.find((b) => b.id === settings.backend) ?? null
+		auth.value = backend.value?.auth.find((a) => a.id === settings.auth) ?? null
+		Object.assign(form, { name: settings.name, path: settings.path, options: Object.fromEntries(Object.entries(settings.options).map(([k, v]) => [k, v ?? ''])),
+			maxGb: target.maxBytes ? String(+(target.maxBytes / 1073741824).toFixed(2)) : '' })
+		await nextTick()
+		prefilling = false
+		editing.value = target
+		adding.value = true
+	} catch (e) {
+		prefilling = false
+		error.value = e?.message || ''
+	}
+}
+
+async function save() {
+	busy.value = true
+	error.value = ''
+	const maxGb = form.maxGb === '' ? null : Number(form.maxGb)
+	try {
+		await confirmPassword()
+		if (editing.value) {
+			// An empty password field sends null: the server keeps the stored password.
+			const options = { ...form.options }
+			for (const field of fields.value) {
+				if (field.type === 2 && !options[field.key]) {
+					options[field.key] = null
+				}
+			}
+			await api.updateTarget(editing.value.id, { name: form.name, backend: backend.value.id, auth: auth.value.id, options, path: form.path })
+			if (maxGb !== (editing.value.maxBytes ? Number((editing.value.maxBytes / 1073741824).toFixed(2)) : null)) {
+				await api.setTargetLimit(editing.value.id, maxGb)
+			}
+			delete tests[editing.value.id]
+		} else {
+			await api.addTarget({ name: form.name, backend: backend.value.id, auth: auth.value.id, options: form.options, path: form.path, maxGb })
+		}
 		adding.value = false
+		editing.value = null
 		Object.assign(form, { name: '', path: 'ng_backup', options: {}, maxGb: '' })
 		emit('changed')
 	} catch (e) {
-		error.value = e.message
+		error.value = e?.message || ''
 	} finally {
 		busy.value = false
 	}
@@ -7,7 +7,7 @@
 		:description="t('ng_backup', 'Pick a restore point and a user folder or file. Restores run in the background and go through Nextcloud, so overwritten files keep their old content as a version and removed files go to the trash.')">
 		<div class="ngb-row">
 			<NcSelect v-model="target" :options="status.targets" label="name" :input-label="t('ng_backup', 'Location')" :clearable="false" />
-			<NcSelect v-if="target" v-model="snapshot" :options="snapshots" label="displayLabel" :input-label="t('ng_backup', 'Restore point')" :clearable="false" />
+			<NcSelect v-if="target" v-model="snapshot" :options="snapshots" label="displayLabel" class="ngb-snapshot" :input-label="t('ng_backup', 'Restore point')" :clearable="false" />
 		</div>

 		<template v-if="snapshot">
@@ -69,7 +69,7 @@ const busy = ref(false)
 const error = ref('')
 const message = ref('')
 const modes = [
-	{ id: 'new-folder', label: t('ng_backup', 'Into a new folder "Restored <date>" (nothing existing is changed)') },
+	{ id: 'new-folder', label: t('ng_backup', 'Into a new folder "Restored {date}" (nothing existing is changed)', { date: 'YYYY-MM-DD HH.MM' }) },
 	{ id: 'merge', label: t('ng_backup', 'Into the original place, overwrite (old content kept as a version)') },
 	{ id: 'replace', label: t('ng_backup', 'Into the original place, overwrite and move files that are not in the backup to the trash') },
 ]
@@ -124,6 +124,7 @@ async function restore() {

 <style scoped>
 .ngb-row { display: flex; gap: 12px; flex-wrap: wrap; margin-bottom: 12px; }
+.ngb-row :deep(.ngb-snapshot) { min-width: min(360px, 100%); }
 .ngb-crumbs { display: flex; align-items: center; flex-wrap: wrap; }
 .ngb-entries li { display: flex; align-items: center; gap: 12px; min-height: 36px; }
 .ngb-entries li.selected { background: var(--color-primary-element-light); border-radius: var(--border-radius); }
@@ -0,0 +1,593 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\NgBackup\Tests\Unit\Backend;
+
+use OCA\NgBackup\Backend\BackendException;
+use OCA\NgBackup\Backend\SftpReadStream;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * SftpReadStream against a fake of the phpseclib connection: an SFTP server that answers READ
+ * requests from in-memory files, optionally capped. Every answer must be asked for by its request
+ * id, as phpseclib matches them: a server may answer out of order.
+ */
+class SftpReadStreamTest extends TestCase {
+	protected function setUp(): void {
+		SftpReadStream::reset();
+	}
+
+	public function testReadsAWholeFileWithSeveralRequestsInFlight(): void {
+		$data = random_bytes(5 * 1048576 + 12345);
+		$sftp = new FakeSftpConnection(['/home/repo/packs/ab/abcd' => $data]);
+		$fh = SftpReadStream::open(new FakeSftpStorage($sftp), 'repo/packs/ab/abcd');
+
+		$this->assertIsResource($fh);
+		$this->assertSame($data, stream_get_contents($fh));
+		$this->assertTrue(feof($fh));
+		fclose($fh);
+		$this->assertSame(SftpReadStream::DEPTH, $sftp->maxInFlight);
+		$this->assertSame(0, $sftp->pending(), 'nothing may be left on the connection after close');
+		$this->assertSame([], $sftp->openHandles);
+	}
+
+	public function testAServerThatCapsAReadStillGivesEveryByteInOrder(): void {
+		$data = random_bytes(3 * 1048576 + 7);
+		$sftp = new FakeSftpConnection(['/home/f' => $data], cap: 100000);
+		$fh = SftpReadStream::open(new FakeSftpStorage($sftp), 'f');
+
+		$this->assertSame($data, stream_get_contents($fh));
+		fclose($fh);
+		$this->assertSame(0, $sftp->pending());
+
+		// The cap is learned: a next stream asks for no more than the server gives.
+		$sftp->reads = [];
+		$fh = SftpReadStream::open(new FakeSftpStorage($sftp), 'f');
+		$this->assertSame($data, stream_get_contents($fh));
+		fclose($fh);
+		$this->assertSame([100000], array_values(array_unique($sftp->reads)));
+
+		// Only for that connection.
+		$other = new FakeSftpConnection(['/home/f' => $data]);
+		$fh = SftpReadStream::open(new FakeSftpStorage($other), 'f');
+		$this->assertSame($data, stream_get_contents($fh));
+		fclose($fh);
+		$this->assertSame(261120, max($other->reads));
+	}
+
+	public function testATinyAnswerDoesNotShrinkTheReadsBelowWhatEveryServerSupports(): void {
+		$data = random_bytes(1048576);
+		$sftp = new FakeSftpConnection(['/home/f' => $data], cap: 1000);
+		$fh = SftpReadStream::open(new FakeSftpStorage($sftp), 'f');
+		$this->assertSame($data, stream_get_contents($fh));
+		fclose($fh);
+		$this->assertSame(32768, min($sftp->reads));
+	}
+
+	public function testSeekingReadsFromTheNewOffset(): void {
+		$data = random_bytes(3 * 1048576);
+		$sftp = new FakeSftpConnection(['/home/f' => $data]);
+		$fh = SftpReadStream::open(new FakeSftpStorage($sftp), 'f');
+
+		$this->assertSame(0, fseek($fh, 2000000));
+		$this->assertSame(2000000, ftell($fh));
+		$this->assertSame(substr($data, 2000000, 1000), fread($fh, 1000));
+		$this->assertSame(0, fseek($fh, 10)); // backwards
+		$this->assertSame(substr($data, 10, 70000), $this->readExactly($fh, 70000));
+		$this->assertSame(0, fseek($fh, 100, SEEK_CUR)); // within what is already buffered
+		$this->assertSame(substr($data, 70110, 5000), $this->readExactly($fh, 5000));
+		fclose($fh);
+		$this->assertSame(0, $sftp->pending());
+	}
+
+	public function testASmallReadDoesNotFetchTheWholePipelineAhead(): void {
+		$sftp = new FakeSftpConnection(['/home/f' => random_bytes(10 * 1048576)]);
+		$fh = SftpReadStream::open(new FakeSftpStorage($sftp), 'f');
+		fread($fh, 100);
+		fclose($fh);
+		$this->assertCount(1, $sftp->reads, 'the first request goes alone, the pipeline grows while reading on');
+	}
+
+	public function testAnEmptyFileIsAtEndAtOnce(): void {
+		$sftp = new FakeSftpConnection(['/home/f' => '']);
+		$fh = SftpReadStream::open(new FakeSftpStorage($sftp), 'f');
+		$this->assertSame('', stream_get_contents($fh));
+		$this->assertTrue(feof($fh));
+		fclose($fh);
+	}
+
+	public function testAMissingFileCannotBeOpened(): void {
+		$sftp = new FakeSftpConnection([]);
+		$this->assertFalse(SftpReadStream::open(new FakeSftpStorage($sftp), 'nope'));
+		$this->assertSame(0, $sftp->pending());
+	}
+
+	public function testAServerErrorGoesOnWithTheStoragesOwnStreamFromTheSamePosition(): void {
+		$data = random_bytes(3 * 1048576);
+		$sftp = new FakeSftpConnection(['/home/f' => $data], failAt: 1048576);
+		$storage = new FakeSftpStorage($sftp);
+		$fh = SftpReadStream::open($storage, 'f');
+
+		$this->assertSame($data, $this->readAll($fh));
+		$this->assertSame(['f'], $storage->fopens);
+		$this->assertSame(strlen($data), ftell($fh));
+		fclose($fh);
+		$this->assertSame(0, $sftp->pending(), 'the connection is clean for the storage\'s own stream');
+		$this->assertSame([], $sftp->openHandles, 'the failed handle is closed');
+
+		// One failure is no reason to give up on the fast reads.
+		$fh = SftpReadStream::open($storage, 'f');
+		$this->assertIsResource($fh);
+		fclose($fh);
+	}
+
+	public function testOnlyFailuresInARowSwitchTheFastReadsOff(): void {
+		$data = random_bytes(2 * 1048576);
+		$failing = new FakeSftpStorage(new FakeSftpConnection(['/home/f' => $data], failAt: 1048576));
+		$working = new FakeSftpStorage(new FakeSftpConnection(['/home/f' => $data]));
+		for ($i = 1; $i < SftpReadStream::MAX_FAILURES; $i++) {
+			$fh = SftpReadStream::open($failing, 'f');
+			$this->assertSame($data, $this->readAll($fh));
+			fclose($fh);
+		}
+		$fh = SftpReadStream::open($working, 'f'); // a stream that works resets the count
+		$this->assertSame($data, $this->readAll($fh));
+		fclose($fh);
+		for ($i = 1; $i <= SftpReadStream::MAX_FAILURES; $i++) {
+			$fh = SftpReadStream::open($failing, 'f');
+			$this->assertIsResource($fh, "failure $i");
+			$this->assertSame($data, $this->readAll($fh));
+			fclose($fh);
+		}
+		$this->assertNull(SftpReadStream::open($working, 'f'));
+		$this->assertSame(SftpReadStream::MAX_FAILURES * 2 - 1, count($failing->fopens), 'every failed stream still gave all its data');
+	}
+
+	public function testAServerErrorAfterASeekGoesOnFromTheSeekedPosition(): void {
+		$data = random_bytes(3 * 1048576);
+		$sftp = new FakeSftpConnection(['/home/f' => $data], failAt: 2500000);
+		$storage = new FakeSftpStorage($sftp);
+		$fh = SftpReadStream::open($storage, 'f');
+		$this->assertSame(0, fseek($fh, 2400000));
+		$this->assertSame(substr($data, 2400000), $this->readAll($fh));
+		$this->assertSame(0, fseek($fh, 100)); // seeks go to the storage's stream now
+		$this->assertSame(substr($data, 100, 1000), $this->readExactly($fh, 1000));
+		fclose($fh);
+	}
+
+	public function testAConnectionErrorDoesNotFallBackOnTheSameConnection(): void {
+		// After an exception, answers may still be on their way; files_external's stream would
+		// take them for its own.
+		$sftp = new FakeSftpConnection(['/home/f' => random_bytes(3 * 1048576)], throwAt: 1048576);
+		$storage = new FakeSftpStorage($sftp);
+		$fh = SftpReadStream::open($storage, 'f');
+		$this->assertLessThan(3 * 1048576, strlen($this->readAll($fh)));
+		fclose($fh);
+		$this->assertSame([], $storage->fopens);
+	}
+
+	public function testALostConnectionDoesNotFallBackEither(): void {
+		$sftp = new FakeSftpConnection(['/home/f' => random_bytes(3 * 1048576)], loseAt: 1048576);
+		$storage = new FakeSftpStorage($sftp);
+		$fh = SftpReadStream::open($storage, 'f');
+		$this->assertLessThan(3 * 1048576, strlen($this->readAll($fh)));
+		fclose($fh);
+		$this->assertSame([], $storage->fopens);
+	}
+
+	public function testWhenTheStoragesOwnStreamFailsTooTheReadFails(): void {
+		$sftp = new FakeSftpConnection(['/home/f' => random_bytes(3 * 1048576)], failAt: 1048576);
+		$storage = new FakeSftpStorage($sftp, fopenFails: true);
+		$fh = SftpReadStream::open($storage, 'f');
+		$this->assertLessThan(3 * 1048576, strlen($this->readAll($fh)));
+		fclose($fh);
+		$this->assertSame(['f'], $storage->fopens);
+	}
+
+	public function testAConnectionErrorWhileOpeningIsAnErrorNotAMissingFile(): void {
+		// The OPEN request went out: the storage's own stream must not be tried on this connection.
+		$storage = new FakeSftpStorage(new FakeSftpConnection(['/home/f' => 'x'], throwAt: -1));
+		try {
+			SftpReadStream::open($storage, 'f');
+			$this->fail('expected a BackendException');
+		} catch (BackendException $e) {
+			$this->assertStringContainsString('connection', $e->getMessage());
+		}
+		$lost = new FakeSftpStorage(new FakeSftpConnection(['/home/f' => 'x'], loseAt: -1));
+		$this->expectException(BackendException::class);
+		SftpReadStream::open($lost, 'f');
+	}
+
+	public function testAConnectionErrorWhileOpeningDoesNotStopTheNextFile(): void {
+		try {
+			SftpReadStream::open(new FakeSftpStorage(new FakeSftpConnection(['/home/f' => 'x'], throwAt: -1)), 'f');
+		} catch (BackendException) {
+		}
+		$fh = SftpReadStream::open(new FakeSftpStorage(new FakeSftpConnection(['/home/f' => 'x'])), 'f');
+		$this->assertSame('x', stream_get_contents($fh));
+		fclose($fh);
+	}
+
+	public function testAFailedCloseDoesNotFallBackOnTheSameConnection(): void {
+		$sftp = new FakeSftpConnection(['/home/f' => random_bytes(3 * 1048576)], failAt: 1048576, closeFails: true);
+		$storage = new FakeSftpStorage($sftp);
+		$fh = SftpReadStream::open($storage, 'f');
+		$this->assertLessThan(3 * 1048576, strlen($this->readAll($fh)));
+		fclose($fh);
+		$this->assertSame([], $storage->fopens);
+	}
+
+	public function testAStorageThatThrowsIsNotUsed(): void {
+		$storage = new class {
+			public function getRoot(): string {
+				return '/';
+			}
+
+			public function getConnection(): object {
+				throw new \RuntimeException('Login failed');
+			}
+		};
+		$this->assertNull(SftpReadStream::open($storage, 'f'));
+	}
+
+	public function testReadManyReadsSmallFilesInBatches(): void {
+		$files = [];
+		for ($i = 0; $i < 70; $i++) {
+			// one empty file on purpose (random_bytes(0) throws)
+			$files["/home/index/$i"] = $i === 0 ? '' : random_bytes(random_int(1, 5000));
+		}
+		$files['/home/index/big'] = random_bytes(600000); // more than one READ
+		$sftp = new FakeSftpConnection($files);
+		$paths = array_map(fn ($p) => substr($p, 6), array_keys($files));
+
+		$got = SftpReadStream::readMany(new FakeSftpStorage($sftp), $paths);
+
+		$this->assertSame(array_combine($paths, array_values($files)), $got);
+		$this->assertSame(SftpReadStream::BATCH, $sftp->maxInFlight, 'a batch goes out at once');
+		$this->assertSame(0, $sftp->pending());
+		$this->assertSame([], $sftp->openHandles);
+	}
+
+	public function testReadManyLeavesAMissingOrFailingFileToTheCaller(): void {
+		$sftp = new FakeSftpConnection(['/home/a' => 'aaa', '/home/b' => random_bytes(400000), '/home/c' => 'ccc'], failAt: 300000);
+
+		$got = SftpReadStream::readMany(new FakeSftpStorage($sftp), ['a', 'missing', 'b', 'c']);
+
+		$this->assertSame(['a' => 'aaa', 'missing' => null, 'b' => null, 'c' => 'ccc'], $got);
+		$this->assertSame(0, $sftp->pending());
+		$this->assertSame([], $sftp->openHandles);
+	}
+
+	public function testReadManyAcrossACappedServer(): void {
+		$data = random_bytes(300000);
+		$sftp = new FakeSftpConnection(['/home/a' => $data, '/home/b' => 'b'], cap: 100000);
+		$this->assertSame(['a' => $data, 'b' => 'b'], SftpReadStream::readMany(new FakeSftpStorage($sftp), ['a', 'b']));
+	}
+
+	public function testReadManyEndsTheConnectionOnAConnectionError(): void {
+		// Answers to requests already out may still come: files_external must not get them.
+		$sftp = new FakeSftpConnection(['/home/a' => random_bytes(10), '/home/b' => 'b'], loseAt: 0);
+		try {
+			SftpReadStream::readMany(new FakeSftpStorage($sftp), ['a', 'b']);
+			$this->fail('expected a BackendException');
+		} catch (BackendException) {
+		}
+		$this->assertTrue($sftp->disconnected);
+	}
+
+	public function testReadManyStopsBatchingWhenCloseIsNotConfirmed(): void {
+		$files = [];
+		for ($i = 0; $i < 40; $i++) {
+			$files["/home/$i"] = "file $i";
+		}
+		$sftp = new FakeSftpConnection($files, closeStatus: 4);
+		$got = SftpReadStream::readMany(new FakeSftpStorage($sftp), array_map('strval', range(0, 39)));
+		$this->assertSame('file 0', $got['0']);
+		$this->assertSame('file 31', $got['31']);
+		$this->assertNull($got['32'], 'no second batch after unconfirmed closes');
+		$this->assertCount(SftpReadStream::BATCH, array_filter($got, fn ($v) => $v !== null));
+		// Nor on a later call over the same connection.
+		$this->assertNull(SftpReadStream::readMany(new FakeSftpStorage($sftp), ['0']));
+	}
+
+	public function testReadManyLeavesAMalformedAnswerToTheCaller(): void {
+		$sftp = new FakeSftpConnection(['/home/a' => 'aaaa', '/home/b' => 'bbbb'], malformed: '/home/a');
+		$this->assertSame(['a' => null, 'b' => 'bbbb'], SftpReadStream::readMany(new FakeSftpStorage($sftp), ['a', 'b']));
+		$this->assertSame([], $sftp->openHandles);
+	}
+
+	public function testReadManyOnAnUnsupportedConnectionIsNull(): void {
+		$this->assertNull(SftpReadStream::readMany(new \stdClass(), ['a']));
+		$this->assertNull(SftpReadStream::readMany(new FakeSftpStorage(new FakeSftpConnection(['/home/a' => 'a'], channelFails: true)), ['a']));
+	}
+
+	public function testAFreshConnectionHasItsSftpChannelOpenedFirst(): void {
+		// phpseclib 2 logs in at connect time but opens the SFTP channel on the first SFTP call.
+		$sftp = new FakeSftpConnection(['/home/config' => 'repository config']);
+		$this->assertFalse($sftp->initialised);
+		$fh = SftpReadStream::open(new FakeSftpStorage($sftp), 'config');
+		$this->assertIsResource($fh);
+		$this->assertSame('repository config', stream_get_contents($fh));
+		fclose($fh);
+	}
+
+	public function testAChannelThatCannotBeOpenedLeavesItToTheStoragesOwnStream(): void {
+		$sftp = new FakeSftpConnection(['/home/config' => 'x'], channelFails: true);
+		$this->assertNull(SftpReadStream::open(new FakeSftpStorage($sftp), 'config'));
+		$this->assertSame(0, $sftp->sent, 'nothing may be sent on a connection without an SFTP channel');
+	}
+
+	public function testAConnectionWithoutTheNeededMethodsIsNotUsed(): void {
+		$storage = new class {
+			public function getRoot(): string {
+				return '/';
+			}
+
+			public function getConnection(): object {
+				return new \stdClass();
+			}
+		};
+		$this->assertNull(SftpReadStream::open($storage, 'f'));
+		$this->assertNull(SftpReadStream::open(new \stdClass(), 'f'));
+	}
+
+	public function testAPhpseclib3ConnectionIsNotUsed(): void {
+		// phpseclib 3 has no _-prefixed methods; its packet_type and packet methods are private.
+		$v3 = new class {
+			private int $packet_type = -1;
+
+			private function _send_sftp_packet(): bool {
+				return true;
+			}
+
+			private function _get_sftp_packet(): string {
+				return '';
+			}
+
+			public function _realpath(string $path): string {
+				return $path;
+			}
+
+			public function realpath(string $path): string {
+				return $path . (string)$this->packet_type . $this->_send_sftp_packet() . $this->_get_sftp_packet();
+			}
+		};
+		$storage = new class($v3) {
+			public function __construct(
+				private object $connection,
+			) {
+			}
+
+			public function getRoot(): string {
+				return '/';
+			}
+
+			public function getConnection(): object {
+				return $this->connection;
+			}
+		};
+		$this->assertNull(SftpReadStream::open($storage, 'f'));
+	}
+
+	public function testAPrivatePacketTypeIsNotUsed(): void {
+		$conn = new class {
+			private int $packet_type = -1;
+
+			public function _send_sftp_packet(): bool {
+				return true;
+			}
+
+			public function _get_sftp_packet(): string {
+				return (string)$this->packet_type;
+			}
+
+			public function _realpath(string $path): string {
+				return $path;
+			}
+		};
+		$storage = new class($conn) {
+			public function __construct(
+				private object $connection,
+			) {
+			}
+
+			public function getRoot(): string {
+				return '/';
+			}
+
+			public function getConnection(): object {
+				return $this->connection;
+			}
+		};
+		$this->assertNull(SftpReadStream::open($storage, 'f'));
+	}
+
+	/** @param resource $fh */
+	private function readAll($fh): string {
+		$data = '';
+		while (!feof($fh)) {
+			$chunk = fread($fh, 65536);
+			if ($chunk === false || $chunk === '') {
+				break;
+			}
+			$data .= $chunk;
+		}
+		return $data;
+	}
+
+	/** @param resource $fh */
+	private function readExactly($fh, int $length): string {
+		$data = '';
+		while (strlen($data) < $length && !feof($fh)) {
+			$data .= fread($fh, $length - strlen($data));
+		}
+		return $data;
+	}
+}
+
+final class FakeSftpStorage {
+	/** @var list<string> paths opened through the storage's own stream */
+	public array $fopens = [];
+
+	public function __construct(
+		private FakeSftpConnection $connection,
+		private bool $fopenFails = false,
+	) {
+	}
+
+	/** files_external's own read stream: here the file from memory, seekable. */
+	public function fopen(string $path, string $mode) {
+		$this->fopens[] = $path;
+		$data = $this->connection->file('/home/' . $path);
+		if ($this->fopenFails || $data === null) {
+			return false;
+		}
+		$fh = fopen('php://memory', 'r+');
+		fwrite($fh, $data);
+		rewind($fh);
+		return $fh;
+	}
+
+	public function getRoot(): string {
+		return '/home/';
+	}
+
+	public function getConnection(): FakeSftpConnection {
+		return $this->connection;
+	}
+}
+
+/** The part of phpseclib\Net\SFTP (2.x) that SftpReadStream uses. */
+final class FakeSftpConnection {
+	public int $packet_type = -1;
+	public int $maxInFlight = 0;
+	/** @var list<int> lengths asked for by READ requests */
+	public array $reads = [];
+	/** @var array<string, string> */
+	public array $openHandles = [];
+	/** Whether the SFTP channel is open: phpseclib 2 opens it on the first SFTP call. */
+	public bool $initialised = false;
+	/** Packets sent */
+	public int $sent = 0;
+	/** @var array<int, array{int, string}> answers by request id, in the order the server sent them */
+	private array $answers = [];
+	private int $handles = 0;
+
+	/** @param array<string, string> $files */
+	public function __construct(
+		private array $files,
+		private int $cap = 261120,
+		private ?int $failAt = null,
+		/** READ at or past this offset throws; -1: OPEN throws */
+		private ?int $throwAt = null,
+		/** READ at or past this offset finds the connection gone (phpseclib returns false); -1: OPEN */
+		private ?int $loseAt = null,
+		private bool $closeFails = false,
+		private bool $channelFails = false,
+		/** status code the server answers CLOSE with */
+		private int $closeStatus = 0,
+		/** a file whose DATA answers declare a wrong length */
+		private ?string $malformed = null,
+	) {
+	}
+
+	public bool $disconnected = false;
+
+	public function disconnect(): void {
+		$this->disconnected = true;
+	}
+
+	public function pwd(): string|false {
+		if ($this->channelFails) {
+			return false;
+		}
+		$this->initialised = true;
+		return '/home';
+	}
+
+	public function file(string $path): ?string {
+		return $this->files[$path] ?? null;
+	}
+
+	public function pending(): int {
+		return count($this->answers);
+	}
+
+	public function _realpath(string $path): string {
+		return '/' . trim(preg_replace('#/+#', '/', $path), '/');
+	}
+
+	public function _send_sftp_packet(int $type, string $data, int $id = 1): bool {
+		$this->sent++;
+		if (!$this->initialised) {
+			return false; // like phpseclib 2: no SFTP channel yet
+		}
+		switch ($type) {
+			case 3: // OPEN
+				if ($this->throwAt === -1) {
+					throw new \RuntimeException('Connection closed by server');
+				}
+				if ($this->loseAt === -1) {
+					return false;
+				}
+				$path = substr($data, 4, unpack('N', $data)[1]);
+				if (!isset($this->files[$path])) {
+					$this->answers[$id] = [101, pack('N', 2)];
+					break;
+				}
+				$handle = 'h' . ++$this->handles;
+				$this->openHandles[$handle] = $path;
+				$this->answers[$id] = [102, pack('Na*', strlen($handle), $handle)];
+				break;
+			case 4: // CLOSE
+				if ($this->closeFails) {
+					return false;
+				}
+				$handle = substr($data, 4, unpack('N', $data)[1]);
+				unset($this->openHandles[$handle]);
+				$this->answers[$id] = [101, pack('N', $this->closeStatus)];
+				break;
+			case 5: // READ
+				$len = unpack('N', $data)[1];
+				$handle = substr($data, 4, $len);
+				['hi' => $hi, 'lo' => $lo, 'n' => $n] = unpack('Nhi/Nlo/Nn', substr($data, 4 + $len));
+				$offset = $hi * 4294967296 + $lo;
+				$this->reads[] = $n;
+				if ($this->throwAt !== null && $this->throwAt >= 0 && $offset >= $this->throwAt) {
+					throw new \RuntimeException('Connection closed by server');
+				}
+				if ($this->loseAt !== null && $this->loseAt >= 0 && $offset >= $this->loseAt) {
+					$this->answers = [];
+					return false;
+				}
+				$file = $this->files[$this->openHandles[$handle]];
+				if ($this->failAt !== null && $offset >= $this->failAt) {
+					$this->answers[$id] = [101, pack('N', 4)]; // FX_FAILURE
+				} elseif ($offset >= strlen($file)) {
+					$this->answers[$id] = [101, pack('N', 1)]; // FX_EOF
+				} else {
+					$chunk = substr($file, $offset, min($n, $this->cap));
+					$declared = $this->openHandles[$handle] === $this->malformed ? strlen($chunk) + 7 : strlen($chunk);
+					$this->answers[$id] = [103, pack('Na*', $declared, $chunk)];
+				}
+				$this->maxInFlight = max($this->maxInFlight, count($this->answers));
+				break;
+			default:
+				throw new \LogicException("unexpected packet type $type");
+		}
+		return true;
+	}
+
+	public function _get_sftp_packet(?int $id = null): string|false {
+		if ($this->answers === []) {
+			throw new \LogicException('waiting for an answer that will never come');
+		}
+		if ($id === null || !isset($this->answers[$id])) {
+			throw new \LogicException("no answer for request $id");
+		}
+		[$this->packet_type, $payload] = $this->answers[$id];
+		unset($this->answers[$id]);
+		return $payload;
+	}
+}
@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\NgBackup\Tests\Unit\Backend;
+
+use OCA\NgBackup\Backend\BackendException;
+use OCA\NgBackup\Backend\StorageBackend;
+use OCA\NgBackup\Tests\Unit\TempDirTrait;
+use OCP\Files\Storage\IStorage;
+use PHPUnit\Framework\TestCase;
+
+/** On a remote storage every is_dir() is a round trip: listing index/ must not cost one per pack. */
+class StorageBackendListTest extends TestCase {
+	use TempDirTrait;
+
+	public function testListFilesChecksOnlyTheFolderItself(): void {
+		$dir = $this->tempDir();
+		foreach (['b1', 'a2', 'c3.part-0123abcd'] as $name) {
+			touch("$dir/$name");
+		}
+		$isDirCalls = 0;
+		$storage = $this->createMock(IStorage::class);
+		$storage->method('instanceOfStorage')->willReturn(false);
+		$storage->method('is_dir')->willReturnCallback(function (string $path) use (&$isDirCalls): bool {
+			$isDirCalls++;
+			return $path === 'repo' || $path === 'repo/index';
+		});
+		$storage->method('opendir')->willReturnCallback(fn (string $path) => $path === 'repo/index' ? opendir($dir) : false);
+
+		$backend = new StorageBackend($storage, 'repo');
+		$isDirCalls = 0; // the constructor checks the base folder
+		$this->assertSame(['index/a2', 'index/b1'], $backend->listFiles('index'));
+		$this->assertSame(1, $isDirCalls);
+
+		$isDirCalls = 0;
+		$this->assertSame(['index/a2', 'index/b1'], $backend->list('index'));
+		$this->assertSame(4, $isDirCalls, 'list() checks every entry: the reason listFiles() exists');
+	}
+
+	public function testListFilesOfAMissingFolderIsEmpty(): void {
+		$storage = $this->createMock(IStorage::class);
+		$storage->method('instanceOfStorage')->willReturn(false);
+		$storage->method('is_dir')->willReturnCallback(fn (string $path): bool => $path === 'repo');
+		$storage->expects($this->never())->method('opendir');
+		$this->assertSame([], (new StorageBackend($storage, 'repo'))->listFiles('snapshots'));
+	}
+
+	public function testAnUnreadableFolderIsAnErrorNotEmpty(): void {
+		$storage = $this->createMock(IStorage::class);
+		$storage->method('instanceOfStorage')->willReturn(false);
+		$storage->method('is_dir')->willReturn(true);
+		$storage->method('opendir')->willReturn(false);
+		$this->expectException(BackendException::class);
+		(new StorageBackend($storage, 'repo'))->listFiles('catalog');
+	}
+}
@@ -0,0 +1,146 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\NgBackup\Tests\Unit\Backend;
+
+use OCA\NgBackup\Backend\BackendException;
+use OCA\NgBackup\Backend\StorageBackend;
+use OCP\Files\Storage\IStorage;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * A Hetzner Storage Box drops an SFTP connection that carried a lot of data and then stayed
+ * quiet for a few minutes; files_external keeps using the dead client, on which every file
+ * looks missing. The backend builds the storage anew instead.
+ */
+class StorageBackendReconnectTest extends TestCase {
+	/** @var list<ReconnectFakeSftp> */
+	private array $connections = [];
+	/** New connections come up dead (the location is gone). */
+	private bool $deadOnArrival = false;
+
+	private function storage(): IStorage {
+		$sftp = new ReconnectFakeSftp();
+		$sftp->dropped = $this->deadOnArrival;
+		$this->connections[] = $sftp;
+		$storage = $this->createMock(SftpLikeStorage::class);
+		$storage->method('instanceOfStorage')->willReturnCallback(fn (string $class): bool => $class === \OCA\Files_External\Lib\Storage\SFTP::class);
+		$storage->method('getConnection')->willReturn($sftp);
+		$storage->method('is_dir')->willReturn(true);
+		$storage->method('file_exists')->willReturnCallback(fn (string $path): bool => $sftp->request() && $path === 'repo/config');
+		$storage->method('fopen')->willReturnCallback(function (string $path) use ($sftp) {
+			if (!$sftp->request() || $path !== 'repo/config') {
+				return false;
+			}
+			$fh = fopen('php://memory', 'w+b');
+			fwrite($fh, 'config');
+			rewind($fh);
+			return $fh;
+		});
+		return $storage;
+	}
+
+	private function backend(bool $reconnect = true): StorageBackend {
+		return new StorageBackend($this->storage(), 'repo', false, $reconnect ? fn (): IStorage => $this->storage() : null);
+	}
+
+	private static function idle(StorageBackend $backend): void {
+		(new \ReflectionProperty($backend, 'lastUsed'))->setValue($backend, microtime(true) - StorageBackend::IDLE_CHECK - 1);
+	}
+
+	public function testADeadConnectionIsReplacedAfterAPause(): void {
+		$backend = $this->backend();
+		$this->connections[0]->dropped = true;
+		self::idle($backend);
+		$this->assertTrue($backend->exists('config'));
+		$this->assertSame(1, $backend->reconnects);
+		$this->assertSame(1, $this->connections[0]->requests, 'only the check went over the old connection');
+	}
+
+	public function testAPauseOnALiveConnectionCostsOneCheck(): void {
+		$backend = $this->backend();
+		self::idle($backend);
+		$this->assertTrue($backend->exists('config'));
+		$this->assertSame(0, $backend->reconnects);
+		$this->assertSame(2, $this->connections[0]->requests);
+		$this->assertTrue($backend->exists('config'));
+		$this->assertSame(3, $this->connections[0]->requests, 'no check without a pause');
+	}
+
+	public function testAFailureOnAConnectionThatJustDiedIsRepeated(): void {
+		$backend = $this->backend();
+		$this->connections[0]->dropped = true; // without a pause: not checked first
+		$this->assertTrue($backend->exists('config'));
+		$fh = $backend->get('config');
+		$this->assertSame('config', stream_get_contents($fh));
+		$this->assertSame(1, $backend->reconnects);
+	}
+
+	public function testAMissingFileOnALiveConnectionIsJustMissing(): void {
+		$backend = $this->backend();
+		$this->assertFalse($backend->exists('nothing'));
+		try {
+			$backend->get('nothing');
+			$this->fail('missing');
+		} catch (BackendException $e) {
+			$this->assertStringContainsString('Not found', $e->getMessage());
+		}
+		$this->assertSame(0, $backend->reconnects);
+		$this->assertCount(1, $this->connections);
+	}
+
+	public function testANewConnectionThatFailsToo(): void {
+		$backend = $this->backend();
+		$this->connections[0]->dropped = true;
+		$backend->exists('config'); // reconnects
+		$this->connections[1]->dropped = true;
+		$this->deadOnArrival = true;
+		self::idle($backend);
+		try {
+			$backend->get('config');
+			$this->fail('no connection');
+		} catch (BackendException) {
+		}
+		$this->assertSame(3, $backend->reconnects, 'once after the pause, once after the failure, no more');
+	}
+
+	public function testWithoutAWayToReconnectNothingChanges(): void {
+		$backend = $this->backend(false);
+		$this->connections[0]->dropped = true;
+		self::idle($backend);
+		$this->assertFalse($backend->exists('config'));
+		$this->assertCount(1, $this->connections);
+	}
+}
+
+interface SftpLikeStorage extends IStorage {
+	public function getConnection(): object;
+}
+
+/** The public phpseclib calls the backend uses to tell a dead connection. */
+final class ReconnectFakeSftp {
+	public bool $dropped = false;
+	private bool $connected = true;
+	public int $requests = 0;
+
+	public function isConnected(): bool {
+		return $this->connected;
+	}
+
+	public function clearStatCache(): void {
+	}
+
+	public function stat(string $path): array|false {
+		return $this->request() ? ['type' => 2] : false;
+	}
+
+	/** A request: false (and from then on disconnected) when the server has dropped the connection. */
+	public function request(): bool {
+		$this->requests++;
+		if ($this->dropped) {
+			$this->connected = false;
+		}
+		return $this->connected;
+	}
+}
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\NgBackup\Tests\Unit\Job;
+
+use OCA\NgBackup\Job\BackupRun;
+use PHPUnit\Framework\TestCase;
+
+class BackupProgressTest extends TestCase {
+	public function testCountsFinishedFilesAndTheFileBeingRead(): void {
+		$state = ['phase' => 'files', 'estimate' => ['bytes' => 1000, 'approximate' => false],
+			'stats' => ['bytes' => 500], 'cur' => ['offset' => 180]];
+		$this->assertSame(['fraction' => 0.68, 'approximate' => false], BackupRun::progress($state));
+	}
+
+	public function testStaysBelowHundredPercentWhenTheEstimateIsTooLow(): void {
+		$state = ['phase' => 'files', 'estimate' => ['bytes' => 1000, 'approximate' => true], 'stats' => ['bytes' => 5000], 'cur' => null];
+		$this->assertSame(['fraction' => 0.99, 'approximate' => true], BackupRun::progress($state));
+	}
+
+	public function testNoProgressWithoutEstimateOrOutsideTheFilesPhase(): void {
+		$this->assertNull(BackupRun::progress(['phase' => 'files', 'stats' => ['bytes' => 1]]));
+		$this->assertNull(BackupRun::progress(['phase' => 'files', 'estimate' => ['bytes' => 0, 'approximate' => true], 'stats' => ['bytes' => 1]]));
+		$this->assertNull(BackupRun::progress(['phase' => 'commit', 'estimate' => ['bytes' => 10, 'approximate' => false], 'stats' => ['bytes' => 1]]));
+	}
+}
@@ -27,13 +27,14 @@ class BackupRunTest extends TestCase {

 		$state = BackupRun::start($src);
 		$steps = 0;
-		while ($state['phase'] !== 'done' && $steps < 500) {
+		while ($state['phase'] !== 'commit' && $steps < 500) {
 			// Fresh repository object per step, state through JSON: as separate processes would.
 			$repo = Repository::openWithKey($backend, $keys);
 			$state = json_decode(json_encode(BackupRun::step($repo, $state, microtime(true) + 0.05)), true);
 			$steps++;
 		}
-		$this->assertSame('done', $state['phase']);
+		$this->assertSame('commit', $state['phase']);
+		Repository::openWithKey($backend, $keys)->recordSnapshot($state['snapshot']);
 		$this->assertGreaterThan(2, $steps, 'the run was actually split into steps');

 		$target = $this->tempDir();
@@ -50,7 +51,7 @@ class BackupRunTest extends TestCase {

 		$state = BackupRun::start($src);
 		$mutated = false;
-		for ($i = 0; $i < 500 && $state['phase'] !== 'done'; $i++) {
+		for ($i = 0; $i < 500 && $state['phase'] !== 'commit'; $i++) {
 			$state = BackupRun::step(Repository::openWithKey($backend, $keys), $state, microtime(true) + 0.01);
 			if (!$mutated && $state['cur'] !== null && $state['cur']['offset'] > 0) {
 				$fh = fopen("$src/big.bin", 'r+b');
@@ -60,6 +61,8 @@ class BackupRunTest extends TestCase {
 				$mutated = true;
 			}
 		}
+		$this->assertSame('commit', $state['phase']);
+		Repository::openWithKey($backend, $keys)->recordSnapshot($state['snapshot']);
 		$this->assertTrue($mutated);
 		$this->assertGreaterThanOrEqual(1, $state['stats']['retried'] ?? 0);
 		$target = $this->tempDir();
@@ -78,14 +81,17 @@ class BackupRunTest extends TestCase {
 		Repository::initWithKey($backend, $keys, $keys->wrap('pw'));
 		$run = function (?string $parent) use ($backend, $src, $keys): array {
 			$state = BackupRun::start(['data' => $src], $parent);
-			for ($i = 0; $i < 2000 && $state['phase'] !== 'done'; $i++) {
+			for ($i = 0; $i < 2000 && $state['phase'] !== 'commit'; $i++) {
 				$state = json_decode(json_encode(BackupRun::step(Repository::openWithKey($backend, $keys), $state, microtime(true))), true);
 			}
+			if ($state['phase'] === 'commit') {
+				Repository::openWithKey($backend, $keys)->recordSnapshot($state['snapshot']);
+			}
 			return $state;
 		};
 		$first = $run(null);
 		$second = $run($first['snapshot']);
-		$this->assertSame('done', $second['phase']);
+		$this->assertSame('commit', $second['phase']);
 		$this->assertGreaterThan(150, $second["steps"], "one file per step");
 		$this->assertSame(0, $second['stats']['read'], 'merge-join with the parent across steps reuses every file');
 		$this->assertSame(200, $second['stats']['reused']);
@@ -0,0 +1,106 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Tests\Unit\Repository;
+
+use OCA\NgBackup\Backend\LocalBackend;
+use OCA\NgBackup\Crypto\KeyRing;
+use OCA\NgBackup\Job\BackupRun;
+use OCA\NgBackup\Repository\Repository;
+use OCA\NgBackup\Repository\RepositoryException;
+use OCA\NgBackup\Tests\Unit\TempDirTrait;
+use PHPUnit\Framework\TestCase;
+
+/** Data-safety cases found in the pre-beta review. */
+class CrashSafetyTest extends TestCase {
+	use TempDirTrait;
+
+	public function testListingKeepsNamesThatOnlyLookLikeTemporaryFiles(): void {
+		$root = $this->tempDir();
+		$backend = new LocalBackend($root);
+		mkdir("$root/users/john.part-time", 0700, true);
+		file_put_contents("$root/users/john.part-time/20261006T120000Z-aaaa0001", 'x');
+		file_put_contents("$root/users/upload.part-deadbeef", 'partial');
+		$this->assertSame(['users/john.part-time/20261006T120000Z-aaaa0001'], $backend->list('users'));
+	}
+
+	public function testPruneStopsWhenARecordedExportManifestIsMissing(): void {
+		$root = $this->tempDir();
+		$backend = new LocalBackend($root);
+		$keys = KeyRing::generate();
+		$repo = Repository::initWithKey($backend, $keys, $keys->wrap('pw'));
+		$stats = [];
+		$blob = $repo->storeData(random_bytes(1000), $stats);
+		$repo->flushPacks();
+		$path = 'users/alice/20261006T120000Z-aaaa0001';
+		$repo->putObject($path, json_encode(['uid' => 'alice', 'entries' => ['f.txt' => ['t' => 'f', 'b' => [$blob], 's' => 1000]]]));
+		$repo->recordUserExport($path);
+		unlink("$root/$path");
+
+		$packsBefore = $backend->list('packs');
+		try {
+			Repository::openWithKey($backend, $keys)->prune();
+			$this->fail('prune must refuse while a recorded export is missing');
+		} catch (RepositoryException $e) {
+			$this->assertStringContainsString('missing on the location', $e->getMessage());
+		}
+		$this->assertSame($packsBefore, $backend->list('packs'), 'no pack was deleted');
+	}
+
+	public function testForgetAndUntrashKeepTheSnapshotRestorable(): void {
+		$src = $this->tempDir();
+		file_put_contents("$src/a.txt", 'hello');
+		$root = $this->tempDir();
+		$backend = new LocalBackend($root);
+		$keys = KeyRing::generate();
+		Repository::initWithKey($backend, $keys, $keys->wrap('pw'));
+		$state = BackupRun::start($src);
+		while ($state['phase'] !== 'commit') {
+			$state = BackupRun::step(Repository::openWithKey($backend, $keys), $state, microtime(true) + 5);
+		}
+		Repository::openWithKey($backend, $keys)->recordSnapshot($state['snapshot']);
+		$id = $state['snapshot'];
+
+		Repository::openWithKey($backend, $keys)->forget($id, 'test');
+		$repo = Repository::openWithKey($backend, $keys);
+		$this->assertSame([], $repo->listSnapshots());
+		$this->assertArrayHasKey($id, $repo->trash());
+		$this->assertFalse($backend->exists('snapshots/' . $id), 'original removed after the catalog switch');
+
+		$repo->untrash($id);
+		$repo = Repository::openWithKey($backend, $keys);
+		$this->assertSame([$id], $repo->listSnapshots());
+		$this->assertSame([], $repo->trash());
+		$target = $this->tempDir();
+		$repo->restore($id, $target);
+		$this->assertSame('hello', file_get_contents("$target/a.txt"));
+	}
+
+	public function testFileThatKeepsChangingDoesNotStallTheRun(): void {
+		$src = $this->tempDir();
+		file_put_contents("$src/live.db", random_bytes(3 * Repository::BLOB_SIZE));
+		$root = $this->tempDir();
+		$backend = new LocalBackend($root);
+		$keys = KeyRing::generate();
+		Repository::initWithKey($backend, $keys, $keys->wrap('pw'));
+
+		$state = BackupRun::start($src);
+		$n = 0;
+		for ($i = 0; $i < 50 && $state['phase'] !== 'commit'; $i++) {
+			$state = BackupRun::step(Repository::openWithKey($backend, $keys), $state, microtime(true) + 0.001);
+			// Rewrite the file after every step: it never stays the same between two steps.
+			$fh = fopen("$src/live.db", 'r+b');
+			fwrite($fh, random_bytes(16));
+			fclose($fh);
+			touch("$src/live.db", time() + ++$n);
+			clearstatcache();
+		}
+		$this->assertSame('commit', $state['phase'], 'the run finishes instead of retrying forever');
+		$this->assertSame(1, $state['stats']['changing'] ?? 0);
+		$this->assertSame(['live.db'], BackupRun::warnings($state)['changing']);
+	}
+}
@@ -20,6 +20,8 @@ class IndexCacheTest extends TestCase {
 			public function all(string $r): array { return $this->data[$r] ?? []; }
 			public function put(string $r, string $p, array $e): void { $this->data[$r][$p] = $e; }
 			public function remove(string $r, array $ps): void { foreach ($ps as $p) { unset($this->data[$r][$p]); } }
+			public function putMany(string $r, array $packs): void { foreach ($packs as $p => $e) { $this->put($r, (string)$p, $e); } }
+			public function replaceAll(string $r, array $packs): void { $this->data[$r] = []; $this->putMany($r, $packs); }
 		};
 		$src = $this->tempDir();
 		for ($i = 0; $i < 12; $i++) {
@@ -51,4 +53,77 @@ class IndexCacheTest extends TestCase {
 		$fourth->restore($r1['snapshot'], $target);
 		$this->assertCount(12, self::hashTree($target));
 	}
+
+	/** The database dump reads in a read-only transaction: a pack that fills up then must not write the cache yet. */
+	public function testHeldCacheWritesWaitForRelease(): void {
+		$cache = new class implements IIndexCache {
+			public array $data = [];
+			public bool $readOnly = false;
+			public function all(string $r): array { return $this->data[$r] ?? []; }
+			public function put(string $r, string $p, array $e): void {
+				if ($this->readOnly) {
+					throw new \RuntimeException('cannot execute INSERT in a read-only transaction');
+				}
+				$this->data[$r][$p] = $e;
+			}
+			public function remove(string $r, array $ps): void { foreach ($ps as $p) { unset($this->data[$r][$p]); } }
+			public function putMany(string $r, array $packs): void { foreach ($packs as $p => $e) { $this->put($r, (string)$p, $e); } }
+			public function replaceAll(string $r, array $packs): void { $this->data[$r] = []; $this->putMany($r, $packs); }
+		};
+		$backend = new LocalBackend($this->tempDir());
+		$keys = KeyRing::generate();
+		Repository::initWithKey($backend, $keys, $keys->wrap('pw'));
+		$repo = Repository::openWithKey($backend, $keys, $cache);
+
+		$stats = [];
+		$repo->holdIndexCache();
+		$cache->readOnly = true;
+		$writer = $repo->blobWriter($stats);
+		for ($i = 0; $i < 40; $i++) {
+			$writer->write(random_bytes(1048576)); // more than one 32 MiB pack
+		}
+		$writer->finish();
+		$this->assertGreaterThan(0, count($backend->list('index')), 'a full pack was uploaded during the hold');
+		$this->assertSame([], $cache->data);
+
+		$cache->readOnly = false;
+		$repo->releaseIndexCache();
+		$repo->flushPacks();
+		$this->assertCount(count($backend->list('index')), array_merge(...array_values($cache->data)));
+		$this->assertSame(0, Repository::openWithKey($backend, $keys, $cache)->indexDownloads());
+	}
+
+	/** After a check the cache holds every index file as it is, also a blob that is in two packs. */
+	public function testACheckCachesTheIndexFilesAsTheyAre(): void {
+		$cache = new class implements IIndexCache {
+			public array $data = [];
+			public int $replaced = 0;
+			public function all(string $r): array { return $this->data[$r] ?? []; }
+			public function put(string $r, string $p, array $e): void { $this->data[$r][$p] = $e; }
+			public function remove(string $r, array $ps): void { foreach ($ps as $p) { unset($this->data[$r][$p]); } }
+			public function putMany(string $r, array $packs): void { foreach ($packs as $p => $e) { $this->put($r, (string)$p, $e); } }
+			public function replaceAll(string $r, array $packs): void { $this->replaced++; $this->data[$r] = $packs; }
+		};
+		$backend = new LocalBackend($this->tempDir());
+		$cipher = new \OCA\NgBackup\Crypto\StreamCipher(KeyRing::generate());
+		$index = new \OCA\NgBackup\Repository\BlobIndex($backend, $cipher);
+		$index->setCache($cache, 'r');
+		$blob = static fn (string $id, int $offset): array => ['id' => $id, 'offset' => $offset, 'length' => 10, 'raw' => 8, 'flags' => 0];
+		$index->addPack('pack1', [$blob('a', 0), $blob('shared', 10)]);
+		$index->addPack('pack2', [$blob('shared', 0), $blob('b', 10)]);
+		$cache->data = ['r' => ['gone' => [$blob('x', 0)]]];
+
+		$index->load(true);
+		$this->assertSame(1, $cache->replaced);
+		$this->assertSame(['pack1', 'pack2'], array_keys($cache->data['r']));
+		$this->assertCount(2, $cache->data['r']['pack1'], 'the shared blob stays in the row of its first pack');
+
+		// the second pack goes: the shared blob is still found in the first
+		$index->removePack('pack2');
+		$again = new \OCA\NgBackup\Repository\BlobIndex($backend, $cipher);
+		$again->setCache($cache, 'r');
+		$again->load();
+		$this->assertSame(0, $again->downloaded);
+		$this->assertSame('pack1', $again->get('shared')[0]);
+	}
 }
@@ -0,0 +1,174 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\NgBackup\Tests\Unit\Repository;
+
+use OCA\NgBackup\Backend\IBackend;
+use OCA\NgBackup\Backend\LocalBackend;
+use OCA\NgBackup\Crypto\KeyRing;
+use OCA\NgBackup\Repository\Repository;
+use OCA\NgBackup\Tests\Unit\TempDirTrait;
+use PHPUnit\Framework\TestCase;
+
+/** Restores and deep verifies read a pack as one stream instead of one request per blob. */
+class PackReadTest extends TestCase {
+	use TempDirTrait;
+
+	private string $root;
+	private KeyRing $keys;
+	private string $src;
+	private string $snapshot;
+
+	protected function setUp(): void {
+		$this->root = $this->tempDir();
+		$this->keys = KeyRing::generate();
+		$this->src = $this->tempDir();
+		for ($i = 0; $i < 200; $i++) {
+			file_put_contents(sprintf('%s/f%03d', $this->src, $i), random_bytes(20000));
+		}
+		$backend = new LocalBackend($this->root);
+		$repo = Repository::initWithKey($backend, $this->keys, $this->keys->wrap('pw'));
+		$this->snapshot = $repo->backupDirectory($this->src)['snapshot'];
+	}
+
+	private function open(PackOpenCountingBackend $backend): Repository {
+		return Repository::openWithKey($backend, $this->keys, null, null);
+	}
+
+	public function testFullRestoreOpensEachPackOnce(): void {
+		$backend = new PackOpenCountingBackend(new LocalBackend($this->root));
+		$target = $this->tempDir();
+
+		$this->assertSame(200, $this->open($backend)->restore($this->snapshot, $target));
+
+		for ($i = 0; $i < 200; $i++) {
+			$name = sprintf('f%03d', $i);
+			$this->assertSame(file_get_contents("$this->src/$name"), file_get_contents("$target/$name"));
+		}
+		// One pack: one stream instead of 200 requests.
+		$this->assertSame(1, $backend->packOpens());
+	}
+
+	public function testDeepVerifyOpensEachPackOnce(): void {
+		$backend = new PackOpenCountingBackend(new LocalBackend($this->root));
+
+		$result = $this->open($backend)->verify($this->snapshot, deep: true);
+
+		$this->assertSame(200 * 20000, $result['bytesChecked']);
+		$this->assertSame(1, $backend->packOpens());
+	}
+
+	public function testReadingBackwardsOpensThePackAgain(): void {
+		$backend = new PackOpenCountingBackend(new LocalBackend($this->root));
+		$repo = $this->open($backend);
+
+		$this->assertSame(1, $repo->restore($this->snapshot, $this->tempDir(), 'f150'));
+		$this->assertSame(1, $repo->restore($this->snapshot, $this->tempDir(), 'f050'));
+
+		$this->assertSame(2, $backend->packOpens());
+	}
+
+	public function testThePackStreamIsClosedBeforeAnyOtherRequest(): void {
+		$backend = new PackOpenCountingBackend(new LocalBackend($this->root));
+		$repo = $this->open($backend);
+		$this->assertSame(1, $repo->restore($this->snapshot, $this->tempDir(), 'f010'));
+		$this->assertTrue($backend->packStreamOpen(), 'kept open for the next read');
+
+		$repo->putObject('objects/after-restore', 'data');
+
+		$this->assertSame([false], $backend->packStreamOpenAtPut);
+	}
+
+	public function testAPackStreamThatCannotSeekIsReadUpToTheOffset(): void {
+		$backend = new PackOpenCountingBackend(new LocalBackend($this->root), $this->root);
+		$target = $this->tempDir();
+
+		$this->assertSame(1, $this->open($backend)->restore($this->snapshot, $target, 'f150'));
+
+		$this->assertSame(file_get_contents("$this->src/f150"), file_get_contents("$target/f150"));
+	}
+
+	public function testDeepVerifyOfATruncatedPackStillChecksTheBlobsBeforeTheDamage(): void {
+		$packs = (new LocalBackend($this->root))->list('packs');
+		$this->assertCount(1, $packs);
+		$pack = $this->root . '/' . $packs[0];
+		$fh = fopen($pack, 'r+b');
+		ftruncate($fh, intdiv(filesize($pack), 2));
+		fclose($fh);
+
+		$result = $this->open(new PackOpenCountingBackend(new LocalBackend($this->root)))->verify($this->snapshot, deep: true);
+
+		$this->assertGreaterThan(80 * 20000, $result['bytesChecked']);
+		$this->assertNotSame([], $result['unreadable']);
+		$this->assertSame([], $result['failed']);
+	}
+}
+
+final class PackOpenCountingBackend implements IBackend {
+	use \OCA\NgBackup\Backend\GetsOneByOne;
+
+	/** @var list<string> */
+	public array $gets = [];
+	/** @var list<bool> */
+	public array $packStreamOpenAtPut = [];
+	/** @var resource|null */
+	private $lastPackStream = null;
+
+	/** @param ?string $pipeFrom serve packs as pipes (streams that cannot seek) from this local repository root */
+	public function __construct(
+		private IBackend $inner,
+		private ?string $pipeFrom = null,
+	) {
+	}
+
+	public function packStreamOpen(): bool {
+		return is_resource($this->lastPackStream);
+	}
+
+	public function put(string $path, $stream): void {
+		$this->packStreamOpenAtPut[] = $this->packStreamOpen();
+		$this->inner->put($path, $stream);
+	}
+
+	public function packOpens(): int {
+		return count(array_filter($this->gets, fn (string $p): bool => str_starts_with($p, 'packs/')));
+	}
+
+	public function get(string $path) {
+		$this->gets[] = $path;
+		if (!str_starts_with($path, 'packs/')) {
+			return $this->inner->get($path);
+		}
+		$fh = $this->pipeFrom !== null
+			? popen('cat ' . escapeshellarg($this->pipeFrom . '/' . $path), 'r')
+			: $this->inner->get($path);
+		$this->lastPackStream = $fh;
+		return $fh;
+	}
+
+	public function getRange(string $path, int $offset, int $length): string {
+		$this->gets[] = $path;
+		return $this->inner->getRange($path, $offset, $length);
+	}
+
+	public function exists(string $path): bool {
+		return $this->inner->exists($path);
+	}
+
+	public function move(string $from, string $to): void {
+		$this->inner->move($from, $to);
+	}
+
+	public function list(string $prefix): array {
+		return $this->inner->list($prefix);
+	}
+
+	public function listFiles(string $dir): array {
+		return $this->inner->listFiles($dir);
+	}
+
+	public function delete(string $path): void {
+		$this->inner->delete($path);
+	}
+}
@@ -0,0 +1,109 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\NgBackup\Tests\Unit\Repository;
+
+use OCA\NgBackup\Backend\LocalBackend;
+use OCA\NgBackup\Crypto\KeyRing;
+use OCA\NgBackup\Repository\ICatalogAnchor;
+use OCA\NgBackup\Repository\Repository;
+use OCA\NgBackup\Repository\RepositoryException;
+use OCA\NgBackup\Tests\Unit\TempDirTrait;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Repository::recordUserExport/listUserExports/forgetUserExport: the catalog side of a
+ * user_migration export (see RepositoryExportDestination/RepositoryImportSource, which this
+ * does not exercise directly since they implement OCP\UserMigration interfaces not available to
+ * plain PHPUnit; that round trip is covered by tests/integration/user-roundtrip.sh instead).
+ */
+class UserExportTest extends TestCase {
+	use TempDirTrait;
+
+	private LocalBackend $backend;
+	private KeyRing $keys;
+	private ICatalogAnchor $anchor;
+	private string $root;
+
+	protected function setUp(): void {
+		$this->root = $this->tempDir();
+		$this->backend = new LocalBackend($this->root);
+		$this->keys = KeyRing::generate();
+		$this->anchor = new class implements ICatalogAnchor {
+			public array $data = [];
+			public function get(string $r): ?array { return $this->data[$r] ?? null; }
+			public function set(string $r, int $g, string $h): void { $this->data[$r] = ['gen' => $g, 'hash' => $h]; }
+		};
+	}
+
+	private function open(): Repository {
+		return Repository::openWithKey($this->backend, $this->keys, null, $this->anchor);
+	}
+
+	/** Stands in for an export destination's close(): a manifest object plus a catalog record. */
+	private function putManifest(Repository $repo, string $path): void {
+		$repo->putObject($path, json_encode(['uid' => 'alice']));
+		$repo->recordUserExport($path);
+	}
+
+	public function testRecordAndListSurviveAReopen(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'), $this->anchor);
+		$this->putManifest($repo, 'users/alice/20261005T120000Z-aaaa0001');
+
+		$again = $this->open();
+		$this->assertSame(['users/alice/20261005T120000Z-aaaa0001'], $again->listUserExports());
+		$this->assertSame(['users/alice/20261005T120000Z-aaaa0001'], $again->listUserExports('alice'));
+		$this->assertSame([], $again->listUserExports('bob'));
+	}
+
+	public function testListIsNewestFirst(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'), $this->anchor);
+		$this->putManifest($repo, 'users/alice/20261005T120000Z-aaaa0001');
+		$this->putManifest($repo, 'users/alice/20261006T120000Z-aaaa0002');
+
+		$this->assertSame(
+			['users/alice/20261006T120000Z-aaaa0002', 'users/alice/20261005T120000Z-aaaa0001'],
+			$repo->listUserExports('alice'),
+		);
+	}
+
+	public function testForgetRemovesItFromTheCatalogAndLocation(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'), $this->anchor);
+		$path = 'users/alice/20261005T120000Z-aaaa0001';
+		$this->putManifest($repo, $path);
+
+		$repo->forgetUserExport($path);
+
+		$this->assertSame([], $repo->listUserExports());
+		$this->assertFalse($this->backend->exists($path));
+	}
+
+	public function testForgetRejectsAPathNotInTheCatalog(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'), $this->anchor);
+		$this->expectException(RepositoryException::class);
+		$repo->forgetUserExport('users/nobody/not-a-real-export');
+	}
+
+	public function testIsRecordedUserExport(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'), $this->anchor);
+		$path = 'users/alice/20261005T120000Z-aaaa0001';
+		$this->putManifest($repo, $path);
+
+		$this->assertTrue($repo->isRecordedUserExport($path));
+		$this->assertFalse($repo->isRecordedUserExport('users/alice/not-the-real-one'));
+	}
+
+	public function testListingDetectsAManifestRemovedBehindItsBack(): void {
+		// A catalog-listed export whose object disappeared from the location (deleted or
+		// hidden outside NG Backup) must be detected, the same as a missing snapshot.
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'), $this->anchor);
+		$path = 'users/alice/20261005T120000Z-aaaa0001';
+		$this->putManifest($repo, $path);
+		$this->backend->delete($path);
+
+		$this->expectException(RepositoryException::class);
+		$this->expectExceptionMessage('missing on the location');
+		$repo->listUserExports();
+	}
+}
@@ -0,0 +1,345 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\NgBackup\Tests\Unit\Repository;
+
+use OCA\NgBackup\Backend\BackendException;
+use OCA\NgBackup\Backend\IBackend;
+use OCA\NgBackup\Backend\LocalBackend;
+use OCA\NgBackup\Crypto\KeyRing;
+use OCA\NgBackup\Repository\Repository;
+use OCA\NgBackup\Tests\Unit\TempDirTrait;
+use PHPUnit\Framework\TestCase;
+
+class VerifyTest extends TestCase {
+	use TempDirTrait;
+
+	private LocalBackend $backend;
+	private KeyRing $keys;
+	private string $root;
+	private string $src;
+
+	protected function setUp(): void {
+		$this->root = $this->tempDir();
+		$this->backend = new LocalBackend($this->root);
+		$this->keys = KeyRing::generate();
+		$this->src = $this->tempDir();
+		file_put_contents("$this->src/a", random_bytes(100000));
+		file_put_contents("$this->src/b", random_bytes(100000));
+	}
+
+	private function open(): Repository {
+		return Repository::openWithKey($this->backend, $this->keys, null, null);
+	}
+
+	public function testShallowVerifyPassesOnAHealthyRepository(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+
+		$result = $this->open()->verify($s['snapshot']);
+
+		$this->assertSame(2, $result['filesChecked']);
+		$this->assertGreaterThanOrEqual(1, $result['blobsChecked']);
+		$this->assertSame(0, $result['bytesChecked']); // not downloaded without --deep
+		$this->assertSame([], $result['missing']);
+		$this->assertSame([], $result['failed']);
+	}
+
+	public function testDeepVerifyDownloadsAndCountsBytes(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+
+		$result = $this->open()->verify($s['snapshot'], deep: true);
+
+		$this->assertSame(200000, $result['bytesChecked']);
+		$this->assertSame([], $result['missing']);
+		$this->assertSame([], $result['failed']);
+	}
+
+	public function testShallowVerifyDetectsAMissingPack(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		foreach ($this->backend->list('packs') as $pack) {
+			$this->backend->delete($pack);
+		}
+
+		$result = $this->open()->verify($s['snapshot']);
+
+		$this->assertNotSame([], $result['missing']);
+	}
+
+	public function testVerifyFailsOnAMissingDatabaseManifest(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$repo->writeSnapshot('snap-no-db', ['time' => gmdate('c'), 'db' => 'db/does-not-exist'], []);
+
+		$result = $this->open()->verify('snap-no-db');
+
+		$this->assertSame(['db/does-not-exist'], $result['missing']);
+	}
+
+	public function testVerifyReportsHowFarItIs(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$seen = [];
+
+		$open = $this->open();
+		$open->listPacksAbove = 0;
+		$open->verify($s['snapshot'], heartbeat: function (array $p) use (&$seen): void {
+			$seen[] = $p;
+		});
+
+		$phases = array_values(array_unique(array_column($seen, 'phase')));
+		$this->assertSame(['index', 'packs', 'files'], $phases);
+		$this->assertSame(['phase' => 'packs', 'done' => 256, 'total' => 256], $seen[array_key_last(array_filter($seen, fn ($p) => $p['phase'] === 'packs'))]);
+		$last = end($seen);
+		$this->assertSame(2, $last['done']);
+		$this->assertNull($last['total'], 'this snapshot has no file count in its metadata (a backup run records one)');
+	}
+
+	/** Lists the pack folders however few packs there are. */
+	private static function listing(Repository $repo): Repository {
+		$repo->listPacksAbove = 0;
+		return $repo;
+	}
+
+	public function testWithNoMorePacksThanFoldersEveryPackIsCheckedInstead(): void {
+		// fewer requests; on FTP each takes a data connection, of which a server may have few
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$counting = new ListingBackend($this->backend);
+
+		$result = Repository::openWithKey($counting, $this->keys, null, null)->verify($s['snapshot']);
+
+		$this->assertSame([], $result['missing']);
+		$this->assertSame(0, $counting->packListings);
+		$this->assertGreaterThan(0, $counting->packExists);
+	}
+
+	public function testVerifyListsPackFoldersInsteadOfCheckingEveryPack(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$counting = new ListingBackend($this->backend);
+
+		$result = self::listing(Repository::openWithKey($counting, $this->keys, null, null))->verify($s['snapshot']);
+
+		$this->assertSame([], $result['missing']);
+		$this->assertSame(0, $counting->packExists);
+	}
+
+	public function testAPackFolderThatCannotBeListedIsCheckedPackByPack(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$counting = new ListingBackend($this->backend, unlistable: true);
+
+		$result = self::listing(Repository::openWithKey($counting, $this->keys, null, null))->verify($s['snapshot']);
+
+		$this->assertSame([], $result['missing']);
+		$this->assertGreaterThan(0, $counting->packExists);
+	}
+
+	public function testAnEmptyFolderListingIsNoProofThatItsPacksAreGone(): void {
+		// A storage also reports an empty folder when it could not look (is_dir() false).
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$counting = new ListingBackend($this->backend, emptyListings: true);
+
+		$result = self::listing(Repository::openWithKey($counting, $this->keys, null, null))->verify($s['snapshot']);
+
+		$this->assertSame([], $result['missing']);
+		$this->assertGreaterThan(0, $counting->packExists);
+	}
+
+	public function testAPackMissingFromAFolderThatIsNotEmptyIsReportedWithoutAskingForIt(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$packs = $this->backend->list('packs');
+		// Another file in the same folder keeps its listing non-empty.
+		$this->backend->put(dirname($packs[0]) . '/0000other', fopen('data://text/plain,x', 'r'));
+		foreach ($packs as $pack) {
+			$this->backend->delete($pack);
+		}
+		$counting = new ListingBackend($this->backend);
+
+		$result = self::listing(Repository::openWithKey($counting, $this->keys, null, null))->verify($s['snapshot']);
+
+		$this->assertNotSame([], $result['missing']);
+		$this->assertSame(0, $counting->packExists);
+	}
+
+	public function testAPackMissingFromAnEmptyFolderIsReportedToo(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		foreach ($this->backend->list('packs') as $pack) {
+			$this->backend->delete($pack);
+		}
+
+		$result = self::listing(Repository::openWithKey(new ListingBackend($this->backend), $this->keys, null, null))->verify($s['snapshot']);
+
+		$this->assertNotSame([], $result['missing']);
+	}
+
+	public function testDeepVerifyDetectsATamperedPack(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$packs = $this->backend->list('packs');
+		$this->assertNotEmpty($packs);
+		$path = $this->root . '/' . $packs[0];
+		$bytes = file_get_contents($path);
+		// Flip a byte well inside the file, away from any header, so decryption's own
+		// authentication tag catches it (this must fail loudly, not just "do nothing").
+		$bytes[(int)(strlen($bytes) / 2)] = chr(~ord($bytes[(int)(strlen($bytes) / 2)]) & 0xFF);
+		file_put_contents($path, $bytes);
+
+		$result = $this->open()->verify($s['snapshot'], deep: true);
+
+		$this->assertNotSame([], $result['failed']);
+	}
+
+	public function testDeepVerifyRetriesAReadThatFailsOnce(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$flaky = new FlakyRangeBackend($this->backend, failures: 1);
+
+		$result = Repository::openWithKey($flaky, $this->keys, null, null)->verify($s['snapshot'], deep: true);
+
+		$this->assertSame(200000, $result['bytesChecked']);
+		$this->assertSame([], $result['failed']);
+		$this->assertSame([], $result['unreadable']);
+	}
+
+	public function testDeepVerifyReportsAPersistentReadErrorAsUnreadableNotCorrupted(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$broken = new FlakyRangeBackend($this->backend, failures: PHP_INT_MAX);
+
+		$result = Repository::openWithKey($broken, $this->keys, null, null)->verify($s['snapshot'], deep: true);
+
+		$this->assertSame([], $result['failed']);
+		$this->assertNotSame([], $result['unreadable']);
+		$this->assertSame('connection reset', $result['readError']);
+	}
+
+	public function testDeepVerifyDoesNotHideAProgrammingError(): void {
+		$repo = Repository::initWithKey($this->backend, $this->keys, $this->keys->wrap('pw'));
+		$s = $repo->backupDirectory($this->src);
+		$buggy = new FlakyRangeBackend($this->backend, failures: PHP_INT_MAX, error: new \TypeError('bug'));
+
+		$this->expectException(\TypeError::class);
+		Repository::openWithKey($buggy, $this->keys, null, null)->verify($s['snapshot'], deep: true);
+	}
+}
+
+/** Delegates to a real backend, but reading a pack throws for the first $failures reads. */
+final class FlakyRangeBackend implements IBackend {
+	use \OCA\NgBackup\Backend\GetsOneByOne;
+
+	public function __construct(
+		private IBackend $inner,
+		private int $failures,
+		private ?\Throwable $error = null,
+	) {
+	}
+
+	public function put(string $path, $stream): void {
+		$this->inner->put($path, $stream);
+	}
+
+	public function get(string $path) {
+		if (str_starts_with($path, 'packs/')) {
+			$this->fail();
+		}
+		return $this->inner->get($path);
+	}
+
+	public function getRange(string $path, int $offset, int $length): string {
+		$this->fail();
+		return $this->inner->getRange($path, $offset, $length);
+	}
+
+	private function fail(): void {
+		if ($this->failures > 0) {
+			$this->failures--;
+			throw $this->error ?? new BackendException('connection reset');
+		}
+	}
+
+	public function exists(string $path): bool {
+		return $this->inner->exists($path);
+	}
+
+	public function move(string $from, string $to): void {
+		$this->inner->move($from, $to);
+	}
+
+	public function list(string $prefix): array {
+		return $this->inner->list($prefix);
+	}
+
+	public function listFiles(string $dir): array {
+		return $this->inner->listFiles($dir);
+	}
+
+	public function delete(string $path): void {
+		$this->inner->delete($path);
+	}
+}
+
+/** Delegates to a real backend; counts exists() on packs, and can refuse to list pack folders. */
+final class ListingBackend implements IBackend {
+	use \OCA\NgBackup\Backend\GetsOneByOne;
+
+	public int $packExists = 0;
+	public int $packListings = 0;
+
+	public function __construct(
+		private IBackend $inner,
+		private bool $unlistable = false,
+		private bool $emptyListings = false,
+	) {
+	}
+
+	public function put(string $path, $stream): void {
+		$this->inner->put($path, $stream);
+	}
+
+	public function get(string $path) {
+		return $this->inner->get($path);
+	}
+
+	public function getRange(string $path, int $offset, int $length): string {
+		return $this->inner->getRange($path, $offset, $length);
+	}
+
+	public function exists(string $path): bool {
+		if (str_starts_with($path, 'packs/')) {
+			$this->packExists++;
+		}
+		return $this->inner->exists($path);
+	}
+
+	public function move(string $from, string $to): void {
+		$this->inner->move($from, $to);
+	}
+
+	public function list(string $prefix): array {
+		return $this->inner->list($prefix);
+	}
+
+	public function listFiles(string $dir): array {
+		if (str_starts_with($dir, 'packs/')) {
+			$this->packListings++;
+		}
+		if ($this->unlistable && str_starts_with($dir, 'packs/')) {
+			throw new BackendException('Cannot list ' . $dir);
+		}
+		if ($this->emptyListings && str_starts_with($dir, 'packs/')) {
+			return [];
+		}
+		return $this->inner->listFiles($dir);
+	}
+
+	public function delete(string $path): void {
+		$this->inner->delete($path);
+	}
+}
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+// SPDX-FileCopyrightText: 2026 Dillard Blom
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+namespace OCA\NgBackup\Tests\Unit\Service;
+
+use OCA\NgBackup\Service\LeaseService;
+use PHPUnit\Framework\TestCase;
+
+final class LeaseThrottleTest extends TestCase {
+	public function testRefreshesOnlyOncePerInterval(): void {
+		$calls = 0;
+		$beat = LeaseService::throttled(function () use (&$calls): void {
+			$calls++;
+		}, 3600);
+		for ($i = 0; $i < 1000; $i++) {
+			$beat();
+		}
+		$this->assertSame(0, $calls, 'no refresh before the interval has passed');
+	}
+
+	public function testRefreshesEveryCallWithZeroInterval(): void {
+		$calls = 0;
+		$beat = LeaseService::throttled(function () use (&$calls): void {
+			$calls++;
+		}, 0);
+		for ($i = 0; $i < 5; $i++) {
+			$beat();
+		}
+		$this->assertSame(5, $calls);
+	}
+}
@@ -3,3 +3,13 @@
 declare(strict_types=1);

 require __DIR__ . '/../vendor/autoload.php';
+
+// nextcloud/ocp ships the public interfaces without an autoloader; tests that mock them need one.
+spl_autoload_register(static function (string $class): void {
+	if (str_starts_with($class, 'OCP\\')) {
+		$file = __DIR__ . '/../vendor/nextcloud/ocp/' . str_replace('\\', '/', $class) . '.php';
+		if (is_file($file)) {
+			require $file;
+		}
+	}
+});
@@ -0,0 +1,86 @@
+#!/bin/bash
+# Disaster recovery: occ backup:key:import + backup:target:add + backup:restore:full on a
+# SECOND, fresh Nextcloud instance that never saw the first one, sharing only the backup
+# location (a local directory, bind-mounted into both containers) -- see PLAN.md 3.7.
+# Usage: full-restore-roundtrip.sh <nextcloud-image-tag>
+#   e.g. full-restore-roundtrip.sh 35-apache
+set -euo pipefail
+IMAGE="nextcloud:${1:-35-apache}"
+APP=$(cd "$(dirname "$0")/../.." && pwd)
+NET=ngb-frt-net
+SHARED=$(mktemp -d)
+chmod 777 "$SHARED"
+fail() { echo "FAIL: $*"; exit 1; }
+ok() { echo "ok   $*"; }
+
+cleanup() {
+	docker rm -fv ngb-frt-origin ngb-frt-restore >/dev/null 2>&1 || true
+	docker network rm "$NET" >/dev/null 2>&1 || true
+	docker run --rm -v "$SHARED:/target" alpine sh -c 'rm -rf /target/*' >/dev/null 2>&1 || true
+	rmdir "$SHARED" 2>/dev/null || true
+	rm -f /tmp/ngb-frt-kit.json /tmp/ngb-frt-pass
+}
+trap cleanup EXIT
+
+run_on() { docker exec -u www-data "$1" php occ "${@:2}"; }
+
+docker network create "$NET" >/dev/null
+docker run -d --name ngb-frt-origin --network "$NET" -e SQLITE_DATABASE=nextcloud \
+	-e NEXTCLOUD_ADMIN_USER=admin -e NEXTCLOUD_ADMIN_PASSWORD=admin \
+	-v "$APP:/var/www/html/custom_apps/ng_backup:ro" -v "$SHARED:/mnt/shared" "$IMAGE" >/dev/null
+for i in $(seq 1 90); do run_on ngb-frt-origin status 2>/dev/null | grep -q "installed: true" && break; sleep 3; done
+docker exec ngb-frt-origin chown www-data:www-data /var/www/html/custom_apps
+run_on ngb-frt-origin app:enable ng_backup >/dev/null
+ok "origin instance up"
+
+docker exec ngb-frt-origin sh -c "printf 'full restore roundtrip passphrase 2026\n' > /tmp/pass"
+run_on ngb-frt-origin backup:key:init --passphrase-file=/tmp/pass --label=CI >/dev/null || fail "key init"
+run_on ngb-frt-origin backup:key:kit --output=/tmp/kit.json >/dev/null
+CODE=$(run_on ngb-frt-origin backup:key:kit | php -r 'echo json_decode(stream_get_contents(STDIN), true)["confirmation_code"];')
+run_on ngb-frt-origin backup:key:confirm -u admin --code="$CODE" --confirm="Yes, I confirm" >/dev/null || fail "confirm"
+run_on ngb-frt-origin backup:target:add offsite local -a null::null -o datadir=/mnt/shared --path=repo >/dev/null || fail "target add"
+ok "key, kit and location on the origin"
+
+NC_PASS=$(openssl rand -hex 16)
+docker exec -u www-data -e OC_PASS="$NC_PASS" ngb-frt-origin php occ user:add --password-from-env frtest >/dev/null
+docker exec ngb-frt-origin sh -c "mkdir -p /var/www/html/data/frtest/files/Docs && head -c 200000 /dev/urandom > /var/www/html/data/frtest/files/Docs/report.bin && echo 'hello disaster recovery' > /var/www/html/data/frtest/files/Docs/note.txt && chown -R www-data:www-data /var/www/html/data/frtest"
+run_on ngb-frt-origin files:scan frtest >/dev/null
+RUN_OUT=$(run_on ngb-frt-origin backup:run offsite -l disaster-test)
+SNAP=$(printf '%s\n' "$RUN_OUT" | head -1 | awk -F'snapshot ' '{print $2}' | tr -d ',')
+[ -n "$SNAP" ] || fail "no snapshot id from backup:run"
+ok "test data backed up, snapshot $SNAP"
+
+docker cp ngb-frt-origin:/tmp/kit.json /tmp/ngb-frt-kit.json
+docker exec ngb-frt-origin sh -c "cat /tmp/pass" > /tmp/ngb-frt-pass
+docker run -d --name ngb-frt-restore --network "$NET" -e SQLITE_DATABASE=nextcloud \
+	-e NEXTCLOUD_ADMIN_USER=admin -e NEXTCLOUD_ADMIN_PASSWORD=admin \
+	-v "$APP:/var/www/html/custom_apps/ng_backup:ro" -v "$SHARED:/mnt/shared" "$IMAGE" >/dev/null
+for i in $(seq 1 90); do run_on ngb-frt-restore status 2>/dev/null | grep -q "installed: true" && break; sleep 3; done
+docker exec ngb-frt-restore chown www-data:www-data /var/www/html/custom_apps
+run_on ngb-frt-restore app:enable ng_backup >/dev/null
+docker cp /tmp/ngb-frt-kit.json ngb-frt-restore:/tmp/kit.json
+docker exec ngb-frt-restore chmod 644 /tmp/kit.json
+docker cp /tmp/ngb-frt-pass ngb-frt-restore:/tmp/pass
+ok "fresh restore instance up"
+
+run_on ngb-frt-restore backup:key:import /tmp/kit.json --passphrase-file=/tmp/pass >/dev/null || fail "key import"
+run_on ngb-frt-restore backup:target:add offsite local -a null::null -o datadir=/mnt/shared --path=repo >/dev/null || fail "target add on the restore instance"
+run_on ngb-frt-restore backup:list offsite | grep -q "$SNAP" || fail "the origin's snapshot is not listed after connecting the location"
+ok "recovery kit imported, existing repository adopted, snapshot visible"
+
+run_on ngb-frt-restore backup:restore:full offsite "$SNAP" --no-interaction >/dev/null || fail "restore:full"
+ok "backup:restore:full completed"
+
+# Everything below must work in a FRESH occ process (a new PHP process per docker exec), since
+# earlier bugs here only showed up after config.php's secret was rewritten mid-restore.
+run_on ngb-frt-restore backup:status >/dev/null || fail "backup:status fails after restore (own key/target undecryptable?)"
+run_on ngb-frt-restore user:list | grep -q frtest || fail "the backed-up user is missing from the restored database"
+docker exec ngb-frt-restore test -f /var/www/html/data/frtest/files/Docs/note.txt || fail "restored file is missing"
+[ "$(docker exec ngb-frt-restore cat /var/www/html/data/frtest/files/Docs/note.txt)" = "hello disaster recovery" ] || fail "restored file content differs"
+run_on ngb-frt-restore files:scan frtest >/dev/null || fail "files:scan fails after restore"
+ok "database, files and ng_backup's own state are all intact and usable after the restore"
+
+run_on ngb-frt-restore backup:run offsite -l post-restore-check >/dev/null || fail "a new backup after the restore fails"
+ok "the restored instance can run a new backup of its own"
+
+echo "FULL RESTORE ROUNDTRIP PASS"
@@ -49,6 +49,11 @@ SUM_AFTER=$($X sh -c "cd $DATA/$U/files && find . -type f -print0 | sort -z | xa
 $X sh -c "ls $DATA/$U/files_trashbin/files/ | grep -q '^extra.txt'" || fail "extra file not in trash"
 ok "restore new-folder and replace: files identical, extra file in the trash"

+# Checksum audit: shallow (index presence) and deep (download, decrypt, verify every blob).
+occ backup:verify ci "$SNAP" | grep -q "^OK$" || fail "shallow verify"
+occ backup:verify ci "$SNAP" --deep | grep -q "^OK$" || fail "deep verify"
+ok "shallow and deep checksum audit"
+
 # Database dump/restore round trip (all tables, checksums, sequences on PostgreSQL).
 $X php -d memory_limit=512M "$APPS/ng_backup/spikes/03-db-dump.php" /tmp/ngb-rt-db | grep "ALL PASS" >/dev/null || fail "database round trip"
 ok "database dump and restore"
@@ -1,17 +1,25 @@
 #!/bin/bash
-# Round trip of NG Backup against real S3 (s3mock) and SFTP backends, through files_external's own
-# backend/auth classes, same as a production location would use. Backend correctness does not
-# depend on the Nextcloud version or database, so this runs once (not matrixed across NC/DB),
-# on a recent Nextcloud with sqlite. Each backend gets its own fresh Nextcloud container, since
-# NG Backup's key can only be initialised once per instance.
+# Round trip of NG Backup against real S3 (s3mock), SFTP, FTP and SMB backends, through
+# files_external's own backend/auth classes, same as a production location would use. Backend
+# correctness does not depend on the Nextcloud version or database, so this runs once (not
+# matrixed across NC/DB), on a recent Nextcloud with sqlite. Each backend gets its own fresh
+# Nextcloud container, since NG Backup's key can only be initialised once per instance.
 # Usage: tests/integration/targets-matrix.sh [nextcloud-version]
 set -euo pipefail
 V=${1:-35}
 APP=$(cd "$(dirname "$0")/../.." && pwd)
 NET=ngb-targets-net
+SMB_IMAGE=ngb-targets-smb-nc
+SMB_BUILD_DIR=$(mktemp -d)
 RESULTS=()

-cleanup() { docker rm -fv ngb-targets-nc-s3 ngb-targets-nc-sftp ngb-targets-s3 ngb-targets-sftp >/dev/null 2>&1; docker network rm "$NET" >/dev/null 2>&1; }
+cleanup() {
+  docker rm -fv ngb-targets-nc-s3 ngb-targets-nc-sftp ngb-targets-nc-ftp ngb-targets-nc-smb \
+    ngb-targets-s3 ngb-targets-sftp ngb-targets-ftp ngb-targets-smb >/dev/null 2>&1 || true
+  docker rmi "$SMB_IMAGE" >/dev/null 2>&1 || true
+  docker network rm "$NET" >/dev/null 2>&1 || true
+  rm -rf "$SMB_BUILD_DIR"
+}
 trap cleanup EXIT

 wait_tcp() { # host port
@@ -19,11 +27,11 @@ wait_tcp() { # host port
    || { echo "FAIL: $1:$2 never came up"; exit 1; }
 }

-start_nc() { # container-name
+start_nc() { # container-name [image]
  docker run -d --name "$1" --network "$NET" \
    -e NEXTCLOUD_ADMIN_USER=admin -e NEXTCLOUD_ADMIN_PASSWORD=admin-targets-pw -e NEXTCLOUD_TRUSTED_DOMAINS=localhost \
    -e SQLITE_DATABASE=nextcloud \
-    -v "$APP:/var/www/html/custom_apps/ng_backup:ro" nextcloud:$V-apache >/dev/null
+    -v "$APP:/var/www/html/custom_apps/ng_backup:ro" "${2:-nextcloud:$V-apache}" >/dev/null
  for i in $(seq 1 90); do docker exec -u www-data "$1" php occ status 2>/dev/null | grep -q "installed: true" && break; sleep 4; done
  docker exec "$1" chown www-data:www-data /var/www/html/custom_apps
  echo "=== NC $V / sqlite ($1): $(docker exec -u www-data "$1" php occ -V 2>/dev/null)"
@@ -51,8 +59,37 @@ docker run -d --name ngb-targets-s3 --network "$NET" \
 docker run -d --name ngb-targets-sftp --network "$NET" \
  atmoz/sftp ngbackup:ngbackuppw:::upload >/dev/null

+# stilliard/pure-ftpd: delfer/alpine-ftp-server (vsftpd) was tried first and rejects the absolute
+# paths files_external's FTP backend always builds, inside this server's chroot specifically --
+# not a files_external bug (confirmed with plain php ftp_mkdir()), but pure-ftpd sidesteps it.
+docker run -d --name ngb-targets-ftp --network "$NET" \
+  -e "FTP_USER_NAME=ngbackup" -e "FTP_USER_PASS=ngbackuppw" -e "FTP_USER_HOME=/home/ngbackup" \
+  -e "PUBLICHOST=ngb-targets-ftp" \
+  stilliard/pure-ftpd >/dev/null
+
+# dperson/samba. The *native* smbclient PECL extension is required: files_external's shell-based
+# fallback (just the smbclient CLI binary) still registers this backend, but its stream cannot
+# seek, and ng_backup reads blobs back by byte range while backing up -- confirmed live, that
+# fallback fails the very first (small) backup with "Seek failed in packs/...". The extension is
+# not in the stock nextcloud image (needs libsmbclient-dev + a compile), so this backend gets its
+# own small image, built once here, in its own directory (never /tmp directly: that would send
+# every unrelated file under /tmp to the docker daemon as build context).
+cat > "$SMB_BUILD_DIR/Dockerfile" <<EOF
+FROM nextcloud:$V-apache
+RUN apt-get update -qq && apt-get install -y -qq libsmbclient-dev >/dev/null \\
+  && pecl install smbclient >/dev/null 2>&1 \\
+  && docker-php-ext-enable smbclient \\
+  && apt-get clean
+EOF
+docker build -q -t "$SMB_IMAGE" "$SMB_BUILD_DIR" >/dev/null
+docker run -d --name ngb-targets-smb --network "$NET" \
+  -e USERID=1000 -e GROUPID=1000 \
+  dperson/samba -p -u "ngbackup;ngbackuppw" -s "backup;/share;yes;no;no;ngbackup" >/dev/null
+
 wait_tcp ngb-targets-s3 9090
 wait_tcp ngb-targets-sftp 22
+wait_tcp ngb-targets-ftp 21
+wait_tcp ngb-targets-smb 445

 start_nc ngb-targets-nc-s3
 run "S3 (s3mock)" ngb-targets-nc-s3 "amazons3 -a amazons3::accesskey -o bucket=ngbackups -o hostname=ngb-targets-s3 -o port=9090 -o region=us-east-1 -o use_ssl=false -o use_path_style=true -o key=test -o secret=test"
@@ -60,6 +97,12 @@ run "S3 (s3mock)" ngb-targets-nc-s3 "amazons3 -a amazons3::accesskey -o bucket=n
 start_nc ngb-targets-nc-sftp
 run "SFTP" ngb-targets-nc-sftp "sftp -a password::password -o host=ngb-targets-sftp -o root=/upload -o user=ngbackup -o password=ngbackuppw"

+start_nc ngb-targets-nc-ftp
+run "FTP" ngb-targets-nc-ftp "ftp -a password::password -o host=ngb-targets-ftp -o user=ngbackup -o password=ngbackuppw"
+
+start_nc ngb-targets-nc-smb "$SMB_IMAGE"
+run "SMB" ngb-targets-nc-smb "smb -a password::password -o host=ngb-targets-smb -o share=backup -o user=ngbackup -o password=ngbackuppw"
+
 printf '%s\n' "${RESULTS[@]}"
 printf '%s\n' "${RESULTS[@]}" | grep -q FAIL && exit 1
 exit 0
@@ -0,0 +1,72 @@
+#!/bin/bash
+# Per-user backup/restore round trip via user_migration (optional dependency, see PLAN.md 3.8):
+# occ backup:user:backup / occ backup:user:restore --mode=as-backup|replace.
+# Usage: user-roundtrip.sh "<command prefix to run occ/php as the web user>" <datadir> [target-args]
+#   e.g. user-roundtrip.sh "docker exec -u www-data ngb-nc35-pgsql" /var/www/html/data
+set -euo pipefail
+X="$1"; DATA="$2"
+TARGET_ARGS="${3:-local -a null::null -o datadir=/tmp/ngb-urt-target}"
+occ() { $X php occ "$@"; }
+fail() { echo "FAIL: $*"; exit 1; }
+ok() { echo "ok   $*"; }
+U=ngbutest-$RANDOM
+
+occ app:enable ng_backup >/dev/null
+if ! occ app:install user_migration >/dev/null 2>&1 && ! occ app:enable user_migration >/dev/null 2>&1; then
+	echo "SKIP: user_migration is not available (no network, or the app store is unreachable) -- per-user backup/restore not tested"
+	exit 0
+fi
+sleep 8 # APCu app config cache
+
+$X sh -c "printf 'user roundtrip passphrase 2026\n' > /tmp/ngb-urt-pass && mkdir -p /tmp/ngb-urt-target"
+occ backup:key:init --passphrase-file=/tmp/ngb-urt-pass --label=CI --delete-delay-days=7 >/dev/null || fail "key init"
+CODE=$(occ backup:key:kit | php -r 'echo json_decode(stream_get_contents(STDIN), true)["confirmation_code"];')
+occ backup:key:confirm -u admin --code="$CODE" --confirm="Yes, I confirm" >/dev/null || fail "confirm"
+ok "key, kit code and confirmation"
+
+occ backup:target:add ci $TARGET_ARGS --path=repo >/dev/null || fail "target add"
+ok "location added"
+
+$X sh -c "OC_PASS='User-roundtrip-pw-2026' php occ user:add --password-from-env $U >/dev/null"
+$X sh -c "mkdir -p $DATA/$U/files/Docs && for i in 1 2 3; do head -c 100000 /dev/urandom > $DATA/$U/files/Docs/f\$i.bin; done"
+occ files:scan "$U" >/dev/null
+SUM_BEFORE=$($X sh -c "cd $DATA/$U/files && find . -type f -print0 | sort -z | xargs -0 md5sum | md5sum")
+
+MANIFEST=$(occ backup:user:backup ci "$U" | sed -n 's/.* to \(.*\)\.$/\1/p')
+[ -n "$MANIFEST" ] || fail "backup:user:backup printed no manifest path"
+ok "backed up $U to $MANIFEST"
+
+# as-backup: restore into <uid>-bak; the original account must stay untouched.
+occ backup:user:restore ci "$MANIFEST" --mode=as-backup >/dev/null || fail "restore as-backup"
+occ files:scan "$U-bak" >/dev/null
+SUM_BAK=$($X sh -c "cd $DATA/$U-bak/files && find . -type f -print0 | sort -z | xargs -0 md5sum | md5sum")
+[ "$SUM_BEFORE" = "$SUM_BAK" ] || fail "the <uid>-bak account's files differ from the original"
+occ user:delete "$U-bak" >/dev/null
+$X sh -c "[ -d '$DATA/$U/files/Docs' ]" || fail "the original account should be untouched by an as-backup restore"
+ok "as-backup restores into <uid>-bak, byte-identical, original account untouched"
+
+# replace: damage the account, then restore it in place under the same uid.
+$X sh -c "rm '$DATA/$U/files/Docs/f1.bin' && echo damaged > '$DATA/$U/files/Docs/f1.bin'"
+occ files:scan "$U" >/dev/null
+if occ backup:user:restore ci "$MANIFEST" --mode=replace --no-interaction >/dev/null 2>&1; then fail "replace of an existing account ran without --force"; fi
+occ backup:user:restore ci "$MANIFEST" --mode=replace --force >/dev/null || fail "restore replace"
+occ files:scan "$U" >/dev/null
+SUM_AFTER=$($X sh -c "cd $DATA/$U/files && find . -type f -print0 | sort -z | xargs -0 md5sum | md5sum")
+[ "$SUM_BEFORE" = "$SUM_AFTER" ] || fail "files differ after a replace restore"
+ok "replace restores the original content under the same uid, byte-identical"
+
+# Retention: $U now has the manual export above plus the automatic safety-export the replace
+# restore made of it just before deleting it (4 total after these two more), then --user-last=2
+# must forget exactly the 2 oldest.
+sleep 1.1 # exportId is time-based to the second; force each one to be distinct
+occ backup:user:backup ci "$U" >/dev/null || fail "third backup:user:backup"
+sleep 1.1
+occ backup:user:backup ci "$U" >/dev/null || fail "fourth backup:user:backup"
+occ backup:retention --user-last=2 >/dev/null || fail "retention --user-last"
+PRUNE_OUT=$(occ backup:prune ci)
+echo "$PRUNE_OUT" | grep -q "forgot 2 user export(s) for 1 user(s)" || fail "prune did not forget the expected two user exports"
+ok "user-export retention forgets exactly the exports over the keep count"
+
+occ user:delete "$U" >/dev/null
+$X sh -c "rm -rf /tmp/ngb-urt-target /tmp/ngb-urt-pass"
+echo "USER ROUNDTRIP PASS"