Plan: release stages and version numbers

- tests/integration/roundtrip.sh: key, kit code and confirmation,
  location, full and unchanged incremental backup, restore new-folder and
  replace (files identical, extra file in the trash), database dump and
  restore, retention, trash and restore from trash, no files_external
  errors in the log
- tests/integration/matrix.sh: fresh Nextcloud per version and database
  (SQLite, MariaDB, PostgreSQL), removes only its own containers and
  their volumes; locally green on NC32 and NC35 with all three databases
- GitHub Actions: unit tests on PHP 8.2-8.4, round trip on NC32-35 x
  SQLite/MariaDB/PostgreSQL

Fixes found by the matrix:
- files_external is no longer booted when it is disabled: only its
  classes are loaded and a private BackendService gets its backends from
  its Application class (booting registered its mount provider, which
  failed on installations where its tables were never created)
- SQLite: the database file is excluded from the file backup (it is
  covered by the logical dump and copying the live file is inconsistent)
- occ backup:key:confirm accepts --code and --confirm for scripts

.github/workflows/ci.yml

@@ -17,8 +17,6 @@ jobs:
         php: ['8.2', '8.3', '8.4']
     steps:
       - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
       - uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php }}
@@ -27,20 +25,6 @@ jobs:
       - run: composer install --no-interaction --no-progress
       - run: vendor/bin/phpunit -c tests/phpunit.xml
 
-  psalm:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.2'
-          extensions: sodium, zip
-          coverage: none
-      - run: composer install --no-interaction --no-progress
-      - run: composer psalm
-
   integration:
     # Full round trip (key, kit, location, backup, incremental, restore modes, database dump and
     # restore, retention, trash) on a fresh Nextcloud per version and database.
@@ -52,55 +36,5 @@ jobs:
         database: ['sqlite', 'mariadb', 'pgsql']
     steps:
       - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
       - name: Round trip on Nextcloud ${{ matrix.nextcloud }} / ${{ matrix.database }}
         run: tests/integration/matrix.sh "${{ matrix.nextcloud }}" "${{ matrix.database }}"
-
-  integration-targets:
-    # Same round trip, but through the real S3 (s3mock) and SFTP backends instead of a local
-    # path, so files_external's AmazonS3/SFTP backend and auth classes are actually exercised.
-    # Backend correctness does not depend on the Nextcloud version or database, so this runs once.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: Round trip against S3 and SFTP
-        run: tests/integration/targets-matrix.sh
-
-  integration-user:
-    # Per-user backup/restore via user_migration (occ backup:user:backup / backup:user:restore),
-    # an optional dependency installed from the app store. It calls user_migration's internal
-    # UserMigrationService, whose API can change between Nextcloud versions, so this runs on every
-    # supported version (not the database, which the main integration job already covers).
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        nextcloud: ['32', '33', '34', '35']
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: Set up a fresh Nextcloud instance
-        run: |
-          docker run -d --name ngbu -e SQLITE_DATABASE=nextcloud -e NEXTCLOUD_ADMIN_USER=admin \
-            -e NEXTCLOUD_ADMIN_PASSWORD=admin-user-roundtrip -e NEXTCLOUD_TRUSTED_DOMAINS=localhost \
-            -v "$PWD:/var/www/html/custom_apps/ng_backup:ro" nextcloud:${{ matrix.nextcloud }}-apache
-          for i in $(seq 1 90); do docker exec -u www-data ngbu php occ status 2>/dev/null | grep -q "installed: true" && break; sleep 4; done
-          docker exec ngbu chown www-data:www-data /var/www/html/custom_apps
-      - name: Per-user backup/restore round trip on Nextcloud ${{ matrix.nextcloud }}
-        run: tests/integration/user-roundtrip.sh "docker exec -u www-data ngbu" /var/www/html/data
-
-  integration-full-restore:
-    # Disaster recovery (occ backup:restore:full) on a SECOND, fresh Nextcloud instance that
-    # never saw the first one, sharing only the backup location. Does not depend on the database
-    # beyond what the main integration job already covers, so this runs once, on one NC version.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: Full restore round trip
-        run: tests/integration/full-restore-roundtrip.sh 35-apache

.gitignore

@@ -1,10 +1,7 @@
 /build/
-cred-*
-*credentials*
 /css/
 /js/
 /node_modules/
 .phpunit.result.cache
-*.secret
 /spikes/out/
 /vendor/

CHANGELOG.md

@@ -1,128 +0,0 @@
-# Changelog
-
-All notable changes to NG Backup are documented here. The format follows
-[Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning follows the stages in
-`PLAN.md` section 9. The `<version>` in `appinfo/info.xml` is plain SemVer-numeric on purpose:
-the app store accepts a `-beta` suffix, but Nextcloud servers then only offer the release on the
-beta/daily update channel, which would hide the app from most admins. The stability stage is
-instead carried by the app description, the git tag, the release, and this file.
-
-## [0.9.2-beta.3] - 2026-10-08
-
-Bugfix release.
-
-### Added
-- README: notes on using a Hetzner Storage Box over WebDAV and SMB.
-
-### Fixed
-- Adding a backup location in the web interface failed with "Request failed with status code 403"
-  when the login was more than 30 minutes old: the form did not ask for password confirmation.
-- Settings page: the "Backup and restore" / "Settings" tabs line up with the sections below them.
-- Backups: the runs table scrolls horizontally on narrow screens instead of running off the page.
-- `occ backup:verify --deep`: a blob that could not be read (network or storage error) was reported
-  as "corrupted or tampered". Reads are now retried, and a read that keeps failing is reported
-  separately as unreadable, with the error (run the check again; if the same blobs stay unreadable,
-  their pack may be damaged or truncated). Only a blob that was read but fails decryption or its
-  hash check counts as corrupted. Found on a Hetzner Storage Box over WebDAV, where the blob
-  turned out to be intact.
-
-## [0.9.1-beta.2] - 2026-10-07
-
-Second beta, the first release in the Nextcloud app store (signed).
-
-### Added
-- App store listing: screenshots, website, repository and documentation link in `appinfo/info.xml`.
-
-### Fixed
-- Restore: the "new folder" option showed `"Restored "` without the date pattern.
-- Restore: the restore-point dropdown cut off the time.
-- Settings: the passphrase actions are on one line instead of stacked.
-- `docs/HOWTO.md`: the SFTP example used a non-existent auth mechanism (`sftp::password`
-  instead of `password::password`).
-
-## [0.9.0-beta.1] - 2026-10-07
-
-First beta. Tested thoroughly and usable **alongside** your current backup, but **not yet a
-drop-in replacement** for it. We test what we can ourselves (Nextcloud 32–35, SQLite, MariaDB and
-PostgreSQL, S3, SFTP, FTP, SMB and NFS), but we need field experience from other setups: please
-report what works and what doesn't, especially on large instances and on storage providers not
-listed in the README.
-
-### Added
-- Disaster recovery: `occ backup:key:import` and `occ backup:restore:full` restore the database,
-  data directory and config onto a fresh installation of the same major version.
-- Per-user backup and restore via user_migration: `occ backup:user:backup` and
-  `occ backup:user:restore` (replace the account after a safety export, or restore as
-  `<uid>-bak`), also onto a server where the user does not exist yet. The commands ask before
-  installing user_migration (or take `--install-user-migration`).
-- Checksum audit: `occ backup:verify`, shallow or `--deep`, for snapshots and per-user exports.
-- Retention for per-user exports: `occ backup:retention --user-last=N`.
-- FTP and SMB covered by the integration tests; NFS through the `local` backend on a mounted share.
-- `docs/HOWTO.md`: step by step from setup to a tested restore.
-- Warnings when a backup finishes with unreadable files or folders, or with files that kept
-  changing while being read (log, `occ`, notification, snapshot).
-
-### Changed
-- `backup:restore:full` refuses on an installation with more than one user and asks first;
-  `backup:user:restore --mode=replace` asks before deleting an existing account (`--force` for
-  scripts in both cases).
-- A failed scheduled backup is retried at most three times a day, an hour apart.
-- The recovery kit carries the deletion delay; the kit file is created owner-only.
-- Adding a location through the web API needs password confirmation.
-
-### Fixed
-- Exports of users whose id contains `.part-` could be deleted by cleanup on remote locations.
-- Cleanup no longer frees the data of a per-user export whose manifest is missing.
-- Crash safety of moving snapshots to and from the trash, of catalog writes by concurrent
-  backups and per-user exports, and of short uploads.
-- A file that keeps changing no longer makes a backup restart forever.
-- Long restores and exports keep their lock on the location alive.
-- Floating-point database columns are dumped exactly.
-
-### Known limitations
-See "Known limitations" in the README: memory use on very large instances, never two servers
-writing to one location, removing a passphrase slot does not revoke access, no rollback detection
-before a disaster recovery, and a few smaller points. None of them block the road to 1.0.0; they
-are on the backlog in `PLAN.md`.
-
-## [0.1.0-alpha.1] - 2026-10-05
-
-First public alpha. Feature-complete for phase 1: scheduled, encrypted, incremental backups, and
-restore of files and folders. **Not for production use** — test on a copy of production (dev,
-test, staging). Full disaster recovery (`backup:restore:full` on a fresh installation) is phase 2
-and not implemented yet.
-
-### Added
-- Encrypted (XChaCha20-Poly1305), content-addressed, deduplicated, incremental backups, streamed
-  from source to destination without a local copy of the data.
-- Backup locations via files_external's own backend/auth classes, without ever mounting the
-  location: S3 (and compatible services), SFTP, WebDAV, FTP, Swift, or a local path.
-- A recovery kit with up to three passphrase slots, mandatory download-and-confirm before the
-  first backup runs, and an optional encrypted copy by email.
-- Resumable, time-boxed background jobs (database dump, file walk, upload), so a run survives
-  short PHP time limits and a crash is resumed, never restarted, without leaving the instance in
-  maintenance mode.
-- Database dump and restore without external tools, via Nextcloud's own `IDBConnection`/DBAL,
-  streamed through the same pipeline as file data.
-- Restore of files and folders via the web interface and `occ`, into a new folder, merged, or
-  replacing the original (with the previous content going to the trash).
-- Retention policy (last/daily/weekly/monthly), prune with pack repacking, and a snapshot trash
-  with a configurable deletion delay.
-- Append-only locations and documented recommendations against ransomware and a compromised
-  server (object lock, delete-less credentials, off-site copies).
-- Admin settings page (locations, schedule, retention, key management) and a JSON API.
-- Notifications and an admin setup check for a failed or overdue backup.
-- CI: unit tests on PHP 8.2–8.4, and an end-to-end backup→restore round trip on Nextcloud 32–35 ×
-  SQLite/MariaDB/PostgreSQL, and against real S3 and SFTP backends (not just a local path).
-
-### Known limitations
-- No full/disaster-recovery restore yet (phase 2).
-- No per-user backup/restore via user_migration yet (phase 2).
-- No FTP/SMB coverage in CI yet, and no verification/checksum-audit command yet (phase 2).
-- See the "Storage backend experiences" section of the README for provider-specific quirks found
-  so far (e.g. Hetzner Storage Box sub-accounts).
-
-[0.9.2-beta.3]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.2-beta.3
-[0.9.1-beta.2]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.1-beta.2
-[0.9.0-beta.1]: https://github.com/dillardblom/ng_backup/releases/tag/v0.9.0-beta.1
-[0.1.0-alpha.1]: https://github.com/dillardblom/ng_backup/releases/tag/v0.1.0-alpha.1

PLAN.md

@@ -214,8 +214,8 @@ Daarom:
 ### 3.8 Backup en restore per gebruiker: via user_migration
 
 In plaats van zelf te bepalen welke gegevens van een gebruiker meegaan, hergebruiken we
-**user_migration** (officiële Nextcloud-app, actief onderhouden, NC29–36; draait ook op onze eigen productie-instantie).
-Die app werkt met *migrators* die andere apps zelf aanleveren. Op onze productie-instantie zijn dat er al:
+**user_migration** (officiële Nextcloud-app, actief onderhouden, NC29–36; staat ook op nc01).
+Die app werkt met *migrators* die andere apps zelf aanleveren. Op nc01 hebben die er al:
 calendar, dav (agenda's en contactpersonen), deck, files_trashbin, mail, settings (profiel,
 account, app-instellingen) en de bestanden zelf. Elke app die later een migrator toevoegt, gaat
 automatisch mee.
@@ -276,7 +276,7 @@ onderdelen wel en niet terugkomen, op basis van de geregistreerde migrators.
 | `backup:list [--target=]` | herstelpunten |
 | `backup:verify <snapshot> [--deep]` | checksums controleren, optioneel alles ontsleutelen |
 | `backup:restore:file <snapshot> <user> <pad> [--to=]` | bestand/map terugzetten |
-| `backup:user:restore <snapshot> <user> [--to-user=]` | gebruiker terugzetten via user_migration (fase 2) |
+| `backup:restore:user <snapshot> <user> [--to-user=]` | gebruiker terugzetten via user_migration (fase 2) |
 | `backup:restore:full <snapshot>` | volledige restore (fase 2, verse installatie) |
 | `backup:target:add/list/remove/test` | opslagdoelen beheren en testen |
 | `backup:key:export / import` | herstelkit |
@@ -308,14 +308,14 @@ niet met de hunne, maar bij installatie waarschuwen als `backup` ook actief is.
 | 2 | Backup/restore per gebruiker via user_migration, volledige restore op verse installatie, FTP/SMB, verificatie | 3–4 weken |
 | 3 | In-place volledige restore (restore-modus), zelfbediening voor gebruikers, extra doelen | open |
 
-Release in de app store pas na fase 1 en een periode van eigen gebruik op onze productie-instantie (net als occweb):
+Release in de app store pas na fase 1 en een periode van eigen gebruik op nc01 (net als occweb):
 een backup-app die niet betrouwbaar is, is erger dan geen backup-app.
 
 ## 8. Besluiten (2026-10-01)
 
 1. **Doelgroep:** alle varianten: AIO, losse installaties én gehoste Nextcloud zonder SSH.
 2. **Licentie:** AGPL-3.0-or-later.
-3. **Repository:** eigen Gitea + GitHub (dillardblom), zoals occweb.
+3. **Repository:** Ensembia op Gitea + GitHub (dillardblom), zoals occweb.
 4. **Naam:** "NG Backup", app-id `ng_backup`, occ-voorvoegsel `backup:`.
 5. **Herstelkit:** verplicht downloaden + expliciete bevestiging door de beheerder (vinkje +
    "Yes, I confirm"), zie 3.2; versleuteld per e-mail als optionele extra kopie.
@@ -338,54 +338,6 @@ een backup-app die niet betrouwbaar is, is erger dan geen backup-app.
 Volgorde: fase 1 grondig testen, reviewen en debuggen; dan nadenken over 0.1.0-alpha.1. Een
 minimale volledige restore (`occ backup:restore:full` op een verse installatie) komt vóór de beta.
 
-**Roadmap-indeling fase 2 (besluit 2026-10-05):** naar v1.2.0 toewerken met in fase 2:
-1. `backup:restore:full` (disaster recovery, verse installatie) — **klaar** (2026-10-05)
-2. FTP/SMB-ondersteuning — **klaar** (2026-10-06): beide liepen al via files_external's generieke
-   adapter zonder enige ng_backup-code; alleen testdekking toegevoegd
-   (`tests/integration/targets-matrix.sh`) + bevindingen in README ("Storage backend experiences").
-   SMB vereist de `smbclient` PECL-extensie (niet standaard in de Nextcloud-image, in CI nu
-   on-the-fly gebouwd). NFS is geen eigen backend: lokaal mounten + `local`-backend erop richten.
-3. Verificatie/checksum-audit-commando — **klaar** (2026-10-05)
-4. Retentie/prune voor user-exports — **klaar** (2026-10-06): `occ backup:retention --user-last=N`
-   (standaard 3, per installatie, net als de bestaande snapshot-policy), toegepast door
-   `occ backup:prune` (geen prullenbak voor user-exports, in tegenstelling tot snapshots — on-demand,
-   niet het primaire vangnet).
-5. Automatische user-export in het reguliere schema — **naar backlog** (niet voor deze release; on-demand blijft)
-9. SMB-roundtrip (protocol, niet een specifieke server) — **klaar** (2026-10-06): CI-matrix, 2 GB-roundtrip en
-   user-export via SMB; NFS via de OMV-share getest (`local`-backend op een gemounte share, 2026-10-06)
-10. `backup:user:restore` zonder user_migration: vraagt om toestemming om de app te installeren en te activeren (of
-   `--install-user-migration`) — **klaar** (2026-10-06); waarschuwing over de settings-allowlist — **klaar**;
-   agenda/contacten bij migratie naar een server zonder die gebruiker — **getest** (2026-10-06, naar `migrated-personal`/`migrated-contacts`)
-    Backlog: (a) de originele weergavenaam herstellen (het label uit de export is niet getest als
-    weergavenaam); (b) de interne `migrated-`-naam hernoemen (vereist directe databasewijziging, niet voor de beta).
-
-**Backlog uit de pre-beta review (2026-10-07)** — geen belemmering voor 0.9.0-beta of 1.0.0, staat
-in README "Known limitations":
-1. Geheugen bij grote instanties (>1 TB, miljoenen bestanden): blob-index, prune-set, browse van een
-   snapshot in de web-UI, `trashExtras` bij restore en het manifest van een user-export staan volledig
-   in het geheugen; streaming/paginering nodig.
-2. Twee servers op één locatie: catalogus kan breken (generatie overschreven, of anchor >200 generaties
-   achter). Docs-waarschuwing staat er; mogelijk later een echte put-if-absent per backend.
-3. Sleutelrotatie: een slot verwijderen trekt geen toegang in (master-key blijft gelijk).
-4. Rollback vóór DR niet detecteerbaar: referentie-generatie en -hash in de kit opnemen of tonen.
-5. Kit-velden buiten `wrapped_key` (o.a. `delete_delay_days`) zijn niet geauthenticeerd; nu alleen getoond.
-6. Repository-id in de AD van objecten (formaatwijziging).
-7. Wachtwoorden van locaties via `--option-file` of omgevingsvariabele i.p.v. de commandoregel.
-8. Tijdelijke restore-bestanden niet via de Files-API verwijderen (komen nu in de prullenbak).
-9. DB-restore in foreign-key-volgorde (cascades).
-10. Packs zonder index (index-upload mislukt) opruimen.
-11. `backup:restore:full` in onderhoudsmodus en hervatbaar maken; nu: opnieuw draaien met `--force`.
-12. Config/rename op FTP/SMB-servers die geen rename over een bestaand bestand toestaan.
-
-Doorgeschoven naar **v1.3.0** (fase 3, niet meer fase 2): in-place volledige restore
-(eigen restore-modus i.p.v. onderhoudsmodus) en zelfbediening voor gebruikers (eigen bestanden
-terugzetten vanuit de Files-app).
-
-**Let op (ontdekt 2026-10-05):** Nextcloud's eigen `info.xsd` staat voor `<version>` alleen
-`[0-9]+(\.[0-9]+){0,2}` toe — geen `-alpha`/`-beta`/`-rc`-achtervoegsel. De stabiliteitsaanduiding
-uit deze tabel gaat dus niet in `info.xml` (dat blijft gewoon oplopend, bijv. `0.1.0`), maar in de
-git-tag (`v0.1.0-alpha.1`), de GitHub/Gitea release (gemarkeerd als pre-release) en de CHANGELOG.
-
 ## Bijlage: lessen uit nextcloud/backup (test NC34, 2026-10-01)
 
 - Externe programma's (`pg_dump`) en extensies (`pgsql`, `mysqli`) → onbruikbaar op standaard/hosted.

README.md

@@ -2,14 +2,10 @@
 
 Encrypted, incremental backups of Nextcloud (database, configuration and data) with restore
 from the web interface. Works without shell access: no external programs, no extra PHP
-extensions beyond sodium for ng_backup itself. Runs on Nextcloud All-in-One, regular
-installations and hosted Nextcloud. (Choosing SMB as a storage backend is the one exception:
-see "Storage backend experiences" below — that requirement comes from files_external, not from
-ng_backup, and applies to any Nextcloud app that writes to an SMB share.)
+extensions beyond sodium. Runs on Nextcloud All-in-One, regular installations and hosted
+Nextcloud.
 
-**Status: beta (0.9.2).** Tested thoroughly, usable alongside your current backup, but not yet a
-drop-in replacement for it. See "Known limitations" below, `PLAN.md` for the design and
-`docs/HOWTO.md` for a step-by-step guide from setup to a tested restore.
+**Status: in development (phase 1). Not ready for production use.** See `PLAN.md` for the design.
 
 License: AGPL-3.0-or-later.
 
@@ -32,7 +28,7 @@ License: AGPL-3.0-or-later.
 occ backup:key:init --label="Safe"                 # first passphrase, deletion delay (default 7 days)
 occ backup:key:slot:add --label="CTO"              # optional second and third passphrase
 occ backup:key:slot:add --label="Head of IT"
-occ backup:key:kit --output=/var/tmp/ng_backup-kit.json
+occ backup:key:kit --output=/root/ng_backup-kit.json
 occ backup:key:confirm
 occ backup:target:add offsite amazons3 -a amazons3::accesskey -o bucket=... -o key=... -o secret=...
 occ backup:run
@@ -63,8 +59,7 @@ All backups of an installation are encrypted with one master key.
   a single slot is possible, but then that one passphrase is a single point of failure.
 - When a holder leaves, give their slot a new passphrase (`occ backup:key:slot:replace`), download
   the new kit and confirm it. Note: an old kit together with the old passphrase still opens the
-  same master key; to revoke it completely, start new locations with a new key. This is noted on
-  the backlog and will be addressed in a future version (key rotation).
+  same master key; to revoke it completely, start new locations with a new key.
 - Downloading the kit, and every change to the slots, requires the administrator's password, is
   written to the audit log and is announced to all administrators.
 
@@ -109,82 +104,7 @@ What you should do on the location (strongly recommended):
 - **Files and folders** of a user: in the web interface or `occ backup:restore`, into a new folder
   ("Restored <date>"), merged into the original place, or replacing it.
 - **Raw restore** of any path (for example `config/`) to a local directory: `occ backup:restore ... --to-directory=DIR`.
-- **Whole server** (disaster recovery onto a fresh installation): `occ backup:restore:full`, see the how-to.
-- **One user** (account, settings, files, calendars, contacts via user_migration): `occ backup:user:backup` and
-  `occ backup:user:restore`, replacing the account or restoring it as `<uid>-bak`. See the how-to.
-
-## Storage backend experiences
-
-Notes from actually running a backend, beyond what's in files_external's own documentation.
-Contributions welcome via PR — add what you ran into with your own provider.
-
-- **Hetzner Storage Box, sub-account:** the SFTP backend's `root` option must be `home`, not `/`.
-  A sub-account's SFTP login lands in `/home` (confirmed via `pwd()` after login); writing to the
-  literal chroot root (`/`) fails with a generic `NET_SFTP_STATUS_FAILURE` from the SFTP server,
-  while the same write under `home` (or a path below it) succeeds. This affects any backend option
-  form that lets you set a path relative to the account's root, not just ng_backup. Not yet
-  verified whether this also applies to a Hetzner Storage Box **main** account (only tested with a
-  sub-account so far) — if you've tried a main account, please say so in a PR.
-
-- **Hetzner Storage Box over WebDAV and SMB (sub-accounts, 2026-10-07):** both work end to end
-  (backup, incremental run, restore of a folder, verify), tested from outside the Hetzner network
-  with about 66 MiB of data. In the Hetzner Console, enable WebDAV or SMB support for the
-  sub-account, and "External reachability" when your server is not in the Hetzner network.
-  WebDAV: host `https://uXXXXX-subN.your-storagebox.de`, and the `root`
-  must be a folder that already exists (or empty): WebDAV does not create missing parent folders,
-  so a root that doesn't exist yet fails `backup:target:add` with `Sabre\HTTP\ClientHttpException:
-  Conflict`. SMB: share = the sub-account name, port 445 must be reachable from your server (it was
-  from a home connection here, but some providers block it), and the `smbclient` PECL extension is
-  required (see the SMB entry below). Both have a noticeable fixed cost per run: an incremental run
-  that uploads nothing took about 20 s over WebDAV and 50 s over SMB. A deep verify is slow over
-  remote storage, since each blob is fetched with its own request (19 minutes for 66 MiB over
-  WebDAV); run it occasionally, not after every backup.
-
-- **FTP, server-dependent absolute-path handling:** files_external's FTP backend always builds
-  absolute paths (e.g. `MKD /repo`) for the configured root, never relative ones. `atmoz/sftp`-style
-  `vsftpd` test servers (chrooted) can reject that with a generic "create directory operation
-  failed", even though a plain `ftp_mkdir()` with a *relative* path on the same server succeeds;
-  `pure-ftpd` accepts the absolute form fine. If a working FTP server rejects ng_backup's writes,
-  try a different FTP server implementation before assuming the backend itself is broken.
-
-- **SMB/CIFS *lists* as available with just the `smbclient` CLI binary, but does not actually
-  work for ng_backup without the `smbclient` PECL extension too.** files_external falls back to a
-  shell-wrapped `smbclient` process when the native extension is missing, which registers the
-  backend in `occ backup:target:backends` fine, but that fallback's stream cannot seek. ng_backup
-  reads blobs back by byte range while backing up, so even the very first (small) backup fails
-  with `Seek failed in packs/...`. Install the extension (`libsmbclient-dev` + `pecl install
-  smbclient` + `docker-php-ext-enable smbclient` on Debian-based images), not just the CLI tool —
-  the backend being listed is not proof it will work here. Once the extension is present it works
-  the same as any other backend; no ng_backup-specific config beyond host/share/user/password.
-
-- **NFS is not a files_external backend at all.** Mount the NFS export on the server yourself
-  (e.g. via `/etc/fstab` or a systemd `.mount` unit) and point ng_backup's `local` backend at the
-  mount point; ng_backup never mounts or unmounts anything on its own, so an NFS mount dropping
-  mid-run behaves like any other local-path failure (the run resumes). See PLAN.md 3.5 for why NFS
-  can't be driven from PHP directly.
-
-## Known limitations
-
-On the backlog; none of these block the beta or 1.0.0, but know them before you rely on it:
-
-- **Very large instances** (well over 1 TB, millions of files): the blob index, cleanup, browsing a
-  snapshot in the web interface and per-user export manifests are held in memory. Expect high
-  memory use there; reports from such instances are very welcome.
-- **One location, one server.** Never let two Nextcloud servers write to the same location (for
-  example a disaster recovery test server pointed at the production location): they can break each
-  other's catalog, and the location is then refused as possibly tampered with. Test a disaster
-  recovery against a copy of the location, or only read from it.
-- **Removing a passphrase slot does not revoke access.** The master key stays the same, so someone
-  with an old recovery kit and that slot's passphrase can still decrypt the location if they can
-  read it. Key rotation is not available yet.
-- **Rollback before a disaster recovery is not detected.** A fresh server has no record of the
-  newest catalog generation, so a location rolled back to an older state looks valid there.
-- Location passwords passed with `-o password=...` are visible in the process list and shell
-  history while the command runs.
-- Temporary files of a restore into a user's files end up in that user's trash.
-- Restoring the database does not order tables by foreign keys; apps with cascading foreign keys
-  could lose rows (Nextcloud core does not use them).
-- A pack whose index upload failed stays on the location until removed by hand.
+- **Whole server** (disaster recovery onto a fresh installation): planned for phase 2.
 
 ## Commands
 
@@ -196,7 +116,3 @@ On the backlog; none of these block the beta or 1.0.0, but know them before you
 | `backup:run`, `backup:status`, `backup:list` | back up, status, restore points |
 | `backup:browse`, `backup:restore` | browse and restore |
 | `backup:retention`, `backup:prune`, `backup:trash`, `backup:trash:restore` | retention, cleanup, trash |
-| `backup:verify` | checksum audit of a restore point (`--deep` downloads and decrypts everything) |
-| `backup:restore:full` | whole-server restore onto a fresh installation (after `backup:key:import`) |
-| `backup:key:import` | import a recovery kit on a fresh installation |
-| `backup:user:backup`, `backup:user:restore` | one user via user_migration (asks before installing it) |

appinfo/info.xml

@@ -4,25 +4,13 @@
     <id>ng_backup</id>
     <name>NG Backup</name>
     <summary>Encrypted, incremental backups of your Nextcloud with restore from the web interface</summary>
-    <description><![CDATA[Beta: scheduled, encrypted, incremental backups of the database, config and data
-directory to S3, SFTP, WebDAV, FTP, SMB or a local path, with restore of files and folders, of
-single users (via user_migration) and of the whole server onto a fresh installation. Tested
-thoroughly and usable alongside your current backup, but not yet a drop-in replacement for it.
-See the README for known limitations and the recovery kit before relying on it.]]></description>
-    <version>0.9.2</version>
+    <description><![CDATA[Work in progress, not ready for use.]]></description>
+    <version>0.0.15</version>
     <licence>agpl</licence>
     <author>Dillard Blom</author>
     <namespace>NgBackup</namespace>
-    <documentation>
-        <admin>https://github.com/dillardblom/ng_backup/blob/main/docs/HOWTO.md</admin>
-    </documentation>
     <category>tools</category>
-    <website>https://apps.nextcloud.com/apps/ng_backup</website>
     <bugs>https://github.com/dillardblom/ng_backup/issues</bugs>
-    <repository type="git">https://github.com/dillardblom/ng_backup</repository>
-    <screenshot>https://raw.githubusercontent.com/dillardblom/ng_backup/main/screenshots/1-backups.png</screenshot>
-    <screenshot>https://raw.githubusercontent.com/dillardblom/ng_backup/main/screenshots/2-restore.png</screenshot>
-    <screenshot>https://raw.githubusercontent.com/dillardblom/ng_backup/main/screenshots/3-settings.png</screenshot>
     <dependencies>
         <php min-version="8.1"/>
         <lib>sodium</lib>
@@ -48,18 +36,12 @@ See the README for known limitations and the recovery kit before relying on it.]
         <command>OCA\NgBackup\Command\Retention</command>
         <command>OCA\NgBackup\Command\TargetAppendOnly</command>
         <command>OCA\NgBackup\Command\TargetTrustCurrent</command>
-        <command>OCA\NgBackup\Command\TargetLimit</command>
         <command>OCA\NgBackup\Command\Trash</command>
         <command>OCA\NgBackup\Command\TrashRestore</command>
         <command>OCA\NgBackup\Command\KeySlots</command>
         <command>OCA\NgBackup\Command\KeySlotAdd</command>
         <command>OCA\NgBackup\Command\KeySlotReplace</command>
         <command>OCA\NgBackup\Command\KeySlotRemove</command>
-        <command>OCA\NgBackup\Command\BackupUser</command>
-        <command>OCA\NgBackup\Command\RestoreUser</command>
-        <command>OCA\NgBackup\Command\KeyImport</command>
-        <command>OCA\NgBackup\Command\RestoreFull</command>
-        <command>OCA\NgBackup\Command\Verify</command>
     </commands>
     <settings>
         <admin>OCA\NgBackup\Settings\Admin</admin>

appinfo/routes.php

@@ -20,7 +20,6 @@ return [
 		['name' => 'AdminApi#addTarget', 'url' => '/api/targets', 'verb' => 'POST'],
 		['name' => 'AdminApi#removeTarget', 'url' => '/api/targets/{id}', 'verb' => 'DELETE'],
 		['name' => 'AdminApi#testTarget', 'url' => '/api/targets/{id}/test', 'verb' => 'POST'],
-		['name' => 'AdminApi#setTargetLimit', 'url' => '/api/targets/{id}/limit', 'verb' => 'PUT'],
 		['name' => 'AdminApi#startBackup', 'url' => '/api/backups', 'verb' => 'POST'],
 		['name' => 'AdminApi#setSchedule', 'url' => '/api/schedule', 'verb' => 'PUT'],
 		['name' => 'AdminApi#snapshots', 'url' => '/api/targets/{targetId}/snapshots', 'verb' => 'GET'],

docs/HOWTO.md

@@ -1,158 +0,0 @@
-# NG Backup how-to
-
-Step by step: from first install to a tested restore. All commands run as the web user
-(`sudo -u www-data php occ ...`, or `docker exec -u www-data <container> php occ ...` in
-All-in-One and Docker setups). Replace names in `<angle brackets>` with your own.
-
-## 1. Create the key and the recovery kit
-
-```
-occ backup:key:init --label="Main" --delete-delay-days=7
-occ backup:key:kit --output=/var/tmp/ng_backup-kit.json
-occ backup:key:confirm -u <your-admin-uid> --code=<code shown> --confirm="Yes, I confirm"
-```
-
-- The passphrase protects the backup. Keep it somewhere other than this server.
-- Optional: extra passphrases for other people with `occ backup:key:slot:add --label="..."`.
-  Any one passphrase is enough to restore. Removing a slot later does not revoke access for someone
-  who kept an old kit and that passphrase (see "Known limitations" in the README).
-- The recovery kit (`/var/tmp/ng_backup-kit.json` above) is also required for disaster recovery. The web
-  user writes it there; then move it off the server as root, next to the passphrase, and delete the
-  copy in `/var/tmp`. Without the kit and a passphrase, the backup cannot be read.
-
-## 2. Add a backup location
-
-NG Backup uses Nextcloud's External storage backends. Check what your server supports first:
-
-```
-occ backup:target:backends
-```
-
-Examples:
-
-```
-occ backup:target:add offsite amazons3 -a amazons3::accesskey -o bucket=<bucket> -o key=<key> -o secret=<secret>
-occ backup:target:add nas sftp -a password::password -o host=<host> -o user=<user> -o password=<pw> -o root=home
-occ backup:target:add local local -a null::null -o datadir=/mnt/backup
-```
-
-- **SFTP on a Hetzner Storage Box sub-account:** use `-o root=home`, not `/` (see README).
-- **FTP:** use a server that accepts absolute paths (for example `pure-ftpd`).
-- **SMB:** requires the native `smbclient` PHP extension. The CLI binary alone is not enough (see README).
-  `backup:target:add` refuses SMB when the extension is missing.
-- **NFS:** not a backend of its own. Mount the export on the server and use the `local` backend
-  with the mount point as `datadir`.
-
-Verify the location before relying on it:
-
-```
-occ backup:target:list
-occ backup:status
-```
-
-## 3. Run the first backup
-
-```
-occ backup:run offsite -l first
-occ backup:list
-```
-
-Later runs upload only changed data. An unchanged run uploads (almost) nothing; the output shows
-the number of uploaded bytes, so check that value when you test incremental behaviour.
-
-Schedule `occ backup:run` from system cron (or use the Administration settings, if you prefer).
-
-## 4. Check the backup regularly
-
-```
-occ backup:verify offsite <snapshot>          # shallow: all blocks are present
-occ backup:verify offsite <snapshot> --deep   # also downloads and decrypts every block
-```
-
-Run the deep check at least once after setting up a location, and after changing it.
-
-## 5. Restore files and folders
-
-In the web interface, or with occ:
-
-```
-occ backup:browse offsite <snapshot>
-occ backup:restore offsite <snapshot> data/<uid>/files/Docs --mode=new-folder
-occ backup:restore offsite <snapshot> data/<uid>/files/Docs --mode=merge
-occ backup:restore offsite <snapshot> data/<uid>/files/Docs --mode=replace
-occ backup:restore offsite <snapshot> config --to-directory=/var/tmp/restore-config
-```
-
-- `new-folder` (default): puts the files in "Restored <date>" next to the original. Safest choice.
-- `merge`: adds missing files, keeps current ones.
-- `replace`: overwrites the folder. Replaced files keep their old content as a version, and removed
-  files go to the trash.
-- `--to-directory`: writes raw files to a local directory (for example `config/`).
-
-## 6. Back up and restore one user
-
-Needs the `user_migration` app. NG Backup asks before installing it:
-
-```
-occ backup:user:backup offsite <uid>
-occ backup:user:restore offsite users/<uid>/<exportId>               # replace (default)
-occ backup:user:restore offsite users/<uid>/<exportId> --mode=as-backup
-```
-
-- If `user_migration` is missing, the command asks to install and enable it. For non-interactive
-  use, add `--install-user-migration` to approve that explicitly. The command stops after the
-  installation; run it once more.
-- `replace` first makes a safety export of the current account, then recreates the user under the
-  same id. When the account exists, the command asks first; in scripts, add `--force`. Shares to
-  others and data of apps without a user_migration migrator are not restored, so prefer
-  `as-backup` when in doubt: it restores into `<uid>-bak` and leaves the original untouched.
-- A restore onto a server where the user does not exist works. Calendars and address books get an
-  internal name with the prefix `migrated-` (for example `migrated-personal`). That prefix comes from
-  user_migration and cannot be turned off. The user can change the display name of these calendars and
-  address books in the app as usual; the internal name stays as it is.
-- **Settings:** on restore, `user_migration` imports only the app settings on its own allowlist
-  (for example calendar view and reminder settings). Other app settings of the user are skipped.
-  NG Backup reuses `user_migration`'s importer, so this list is not extended.
-- Keep the last few exports per user: `occ backup:retention --user-last=3`.
-
-## 7. Disaster recovery: restore the whole server
-
-Use a fresh Nextcloud installation of the same major version, with NG Backup installed and
-the same location available. For a test, use a **copy** of the location: two servers writing to one
-location break each other's catalog.
-
-```
-occ backup:key:import /path/ng_backup-kit.json --passphrase-file=/path/passphrase
-occ backup:target:add offsite <backend> ...          # same details as on the original server
-occ backup:list offsite                              # the snapshots must be listed
-occ backup:restore:full offsite <snapshot>
-```
-
-The command refuses on an installation that already has more than one user, and asks before it
-starts; `--force` skips both (also needed to rerun it after it stopped halfway).
-
-Afterwards, check that users, files and the database are complete, and run a backup of the restored
-server. The restored installation keeps its own app configuration and secret.
-
-## 8. Retention
-
-```
-occ backup:retention --last=3 --daily=7 --weekly=4 --monthly=12
-occ backup:prune offsite --dry-run   # show first
-occ backup:prune offsite             # apply the policy; forgotten snapshots go to the trash first
-occ backup:trash                  # list the trash
-occ backup:trash:restore offsite <id>
-```
-
-Snapshots are kept according to the policy, and their data is deleted only after the deletion delay
-(set with `backup:key:init --delete-delay-days`). `occ backup:prune offsite --dry-run` shows what would be
-removed without changing anything.
-
-## 9. Checklist before you rely on it
-
-- [ ] Key created, passphrase stored off-server, recovery kit stored off-server
-- [ ] Location added; `backup:status` shows it reachable
-- [ ] First backup done and listed in `backup:list`
-- [ ] `backup:verify --deep` succeeds
-- [ ] One file restore tested (`new-folder`)
-- [ ] Disaster recovery tested on a second, fresh installation (or in a test environment)

lib/AppInfo/Application.php

@@ -12,7 +12,7 @@ use OCP\AppFramework\Bootstrap\IBootContext;
 use OCP\AppFramework\Bootstrap\IBootstrap;
 use OCP\AppFramework\Bootstrap\IRegistrationContext;
 
-final class Application extends App implements IBootstrap {
+class Application extends App implements IBootstrap {
 	public const APP_ID = 'ng_backup';
 
 	public function __construct() {

lib/Backend/BackendException.php

@@ -7,5 +7,5 @@ declare(strict_types=1);
 
 namespace OCA\NgBackup\Backend;
 
-final class BackendException extends \RuntimeException {
+class BackendException extends \RuntimeException {
 }

lib/Backend/IBackend.php

@@ -27,13 +27,6 @@ interface IBackend {
 
 	public function exists(string $path): bool;
 
-	/**
-	 * Move an object within the same location (used for the trash). Backends must use a native
-	 * rename, not a read+write copy: some storages (e.g. SFTP) cannot reliably read and write on
-	 * the same connection at once, since the read side is a lazily-pulled stream.
-	 */
-	public function move(string $from, string $to): void;
-
 	/** @return list<string> object paths below $prefix (recursive) */
 	public function list(string $prefix): array;
 

lib/Backend/LocalBackend.php

@@ -33,16 +33,11 @@ final class LocalBackend implements IBackend {
 			if ($out === false) {
 				throw new BackendException('Cannot write ' . $path);
 			}
-			$expected = StorageBackend::remaining($stream);
 			if (stream_copy_to_stream($stream, $out) === false || !fflush($out)) {
 				throw new BackendException('Write failed for ' . $path);
 			}
 			fclose($out);
 			$out = false;
-			clearstatcache(true, $tmp);
-			if ($expected !== null && filesize($tmp) !== $expected) {
-				throw new BackendException('Incomplete write for ' . $path);
-			}
 			if (!rename($tmp, $target)) {
 				throw new BackendException('Cannot finalise ' . $path);
 			}
@@ -99,7 +94,7 @@ final class LocalBackend implements IBackend {
 		$result = [];
 		$it = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($base, \FilesystemIterator::SKIP_DOTS));
 		foreach ($it as $file) {
-			if ($file->isFile() && !StorageBackend::isTemporary($file->getFilename())) {
+			if ($file->isFile() && !str_contains($file->getFilename(), '.part-')) {
 				$result[] = ltrim(substr($file->getPathname(), strlen($this->root)), '/');
 			}
 		}
@@ -111,17 +106,6 @@ final class LocalBackend implements IBackend {
 		@unlink($this->abs($path));
 	}
 
-	public function move(string $from, string $to): void {
-		$target = $this->abs($to);
-		$dir = dirname($target);
-		if (!is_dir($dir) && !mkdir($dir, 0700, true) && !is_dir($dir)) {
-			throw new BackendException('Cannot create ' . $dir);
-		}
-		if (!rename($this->abs($from), $target)) {
-			throw new BackendException("Cannot move $from to $to");
-		}
-	}
-
 	private function abs(string $path): string {
 		if (str_contains($path, '..') || str_starts_with($path, '/')) {
 			throw new BackendException('Invalid path: ' . $path);

lib/Backend/StorageBackend.php

@@ -30,13 +30,7 @@ final class StorageBackend implements IBackend {
 		}
 	}
 
-	/** A temporary upload of put(): "<name>.part-<8 hex>". */
-	public static function isTemporary(string $name): bool {
-		return preg_match('/\.part-[0-9a-f]{8}$/', $name) === 1;
-	}
-
 	public function put(string $path, $stream): void {
-		$expected = self::remaining($stream);
 		$target = $this->abs($path);
 		$this->mkdirs(dirname($target));
 		$writeTo = $this->atomicPut ? $target : $target . '.part-' . bin2hex(random_bytes(4));
@@ -60,10 +54,6 @@ final class StorageBackend implements IBackend {
 			if (is_resource($stream)) {
 				fclose($stream);
 			}
-			// Some adapters report success after a short write or a failed flush: check the size.
-			if ($expected !== null && $this->storage->filesize($writeTo) !== $expected) {
-				throw new BackendException('Incomplete write for ' . $path);
-			}
 			if ($writeTo !== $target && !$this->storage->rename($writeTo, $target)) {
 				throw new BackendException('Cannot finalise ' . $path);
 			}
@@ -125,14 +115,6 @@ final class StorageBackend implements IBackend {
 		$this->storage->unlink($this->abs($path));
 	}
 
-	public function move(string $from, string $to): void {
-		$target = $this->abs($to);
-		$this->mkdirs(dirname($target));
-		if (!$this->storage->rename($this->abs($from), $target)) {
-			throw new BackendException("Cannot move $from to $to");
-		}
-	}
-
 	private function listInto(string $dir, array &$result): void {
 		if (!$this->storage->is_dir($dir)) {
 			return;
@@ -142,39 +124,19 @@ final class StorageBackend implements IBackend {
 			return;
 		}
 		while (($name = readdir($dh)) !== false) {
-			if ($name === '.' || $name === '..') {
+			if ($name === '.' || $name === '..' || str_contains($name, '.part-')) {
 				continue;
 			}
 			$child = $dir . '/' . $name;
 			if ($this->storage->is_dir($child)) {
 				$this->listInto($child, $result);
-			} elseif (!self::isTemporary($name)) {
+			} else {
 				$result[] = $child;
 			}
 		}
 		closedir($dh);
 	}
 
-	/**
-	 * Bytes left to read in a local $stream (php://temp, php://memory or a plain file), or null:
-	 * stream wrappers of remote storages do not report a reliable size.
-	 */
-	public static function remaining(mixed $stream): ?int {
-		if (!is_resource($stream)) {
-			return null;
-		}
-		$meta = stream_get_meta_data($stream);
-		if (!($meta['seekable'] ?? false) || !in_array($meta['wrapper_type'] ?? '', ['PHP', 'plainfile'], true)) {
-			return null;
-		}
-		$stat = fstat($stream);
-		$pos = ftell($stream);
-		if ($stat === false || $pos === false) {
-			return null;
-		}
-		return max(0, $stat['size'] - $pos);
-	}
-
 	private function mkdirs(string $dir): void {
 		if ($dir === '' || $dir === '.' || $this->storage->is_dir($dir)) {
 			return;

lib/BackgroundJob/BackupJob.php

@@ -22,7 +22,7 @@ use Psr\Log\LoggerInterface;
  * With system cron a step may take minutes; with webcron/AJAX cron it is kept short so it fits
  * in a normal web request (hosted Nextcloud).
  */
-final class BackupJob extends TimedJob {
+class BackupJob extends TimedJob {
 	public function __construct(
 		ITimeFactory $time,
 		private BackupService $backups,
@@ -38,19 +38,13 @@ final class BackupJob extends TimedJob {
 		$this->setTimeSensitivity(IJob::TIME_SENSITIVE);
 	}
 
-	private const MAX_DAILY_ATTEMPTS = 3;
-
 	protected function run($argument): void {
 		$budget = PHP_SAPI === 'cli' ? 240.0 : 20.0;
 		$deadline = microtime(true) + $budget;
 		$this->startScheduled();
 		foreach ($this->runs->findRunning(null, BackupService::KIND_FULL) as $run) {
 			while (microtime(true) < $deadline && $run->getStatus() === 'running') {
-				$next = $this->backups->step($run, min($deadline, microtime(true) + $budget));
-				if ($next === $run) {
-					break; // step() hands back the same object when another process holds the run's lease
-				}
-				$run = $next;
+				$run = $this->backups->step($run, min($deadline, microtime(true) + $budget));
 			}
 		}
 		$this->failStaleRestores();
@@ -73,15 +67,10 @@ final class BackupJob extends TimedJob {
 		}
 	}
 
-	/**
-	 * Once a week, apply the retention policy to non-append-only locations: from Sunday on, at the
-	 * first moment no backup is running, so a long Sunday backup only delays it instead of skipping
-	 * the week.
-	 */
+	/** Once a week (after Sunday's backup), apply the retention policy to non-append-only locations. */
 	private function weeklyPrune(): void {
 		$lastWeek = $this->appConfig->getValueString(Application::APP_ID, 'last_prune_week', '');
-		$due = date('N') === '7' ? date('o-W') : date('o-W', (int)strtotime('last sunday'));
-		if (strcmp($lastWeek, $due) >= 0 || $this->runs->findRunning(null, BackupService::KIND_FULL) !== []) {
+		if (date('N') !== '7' || $lastWeek === date('o-W') || $this->runs->findRunning(null, BackupService::KIND_FULL) !== []) {
 			return;
 		}
 		foreach ($this->targets->list() as $t) {
@@ -94,7 +83,7 @@ final class BackupJob extends TimedJob {
 				$this->logger->warning('NG Backup: cleanup of ' . $t->getName() . ' failed: ' . $e->getMessage());
 			}
 		}
-		$this->appConfig->setValueString(Application::APP_ID, 'last_prune_week', $due);
+		$this->appConfig->setValueString(Application::APP_ID, 'last_prune_week', date('o-W'));
 	}
 
 	/** Daily schedule: appconfig ng_backup/schedule_time "HH:MM" (server time); empty = no schedule. */
@@ -103,7 +92,7 @@ final class BackupJob extends TimedJob {
 		if (!preg_match('/^([01]\d|2[0-3]):[0-5]\d$/', $at)) {
 			return;
 		}
-		$todayAt = (int)strtotime(date('Y-m-d') . ' ' . $at);
+		$todayAt = strtotime(date('Y-m-d') . ' ' . $at);
 		if (time() < $todayAt) {
 			return;
 		}
@@ -112,12 +101,6 @@ final class BackupJob extends TimedJob {
 			if ($this->runs->findRunning($t->getId(), BackupService::KIND_FULL) !== [] || ($last !== null && $last->getStartedAt() >= $todayAt)) {
 				continue;
 			}
-			// After a failure: retry at most MAX_DAILY_ATTEMPTS times a day, an hour apart, instead
-			// of starting (and notifying about) a new full run every five minutes all day.
-			$today = $this->runs->startedSince($t->getId(), BackupService::KIND_FULL, $todayAt);
-			if (count($today) >= self::MAX_DAILY_ATTEMPTS || ($today !== [] && time() - (int)$today[0]->getFinishedAt() < 3600)) {
-				continue;
-			}
 			try {
 				$this->backups->start($t, 'scheduled');
 			} catch (\Throwable $e) {

lib/BackgroundJob/RestoreJob.php

@@ -16,7 +16,7 @@ use OCP\BackgroundJob\QueuedJob;
 use Psr\Log\LoggerInterface;
 
 /** Runs a restore requested from the web interface, outside the web request. */
-final class RestoreJob extends QueuedJob {
+class RestoreJob extends QueuedJob {
 	public function __construct(
 		ITimeFactory $time,
 		private RunMapper $runs,

lib/Command/BackupUser.php

@@ -1,64 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Command;
-
-use OCA\NgBackup\Service\TargetService;
-use OCA\NgBackup\Service\UserBackupService;
-use OCA\NgBackup\UserMigration\UserMigrationInstaller;
-use OCP\IUserManager;
-use Symfony\Component\Console\Command\Command;
-use Symfony\Component\Console\Input\InputArgument;
-use Symfony\Component\Console\Input\InputInterface;
-use Symfony\Component\Console\Input\InputOption;
-use Symfony\Component\Console\Output\OutputInterface;
-
-final class BackupUser extends Command {
-	public function __construct(
-		private TargetService $targets,
-		private UserBackupService $userBackup,
-		private IUserManager $userManager,
-		private UserMigrationInstaller $installer,
-	) {
-		parent::__construct();
-	}
-
-	protected function configure(): void {
-		$this->setName('backup:user:backup')
-			->setDescription('Back up one user via user_migration (account, settings, files and everything else a migrator covers)')
-			->addArgument('target', InputArgument::REQUIRED, 'Location name or id')
-			->addArgument('user', InputArgument::REQUIRED, 'User id')
-			->addOption('install-user-migration', null, InputOption::VALUE_NONE, 'Install and enable user_migration if it is missing (non-interactive consent)')
-			->setHelp(<<<'HELP'
-Streams a user_migration export straight into the encrypted repository: no zip, no copy in the
-user's own storage. Shares data with the regular backup; this needs the user_migration app
-enabled. The manifest path this prints is what occ backup:user:restore expects.
-
-Example:
-  occ backup:user:backup offsite alice
-HELP);
-	}
-
-	protected function execute(InputInterface $input, OutputInterface $output): int {
-		$uid = (string)$input->getArgument('user');
-		$user = $this->userManager->get($uid);
-		if ($user === null) {
-			$output->writeln("<error>No such user: $uid</error>");
-			return 1;
-		}
-		try {
-			$target = $this->targets->get($input->getArgument('target'));
-			$this->installer->ensureEnabled($input, $output);
-			$manifest = $this->userBackup->backupUser($target, $user);
-		} catch (\Throwable $e) {
-			$output->writeln('<error>' . $e->getMessage() . '</error>');
-			return 1;
-		}
-		$output->writeln("Backed up <info>$uid</info> to $manifest.");
-		return 0;
-	}
-}

lib/Command/Browse.php

@@ -15,7 +15,7 @@ use Symfony\Component\Console\Input\InputArgument;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class Browse extends Command {
+class Browse extends Command {
 	public function __construct(
 		private TargetService $targets,
 		private RestoreService $restore,

lib/Command/KeyConfirm.php

@@ -14,7 +14,7 @@ use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 use Symfony\Component\Console\Question\Question;
 
-final class KeyConfirm extends Command {
+class KeyConfirm extends Command {
 	public const STATEMENT = 'I have downloaded the recovery kit and stored it safely, outside this server. '
 		. 'I understand that keeping these keys safe is my own responsibility and that backups cannot be restored without them.';
 	public const CONFIRMATION = 'Yes, I confirm';

lib/Command/KeyImport.php

@@ -1,85 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Command;
-
-use OCA\NgBackup\Service\KeyService;
-use Symfony\Component\Console\Command\Command;
-use Symfony\Component\Console\Input\InputArgument;
-use Symfony\Component\Console\Input\InputInterface;
-use Symfony\Component\Console\Input\InputOption;
-use Symfony\Component\Console\Output\OutputInterface;
-use Symfony\Component\Console\Question\Question;
-
-final class KeyImport extends Command {
-	public function __construct(
-		private KeyService $keys,
-	) {
-		parent::__construct();
-	}
-
-	protected function configure(): void {
-		$this->setName('backup:key:import')
-			->setDescription('Disaster recovery: adopt the backup key from a recovery kit on a fresh installation')
-			->addArgument('kit-file', InputArgument::REQUIRED, 'The recovery kit file (occ backup:key:kit on the original installation)')
-			->addOption('passphrase-file', null, InputOption::VALUE_REQUIRED, 'Read the passphrase from this file instead of asking')
-			->setHelp(<<<'HELP'
-For a fresh installation only (occ backup:key:init must not have been run here yet). Reads one
-of the kit's passphrase slots to recover the original master key, so occ backup:target:add opens
-the existing repository on the location instead of creating a new, empty one.
-
-Example:
-  occ backup:key:import /root/ng_backup-recovery-kit.json
-  occ backup:target:add offsite sftp -a password::password -o host=... -o user=... -o password=...
-  occ backup:restore:full offsite <snapshot>
-HELP);
-	}
-
-	protected function execute(InputInterface $input, OutputInterface $output): int {
-		if ($this->keys->isInitialized()) {
-			$output->writeln('<error>A backup key already exists here (fingerprint ' . $this->keys->fingerprint() . '). occ backup:key:import is only for a fresh installation.</error>');
-			return 1;
-		}
-		$kitFile = (string)$input->getArgument('kit-file');
-		$raw = @file_get_contents($kitFile);
-		if ($raw === false) {
-			$output->writeln("<error>Cannot read $kitFile</error>");
-			return 1;
-		}
-		try {
-			$kit = json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
-		} catch (\JsonException $e) {
-			$output->writeln('<error>Not a valid recovery kit file: ' . $e->getMessage() . '</error>');
-			return 1;
-		}
-		$file = $input->getOption('passphrase-file');
-		if ($file !== null) {
-			$raw = @file_get_contents($file);
-			if ($raw === false) {
-				$output->writeln('<error>Cannot read the passphrase file</error>');
-				return 1;
-			}
-			$pass = rtrim($raw, "\r\n");
-		} else {
-			$helper = $this->getHelper('question');
-			$q = (new Question('Passphrase of one of the kit\'s slots: '))->setHidden(true)->setHiddenFallback(false);
-			$pass = (string)$helper->ask($input, $output, $q);
-		}
-		try {
-			$this->keys->importRecoveryKit($kit, $pass);
-		} catch (\Throwable $e) {
-			$output->writeln('<error>' . $e->getMessage() . '</error>');
-			return 1;
-		}
-		$output->writeln('Backup key imported, fingerprint <info>' . $this->keys->fingerprint() . '</info>.');
-		// Read from the kit file, which is not authenticated beyond the wrapped key: show it so a
-		// wrong or altered value stands out.
-		$output->writeln('Deletion delay for forgotten snapshots: <info>' . $this->keys->deleteDelayDays() . '</info> days (from the kit).');
-		$output->writeln('Next: connect the backup location with the same details as before (<info>occ backup:target:add</info>), then <info>occ backup:list</info> and <info>occ backup:restore:full</info>.');
-		return 0;
-	}
-}

lib/Command/KeyInit.php

@@ -14,7 +14,7 @@ use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 use Symfony\Component\Console\Question\Question;
 
-final class KeyInit extends Command {
+class KeyInit extends Command {
 	public function __construct(
 		private KeyService $keys,
 	) {

lib/Command/KeyKit.php

@@ -13,7 +13,7 @@ use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class KeyKit extends Command {
+class KeyKit extends Command {
 	public function __construct(
 		private KeyService $keys,
 		private \OCA\NgBackup\Service\AlertService $alerts,
@@ -39,24 +39,11 @@ final class KeyKit extends Command {
 			$output->write($json, false, OutputInterface::OUTPUT_RAW);
 			return 0;
 		}
-		// Created owner-only from the start (no window where it is world-readable), never over an
-		// existing file or symlink someone else may have placed at a predictable path.
-		$old = umask(0077);
-		try {
-			$fh = @fopen($file, 'xb');
-		} finally {
-			umask($old);
-		}
-		if ($fh === false) {
-			$output->writeln("<error>Cannot create $file (it must not exist yet)</error>");
-			return 1;
-		}
-		$ok = fwrite($fh, $json) === strlen($json);
-		if (!fclose($fh) || !$ok) {
-			@unlink($file);
+		if (file_put_contents($file, $json) === false) {
 			$output->writeln("<error>Cannot write $file</error>");
 			return 1;
 		}
+		@chmod($file, 0600);
 		$output->writeln("Recovery kit written to <info>$file</info>. Copy it off this server, then run <info>occ backup:key:confirm</info>.");
 		return 0;
 	}

lib/Command/KeySlotAdd.php

@@ -10,7 +10,7 @@ namespace OCA\NgBackup\Command;
 use OCA\NgBackup\Service\KeyService;
 use OCA\NgBackup\Service\KeySlotService;
 
-final class KeySlotAdd extends KeySlots {
+class KeySlotAdd extends KeySlots {
 	public function __construct(KeyService $keys, KeySlotService $slots) {
 		parent::__construct($keys, $slots, 'add');
 	}

lib/Command/KeySlotRemove.php

@@ -10,7 +10,7 @@ namespace OCA\NgBackup\Command;
 use OCA\NgBackup\Service\KeyService;
 use OCA\NgBackup\Service\KeySlotService;
 
-final class KeySlotRemove extends KeySlots {
+class KeySlotRemove extends KeySlots {
 	public function __construct(KeyService $keys, KeySlotService $slots) {
 		parent::__construct($keys, $slots, 'remove');
 	}

lib/Command/KeySlotReplace.php

@@ -10,7 +10,7 @@ namespace OCA\NgBackup\Command;
 use OCA\NgBackup\Service\KeyService;
 use OCA\NgBackup\Service\KeySlotService;
 
-final class KeySlotReplace extends KeySlots {
+class KeySlotReplace extends KeySlots {
 	public function __construct(KeyService $keys, KeySlotService $slots) {
 		parent::__construct($keys, $slots, 'replace');
 	}

lib/Command/ListSnapshots.php

@@ -15,7 +15,7 @@ use Symfony\Component\Console\Input\InputArgument;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class ListSnapshots extends Command {
+class ListSnapshots extends Command {
 	public function __construct(
 		private TargetService $targets,
 		private SnapshotMapper $snapshots,

lib/Command/Prune.php

@@ -15,7 +15,7 @@ use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class Prune extends Command {
+class Prune extends Command {
 	public function __construct(
 		private TargetService $targets,
 		private PruneService $prune,
@@ -37,22 +37,6 @@ final class Prune extends Command {
 		$output->writeln('Policy: ' . json_encode($this->prune->policy()->toArray()) . ($dry ? ' (dry run)' : ''));
 		$rc = 0;
 		foreach ($targets as $t) {
-			// User exports first: Repository::prune()'s blob garbage collection (run as part of
-			// apply() below) scans the users/ manifests still on the location at that point, so
-			// forgetting one here lets its now-unused blobs be freed in this same pass.
-			try {
-				$ru = $this->prune->applyUserExports($t, $dry);
-			} catch (\Throwable $e) {
-				// Snapshot retention is independent of this: report and carry on with it.
-				$output->writeln('<error>' . $t->getName() . ' (user exports): ' . $e->getMessage() . '</error>');
-				$rc = 1;
-				$ru = ['forgotten' => []];
-			}
-			if ($ru['forgotten'] !== []) {
-				$affected = count(array_unique(array_map(static fn (string $path): string => explode('/', $path)[1] ?? '', $ru['forgotten'])));
-				$output->writeln(sprintf('<info>%s</info>: %s %d user export(s) for %d user(s)',
-					$t->getName(), $dry ? 'would forget' : 'forgot', count($ru['forgotten']), $affected));
-			}
 			try {
 				$r = $this->prune->apply($t, $dry);
 			} catch (\Throwable $e) {

lib/Command/Restore.php

@@ -15,7 +15,7 @@ use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class Restore extends Command {
+class Restore extends Command {
 	public function __construct(
 		private TargetService $targets,
 		private RestoreService $restore,

lib/Command/RestoreFull.php

@@ -1,97 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Command;
-
-use OCA\NgBackup\Service\RestoreFullService;
-use OCA\NgBackup\Service\TargetService;
-use OCP\IUserManager;
-use Symfony\Component\Console\Command\Command;
-use Symfony\Component\Console\Helper\QuestionHelper;
-use Symfony\Component\Console\Input\InputOption;
-use Symfony\Component\Console\Question\ConfirmationQuestion;
-use Symfony\Component\Console\Input\InputArgument;
-use Symfony\Component\Console\Input\InputInterface;
-use Symfony\Component\Console\Output\OutputInterface;
-
-final class RestoreFull extends Command {
-	public function __construct(
-		private TargetService $targets,
-		private RestoreFullService $restoreFull,
-		private IUserManager $userManager,
-	) {
-		parent::__construct();
-	}
-
-	protected function configure(): void {
-		$this->setName('backup:restore:full')
-			->setDescription('Disaster recovery: restore the database, data directory and config on a fresh installation')
-			->addArgument('target', InputArgument::REQUIRED, 'Location name or id')
-			->addArgument('snapshot', InputArgument::REQUIRED, 'Snapshot id (see backup:list)')
-			->addOption('force', null, InputOption::VALUE_NONE, 'Also on an installation that already has more than one user, and without asking')
-			->setHelp(<<<'HELP'
-For a FRESH Nextcloud installation only, same major version as the backup, right after
-occ maintenance:install, occ backup:key:import and occ backup:target:add -- before anyone else
-uses this instance.
-
-Every app that was enabled when the snapshot was taken must already be installed here (its
-database tables must exist before the restore can write into them); the command lists what is
-missing and refuses to continue rather than guess.
-
-Steps: the database is replaced (consistent, in one transaction); the data directory is restored
-directly in place; config.php is merged in -- everything from the backup except the database
-connection and data directory settings, which stay as occ maintenance:install configured them
-here. Other files under config/ (if any) are not restored.
-
-Afterwards: check trusted_domains and overwritehost/overwriteprotocol match this server, and
-occ maintenance:repair.
-
-Example:
-  occ backup:restore:full offsite 537bf7e9c1a4...
-HELP);
-	}
-
-	protected function execute(InputInterface $input, OutputInterface $output): int {
-		$force = (bool)$input->getOption('force');
-		// A whole-server restore replaces the database and data directory of THIS instance. On
-		// anything but a fresh install (only the admin from occ maintenance:install) that is
-		// almost certainly a mistake, so it needs --force.
-		$users = $this->userManager->countUsersTotal(2);
-		if (!$force && ($users === false || $users > 1)) {
-			$output->writeln('<error>This installation already has more than one user: backup:restore:full would replace its whole database and data directory. It is meant for a fresh installation. Use --force if this really is what you want.</error>');
-			return 1;
-		}
-		if (!$force && $input->isInteractive()) {
-			$q = new ConfirmationQuestion('This replaces the database, the data directory and config.php of this installation. Continue? [y/N] ', false);
-			if (!(new QuestionHelper())->ask($input, $output, $q)) {
-				$output->writeln('Cancelled.');
-				return 1;
-			}
-		}
-		try {
-			$target = $this->targets->get($input->getArgument('target'));
-			$snapshot = (string)$input->getArgument('snapshot');
-			$result = $this->restoreFull->restoreFull($target, $snapshot);
-		} catch (\Throwable $e) {
-			$output->writeln('<error>' . $e->getMessage() . '</error>');
-			$output->writeln('If this happened after the restore had started, the instance may be partly restored: fix the cause and run the same command again with --force.');
-			return 1;
-		}
-		$output->writeln(sprintf(
-			'Database restored (<info>%d</info> tables, <info>%d</info> unchanged), config merged (<info>%d</info> keys), <info>%d</info> data files restored.',
-			count($result['dbReport']['restored']),
-			count($result['dbReport']['skipped']),
-			$result['configKeys'],
-			$result['dataFiles'],
-		));
-		if (!$result['dbConsistent']) {
-			$output->writeln('<comment>Warning: this snapshot\'s database dump was made over several steps (web cron), so it is not one consistent point in time. Check the instance carefully; prefer a snapshot made with system cron.</comment>');
-		}
-		$output->writeln('Next: check trusted_domains and overwritehost/overwriteprotocol match this server, then occ maintenance:repair.');
-		return 0;
-	}
-}

lib/Command/RestoreUser.php

@@ -1,82 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Command;
-
-use OCA\NgBackup\Service\TargetService;
-use OCA\NgBackup\Service\UserRestoreService;
-use OCA\NgBackup\UserMigration\UserMigrationInstaller;
-use OCP\IUserManager;
-use Symfony\Component\Console\Command\Command;
-use Symfony\Component\Console\Helper\QuestionHelper;
-use Symfony\Component\Console\Question\ConfirmationQuestion;
-use Symfony\Component\Console\Input\InputArgument;
-use Symfony\Component\Console\Input\InputInterface;
-use Symfony\Component\Console\Input\InputOption;
-use Symfony\Component\Console\Output\OutputInterface;
-
-final class RestoreUser extends Command {
-	public function __construct(
-		private TargetService $targets,
-		private UserRestoreService $userRestore,
-		private UserMigrationInstaller $installer,
-		private IUserManager $userManager,
-	) {
-		parent::__construct();
-	}
-
-	protected function configure(): void {
-		$this->setName('backup:user:restore')
-			->setDescription('Restore a user from a user_migration export (see backup:user:backup)')
-			->addArgument('target', InputArgument::REQUIRED, 'Location name or id')
-			->addArgument('manifest', InputArgument::REQUIRED, 'Manifest path printed by backup:user:backup (users/<uid>/<exportId>)')
-			->addOption('mode', 'm', InputOption::VALUE_REQUIRED, 'replace or as-backup', UserRestoreService::MODE_REPLACE)
-			->addOption('force', null, InputOption::VALUE_NONE, 'Replace an existing account without asking (required when not interactive)')
-			->addOption('install-user-migration', null, InputOption::VALUE_NONE, 'Install and enable user_migration if it is missing (non-interactive consent)')
-			->setHelp(<<<'HELP'
-Never imports over a live account. Modes:
-  replace    (default) safety-exports the current account first, then deletes and recreates it
-             fresh from the backup, under the same user id
-  as-backup  restores into a new account "<uid>-bak" (or "-bak-2", ...) instead, so an admin can
-             compare and transfer by hand; Nextcloud cannot rename a user id, so the backup gets
-             the new name, never the existing account
-
-Example:
-  occ backup:user:restore offsite users/alice/20261005T120000Z-ab12cd34
-  occ backup:user:restore offsite users/alice/20261005T120000Z-ab12cd34 --mode=as-backup
-HELP);
-	}
-
-	protected function execute(InputInterface $input, OutputInterface $output): int {
-		$mode = (string)$input->getOption('mode');
-		$uid = explode('/', (string)$input->getArgument('manifest'))[1] ?? '';
-		if ($mode === UserRestoreService::MODE_REPLACE && $uid !== '' && $this->userManager->userExists($uid) && !$input->getOption('force')) {
-			// Replace deletes the live account (after a safety export). Shares to others and data of
-			// apps without a user_migration migrator do not come back, so never do it unasked.
-			if (!$input->isInteractive()) {
-				$output->writeln("<error>$uid exists: --mode=replace deletes and recreates it. Add --force, or use --mode=as-backup.</error>");
-				return 1;
-			}
-			$q = new ConfirmationQuestion("$uid exists and will be deleted and recreated from the backup (a safety export is made first; its shares to others and data of apps without a migrator are not restored). Continue? [y/N] ", false);
-			if (!(new QuestionHelper())->ask($input, $output, $q)) {
-				$output->writeln('Cancelled.');
-				return 1;
-			}
-		}
-		try {
-			$output->writeln('<comment>Note: on restore, user_migration only imports the app settings on its own allowlist (e.g. calendar view and reminder settings); other app settings of this user are skipped. Reason: NG Backup uses user_migration\'s importer; widening the list would mean building a settings importer of our own.</comment>');
-			$target = $this->targets->get($input->getArgument('target'));
-			$this->installer->ensureEnabled($input, $output);
-			$user = $this->userRestore->restoreUser($target, (string)$input->getArgument('manifest'), $mode);
-		} catch (\Throwable $e) {
-			$output->writeln('<error>' . $e->getMessage() . '</error>');
-			return 1;
-		}
-		$output->writeln('Restored <info>' . $user->getUID() . '</info>.');
-		return 0;
-	}
-}

lib/Command/Retention.php

@@ -14,7 +14,7 @@ use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class Retention extends Command {
+class Retention extends Command {
 	public function __construct(
 		private PruneService $prune,
 	) {
@@ -28,15 +28,10 @@ final class Retention extends Command {
 			->addOption('daily', null, InputOption::VALUE_REQUIRED, 'Keep one per day for the last N days with a backup')
 			->addOption('weekly', null, InputOption::VALUE_REQUIRED, 'Keep one per week for N weeks')
 			->addOption('monthly', null, InputOption::VALUE_REQUIRED, 'Keep one per month for N months')
-			->addOption('user-last', null, InputOption::VALUE_REQUIRED, 'Keep the newest N of each user\'s own exports (occ backup:user:backup)')
-			->setHelp("Example: occ backup:retention --last=3 --daily=7 --weekly=4 --monthly=12 --user-last=3");
+			->setHelp("Example: occ backup:retention --last=3 --daily=7 --weekly=4 --monthly=12");
 	}
 
 	protected function execute(InputInterface $input, OutputInterface $output): int {
-		if ($input->getOption('user-last') !== null && !ctype_digit((string)$input->getOption('user-last'))) {
-			$output->writeln('<error>--user-last must be a whole number</error>');
-			return 1;
-		}
 		$p = $this->prune->policy()->toArray();
 		$changed = false;
 		foreach (['last', 'daily', 'weekly', 'monthly'] as $k) {
@@ -53,16 +48,7 @@ final class Retention extends Command {
 				return 1;
 			}
 		}
-		if ($input->getOption('user-last') !== null) {
-			try {
-				$this->prune->setUserExportRetention((int)$input->getOption('user-last'));
-			} catch (\InvalidArgumentException $e) {
-				$output->writeln('<error>' . $e->getMessage() . '</error>');
-				return 1;
-			}
-		}
 		$output->writeln(sprintf('Keep the last %d, plus one per day for %d days, per week for %d weeks, per month for %d months.', $p['last'], $p['daily'], $p['weekly'], $p['monthly']));
-		$output->writeln(sprintf('Keep the newest %d of each user\'s own exports.', $this->prune->userExportRetention()));
 		return 0;
 	}
 }

lib/Command/RunBackup.php

@@ -16,7 +16,7 @@ use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class RunBackup extends Command {
+class RunBackup extends Command {
 	public function __construct(
 		private BackupService $backups,
 		private TargetService $targets,
@@ -75,13 +75,6 @@ HELP);
 			});
 			if ($run->getStatus() === Run::DONE) {
 				$output->writeln(sprintf('  done in %.0fs', microtime(true) - $start));
-				$f = json_decode($run->getStats() ?? '{}', true)['files'] ?? [];
-				if (($f['unreadable'] ?? 0) > 0) {
-					$output->writeln(sprintf('<comment>  warning: %d unreadable files or folders are missing from this backup (see the server log)</comment>', $f['unreadable']));
-				}
-				if (($f['changing'] ?? 0) > 0) {
-					$output->writeln(sprintf('<comment>  warning: %d files kept changing and were saved as read (see the server log)</comment>', $f['changing']));
-				}
 			} else {
 				$output->writeln('<error>  ' . $run->getStatus() . ': ' . $run->getError() . '</error>');
 				$failed++;

lib/Command/Status.php

@@ -15,7 +15,7 @@ use Symfony\Component\Console\Helper\Table;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class Status extends Command {
+class Status extends Command {
 	public function __construct(
 		private KeyService $keys,
 		private TargetService $targets,

lib/Command/TargetAdd.php

@@ -15,7 +15,7 @@ use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class TargetAdd extends Command {
+class TargetAdd extends Command {
 	public function __construct(
 		private TargetService $targets,
 		private KeyService $keys,

lib/Command/TargetAppendOnly.php

@@ -13,7 +13,7 @@ use Symfony\Component\Console\Input\InputArgument;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class TargetAppendOnly extends Command {
+class TargetAppendOnly extends Command {
 	public function __construct(
 		private TargetService $targets,
 		private \OCA\NgBackup\Service\AlertService $alerts,

lib/Command/TargetBackends.php

@@ -12,7 +12,7 @@ use OCA\NgBackup\Service\TargetService;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class TargetBackends extends Base {
+class TargetBackends extends Base {
 	public function __construct(
 		private TargetService $targets,
 	) {

lib/Command/TargetLimit.php

@@ -1,52 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Command;
-
-use OCA\NgBackup\Service\TargetService;
-use Symfony\Component\Console\Command\Command;
-use Symfony\Component\Console\Input\InputArgument;
-use Symfony\Component\Console\Input\InputInterface;
-use Symfony\Component\Console\Output\OutputInterface;
-
-final class TargetLimit extends Command {
-	public function __construct(
-		private TargetService $targets,
-	) {
-		parent::__construct();
-	}
-
-	protected function configure(): void {
-		$this->setName('backup:target:limit')
-			->setDescription('Set a maximum size for the backups stored on a location (e.g. 100G), or "none"')
-			->addArgument('target', InputArgument::REQUIRED, 'Location name or id')
-			->addArgument('size', InputArgument::OPTIONAL, 'Size like 500M, 20G, 2T, or "none"; omit to show the current limit')
-			->setHelp("A backup that would exceed the limit stops with an error and administrators are notified.\n"
-				. "Note: with versioning or Object Lock on the location, removed data keeps using space there\n"
-				. "until it expires; keep the limit below what you are willing to pay for.");
-	}
-
-	protected function execute(InputInterface $input, OutputInterface $output): int {
-		$t = $this->targets->get($input->getArgument('target'));
-		$size = $input->getArgument('size');
-		if ($size !== null) {
-			if (strtolower($size) === 'none') {
-				$t = $this->targets->setMaxBytes($t, null);
-			} elseif (preg_match('/^(\d+(?:\.\d+)?)\s*([KMGT]?)i?B?$/i', $size, $m)) {
-				$factor = ['' => 1, 'K' => 1024, 'M' => 1024 ** 2, 'G' => 1024 ** 3, 'T' => 1024 ** 4][strtoupper($m[2])];
-				$t = $this->targets->setMaxBytes($t, (int)round((float)$m[1] * $factor));
-			} else {
-				$output->writeln('<error>Use a size like 500M, 20G or 2T, or "none".</error>');
-				return 1;
-			}
-		}
-		$used = $this->targets->repository($t)->storedBytes();
-		$output->writeln(sprintf('%s: %.2f GiB stored, limit %s', $t->getName(), $used / 1073741824,
-			$t->getMaxBytes() === null ? 'none' : sprintf('%.2f GiB', $t->getMaxBytes() / 1073741824)));
-		return 0;
-	}
-}

lib/Command/TargetList.php

@@ -13,7 +13,7 @@ use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class TargetList extends Base {
+class TargetList extends Base {
 	public function __construct(
 		private TargetService $targets,
 	) {

lib/Command/TargetRemove.php

@@ -13,7 +13,7 @@ use Symfony\Component\Console\Input\InputArgument;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class TargetRemove extends Command {
+class TargetRemove extends Command {
 	public function __construct(
 		private TargetService $targets,
 		private \OCA\NgBackup\Service\AlertService $alerts,

lib/Command/TargetTrustCurrent.php

@@ -22,7 +22,7 @@ use Symfony\Component\Console\Question\Question;
  * legitimate cases (e.g. the location was restored from the provider's own snapshot), only from
  * occ, audited and announced to all administrators.
  */
-final class TargetTrustCurrent extends Command {
+class TargetTrustCurrent extends Command {
 	public function __construct(
 		private TargetService $targets,
 		private IAppConfig $appConfig,

lib/Command/Trash.php

@@ -15,7 +15,7 @@ use Symfony\Component\Console\Input\InputArgument;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class Trash extends Command {
+class Trash extends Command {
 	public function __construct(
 		private TargetService $targets,
 		private KeyService $keys,

lib/Command/TrashRestore.php

@@ -14,7 +14,7 @@ use Symfony\Component\Console\Input\InputArgument;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-final class TrashRestore extends Command {
+class TrashRestore extends Command {
 	public function __construct(
 		private TargetService $targets,
 		private PruneService $prune,

lib/Command/Verify.php

@@ -1,81 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Command;
-
-use OCA\NgBackup\Service\TargetService;
-use OCA\NgBackup\Service\VerifyService;
-use Symfony\Component\Console\Command\Command;
-use Symfony\Component\Console\Input\InputArgument;
-use Symfony\Component\Console\Input\InputInterface;
-use Symfony\Component\Console\Input\InputOption;
-use Symfony\Component\Console\Output\OutputInterface;
-
-final class Verify extends Command {
-	public function __construct(
-		private TargetService $targets,
-		private VerifyService $verify,
-	) {
-		parent::__construct();
-	}
-
-	protected function configure(): void {
-		$this->setName('backup:verify')
-			->setDescription('Checksum audit of a snapshot: every blob it needs must be in the (freshly re-checked) index and its pack present')
-			->addArgument('target', InputArgument::REQUIRED, 'Location name or id')
-			->addArgument('snapshot', InputArgument::REQUIRED, 'Snapshot id (see backup:list)')
-			->addOption('deep', null, InputOption::VALUE_NONE, 'Also download and decrypt every blob (verifies its authentication tag and content hash, not just that it is listed); much slower')
-			->setHelp(<<<'HELP'
-Without --deep this re-downloads and re-authenticates the index (never trusting the local cache)
-and confirms every blob the snapshot needs is listed and its pack is present -- fast, no blob
-content is read, so it cannot by itself catch a truncated or bit-rotted pack. With --deep every
-blob is also downloaded and decrypted, which fails loudly on exactly that even if the index still
-lists it -- the same verification an actual restore would do, run here deliberately instead of
-waiting to find out during one.
-
-Run this periodically (cron, picking a sample of recent snapshots) rather than only right before
-you'd need to rely on a restore.
-
-Examples:
-  occ backup:verify offsite 537bf7e9c1a4...
-  occ backup:verify offsite 537bf7e9c1a4... --deep
-HELP);
-	}
-
-	protected function execute(InputInterface $input, OutputInterface $output): int {
-		try {
-			$target = $this->targets->get($input->getArgument('target'));
-			$ref = (string)$input->getArgument('snapshot');
-			$deep = (bool)$input->getOption('deep');
-			$result = str_starts_with($ref, 'users/')
-				? $this->verify->verifyUserExport($target, $ref, $deep)
-				: $this->verify->verify($target, $ref, $deep);
-		} catch (\Throwable $e) {
-			$output->writeln('<error>' . $e->getMessage() . '</error>');
-			return 1;
-		}
-		$output->writeln(sprintf('%d files, %d blobs checked%s.', $result['filesChecked'], $result['blobsChecked'],
-			$deep ? sprintf(' (%.1f MiB decrypted)', $result['bytesChecked'] / 1048576) : ''));
-		if ($result['missing'] !== []) {
-			$output->writeln('<error>' . count($result['missing']) . ' blob(s) missing from the index:</error> ' . implode(', ', $result['missing']));
-		}
-		if ($result['failed'] !== []) {
-			$output->writeln('<error>' . count($result['failed']) . ' blob(s) failed verification (corrupted or tampered):</error> ' . implode(', ', $result['failed']));
-		}
-		if ($result['unreadable'] !== []) {
-			$output->writeln('<error>' . count($result['unreadable']) . ' blob(s) could not be read from the location</error> (often a temporary storage '
-				. 'or network error: run the check again; if the same blobs stay unreadable, their pack may be damaged or truncated): '
-				. implode(', ', $result['unreadable']));
-			$output->writeln('Last read error: ' . $result['readError']);
-		}
-		if ($result['missing'] === [] && $result['failed'] === [] && $result['unreadable'] === []) {
-			$output->writeln('<info>OK</info>');
-			return 0;
-		}
-		return 1;
-	}
-}

lib/Controller/AdminApiController.php

@@ -32,7 +32,7 @@ use OCP\IUserSession;
  * JSON API for the admin settings page. Every method requires an admin (the AppFramework
  * default for controllers without NoAdminRequired) and a valid CSRF token.
  */
-final class AdminApiController extends Controller {
+class AdminApiController extends Controller {
 	public function __construct(
 		IRequest $request,
 		private KeyService $keys,
@@ -55,8 +55,7 @@ final class AdminApiController extends Controller {
 		$targets = [];
 		foreach ($this->targets->list() as $t) {
 			$targets[] = ['id' => $t->getId(), 'name' => $t->getName(), 'backend' => $t->getBackend(), 'path' => $t->getBasePath(),
-				'repositoryId' => $t->getRepositoryId(), 'createdAt' => $t->getCreatedAt(), 'appendOnly' => (bool)$t->getAppendOnly(),
-				'maxBytes' => $t->getMaxBytes(), 'storedBytes' => $this->alerts->lastStoredBytes($t)];
+				'repositoryId' => $t->getRepositoryId(), 'createdAt' => $t->getCreatedAt()];
 		}
 		$runs = array_map(fn (Run $r) => $this->runJson($r), $this->runs->findRecent(15));
 		return new JSONResponse([
@@ -168,26 +167,15 @@ final class AdminApiController extends Controller {
 		return new JSONResponse($this->targets->availableBackends());
 	}
 
-	#[PasswordConfirmationRequired]
-	public function addTarget(string $name, string $backend, string $auth, array $options = [], string $path = 'ng_backup', ?float $maxGb = null): JSONResponse {
+	public function addTarget(string $name, string $backend, string $auth, array $options = [], string $path = 'ng_backup'): JSONResponse {
 		try {
 			$r = $this->targets->add($name, $backend, $auth, $options, $path);
-			if ($maxGb !== null && $maxGb > 0) {
-				$this->targets->setMaxBytes($r['target'], (int)round($maxGb * 1073741824));
-			}
 		} catch (\Throwable $e) {
 			return new JSONResponse(['error' => $e->getMessage()], Http::STATUS_BAD_REQUEST);
 		}
 		return new JSONResponse(['id' => $r['target']->getId(), 'created' => $r['created']]);
 	}
 
-	/** Size limit in GiB; null or 0 = unlimited. */
-	#[PasswordConfirmationRequired]
-	public function setTargetLimit(int $id, ?float $maxGb = null): JSONResponse {
-		$t = $this->targets->setMaxBytes($this->targets->get((string)$id), ($maxGb !== null && $maxGb > 0) ? (int)round($maxGb * 1073741824) : null);
-		return new JSONResponse(['maxBytes' => $t->getMaxBytes()]);
-	}
-
 	#[PasswordConfirmationRequired]
 	public function removeTarget(int $id): JSONResponse {
 		$target = $this->targets->get((string)$id);
@@ -271,17 +259,8 @@ final class AdminApiController extends Controller {
 	}
 
 	private function runJson(Run $r): array {
-		$snapshot = null;
-		if ($r->getSnapshotId() !== null) {
-			try {
-				$s = $this->snapshots->findOne($r->getTargetId(), $r->getSnapshotId());
-				$snapshot = ['createdAt' => $s->getCreatedAt(), 'label' => $s->getLabel()];
-			} catch (\Throwable) {
-				// Snapshot already pruned or trashed: the run keeps its id, just not the date.
-			}
-		}
 		return ['id' => $r->getId(), 'targetId' => $r->getTargetId(), 'kind' => $r->getKind(), 'status' => $r->getStatus(),
-			'phase' => $r->getPhase(), 'snapshotId' => $r->getSnapshotId(), 'snapshot' => $snapshot, 'startedAt' => $r->getStartedAt(),
+			'phase' => $r->getPhase(), 'snapshotId' => $r->getSnapshotId(), 'startedAt' => $r->getStartedAt(),
 			'updatedAt' => $r->getUpdatedAt(), 'finishedAt' => $r->getFinishedAt(), 'error' => $r->getError(),
 			'stats' => json_decode($r->getStats() ?? 'null', true)];
 	}

lib/Crypto/CryptoException.php

@@ -7,5 +7,5 @@ declare(strict_types=1);
 
 namespace OCA\NgBackup\Crypto;
 
-final class CryptoException extends \RuntimeException {
+class CryptoException extends \RuntimeException {
 }

lib/Crypto/KeyRing.php

@@ -96,12 +96,6 @@ final class KeyRing {
 	/** @param array{v:int, salt:string, ops:int, mem:int, nonce:string, key:string} $wrapped */
 	public static function unwrap(array $wrapped, #[\SensitiveParameter] string $passphrase): self {
 		$b64 = static fn (string $s): string => sodium_base642bin($s, SODIUM_BASE64_VARIANT_ORIGINAL);
-		// ops/mem come from unauthenticated JSON (kit file, repository config): bound them, so a
-		// damaged or crafted file cannot make the KDF use unbounded memory or time.
-		if ($wrapped['ops'] < SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE || $wrapped['ops'] > SODIUM_CRYPTO_PWHASH_OPSLIMIT_SENSITIVE
-			|| $wrapped['mem'] < SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE || $wrapped['mem'] > SODIUM_CRYPTO_PWHASH_MEMLIMIT_SENSITIVE) {
-			throw new CryptoException('Unsupported key derivation parameters (damaged or foreign key file)');
-		}
 		$kek = sodium_crypto_pwhash(SODIUM_CRYPTO_SECRETBOX_KEYBYTES, $passphrase, $b64($wrapped['salt']),
 			$wrapped['ops'], $wrapped['mem'], SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13);
 		$master = sodium_crypto_secretbox_open($b64($wrapped['key']), $b64($wrapped['nonce']), $kek);

lib/Crypto/StreamCipher.php

@@ -122,7 +122,6 @@ final class StreamCipher {
 	/** fread() may return short reads on network streams; keep reading until $length or EOF. */
 	private static function readFull($in, int $length): string {
 		$buffer = '';
-		$empty = 0;
 		while (strlen($buffer) < $length && !feof($in)) {
 			$chunk = fread($in, $length - strlen($buffer));
 			if ($chunk === false) {
@@ -133,15 +132,8 @@ final class StreamCipher {
 				if (feof($in)) {
 					break;
 				}
-				// A stalled network stream returns '' without EOF forever: back off, then give up
-				// (about a minute) instead of spinning at full CPU until the lease expires.
-				if (++$empty > 600) {
-					throw new CryptoException('Read stalled');
-				}
-				usleep(100000);
 				continue;
 			}
-			$empty = 0;
 			$buffer .= $chunk;
 		}
 		return $buffer;

lib/Db/AppConfigCatalogAnchor.php

@@ -12,7 +12,7 @@ use OCA\NgBackup\Repository\ICatalogAnchor;
 use OCP\IAppConfig;
 
 /** Keeps the newest catalog generation seen per repository in the app config (outside the location). */
-final class AppConfigCatalogAnchor implements ICatalogAnchor {
+class AppConfigCatalogAnchor implements ICatalogAnchor {
 	public function __construct(
 		private IAppConfig $appConfig,
 	) {

lib/Db/DbDumper.php

@@ -132,7 +132,7 @@ final class DbDumper {
 	 *
 	 * @param array{tables: array<string, array{blobs: list<string>, rows: int}>} $manifest
 	 */
-	public function restore(Repository $repo, array $manifest, ?array &$report = null, ?callable $heartbeat = null): int {
+	public function restore(Repository $repo, array $manifest, ?array &$report = null): int {
 		$sm = $this->db->createSchemaManager();
 		$existing = array_flip($sm->listTableNames());
 		$total = 0;
@@ -175,9 +175,6 @@ final class DbDumper {
 					if (count($batch) >= self::INSERT_ROWS) {
 						$total += $this->insertBatch($table, $columns, $batch, $binary);
 						$batch = [];
-						if ($heartbeat !== null) {
-							$heartbeat();
-						}
 					}
 				}
 				if ($batch !== []) {
@@ -256,11 +253,7 @@ final class DbDumper {
 					} elseif (is_string($row[$i]) && !mb_check_encoding($row[$i], 'UTF-8')) {
 						// Keep invalid UTF-8 byte-exact instead of substituting characters.
 						$row[$i] = ['$b' => base64_encode($row[$i])];
-					} elseif (is_float($row[$i])) {
-						// var_export uses serialize_precision (shortest exact form), not the lossy
-						// 14-digit 'precision' of a (string) cast.
-						$row[$i] = var_export($row[$i], true);
-					} elseif (is_int($row[$i]) || is_bool($row[$i])) {
+					} elseif (is_int($row[$i]) || is_float($row[$i]) || is_bool($row[$i])) {
 						// Normalise: drivers differ in returning numbers as int or string.
 						$row[$i] = (string)(is_bool($row[$i]) ? (int)$row[$i] : $row[$i]);
 					}

lib/Db/DbIndexCache.php

@@ -11,7 +11,7 @@ use OCA\NgBackup\Repository\IIndexCache;
 use OCP\DB\Exception;
 use OCP\IDBConnection;
 
-final class DbIndexCache implements IIndexCache {
+class DbIndexCache implements IIndexCache {
 	public function __construct(
 		private IDBConnection $db,
 	) {

lib/Db/Run.php

@@ -33,7 +33,7 @@ use OCP\AppFramework\Db\Entity;
  * @method int|null getFinishedAt()
  * @method void setFinishedAt(?int $v)
  */
-final class Run extends Entity {
+class Run extends Entity {
 	public const RUNNING = 'running';
 	public const DONE = 'done';
 	public const FAILED = 'failed';

lib/Db/RunMapper.php

@@ -12,7 +12,7 @@ use OCP\DB\QueryBuilder\IQueryBuilder;
 use OCP\IDBConnection;
 
 /** @template-extends QBMapper<Run> */
-final class RunMapper extends QBMapper {
+class RunMapper extends QBMapper {
 	public function __construct(IDBConnection $db) {
 		parent::__construct($db, 'ngb_runs', Run::class);
 	}
@@ -43,17 +43,6 @@ final class RunMapper extends QBMapper {
 		return $this->findEntities($qb);
 	}
 
-	/** @return list<Run> runs of $kind started at or after $since, newest first */
-	public function startedSince(int $targetId, string $kind, int $since): array {
-		$qb = $this->db->getQueryBuilder();
-		$qb->select('*')->from($this->getTableName())
-			->where($qb->expr()->eq('target_id', $qb->createNamedParameter($targetId, IQueryBuilder::PARAM_INT)))
-			->andWhere($qb->expr()->eq('kind', $qb->createNamedParameter($kind)))
-			->andWhere($qb->expr()->gte('started_at', $qb->createNamedParameter($since, IQueryBuilder::PARAM_INT)))
-			->orderBy('id', 'DESC');
-		return $this->findEntities($qb);
-	}
-
 	public function lastFinished(int $targetId, string $kind): ?Run {
 		$qb = $this->db->getQueryBuilder();
 		$qb->select('*')->from($this->getTableName())

lib/Db/Snapshot.php

@@ -25,7 +25,7 @@ use OCP\AppFramework\Db\Entity;
  * @method int|null getBytes()
  * @method void setBytes(?int $v)
  */
-final class Snapshot extends Entity {
+class Snapshot extends Entity {
 	protected int $targetId = 0;
 	protected string $snapshotId = '';
 	protected string $kind = '';

lib/Db/SnapshotMapper.php

@@ -12,7 +12,7 @@ use OCP\DB\QueryBuilder\IQueryBuilder;
 use OCP\IDBConnection;
 
 /** @template-extends QBMapper<Snapshot> */
-final class SnapshotMapper extends QBMapper {
+class SnapshotMapper extends QBMapper {
 	public function __construct(IDBConnection $db) {
 		parent::__construct($db, 'ngb_snapshots', Snapshot::class);
 	}

lib/Db/Target.php

@@ -24,12 +24,10 @@ use OCP\AppFramework\Db\Entity;
  * @method void setRepositoryId(?string $v)
  * @method bool|null getAppendOnly()
  * @method void setAppendOnly(bool $v)
- * @method int|null getMaxBytes()
- * @method void setMaxBytes(?int $v)
  * @method int getCreatedAt()
  * @method void setCreatedAt(int $v)
  */
-final class Target extends Entity {
+class Target extends Entity {
 	protected string $name = '';
 	protected string $backend = '';
 	protected string $auth = '';
@@ -38,11 +36,9 @@ final class Target extends Entity {
 	protected ?string $repositoryId = null;
 	protected int $createdAt = 0;
 	protected ?bool $appendOnly = null;
-	protected ?int $maxBytes = null;
 
 	public function __construct() {
 		$this->addType('createdAt', 'integer');
 		$this->addType('appendOnly', 'boolean');
-		$this->addType('maxBytes', 'integer');
 	}
 }

lib/Db/TargetMapper.php

@@ -11,7 +11,7 @@ use OCP\AppFramework\Db\QBMapper;
 use OCP\IDBConnection;
 
 /** @template-extends QBMapper<Target> */
-final class TargetMapper extends QBMapper {
+class TargetMapper extends QBMapper {
 	public function __construct(IDBConnection $db) {
 		parent::__construct($db, 'ngb_targets', Target::class);
 	}

lib/Job/BackupRun.php

@@ -49,11 +49,9 @@ final class BackupRun {
 	public static function step(Repository $repo, array $state, float $deadline): array {
 		$state['steps']++;
 		if ($state['phase'] === 'files') {
-			$stats = $state['stats'];
-			$walker = new TreeWalker($state['roots'], $state['exclude'], function (string $logical) use (&$state, &$stats): void {
-				self::recordUnreadable($state, $stats, $logical);
-			});
+			$walker = new TreeWalker($state['roots'], $state['exclude']);
 			$parent = new ParentCursor($repo, $state['parent'], $state['parentPos']);
+			$stats = $state['stats'];
 			$lines = [];
 			$finishedWalk = true;
 
@@ -70,20 +68,15 @@ final class BackupRun {
 					$stats['reused']++;
 				} else {
 					$cur = $state['cur'];
-					if ($cur !== null && $cur['path'] === $logical && $cur['version'] !== $version) {
-						// Changed since the previous step: start over, unless it keeps changing.
-						if (self::countRetry($state, $stats, $logical)) {
-							$cur['version'] = $version;
-						} else {
-							$cur = null;
+					if ($cur === null || $cur['path'] !== $logical || $cur['version'] !== $version) {
+						if ($cur !== null && $cur['path'] === $logical) {
+							$stats['retried'] = ($stats['retried'] ?? 0) + 1; // changed since the previous step
 						}
-					}
-					if ($cur === null || $cur['path'] !== $logical) {
 						$cur = ['path' => $logical, 'offset' => 0, 'blobs' => [], 'version' => $version];
 					}
-					$fh = @fopen($path, 'rb');
+					$fh = fopen($path, 'rb');
 					if ($fh === false) {
-						self::recordUnreadable($state, $stats, $logical);
+						$stats['unreadable'] = ($stats['unreadable'] ?? 0) + 1;
 						$state['cur'] = null;
 						continue;
 					}
@@ -98,17 +91,12 @@ final class BackupRun {
 						}
 					}
 					fclose($fh);
-					$now = Repository::fileVersion($path);
-					if ($now !== $cur['version']) {
-						if (!self::countRetry($state, $stats, $logical)) {
-							// Changed while reading: read it again from the start (now or next step).
-							$state['cur'] = null;
-							$finishedWalk = false;
-							break;
-						}
-						// Keeps changing (a live database, VM image or log): keep what was read,
-						// like any copy of a file in use, and report it instead of retrying forever.
-						$cur['version'] = $now;
+					if (Repository::fileVersion($path) !== $cur['version']) {
+						// Changed while reading: read it again from the start (now or next step).
+						$stats['retried'] = ($stats['retried'] ?? 0) + 1;
+						$state['cur'] = null;
+						$finishedWalk = false;
+						break;
 					}
 					if (!$complete) {
 						$state['cur'] = $cur;
@@ -116,7 +104,6 @@ final class BackupRun {
 						break;
 					}
 					$blobs = $cur['blobs'];
-					$size = $cur['offset'];
 					$state['cur'] = null;
 					$stats['read']++;
 				}
@@ -146,66 +133,19 @@ final class BackupRun {
 
 		if ($state['phase'] === 'finish') {
 			$segments = $state['segments'];
-			$repo->putSnapshot($state['snapshot'],
+			$repo->writeSnapshot($state['snapshot'],
 				['time' => $state['started'], 'parent' => $state['parent'], 'label' => $state['label'],
-					'roots' => array_keys($state['roots']), 'stats' => $state['stats'],
-					'warnings' => self::warnings($state)] + $state['meta'],
+					'roots' => array_keys($state['roots']), 'stats' => $state['stats']] + $state['meta'],
 				(function () use ($repo, $segments) {
 					foreach ($segments as $blobs) {
 						yield from $repo->readLines($blobs);
 					}
 				})());
-			$state['phase'] = 'commit';
+			$state['phase'] = 'done';
 		}
 		return $state;
 	}
 
-	/**
-	 * A file or directory that could not be read: it is missing from this snapshot. Remembered (first
-	 * 1000, deduplicated across steps) so the run can report it instead of silently succeeding.
-	 */
-	private static function recordUnreadable(array &$state, array &$stats, string $logical): void {
-		if (isset($state['unreadable'][$logical])) {
-			return;
-		}
-		if (count($state['unreadable'] ?? []) < 1000) {
-			$state['unreadable'][$logical] = true;
-		}
-		$stats['unreadable'] = ($stats['unreadable'] ?? 0) + 1;
-	}
-
-	/** @return array{unreadable: list<string>, changing: list<string>} examples for the report (first 50 each) */
-	public static function warnings(array $state): array {
-		return [
-			'unreadable' => array_slice(array_map('strval', array_keys($state['unreadable'] ?? [])), 0, 50),
-			'changing' => array_slice(array_map('strval', array_values($state['changing'] ?? [])), 0, 50),
-		];
-	}
-
-	/** Retries of one file that changes while it is read, before its last read is kept anyway. */
-	public const MAX_RETRIES = 3;
-
-	/**
-	 * Count a retry of $logical. Returns true once it has changed MAX_RETRIES times: the caller then
-	 * keeps the data it read, and the file is listed in $state['changing'] (first 50) for the report.
-	 */
-	private static function countRetry(array &$state, array &$stats, string $logical): bool {
-		$stats['retried'] = ($stats['retried'] ?? 0) + 1;
-		$n = (($state['retryPath'] ?? null) === $logical ? (int)($state['retryCount'] ?? 0) : 0) + 1;
-		$state['retryPath'] = $logical;
-		$state['retryCount'] = $n;
-		if ($n < self::MAX_RETRIES) {
-			return false;
-		}
-		if ($n === self::MAX_RETRIES) {
-			$stats['changing'] = ($stats['changing'] ?? 0) + 1;
-			if (count($state['changing'] ?? []) < 50) {
-				$state['changing'][] = $logical;
-			}
-		}
-		return true;
-	}
-
 	private static function readFull($fh, int $length): string {
 		$buffer = '';
 		while (strlen($buffer) < $length && !feof($fh)) {

lib/Job/TreeWalker.php

@@ -23,8 +23,6 @@ final class TreeWalker {
 	public function __construct(
 		private array $roots,
 		private array $exclude = [],
-		/** Called with the logical path of a directory that cannot be listed. */
-		private ?\Closure $onUnreadable = null,
 	) {
 	}
 
@@ -59,9 +57,6 @@ final class TreeWalker {
 		}
 		$names = @scandir($abs);
 		if ($names === false) {
-			if ($this->onUnreadable !== null) {
-				($this->onUnreadable)($logical === '' ? '/' : $logical);
-			}
 			return;
 		}
 		$names = array_values(array_diff($names, ['.', '..']));

lib/Migration/Version000001Date20261002000000.php

@@ -13,7 +13,7 @@ use OCP\DB\Types;
 use OCP\Migration\IOutput;
 use OCP\Migration\SimpleMigrationStep;
 
-final class Version000001Date20261002000000 extends SimpleMigrationStep {
+class Version000001Date20261002000000 extends SimpleMigrationStep {
 	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
 		/** @var ISchemaWrapper $schema */
 		$schema = $schemaClosure();

lib/Migration/Version000002Date20261002010000.php

@@ -14,7 +14,7 @@ use OCP\Migration\IOutput;
 use OCP\Migration\SimpleMigrationStep;
 
 /** Local cache of the per-pack index files, so opening a repository does not download them all. */
-final class Version000002Date20261002010000 extends SimpleMigrationStep {
+class Version000002Date20261002010000 extends SimpleMigrationStep {
 	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
 		/** @var ISchemaWrapper $schema */
 		$schema = $schemaClosure();

lib/Migration/Version000003Date20261002020000.php

@@ -14,7 +14,7 @@ use OCP\Migration\IOutput;
 use OCP\Migration\SimpleMigrationStep;
 
 /** Append-only locations: NG Backup never deletes anything there (cleanup by the location's own lifecycle rules). */
-final class Version000003Date20261002020000 extends SimpleMigrationStep {
+class Version000003Date20261002020000 extends SimpleMigrationStep {
 	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
 		/** @var ISchemaWrapper $schema */
 		$schema = $schemaClosure();

lib/Migration/Version000004Date20261002030000.php

@@ -1,28 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Migration;
-
-use Closure;
-use OCP\DB\ISchemaWrapper;
-use OCP\DB\Types;
-use OCP\Migration\IOutput;
-use OCP\Migration\SimpleMigrationStep;
-
-/** Optional size limit per location (cost control; S3 has no bucket quota). */
-final class Version000004Date20261002030000 extends SimpleMigrationStep {
-	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
-		/** @var ISchemaWrapper $schema */
-		$schema = $schemaClosure();
-		$t = $schema->getTable('ngb_targets');
-		if (!$t->hasColumn('max_bytes')) {
-			$t->addColumn('max_bytes', Types::BIGINT, ['notnull' => false, 'unsigned' => true]);
-			return $schema;
-		}
-		return null;
-	}
-}

lib/Migration/Version000005Date20261002040000.php

@@ -1,33 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Migration;
-
-use Closure;
-use OCP\DB\ISchemaWrapper;
-use OCP\DB\Types;
-use OCP\Migration\IOutput;
-use OCP\Migration\SimpleMigrationStep;
-
-/** Leases with an expiry: a killed process cannot block a location for longer than its lease. */
-final class Version000005Date20261002040000 extends SimpleMigrationStep {
-	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
-		/** @var ISchemaWrapper $schema */
-		$schema = $schemaClosure();
-		if ($schema->hasTable('ngb_leases')) {
-			return null;
-		}
-		$t = $schema->createTable('ngb_leases');
-		$t->addColumn('id', Types::STRING, ['notnull' => true, 'length' => 32]);
-		$t->addColumn('name', Types::STRING, ['notnull' => true, 'length' => 128]);
-		$t->addColumn('mode', Types::STRING, ['notnull' => true, 'length' => 1]);
-		$t->addColumn('expires_at', Types::BIGINT, ['notnull' => true, 'unsigned' => true]);
-		$t->setPrimaryKey(['id']);
-		$t->addIndex(['name'], 'ngb_leases_name');
-		return $schema;
-	}
-}

lib/Notification/Notifier.php

@@ -14,7 +14,7 @@ use OCP\Notification\INotification;
 use OCP\Notification\INotifier;
 use OCP\Notification\UnknownNotificationException;
 
-final class Notifier implements INotifier {
+class Notifier implements INotifier {
 	public function __construct(
 		private IFactory $l10n,
 		private IURLGenerator $url,
@@ -42,14 +42,6 @@ final class Notifier implements INotifier {
 					: $l->t('Backup to %s failed', [$p['target']]));
 				$notification->setParsedMessage((string)($p['error'] ?? ''));
 				break;
-			case 'run_warnings':
-				$notification->setParsedSubject($l->t('Backup to %1$s finished with warnings: %2$s unreadable, %3$s changed while being read', [$p['target'], $p['unreadable'], $p['changing']]));
-				$notification->setParsedMessage($l->t('Unreadable files and folders are missing from this backup (check their permissions). Files that kept changing were saved as they were while being read. Examples: %s', [$p['examples'] ?? '']));
-				break;
-			case 'quota_warning':
-				$notification->setParsedSubject($l->t('Backup location %1$s is at %2$s%% of its limit (%3$s of %4$s)', [$p['target'], $p['percent'], $p['used'], $p['limit']]));
-				$notification->setParsedMessage($l->t('Backups stop when the limit is reached. Raise the limit, or let the retention policy remove older backups.'));
-				break;
 			case 'backup_stale':
 				$notification->setParsedSubject($l->t('No successful backup to %1$s since %2$s', [$p['target'], $p['since']]));
 				$notification->setParsedMessage($l->t('Check the backup settings and the server log.'));
@@ -66,8 +58,6 @@ final class Notifier implements INotifier {
 					'catalog_trusted' => $l->t('%1$s accepted an older state of backup location %2$s (catalog generation %3$s)', [$who, $p['target'] ?? '', $p['generation'] ?? '']),
 					'slot_added' => $l->t('%1$s added backup passphrase slot %2$s (%3$s); download and confirm the new recovery kit', [$who, $p['slot'] ?? '', $p['label'] ?? '']),
 					'slot_replaced' => $l->t('%1$s set a new passphrase for backup key slot %2$s (%3$s); download and confirm the new recovery kit', [$who, $p['slot'] ?? '', $p['label'] ?? '']),
-					'user_export_retention_changed' => $l->t('%1$s changed how many exports per user are kept to %2$s', [$who, $p['keep'] ?? '']),
-					'user_exports_forgotten' => $l->t('%1$s removed %2$s per-user exports from %3$s', [$who, $p['count'] ?? '', $p['target'] ?? '']),
 					'slot_removed' => $l->t('%1$s removed backup passphrase slot %2$s; download and confirm the new recovery kit', [$who, $p['slot'] ?? '']),
 					default => $l->t('NG Backup security event'),
 				});

lib/Repository/BlobIndex.php

@@ -139,15 +139,6 @@ final class BlobIndex {
 		}
 	}
 
-	/** Bytes of all blobs in the index (encrypted size, i.e. what is stored in packs). */
-	public function storedBytes(): int {
-		$total = 0;
-		foreach ($this->blobs as [, , $length]) {
-			$total += $length;
-		}
-		return $total;
-	}
-
 	public function count(): int {
 		return count($this->blobs);
 	}

lib/Repository/Catalog.php

@@ -28,8 +28,6 @@ final class Catalog {
 	public array $snapshots = [];
 	/** @var array<string, true> */
 	public array $trash = [];
-	/** @var array<string, true> manifest path => true, for a per-user export (users/<uid>/<exportId>) */
-	public array $userExports = [];
 	public string $hash = '';
 
 	public function __construct(
@@ -41,7 +39,7 @@ final class Catalog {
 	}
 
 	/** Load and verify the newest catalog; create the first one for repositories that have none. */
-	public function load(callable $listSnapshots, callable $listTrash, callable $listUserExports): void {
+	public function load(callable $listSnapshots, callable $listTrash): void {
 		$gens = $this->generations();
 		if ($gens === []) {
 			// First use (new or pre-catalog repository): adopt the current state as generation 1.
@@ -51,7 +49,6 @@ final class Catalog {
 			}
 			$this->snapshots = array_fill_keys($listSnapshots(), true);
 			$this->trash = array_fill_keys($listTrash(), true);
-			$this->userExports = array_fill_keys($listUserExports(), true);
 			$this->write();
 			return;
 		}
@@ -79,23 +76,14 @@ final class Catalog {
 		$this->hash = $hash;
 		$this->snapshots = array_fill_keys($data['snapshots'], true);
 		$this->trash = array_fill_keys($data['trash'], true);
-		// Catalogs written before user exports existed have no such key: default to empty rather
-		// than adopting the location's current users/ listing (that would skip verification).
-		$this->userExports = array_fill_keys($data['userExports'] ?? [], true);
 		$this->anchor?->set($this->repositoryId, $this->gen, $this->hash);
 	}
 
 	/** Write the next generation after the in-memory state was changed. */
 	public function write(): void {
 		$next = $this->gen + 1;
-		// Two writers starting from the same generation would otherwise overwrite each other
-		// silently and break the chain for whichever server anchored the lost write.
-		if ($this->backend->exists($this->path($next))) {
-			throw new RepositoryException("Catalog generation $next was written by another process at the same time; try again");
-		}
 		$plain = json_encode(['repository' => $this->repositoryId, 'gen' => $next, 'time' => gmdate('c'), 'prev' => $this->hash,
-			'snapshots' => array_keys($this->snapshots), 'trash' => array_keys($this->trash),
-			'userExports' => array_keys($this->userExports)], JSON_THROW_ON_ERROR);
+			'snapshots' => array_keys($this->snapshots), 'trash' => array_keys($this->trash)], JSON_THROW_ON_ERROR);
 		$encrypted = $this->cipher->encryptString($plain, $this->ad($next));
 		$stream = fopen('php://memory', 'w+b');
 		fwrite($stream, $encrypted);

lib/Repository/PackWriter.php

@@ -32,7 +32,6 @@ final class PackWriter {
 		private StreamCipher $cipher,
 		private BlobIndex $index,
 		private int $targetSize = 32 * 1048576,
-		private ?int $maxBytes = null,
 	) {
 		$this->reset();
 	}
@@ -65,12 +64,6 @@ final class PackWriter {
 		if ($this->entries === []) {
 			return;
 		}
-		if ($this->maxBytes !== null && $this->index->storedBytes() + $this->size > $this->maxBytes) {
-			$this->index->dropPending(array_column($this->entries, 'id'));
-			$this->reset();
-			throw new QuotaExceededException(sprintf('Storage limit of this location reached (%.1f GiB): backup stopped',
-				$this->maxBytes / 1073741824));
-		}
 		$packId = bin2hex(random_bytes(16));
 		$header = $this->cipher->encryptString(json_encode($this->entries, JSON_THROW_ON_ERROR), 'pack-header:' . $packId);
 		fwrite($this->buffer, $header . pack('N', strlen($header)));

lib/Repository/QuotaExceededException.php

@@ -1,11 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Repository;
-
-final class QuotaExceededException extends RepositoryException {
-}

lib/Repository/Repository.php

@@ -28,13 +28,10 @@ final class Repository {
 	public const FORMAT = 1;
 	public const BLOB_SIZE = 4 * 1048576;
 	private const FLAG_DEFLATE = 1;
-	/** Reads per blob in a deep verify before it is reported as unreadable (not corrupted). */
-	private const VERIFY_READ_ATTEMPTS = 3;
 
 	private StreamCipher $cipher;
 	private BlobIndex $index;
 	private ?PackWriter $runPacks = null;
-	private ?int $maxBytes = null;
 	private Catalog $catalog;
 
 	private function __construct(
@@ -93,17 +90,7 @@ final class Repository {
 		$this->catalog = new Catalog($this->backend, $this->cipher, $this->repositoryId, $anchor);
 		$this->catalog->load(
 			fn () => array_map('basename', $this->backend->list('snapshots')),
-			fn () => array_map('basename', $this->backend->list('trash/info')),
-			fn () => $this->backend->list('users'));
-	}
-
-	/** Refuse uploads that would make the stored data larger than this (null = no limit). */
-	public function setMaxBytes(?int $maxBytes): void {
-		$this->maxBytes = $maxBytes;
-	}
-
-	public function storedBytes(): int {
-		return $this->index->storedBytes();
+			fn () => array_map('basename', $this->backend->list('trash/info')));
 	}
 
 	/** Current catalog generation (for status and tests). */
@@ -158,7 +145,7 @@ final class Repository {
 	public function backupDirectory(string $source, ?string $parent = null, string $label = ''): array {
 		$source = rtrim($source, '/');
 		$previous = $parent !== null ? $this->loadEntries($parent) : [];
-		$packs = new PackWriter($this->backend, $this->cipher, $this->index, 32 * 1048576, $this->maxBytes);
+		$packs = new PackWriter($this->backend, $this->cipher, $this->index);
 		$stats = ['files' => 0, 'reused' => 0, 'read' => 0, 'newBlobs' => 0, 'dupBlobs' => 0, 'uploaded' => 0];
 
 		$tree = fopen('php://temp/maxmemory:' . (4 * 1048576), 'w+b');
@@ -192,15 +179,8 @@ final class Repository {
 		return ['snapshot' => $snapshotId] + $stats;
 	}
 
-	/**
-	 * Restore a snapshot (or only paths starting with $prefix) into a local directory.
-	 *
-	 * @param bool $stripPrefix write "$target/<path without $prefix>" instead of
-	 *             "$target/<full logical path>" (disaster recovery: restoring e.g. "data/" or
-	 *             "config/" directly into the real data/config directory, not a subdirectory
-	 *             named after the prefix). Ignored when $prefix is '' (nothing to strip).
-	 */
-	public function restore(string $snapshotId, string $target, string $prefix = '', bool $stripPrefix = false, ?callable $heartbeat = null): int {
+	/** Restore a snapshot (or only paths starting with $prefix) into a local directory. */
+	public function restore(string $snapshotId, string $target, string $prefix = ''): int {
 		if ($prefix !== '' && !self::isSafePath(rtrim($prefix, '/'))) {
 			throw new RepositoryException('Invalid path prefix');
 		}
@@ -209,8 +189,7 @@ final class Repository {
 			if ($prefix !== '' && !str_starts_with($entry['p'], $prefix)) {
 				continue;
 			}
-			$relPath = ($stripPrefix && $prefix !== '') ? substr($entry['p'], strlen(rtrim($prefix, '/')) + 1) : $entry['p'];
-			$dest = rtrim($target, '/') . '/' . $relPath;
+			$dest = rtrim($target, '/') . '/' . $entry['p'];
 			if (!is_dir(dirname($dest))) {
 				mkdir(dirname($dest), 0700, true);
 			}
@@ -229,22 +208,14 @@ final class Repository {
 			}
 			foreach ($entry['b'] as $id) {
 				fwrite($out, $this->loadBlob($id));
-				if ($heartbeat !== null) {
-					$heartbeat();
-				}
 			}
 			fclose($out);
 			if (filesize($tmp) !== $entry['s']) {
 				unlink($tmp);
 				throw new RepositoryException('Size mismatch restoring ' . $entry['p']);
 			}
-			if (!rename($tmp, $dest)) {
-				@unlink($tmp);
-				throw new RepositoryException('Cannot put the restored file in place: ' . $entry['p']);
-			}
-			if (!touch($dest, $entry['m'])) {
-				throw new RepositoryException('Cannot set the modification time of ' . $entry['p']);
-			}
+			rename($tmp, $dest);
+			touch($dest, $entry['m']);
 			$count++;
 		}
 		return $count;
@@ -255,7 +226,7 @@ final class Repository {
 	 * run is done, so the last pack is uploaded before anything references it.
 	 */
 	public function blobWriter(array &$stats): BlobWriter {
-		$this->runPacks ??= new PackWriter($this->backend, $this->cipher, $this->index, 32 * 1048576, $this->maxBytes);
+		$this->runPacks ??= new PackWriter($this->backend, $this->cipher, $this->index);
 		$packs = $this->runPacks;
 		return new BlobWriter(function (string $data) use ($packs, &$stats): string {
 			return $this->storeBlob($data, $packs, $stats);
@@ -287,7 +258,7 @@ final class Repository {
 
 	/** Store one blob of file data in the current run (deduplicated); returns its id. */
 	public function storeData(string $data, array &$stats): string {
-		$this->runPacks ??= new PackWriter($this->backend, $this->cipher, $this->index, 32 * 1048576, $this->maxBytes);
+		$this->runPacks ??= new PackWriter($this->backend, $this->cipher, $this->index);
 		return $this->storeBlob($data, $this->runPacks, $stats);
 	}
 
@@ -298,17 +269,6 @@ final class Repository {
 	 * @param iterable<string> $lines
 	 */
 	public function writeSnapshot(string $snapshotId, array $meta, iterable $lines): void {
-		$this->putSnapshot($snapshotId, $meta, $lines);
-		$this->recordSnapshot($snapshotId);
-	}
-
-	/**
-	 * Store a snapshot object without touching the catalog. Use recordSnapshot() afterwards, from a
-	 * repository opened inside the catalog lock, so the catalog write builds on the latest generation.
-	 *
-	 * @param iterable<string> $lines
-	 */
-	public function putSnapshot(string $snapshotId, array $meta, iterable $lines): void {
 		$tree = fopen('php://temp/maxmemory:' . (4 * 1048576), 'w+b');
 		fwrite($tree, json_encode(['snapshot' => $snapshotId] + $meta, JSON_THROW_ON_ERROR) . "\n");
 		foreach ($lines as $line) {
@@ -322,9 +282,6 @@ final class Repository {
 		fclose($tree);
 		rewind($encrypted);
 		$this->backend->put('snapshots/' . $snapshotId, $encrypted);
-	}
-
-	public function recordSnapshot(string $snapshotId): void {
 		$this->catalog->snapshots[$snapshotId] = true;
 		$this->catalog->write();
 	}
@@ -378,16 +335,11 @@ final class Repository {
 		$meta = $this->snapshotMeta($snapshotId);
 		$dbInTrash = null;
 		if (isset($meta['db']) && is_string($meta['db']) && $this->backend->exists($meta['db'])) {
-			// Its encryption is bound to its path (object:db/...), which changes on a move, so it
-			// must be decrypted and re-encrypted under the new path, not moved as raw bytes.
 			$dbInTrash = 'trash/' . $meta['db'];
 			$this->putObject($dbInTrash, $this->getObject($meta['db']));
 		}
-		// Copy first, switch the catalog, delete the originals last: a crash at any point leaves
-		// either the old state or the new one plus unreferenced leftovers, never a catalog entry
-		// pointing at a missing object. The snapshot object is bound to its id (not its path),
-		// so it can be copied as raw bytes.
-		$this->copyRaw('snapshots/' . $snapshotId, 'trash/snapshots/' . $snapshotId);
+		// The snapshot object is bound to its id (not its path), so it can be copied as-is.
+		$this->backend->put('trash/snapshots/' . $snapshotId, $this->backend->get('snapshots/' . $snapshotId));
 		$this->putObject('trash/info/' . $snapshotId, json_encode(['forgottenAt' => time(), 'by' => $by, 'db' => $meta['db'] ?? null,
 			'dbInTrash' => $dbInTrash, 'time' => $meta['time'] ?? null, 'label' => $meta['label'] ?? ''], JSON_THROW_ON_ERROR));
 		unset($this->catalog->snapshots[$snapshotId]);
@@ -402,85 +354,18 @@ final class Repository {
 	/** Undo forget(): move a snapshot back from the trash. */
 	public function untrash(string $snapshotId): void {
 		$info = $this->trashInfo($snapshotId);
-		$restoreDb = $info['dbInTrash'] !== null && $this->backend->exists($info['dbInTrash']);
-		if ($restoreDb) {
+		if ($info['dbInTrash'] !== null && $this->backend->exists($info['dbInTrash'])) {
 			$this->putObject($info['db'], $this->getObject($info['dbInTrash']));
+			$this->backend->delete($info['dbInTrash']);
 		}
-		// Same order as forget(): copy, switch the catalog, then delete the trash copies.
-		$this->copyRaw('trash/snapshots/' . $snapshotId, 'snapshots/' . $snapshotId);
+		$this->backend->put('snapshots/' . $snapshotId, $this->backend->get('trash/snapshots/' . $snapshotId));
 		$this->catalog->snapshots[$snapshotId] = true;
 		unset($this->catalog->trash[$snapshotId]);
 		$this->catalog->write();
-		if ($restoreDb) {
-			$this->backend->delete($info['dbInTrash']);
-		}
 		$this->backend->delete('trash/snapshots/' . $snapshotId);
 		$this->backend->delete('trash/info/' . $snapshotId);
 	}
 
-	/** Copy an object as raw bytes, buffered locally (remote read streams cannot be uploaded directly everywhere). */
-	private function copyRaw(string $from, string $to): void {
-		$in = $this->backend->get($from);
-		$buffer = fopen('php://temp/maxmemory:' . (4 * 1048576), 'w+b');
-		if ($buffer === false) {
-			fclose($in);
-			throw new RepositoryException("Cannot buffer $from");
-		}
-		try {
-			if (stream_copy_to_stream($in, $buffer) === false) {
-				throw new RepositoryException("Cannot read $from");
-			}
-		} finally {
-			fclose($in);
-		}
-		rewind($buffer);
-		$this->backend->put($to, $buffer);
-	}
-
-	/** Record a user_migration export's manifest in the catalog (rollback-protected like a snapshot). */
-	public function recordUserExport(string $manifestPath): void {
-		$this->catalog->userExports[$manifestPath] = true;
-		$this->catalog->write();
-	}
-
-	/**
-	 * User export manifests according to the verified catalog, newest first. A manifest the
-	 * catalog lists but the location no longer has means it was deleted or hidden behind NG
-	 * Backup's back, same as a missing snapshot (see listSnapshots()).
-	 *
-	 * @return list<string>
-	 */
-	public function listUserExports(?string $uid = null): array {
-		$prefix = $uid !== null ? 'users/' . $uid . '/' : 'users/';
-		$out = [];
-		foreach (array_keys($this->catalog->userExports) as $path) {
-			if (!str_starts_with($path, $prefix)) {
-				continue;
-			}
-			if (!$this->backend->exists($path)) {
-				throw new RepositoryException("User export $path is missing on the location (deleted or hidden outside NG Backup)");
-			}
-			$out[] = $path;
-		}
-		sort($out, SORT_STRING);
-		return array_reverse($out);
-	}
-
-	/** Whether $manifestPath is a user export the verified catalog actually recorded. */
-	public function isRecordedUserExport(string $manifestPath): bool {
-		return isset($this->catalog->userExports[$manifestPath]);
-	}
-
-	/** Permanently delete a user export. Its blobs are freed by the next prune() like any other. */
-	public function forgetUserExport(string $manifestPath): void {
-		if (!isset($this->catalog->userExports[$manifestPath])) {
-			throw new RepositoryException("$manifestPath is not a recorded user export");
-		}
-		unset($this->catalog->userExports[$manifestPath]);
-		$this->catalog->write();
-		$this->backend->delete($manifestPath);
-	}
-
 	/** @return array<string, array{forgottenAt:int, by:string, db:?string, dbInTrash:?string, time:?string, label:string}> */
 	public function trash(): array {
 		$out = [];
@@ -496,26 +381,23 @@ final class Repository {
 
 	/** Permanently delete trash entries older than $delaySeconds. @return list<string> purged snapshot ids */
 	public function purgeTrash(int $delaySeconds): array {
-		$doomed = [];
+		$purged = [];
 		foreach ($this->trash() as $id => $info) {
 			if (time() - $info['forgottenAt'] < $delaySeconds) {
 				continue;
 			}
-			$doomed[$id] = $info;
-			unset($this->catalog->trash[$id]);
-		}
-		if ($doomed === []) {
-			return [];
-		}
-		$this->catalog->write();
-		foreach ($doomed as $id => $info) {
 			if ($info['dbInTrash'] !== null) {
 				$this->backend->delete($info['dbInTrash']);
 			}
 			$this->backend->delete('trash/snapshots/' . $id);
 			$this->backend->delete('trash/info/' . $id);
+			unset($this->catalog->trash[$id]);
+			$purged[] = $id;
 		}
-		return array_keys($doomed);
+		if ($purged !== []) {
+			$this->catalog->write();
+		}
+		return $purged;
 	}
 
 	private function trashInfo(string $snapshotId): array {
@@ -567,10 +449,7 @@ final class Repository {
 				}
 			}
 		}
-		// listUserExports() throws when a recorded export's manifest is missing: then stop, since
-		// freeing its blobs would turn a tampering or storage alarm into irreversible deletion.
-		$exports = array_unique(array_merge($this->listUserExports(), $this->backend->list('users')));
-		foreach ($exports as $path) {
+		foreach ($this->backend->list('users') as $path) {
 			foreach (json_decode($this->getObject($path), true, 512, JSON_THROW_ON_ERROR)['entries'] as $e) {
 				foreach ($e['b'] ?? [] as $b) {
 					$used[$b] = true;
@@ -602,7 +481,6 @@ final class Repository {
 			} else {
 				$stats['repacked']++;
 				if (!$dryRun) {
-					// No size limit here: repacking is how space is freed.
 					$writer ??= new PackWriter($this->backend, $this->cipher, $this->index);
 					$path = 'packs/' . substr($packId, 0, 2) . '/' . $packId;
 					foreach ($blobs as $b) {
@@ -698,13 +576,8 @@ final class Repository {
 	}
 
 	private function loadBlob(string $id): string {
-		[$pack, $offset, $length] = $this->index->get($id);
-		return $this->decodeBlob($id, $this->backend->getRange('packs/' . substr($pack, 0, 2) . '/' . $pack, $offset, $length));
-	}
-
-	/** Decrypts and checks a blob read from its pack; throws when it is corrupted or tampered with. */
-	private function decodeBlob(string $id, string $encrypted): string {
-		[, , , $raw, $flags] = $this->index->get($id);
+		[$pack, $offset, $length, $raw, $flags] = $this->index->get($id);
+		$encrypted = $this->backend->getRange('packs/' . substr($pack, 0, 2) . '/' . $pack, $offset, $length);
 		$payload = $this->cipher->decryptString($encrypted, 'blob:' . $id);
 		$data = ($flags & self::FLAG_DEFLATE) ? gzinflate($payload) : $payload;
 		if ($data === false || strlen($data) !== $raw || $this->keys->blobId($data) !== $id) {
@@ -727,134 +600,6 @@ final class Repository {
 		return $this->streamEntries($snapshotId);
 	}
 
-	/**
-	 * Checksum audit of a snapshot: every blob it references (files and the database dump, when
-	 * the snapshot has one) must be in the index, freshly re-downloaded and re-authenticated from
-	 * the location rather than trusted from the local cache (same reasoning as prune()), and its
-	 * pack must still be present. With $deep, each blob is also downloaded and decrypted, which
-	 * verifies its AEAD authentication tag and its content hash against the blob id (loadBlob()
-	 * already does both on every real read -- this just does it for everything in the snapshot,
-	 * deliberately, rather than relying on it to come up during a later restore). A blob
-	 * referenced by more than one file is only checked once; a missing database manifest is a
-	 * failure, not something to silently skip over.
-	 *
-	 * @param ?callable $heartbeat called after every blob (shallow) or every blob read (deep);
-	 *        callers use it to keep a time-boxed lease alive during a large audit
-	 * @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string}
-	 */
-	public function verify(string $snapshotId, bool $deep = false, ?callable $heartbeat = null): array {
-		$heartbeat ??= static function (): void {
-		};
-		$this->index->load(true);
-		$stats = ['filesChecked' => 0, 'blobsChecked' => 0, 'bytesChecked' => 0, 'missing' => [], 'failed' => [], 'unreadable' => [], 'readError' => ''];
-		$seen = [];
-		$packSeen = []; // pack id => exists on the backend; avoids one exists() call per blob
-		foreach ($this->streamEntries($snapshotId) as $entry) {
-			$stats['filesChecked']++;
-			foreach ($entry['b'] as $id) {
-				if (isset($seen[$id])) {
-					continue;
-				}
-				$seen[$id] = true;
-				$this->verifyBlob($id, $deep, $stats, $packSeen);
-				$heartbeat();
-			}
-		}
-		$meta = $this->snapshotMeta($snapshotId);
-		if (isset($meta['db']) && is_string($meta['db'])) {
-			if (!$this->backend->exists($meta['db'])) {
-				$stats['missing'][] = $meta['db'];
-			} else {
-				$dbManifest = json_decode($this->getObject($meta['db']), true, 512, JSON_THROW_ON_ERROR);
-				foreach ($dbManifest['tables'] as $info) {
-					foreach ($info['blobs'] as $id) {
-						if (isset($seen[$id])) {
-							continue;
-						}
-						$seen[$id] = true;
-						$this->verifyBlob($id, $deep, $stats, $packSeen);
-						$heartbeat();
-					}
-				}
-			}
-		}
-		return $stats;
-	}
-
-	/**
-	 * Same checks as verify(), for a user export: every blob its manifest references must be in
-	 * the freshly re-authenticated index with its pack present; $deep also decrypts each.
-	 *
-	 * @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string}
-	 */
-	public function verifyUserExport(string $manifestPath, bool $deep = false, ?callable $heartbeat = null): array {
-		if (!$this->isRecordedUserExport($manifestPath)) {
-			throw new RepositoryException("$manifestPath is not a recorded user export for this location");
-		}
-		$heartbeat ??= static function (): void {
-		};
-		$this->index->load(true);
-		$stats = ['filesChecked' => 0, 'blobsChecked' => 0, 'bytesChecked' => 0, 'missing' => [], 'failed' => [], 'unreadable' => [], 'readError' => ''];
-		$seen = [];
-		$packSeen = [];
-		$manifest = json_decode($this->getObject($manifestPath), true, 512, JSON_THROW_ON_ERROR);
-		foreach ($manifest['entries'] as $entry) {
-			if (($entry['t'] ?? '') !== 'f') {
-				continue;
-			}
-			$stats['filesChecked']++;
-			foreach ($entry['b'] ?? [] as $id) {
-				if (isset($seen[$id])) {
-					continue;
-				}
-				$seen[$id] = true;
-				$this->verifyBlob($id, $deep, $stats, $packSeen);
-				$heartbeat();
-			}
-		}
-		return $stats;
-	}
-
-	/** @param array<string, bool> $packSeen */
-	private function verifyBlob(string $id, bool $deep, array &$stats, array &$packSeen): void {
-		if (!$this->index->has($id)) {
-			$stats['missing'][] = $id;
-			return;
-		}
-		[$pack] = $this->index->get($id);
-		$packExists = $packSeen[$pack] ??= $this->backend->exists('packs/' . substr($pack, 0, 2) . '/' . $pack);
-		if (!$packExists) {
-			$stats['missing'][] = $id;
-			return;
-		}
-		$stats['blobsChecked']++;
-		if (!$deep) {
-			return;
-		}
-		// Reading and checking are kept apart: a read that fails is usually a network or
-		// storage error, so it is retried and reported as unreadable (a pack that stays
-		// unreadable may still be truncated). Only a blob that was read but does not
-		// decrypt or match its id counts as failed: that is proof of damage.
-		[, $offset, $length] = $this->index->get($id);
-		$encrypted = null;
-		for ($attempt = 1; $attempt <= self::VERIFY_READ_ATTEMPTS && $encrypted === null; $attempt++) {
-			try {
-				$encrypted = $this->backend->getRange('packs/' . substr($pack, 0, 2) . '/' . $pack, $offset, $length);
-			} catch (\Exception $e) { // storage adapters throw their own exceptions; \Error (a bug) is not retried
-				$stats['readError'] = $e->getMessage();
-			}
-		}
-		if ($encrypted === null) {
-			$stats['unreadable'][] = $id;
-			return;
-		}
-		try {
-			$stats['bytesChecked'] += strlen($this->decodeBlob($id, $encrypted));
-		} catch (\Throwable) {
-			$stats['failed'][] = $id;
-		}
-	}
-
 	/** The meta record (first line) of a snapshot. */
 	public function snapshotMeta(string $snapshotId): array {
 		$plain = fopen('php://temp/maxmemory:' . (4 * 1048576), 'w+b');

lib/Service/AlertService.php

@@ -15,7 +15,7 @@ use OCP\IGroupManager;
 use OCP\Notification\IManager;
 
 /** Notifies administrators about failed runs and locations without a recent successful backup. */
-final class AlertService {
+class AlertService {
 	public const STALE_AFTER = 2 * 86400;
 
 	public function __construct(
@@ -54,43 +54,6 @@ final class AlertService {
 			['kind' => $run->getKind(), 'target' => $targetName, 'error' => mb_strimwidth((string)$run->getError(), 0, 300, '…')]);
 	}
 
-	/** A backup that finished but is missing unreadable files, or holds files that changed while read. */
-	public function runWarnings(Run $run, string $targetName, int $unreadable, int $changing, array $examples): void {
-		$this->notifyAdmins('run_warnings', 'run-' . $run->getId(), ['target' => $targetName,
-			'unreadable' => (string)$unreadable, 'changing' => (string)$changing,
-			'examples' => mb_strimwidth(implode(', ', array_merge($examples['unreadable'], $examples['changing'])), 0, 300, '…')]);
-	}
-
-	/**
-	 * Remember how much is stored on a location (for the settings page) and warn administrators
-	 * once a day when it is at 80% of its limit or more.
-	 */
-	public function storedBytes(Target $target, int $bytes): void {
-		$this->appConfig->setValueString(Application::APP_ID, 'stored_' . $target->getId(), (string)$bytes);
-		$limit = $target->getMaxBytes();
-		if ($limit === null || $limit <= 0 || $bytes < 0.8 * $limit) {
-			return;
-		}
-		$key = 'quota_notified_' . $target->getId();
-		if ($this->appConfig->getValueString(Application::APP_ID, $key, '') === date('Y-m-d')) {
-			return;
-		}
-		$this->appConfig->setValueString(Application::APP_ID, $key, date('Y-m-d'));
-		$this->notifyAdmins('quota_warning', 'quota-' . $target->getId() . '-' . date('Y-m-d'), [
-			'target' => $target->getName(), 'percent' => (string)round($bytes / $limit * 100),
-			'used' => self::gib($bytes), 'limit' => self::gib($limit)]);
-	}
-
-	private static function gib(int $bytes): string {
-		$g = $bytes / 1073741824;
-		return sprintf($g < 10 ? '%.2f GiB' : '%.1f GiB', $g);
-	}
-
-	public function lastStoredBytes(Target $target): ?int {
-		$v = $this->appConfig->getValueString(Application::APP_ID, 'stored_' . $target->getId(), '');
-		return $v === '' ? null : (int)$v;
-	}
-
 	/** At most one notification per location per day. */
 	public function checkStale(Target $target): void {
 		$last = $this->runs->lastFinished($target->getId(), BackupService::KIND_FULL);

lib/Service/BackupService.php

@@ -14,7 +14,6 @@ use OCA\NgBackup\Db\Snapshot;
 use OCA\NgBackup\Db\SnapshotMapper;
 use OCA\NgBackup\Db\Target;
 use OCA\NgBackup\Job\BackupRun;
-use OCA\NgBackup\Repository\RepositoryException;
 use OCP\App\IAppManager;
 use OCP\IConfig;
 use OCP\IDBConnection;
@@ -29,7 +28,7 @@ use Psr\Log\LoggerInterface;
  * Excluded by default: previews, log files, the updater's backups and each user's cache and
  * temporary uploads (all regenerable or temporary).
  */
-final class BackupService {
+class BackupService {
 	public const KIND_FULL = 'full';
 
 	public function __construct(
@@ -43,7 +42,6 @@ final class BackupService {
 		private ILockingProvider $locking,
 		private LoggerInterface $logger,
 		private AlertService $alerts,
-		private LeaseService $leases,
 	) {
 	}
 
@@ -56,16 +54,17 @@ final class BackupService {
 		}
 		// Check and create the run under the location's exclusive lock, so a cleanup cannot start
 		// in between (it takes the same lock and refuses while a run exists).
-		// A run that is already in progress is simply continued; no lease needed for that.
-		$running = $this->runs->findRunning($target->getId(), self::KIND_FULL);
-		if ($running !== []) {
-			return $running[0];
-		}
+		$lock = PruneService::lockKey($target);
 		try {
-			return $this->leases->with(PruneService::lockKey($target), LeaseService::EXCLUSIVE, 60, fn () => $this->createRun($target, $label));
+			$this->locking->acquireLock($lock, ILockingProvider::LOCK_EXCLUSIVE);
 		} catch (LockedException) {
 			throw new \RuntimeException('A cleanup or another start for ' . $target->getName() . ' is running; try again later');
 		}
+		try {
+			return $this->createRun($target, $label);
+		} finally {
+			$this->locking->releaseLock($lock, ILockingProvider::LOCK_EXCLUSIVE);
+		}
 	}
 
 	private function createRun(Target $target, string $label): Run {
@@ -104,18 +103,18 @@ final class BackupService {
 	 * run locked and returns immediately.
 	 */
 	public function step(Run $run, float $deadline): Run {
-		// Leases expire on their own: a step killed by a time limit or OOM blocks nothing for long.
-		$ttl = (int)min(3600, max(120, $deadline - microtime(true) + 120));
+		$lockKey = 'ng_backup/run/' . $run->getId();
 		try {
-			$runLease = $this->leases->acquire('run/' . $run->getId(), LeaseService::EXCLUSIVE, $ttl);
+			$this->locking->acquireLock($lockKey, ILockingProvider::LOCK_EXCLUSIVE);
 		} catch (LockedException) {
-			return $run; // another process is doing this step
+			return $run;
 		}
-		// Shared lease on the location while this step writes: a cleanup (exclusive) cannot run now.
+		// Shared lock on the location while this step writes: a cleanup (exclusive) cannot run now.
+		$targetLock = 'ng_backup/target/' . $run->getTargetId();
 		try {
-			$targetLease = $this->leases->acquire('ng_backup/target/' . $run->getTargetId(), LeaseService::SHARED, $ttl);
+			$this->locking->acquireLock($targetLock, ILockingProvider::LOCK_SHARED);
 		} catch (LockedException) {
-			$this->leases->release($runLease);
+			$this->locking->releaseLock($lockKey, ILockingProvider::LOCK_EXCLUSIVE);
 			return $run;
 		}
 		try {
@@ -148,29 +147,8 @@ final class BackupService {
 				}
 			} else {
 				$state['files'] = BackupRun::step($repo, $state['files'], $deadline);
-				if ($state['files']['phase'] === 'commit') {
-					// Catalog write under the catalog lock, from a repository opened inside it: a per-user
-					// export or restore may have written the catalog since this step opened $repo.
-					try {
-						$this->leases->with(PruneService::catalogLockKey($target), LeaseService::EXCLUSIVE, 300,
-							fn () => $this->targets->repository($target)->recordSnapshot((string)$state['files']['snapshot']));
-						$state['files']['phase'] = 'done';
-					} catch (LockedException|RepositoryException) {
-						// Another catalog write is in progress (or just raced us to the next
-						// generation): the next step retries this commit on the fresh catalog.
-					}
-				}
 				if ($state['files']['phase'] === 'done') {
 					$this->recordSnapshot($run, $state['files']);
-					$this->alerts->storedBytes($target, $repo->storedBytes());
-					$stats = $state['files']['stats'];
-					if (($stats['unreadable'] ?? 0) > 0 || ($stats['changing'] ?? 0) > 0) {
-						$warnings = BackupRun::warnings($state['files']);
-						$this->logger->warning(sprintf('NG Backup run %d to %s: %d unreadable (missing from the snapshot): %s; %d changed while being read: %s',
-							$run->getId(), $target->getName(), $stats['unreadable'] ?? 0, implode(', ', $warnings['unreadable']),
-							$stats['changing'] ?? 0, implode(', ', $warnings['changing'])));
-						$this->alerts->runWarnings($run, $target->getName(), (int)($stats['unreadable'] ?? 0), (int)($stats['changing'] ?? 0), $warnings);
-					}
 					$run->setStatus(Run::DONE);
 					$run->setPhase('done');
 					$run->setFinishedAt(time());
@@ -193,22 +171,15 @@ final class BackupService {
 			}
 			return $run;
 		} finally {
-			$this->leases->release($targetLease);
-			$this->leases->release($runLease);
+			$this->locking->releaseLock($targetLock, ILockingProvider::LOCK_SHARED);
+			$this->locking->releaseLock($lockKey, ILockingProvider::LOCK_EXCLUSIVE);
 		}
 	}
 
 	/** Run to completion in this process (occ, system cron), reporting progress. */
 	public function runToCompletion(Run $run, ?callable $progress = null, float $stepSeconds = 30): Run {
 		while ($run->getStatus() === Run::RUNNING) {
-			$before = $run->getUpdatedAt();
 			$run = $this->step($run, microtime(true) + $stepSeconds);
-			if ($run->getStatus() === Run::RUNNING && $run->getUpdatedAt() === $before) {
-				// Step was not possible (another process holds the run, or a crashed step's lease has
-				// not expired yet): wait instead of spinning.
-				sleep(5);
-				$run = $this->runs->find($run->getId());
-			}
 			if ($progress !== null) {
 				$progress($run);
 			}

lib/Service/KeyService.php

@@ -22,7 +22,7 @@ use OCP\Security\ICrypto;
  *   into the recovery kit, so backups can be restored on a fresh server with the passphrase.
  * - The admin must confirm having stored the recovery kit before the first backup runs.
  */
-final class KeyService {
+class KeyService {
 	private const KEY_MASTER = 'master_key';
 	private const KEY_WRAPPED = 'master_key_wrapped';
 	private const KEY_CONFIRMED = 'recovery_kit_confirmed';
@@ -71,86 +71,6 @@ final class KeyService {
 		$this->cached = $keys;
 	}
 
-	/**
-	 * Disaster recovery on a fresh installation: adopt the master key from a recovery kit
-	 * (occ backup:key:kit on the original installation) instead of generating a new one.
-	 * Afterwards occ backup:target:add opens the existing repository on the location with this
-	 * key, instead of creating a new, empty one.
-	 *
-	 * @param array<string, mixed> $kit as produced by recoveryKit()
-	 * @throws \OCA\NgBackup\Crypto\CryptoException wrong passphrase, or a damaged/foreign kit
-	 */
-	public function importRecoveryKit(array $kit, #[\SensitiveParameter] string $passphrase): void {
-		if ($this->isInitialized()) {
-			throw new \RuntimeException('A backup key already exists');
-		}
-		if (!isset($kit['wrapped_key'])) {
-			throw new \InvalidArgumentException('Not a NG Backup recovery kit file');
-		}
-		$keys = KeyRing::unwrapAny($kit['wrapped_key'], $passphrase);
-		$this->appConfig->setValueString(Application::APP_ID, self::KEY_MASTER,
-			$this->crypto->encrypt(base64_encode($keys->exportMasterKey())), true, true);
-		$this->cached = $keys;
-		$this->appConfig->setValueString(Application::APP_ID, self::KEY_WRAPPED, json_encode($kit['wrapped_key'], JSON_THROW_ON_ERROR), true, true);
-		$this->appConfig->setValueString(Application::APP_ID, self::KEY_FINGERPRINT, $this->fingerprintOf($keys), true);
-		// Kits from before this field existed fall back to the default.
-		$delay = (int)($kit['delete_delay_days'] ?? self::DEFAULT_DELETE_DELAY);
-		$this->appConfig->setValueInt(Application::APP_ID, self::KEY_DELETE_DELAY, ($delay >= 1 && $delay <= 365) ? $delay : self::DEFAULT_DELETE_DELAY, true);
-		$this->appConfig->setValueInt(Application::APP_ID, self::KEY_KIT_VERSION, (int)($kit['kit_version'] ?? 1), true);
-		// Having and successfully using a real kit file is stronger proof than the normal
-		// download-and-confirm flow it replaces.
-		$this->confirmRecoveryKit('cli-import');
-	}
-
-	/**
-	 * The master key and the recovery kit code are stored encrypted with Nextcloud's own
-	 * instance secret (ICrypto), not with themselves; the wrapped key is not (it is sealed with
-	 * the admin's passphrase instead), but Nextcloud's own AppConfig additionally encrypts any
-	 * "sensitive" value with the instance secret regardless, underneath whatever we store. So
-	 * changing that secret (occ backup:restore:full merging config.php) would otherwise leave
-	 * all three permanently undecryptable. Call $applySecretChange (which must be the only thing
-	 * that changes the secret) through here instead: all three are decrypted first, then
-	 * re-encrypted under whatever secret is active once $applySecretChange returns.
-	 *
-	 * Not crash-safe: a process kill between the delete and the re-save of one of these keys
-	 * would leave it missing rather than merely stale. Disaster recovery is run once, by hand,
-	 * right after occ maintenance:install; a dedicated two-phase write is not justified yet for
-	 * that narrow a window.
-	 */
-	public function reencryptForSecretRotation(callable $applySecretChange): mixed {
-		$master = $this->appConfig->getValueString(Application::APP_ID, self::KEY_MASTER, '', true);
-		$wrapped = $this->appConfig->getValueString(Application::APP_ID, self::KEY_WRAPPED, '', true);
-		$kitCodeRaw = $this->appConfig->getValueString(Application::APP_ID, self::KEY_KIT_CODE, '', true);
-		$kitCode = $kitCodeRaw !== '' ? json_decode($kitCodeRaw, true, 512, JSON_THROW_ON_ERROR) : null;
-		$masterPlain = $master !== '' ? $this->crypto->decrypt($master) : null;
-		$kitCodePlain = $kitCode !== null && isset($kitCode['code']) ? $this->crypto->decrypt($kitCode['code']) : null;
-
-		$result = $applySecretChange();
-		$this->cached = null; // the master key is about to be re-saved; do not keep the pre-rotation copy
-
-		// Nextcloud's own AppConfig additionally encrypts a "sensitive" value itself (tied to
-		// the same secret, underneath our own encrypt() above); setValueString() on an existing
-		// key reads the old value first to compare, which would try to decrypt it with the new
-		// secret and fail the same way. Delete first so there is nothing to compare against.
-		if ($masterPlain !== null) {
-			$this->appConfig->deleteKey(Application::APP_ID, self::KEY_MASTER);
-			$this->appConfig->setValueString(Application::APP_ID, self::KEY_MASTER, $this->crypto->encrypt($masterPlain), true, true);
-		}
-		if ($wrapped !== '') {
-			// Already plaintext JSON here: getValueString() above transparently undid
-			// AppConfig's own sensitive-value encryption; there is no encrypt() of our own to
-			// redo (wrapping is sealed with the passphrase, not the instance secret).
-			$this->appConfig->deleteKey(Application::APP_ID, self::KEY_WRAPPED);
-			$this->appConfig->setValueString(Application::APP_ID, self::KEY_WRAPPED, $wrapped, true, true);
-		}
-		if ($kitCodePlain !== null) {
-			$kitCode['code'] = $this->crypto->encrypt($kitCodePlain);
-			$this->appConfig->deleteKey(Application::APP_ID, self::KEY_KIT_CODE);
-			$this->appConfig->setValueString(Application::APP_ID, self::KEY_KIT_CODE, json_encode($kitCode, JSON_THROW_ON_ERROR), true, true);
-		}
-		return $result;
-	}
-
 	public function keyRing(): KeyRing {
 		if ($this->cached === null) {
 			$enc = $this->appConfig->getValueString(Application::APP_ID, self::KEY_MASTER, '', true);
@@ -262,14 +182,13 @@ final class KeyService {
 		return $this->appConfig->getValueString(Application::APP_ID, self::KEY_FINGERPRINT, '', true);
 	}
 
-	/** @return array{version:int, app:string, fingerprint:string, kit_version:int, delete_delay_days:int, confirmation_code:string, created:string, wrapped_key:array, slots:list<array{slot:int, label:string, created:int}>, instructions:string} */
+	/** @return array{version:int, app:string, fingerprint:string, created:string, wrapped_key:array, instructions:string} */
 	public function recoveryKit(): array {
 		return [
 			'version' => 1,
 			'app' => 'NG Backup',
 			'fingerprint' => $this->fingerprint(),
 			'kit_version' => $this->kitVersion(),
-			'delete_delay_days' => $this->deleteDelayDays(),
 			'confirmation_code' => $this->kitCode(),
 			'created' => gmdate('c'),
 			'wrapped_key' => $this->wrappedKey(),

lib/Service/KeySlotService.php

@@ -13,7 +13,7 @@ namespace OCA\NgBackup\Service;
  * is written to all locations and announced to all administrators; a new recovery kit must be
  * downloaded and confirmed afterwards (backups keep running meanwhile).
  */
-final class KeySlotService {
+class KeySlotService {
 	public function __construct(
 		private KeyService $keys,
 		private TargetService $targets,

lib/Service/LeaseService.php

@@ -1,99 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Service;
-
-use OCP\IDBConnection;
-use OCP\Lock\ILockingProvider;
-use OCP\Lock\LockedException;
-
-/**
- * Shared/exclusive leases with an expiry, stored in ngb_leases.
- *
- * Nextcloud's locks live up to an hour; a PHP process killed while holding one (web cron time
- * limit, OOM, kill -9) would block a location that long. A lease expires on its own unless its
- * holder keeps refreshing it. Nextcloud's lock is only held for the few milliseconds in which a
- * lease is checked and written.
- */
-final class LeaseService {
-	public const SHARED = 's';
-	public const EXCLUSIVE = 'x';
-
-	public function __construct(
-		private IDBConnection $db,
-		private ILockingProvider $locking,
-	) {
-	}
-
-	/** @return string lease id; throws LockedException when it conflicts with a live lease */
-	public function acquire(string $name, string $mode, int $ttl): string {
-		$guard = 'ng_backup/lease/' . $name;
-		$this->locking->acquireLock($guard, ILockingProvider::LOCK_EXCLUSIVE);
-		try {
-			$now = time();
-			$qb = $this->db->getQueryBuilder();
-			$qb->delete('ngb_leases')
-				->where($qb->expr()->eq('name', $qb->createNamedParameter($name)))
-				->andWhere($qb->expr()->lt('expires_at', $qb->createNamedParameter($now)));
-			$qb->executeStatement();
-
-			$qb = $this->db->getQueryBuilder();
-			$qb->select('mode')->from('ngb_leases')->where($qb->expr()->eq('name', $qb->createNamedParameter($name)));
-			$modes = $qb->executeQuery()->fetchAll(\PDO::FETCH_COLUMN);
-			if ($modes !== [] && ($mode === self::EXCLUSIVE || in_array(self::EXCLUSIVE, $modes, true))) {
-				throw new LockedException($name);
-			}
-			$id = bin2hex(random_bytes(16));
-			$qb = $this->db->getQueryBuilder();
-			$qb->insert('ngb_leases')->values([
-				'id' => $qb->createNamedParameter($id),
-				'name' => $qb->createNamedParameter($name),
-				'mode' => $qb->createNamedParameter($mode),
-				'expires_at' => $qb->createNamedParameter($now + $ttl),
-			]);
-			$qb->executeStatement();
-			return $id;
-		} finally {
-			$this->locking->releaseLock($guard, ILockingProvider::LOCK_EXCLUSIVE);
-		}
-	}
-
-	/** Extend a lease while its holder is still working. */
-	public function refresh(string $id, int $ttl): void {
-		$qb = $this->db->getQueryBuilder();
-		$qb->update('ngb_leases')->set('expires_at', $qb->createNamedParameter(time() + $ttl))
-			->where($qb->expr()->eq('id', $qb->createNamedParameter($id)));
-		$qb->executeStatement();
-	}
-
-	public function release(string $id): void {
-		$qb = $this->db->getQueryBuilder();
-		$qb->delete('ngb_leases')->where($qb->expr()->eq('id', $qb->createNamedParameter($id)));
-		$qb->executeStatement();
-	}
-
-	/** Wraps $refresh so calling it often (per file, per row batch) only touches the database every $seconds. */
-	public static function throttled(callable $refresh, int $seconds = 60): \Closure {
-		$last = time();
-		return static function () use ($refresh, $seconds, &$last): void {
-			if (time() - $last >= $seconds) {
-				$refresh();
-				$last = time();
-			}
-		};
-	}
-
-	/** Run $fn under a lease; $refresh() can be called during long work. */
-	public function with(string $name, string $mode, int $ttl, callable $fn): mixed {
-		$id = $this->acquire($name, $mode, $ttl);
-		try {
-			return $fn(fn () => $this->refresh($id, $ttl));
-		} finally {
-			$this->release($id);
-		}
-	}
-}

lib/Service/PruneService.php

@@ -20,7 +20,7 @@ use OCP\Lock\LockedException;
  * prunes data no remaining snapshot uses. Never runs on append-only locations, never while a
  * backup to the same location is running (the location lock is shared with BackupService).
  */
-final class PruneService {
+class PruneService {
 	public function __construct(
 		private TargetService $targets,
 		private RunMapper $runs,
@@ -29,16 +29,15 @@ final class PruneService {
 		private ILockingProvider $locking,
 		private AlertService $alerts,
 		private KeyService $keys,
-		private LeaseService $leases,
 	) {
 	}
 
 	public function untrash(Target $target, string $snapshotId): void {
-		$lease = $this->lockExclusive($target, 300);
+		$this->lockExclusive($target);
 		try {
 			$this->doUntrash($target, $snapshotId);
 		} finally {
-			$this->leases->release($lease);
+			$this->locking->releaseLock(self::lockKey($target), ILockingProvider::LOCK_EXCLUSIVE);
 		}
 	}
 
@@ -48,27 +47,31 @@ final class PruneService {
 	 */
 	public function underStartLock(Target $target, callable $fn): mixed {
 		try {
-			return $this->leases->with(self::lockKey($target), LeaseService::EXCLUSIVE, 60, fn () => $fn());
+			$this->locking->acquireLock(self::lockKey($target), ILockingProvider::LOCK_EXCLUSIVE);
 		} catch (LockedException) {
 			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');
 		}
+		try {
+			return $fn();
+		} finally {
+			$this->locking->releaseLock(self::lockKey($target), ILockingProvider::LOCK_EXCLUSIVE);
+		}
 	}
 
 	/**
 	 * Exclusive lock on the location, then make sure no run of any kind (backup, restore, export)
 	 * is in progress: their data may not be referenced by a snapshot yet, or is being read.
 	 */
-	private function lockExclusive(Target $target, int $ttl): string {
+	private function lockExclusive(Target $target): void {
 		try {
-			$lease = $this->leases->acquire(self::lockKey($target), LeaseService::EXCLUSIVE, $ttl);
+			$this->locking->acquireLock(self::lockKey($target), ILockingProvider::LOCK_EXCLUSIVE);
 		} catch (LockedException) {
 			throw new \RuntimeException('A backup, restore or cleanup of ' . $target->getName() . ' is in progress; try again later');
 		}
 		if ($this->runs->findRunning($target->getId()) !== []) {
-			$this->leases->release($lease);
+			$this->locking->releaseLock(self::lockKey($target), ILockingProvider::LOCK_EXCLUSIVE);
 			throw new \RuntimeException('A backup or restore of ' . $target->getName() . ' is running; try again later');
 		}
-		return $lease;
 	}
 
 	private function doUntrash(Target $target, string $snapshotId): void {
@@ -98,83 +101,6 @@ final class PruneService {
 		return 'ng_backup/target/' . $target->getId();
 	}
 
-	/**
-	 * A separate, short-lived exclusive lock serializing writes to the catalog itself. The
-	 * per-target lock above only keeps readers/writers out while a cleanup runs; it does not
-	 * stop two SHARED holders (e.g. two concurrent per-user backups, or one alongside a full
-	 * backup) from both reading the same catalog generation and racing to write the next one,
-	 * silently dropping whichever's change loses. The full-backup path avoids this today only
-	 * because a Run row makes concurrent runs for the same target mutually exclusive; per-user
-	 * backup/restore has no such row, so it takes this lock around the catalog write itself.
-	 */
-	public static function catalogLockKey(Target $target): string {
-		return self::lockKey($target) . '/catalog';
-	}
-
-	/** How many of each user's own exports (occ backup:user:backup) to keep, newest first. */
-	public function userExportRetention(): int {
-		return $this->appConfig->getValueInt(Application::APP_ID, 'user_export_retention', 3);
-	}
-
-	public function setUserExportRetention(int $keep): void {
-		if ($keep < 1) {
-			throw new \InvalidArgumentException('Keep at least the last export');
-		}
-		$old = $this->userExportRetention();
-		$this->appConfig->setValueInt(Application::APP_ID, 'user_export_retention', $keep);
-		if ($old !== $keep) {
-			$this->alerts->securityEvent('user_export_retention_changed', ['keep' => (string)$keep]);
-		}
-	}
-
-	/**
-	 * Forgets a user's older exports once more than userExportRetention() exist for them,
-	 * newest first; no trash, unlike a full snapshot (occ backup:user:backup is on-demand, not
-	 * yet the primary safety net the deletion delay protects).
-	 *
-	 * @return array{kept: array<string, list<string>>, forgotten: list<string>}
-	 */
-	public function applyUserExports(Target $target, bool $dryRun = false): array {
-		if ($target->getAppendOnly()) {
-			throw new \RuntimeException('Location ' . $target->getName() . ' is append-only: NG Backup does not delete anything there');
-		}
-		$lease = $this->lockExclusive($target, 1800);
-		try {
-			$repo = $this->targets->repository($target);
-			$keep = $this->userExportRetention();
-			$byUser = [];
-			foreach ($repo->listUserExports() as $path) {
-				$uid = explode('/', $path)[1] ?? '';
-				$manifest = json_decode($repo->getObject($path), true, 512, JSON_THROW_ON_ERROR);
-				$byUser[$uid][$path] = (int)strtotime((string)($manifest['time'] ?? '@0'));
-			}
-			$kept = [];
-			$forget = [];
-			foreach ($byUser as $uid => $times) {
-				arsort($times);
-				$i = 0;
-				foreach (array_keys($times) as $path) {
-					if ($i++ < $keep) {
-						$kept[$uid][] = $path;
-					} else {
-						$forget[] = $path;
-					}
-				}
-			}
-			if (!$dryRun) {
-				foreach ($forget as $path) {
-					$repo->forgetUserExport($path);
-				}
-				if ($forget !== []) {
-					$this->alerts->securityEvent('user_exports_forgotten', ['target' => $target->getName(), 'count' => (string)count($forget)], false);
-				}
-			}
-			return ['kept' => $kept, 'forgotten' => $forget];
-		} finally {
-			$this->leases->release($lease);
-		}
-	}
-
 	public function policy(): RetentionPolicy {
 		return RetentionPolicy::fromArray(json_decode($this->appConfig->getValueString(Application::APP_ID, 'retention', '{}'), true) ?: []);
 	}
@@ -200,7 +126,7 @@ final class PruneService {
 		if ($target->getAppendOnly()) {
 			throw new \RuntimeException('Location ' . $target->getName() . ' is append-only: NG Backup does not delete anything there');
 		}
-		$lease = $this->lockExclusive($target, 1800);
+		$this->lockExclusive($target);
 		try {
 			$repo = $this->targets->repository($target);
 			$times = [];
@@ -234,7 +160,7 @@ final class PruneService {
 			$prune = $repo->prune($dryRun);
 			return ['kept' => $keep, 'forgotten' => $forget, 'purged' => $purged, 'prune' => $prune];
 		} finally {
-			$this->leases->release($lease);
+			$this->locking->releaseLock(self::lockKey($target), ILockingProvider::LOCK_EXCLUSIVE);
 		}
 	}
 }

lib/Service/RestoreFullService.php

@@ -1,228 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Service;
-
-use OCA\NgBackup\Db\DbDumper;
-use OCA\NgBackup\Db\Target;
-use OCP\App\IAppManager;
-use OCP\IConfig;
-use OCP\IDBConnection;
-use OCP\Lock\LockedException;
-
-/**
- * Disaster recovery on a fresh Nextcloud installation (same major version): replace the
- * database, restore the data directory and merge the backed-up config.php, see PLAN.md 3.7.
- *
- * Deliberately NOT handled yet (phase 3): restoring in place over a live, already-used
- * installation. The admin is expected to run this once, right after occ maintenance:install and
- * occ backup:key:import/backup:target:add, before anyone else touches the instance.
- */
-final class RestoreFullService {
-	/**
-	 * Config keys that must keep pointing at THIS installation's actual, already-working
-	 * database and data directory (set by occ maintenance:install), never at the old server's.
-	 */
-	private const CONNECTION_KEYS = [
-		'dbtype', 'dbhost', 'dbport', 'dbname', 'dbuser', 'dbpassword', 'dbpersistent',
-		'dbtableprefix', 'dbdriveroptions', 'datadirectory',
-	];
-
-	public function __construct(
-		private TargetService $targets,
-		private RestoreService $restore,
-		private LeaseService $leases,
-		private IConfig $config,
-		private IDBConnection $db,
-		private IAppManager $appManager,
-		private KeyService $keys,
-	) {
-	}
-
-	/**
-	 * Whether this installation can receive $snapshotId: same Nextcloud major version, and every
-	 * app that was enabled at backup time already installed here (its tables must exist before
-	 * the database restore can write into them).
-	 *
-	 * @return array{ok:bool, currentMajor:string, snapshotMajor:string, missingApps:list<string>}
-	 */
-	public function checkCompatibility(Target $target, string $snapshotId): array {
-		$meta = $this->targets->repository($target)->snapshotMeta($snapshotId);
-		$currentMajor = explode('.', $this->config->getSystemValueString('version'))[0];
-		$snapshotMajor = explode('.', (string)($meta['nextcloud'] ?? ''))[0];
-		$enabled = array_flip($this->appManager->getEnabledApps());
-		$missingApps = array_values(array_diff(array_keys($meta['apps'] ?? []), array_keys($enabled)));
-		return [
-			'ok' => $currentMajor === $snapshotMajor && $missingApps === [],
-			'currentMajor' => $currentMajor,
-			'snapshotMajor' => $snapshotMajor,
-			'missingApps' => $missingApps,
-		];
-	}
-
-	/** @return array{dbReport:array, dataFiles:int, configKeys:int, dbConsistent:bool} */
-	public function restoreFull(Target $target, string $snapshotId): array {
-		$check = $this->checkCompatibility($target, $snapshotId);
-		if (!$check['ok']) {
-			throw new \RuntimeException($this->describeBlockers($check));
-		}
-		return $this->withSharedLock($target, function (callable $refresh) use ($target, $snapshotId) {
-			$beat = LeaseService::throttled($refresh);
-			$repo = $this->targets->repository($target);
-			$meta = $repo->snapshotMeta($snapshotId);
-
-			$dbReport = null;
-			$manifest = [];
-			if (isset($meta['db'])) {
-				$manifest = json_decode($repo->getObject($meta['db']), true, 512, JSON_THROW_ON_ERROR);
-				$prefix = $this->config->getSystemValueString('dbtableprefix', 'oc_');
-				// ng_backup's own tables (and its own rows in the shared appconfig table) must
-				// survive this restore untouched: they describe the backup/key/target that is
-				// actively performing it right now, on THIS installation, not the one that was
-				// backed up. Overwriting them mid-restore would pull the rug from under it.
-				foreach (array_keys($manifest['tables']) as $table) {
-					/** @var string $table */
-					if (str_starts_with($table, $prefix . 'ngb_')) {
-						unset($manifest['tables'][$table]);
-					}
-				}
-				// Sequences are keyed separately from tables; excluding a table does not exclude
-				// its sequence, which would otherwise rewind a retained ngb_* table's sequence
-				// below its current ids (PostgreSQL only -- see DbDumper::restoreSequences()).
-				foreach (array_keys($manifest['sequences'] ?? []) as $seq) {
-					/** @var string $seq */
-					if (str_starts_with((string)($manifest['sequences'][$seq]['table'] ?? ''), $prefix . 'ngb_')) {
-						unset($manifest['sequences'][$seq]);
-					}
-				}
-				$ownAppConfig = $this->preserveOwnAppConfig();
-				$dumper = new DbDumper($this->db->getInner(), $prefix);
-				try {
-					$dumper->restore($repo, $manifest, $dbReport, $beat);
-				} finally {
-					$this->restoreOwnAppConfig($ownAppConfig);
-				}
-			}
-
-			// Read (but do not yet apply) the backed-up config.php before touching the data
-			// directory: once applied, 'secret' may differ from what ng_backup's own Target
-			// options were encrypted with (see restoreFull()'s docblock), and every further
-			// repository access through $this->targets would fail to decrypt them.
-			/** @var array<string, mixed> $backupConfig */
-			$backupConfig = $this->fetchBackupConfig($target, $snapshotId);
-
-			$dataDir = rtrim($this->config->getSystemValueString('datadirectory'), '/');
-			$dataFiles = $this->restore->restoreToDirectory($target, $snapshotId, 'data', $dataDir, stripPrefix: true, heartbeat: $beat);
-
-			// Last step: nothing after this may need $this->targets->repository($target) again.
-			if ($backupConfig !== []) {
-				$this->targets->reencryptOptionsAround(
-					fn (): mixed => $this->keys->reencryptForSecretRotation(fn (): mixed => $this->config->setSystemValues($backupConfig)),
-				);
-			}
-
-			return ['dbReport' => $dbReport ?? ['skipped' => [], 'restored' => []], 'dataFiles' => $dataFiles, 'configKeys' => count($backupConfig),
-				'dbConsistent' => (bool)($manifest['consistent'] ?? true)];
-		});
-	}
-
-	/** @return array<string, mixed> config.php's $CONFIG from the backup, minus the connection keys */
-	private function fetchBackupConfig(Target $target, string $snapshotId): array {
-		$tmp = sys_get_temp_dir() . '/ngb-restore-config-' . bin2hex(random_bytes(6));
-		try {
-			$this->restore->restoreToDirectory($target, $snapshotId, 'config', $tmp, stripPrefix: true);
-			$path = $tmp . '/config.php';
-			if (!is_file($path)) {
-				return []; // nothing to merge; the live config.php stays as occ maintenance:install made it
-			}
-			$backupConfig = (static function () use ($path): array {
-				$CONFIG = [];
-				include $path;
-				return $CONFIG;
-			})();
-			foreach (self::CONNECTION_KEYS as $key) {
-				unset($backupConfig[$key]);
-			}
-			return $backupConfig;
-		} finally {
-			$this->rmrf($tmp);
-		}
-	}
-
-	/** @return list<array<string, mixed>> raw appconfig rows (appid, configkey, configvalue, type, lazy) */
-	private function preserveOwnAppConfig(): array {
-		$qb = $this->db->getQueryBuilder();
-		$qb->select('*')->from('appconfig')
-			->where($qb->expr()->eq('appid', $qb->createNamedParameter(\OCA\NgBackup\AppInfo\Application::APP_ID)));
-		/** @var list<array<string, mixed>> */
-		return $qb->executeQuery()->fetchAll();
-	}
-
-	/**
-	 * @param list<array<string, mixed>> $rows raw appconfig rows, as returned by preserveOwnAppConfig()
-	 *
-	 * Runs in its own transaction (DbDumper::restore() already committed its own by the time
-	 * this is called): not a full guarantee against a crash spanning both, but means this step
-	 * itself cannot leave ng_backup's appconfig rows half deleted, half reinserted.
-	 */
-	private function restoreOwnAppConfig(array $rows): void {
-		$this->db->beginTransaction();
-		try {
-			$qb = $this->db->getQueryBuilder();
-			$qb->delete('appconfig')
-				->where($qb->expr()->eq('appid', $qb->createNamedParameter(\OCA\NgBackup\AppInfo\Application::APP_ID)));
-			$qb->executeStatement();
-			foreach ($rows as $row) {
-				$ins = $this->db->getQueryBuilder();
-				$ins->insert('appconfig')->values([
-					'appid' => $ins->createNamedParameter($row['appid']),
-					'configkey' => $ins->createNamedParameter($row['configkey']),
-					'configvalue' => $ins->createNamedParameter($row['configvalue']),
-					'type' => $ins->createNamedParameter($row['type'], \OCP\DB\QueryBuilder\IQueryBuilder::PARAM_INT),
-					'lazy' => $ins->createNamedParameter($row['lazy'], \OCP\DB\QueryBuilder\IQueryBuilder::PARAM_INT),
-				]);
-				$ins->executeStatement();
-			}
-			$this->db->commit();
-		} catch (\Throwable $e) {
-			$this->db->rollBack();
-			throw $e;
-		}
-	}
-
-	private function rmrf(string $dir): void {
-		if (!is_dir($dir)) {
-			return;
-		}
-		foreach (new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($dir, \FilesystemIterator::SKIP_DOTS), \RecursiveIteratorIterator::CHILD_FIRST) as $f) {
-			$f->isDir() ? rmdir($f->getPathname()) : unlink($f->getPathname());
-		}
-		rmdir($dir);
-	}
-
-	private function describeBlockers(array $check): string {
-		$parts = [];
-		if ($check['currentMajor'] !== $check['snapshotMajor']) {
-			$parts[] = "this installation is Nextcloud {$check['currentMajor']}, the backup is from {$check['snapshotMajor']} (same major version required)";
-		}
-		if ($check['missingApps'] !== []) {
-			$parts[] = 'install these apps first (their tables must exist before the database restore can use them): '
-				. implode(', ', array_map(fn (string $a) => "occ app:install $a", $check['missingApps']));
-		}
-		return implode('; ', $parts);
-	}
-
-	private function withSharedLock(Target $target, callable $fn): mixed {
-		try {
-			// Refreshed during the database and data restore (per row batch, per blob), so a
-			// cleanup cannot take over the location while a long restore is still reading it.
-			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 7200, $fn);
-		} catch (LockedException) {
-			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');
-		}
-	}
-}

lib/Service/RestoreService.php

@@ -28,7 +28,7 @@ use OCP\Files\NotFoundException;
  *  - merge:   into the original place, existing files are overwritten (old content kept as a version)
  *  - replace: like merge, and files that are not in the snapshot are moved to the trash
  */
-final class RestoreService {
+class RestoreService {
 	public const MODE_NEW_FOLDER = 'new-folder';
 	public const MODE_MERGE = 'merge';
 	public const MODE_REPLACE = 'replace';
@@ -36,17 +36,23 @@ final class RestoreService {
 	public function __construct(
 		private TargetService $targets,
 		private IRootFolder $root,
-		private LeaseService $leases,
+		private \OCP\Lock\ILockingProvider $locking,
 	) {
 	}
 
 	/** Shared lock on the location while restoring: a cleanup (exclusive) must not delete what is being read. */
-	private function withSharedLock(Target $target, callable $fn, int $ttl = 600): mixed {
+	private function withSharedLock(Target $target, callable $fn): mixed {
+		$key = PruneService::lockKey($target);
 		try {
-			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, $ttl, $fn);
+			$this->locking->acquireLock($key, \OCP\Lock\ILockingProvider::LOCK_SHARED);
 		} catch (\OCP\Lock\LockedException) {
 			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is running; try again later');
 		}
+		try {
+			return $fn();
+		} finally {
+			$this->locking->releaseLock($key, \OCP\Lock\ILockingProvider::LOCK_SHARED);
+		}
 	}
 
 	/**
@@ -82,20 +88,7 @@ final class RestoreService {
 	 * @return array{restored:int, trashed:int, target:string}
 	 */
 	public function restoreUserFiles(Target $target, string $snapshotId, string $logicalPath, string $mode = self::MODE_NEW_FOLDER, ?callable $progress = null): array {
-		return $this->withSharedLock($target, function (callable $refresh) use ($target, $snapshotId, $logicalPath, $mode, $progress) {
-			$last = time();
-			// Keep the lease alive while files are being written.
-			$beat = function (int $done, int $total, string $name) use ($refresh, $progress, &$last): void {
-				if (time() - $last >= 60) {
-					$refresh();
-					$last = time();
-				}
-				if ($progress !== null) {
-					$progress($done, $total, $name);
-				}
-			};
-			return $this->doRestoreUserFiles($target, $snapshotId, $logicalPath, $mode, $beat);
-		});
+		return $this->withSharedLock($target, fn () => $this->doRestoreUserFiles($target, $snapshotId, $logicalPath, $mode, $progress));
 	}
 
 	private function doRestoreUserFiles(Target $target, string $snapshotId, string $logicalPath, string $mode, ?callable $progress): array {
@@ -149,30 +142,15 @@ final class RestoreService {
 		return ['restored' => $restored, 'trashed' => $trashed, 'target' => $uid . ':' . $userFolder->getRelativePath($dest->getPath())];
 	}
 
-	/**
-	 * Raw restore of any snapshot path to a local directory (administrators, disaster recovery).
-	 *
-	 * @param bool $stripPrefix write into $directory itself instead of $directory/$prefix (see
-	 *             Repository::restore()); used to restore "data/" or "config/" straight into the
-	 *             real data/config directory for occ backup:restore:full.
-	 */
-	public function restoreToDirectory(Target $target, string $snapshotId, string $prefix, string $directory, bool $stripPrefix = false, ?callable $heartbeat = null): int {
+	/** Raw restore of any snapshot path to a local directory (administrators, disaster recovery). */
+	public function restoreToDirectory(Target $target, string $snapshotId, string $prefix, string $directory): int {
 		if ($prefix !== '' && !Repository::isSafePath($prefix)) {
 			throw new \InvalidArgumentException('Invalid path: ' . $prefix);
 		}
 		if (!is_dir($directory) && !mkdir($directory, 0750, true) && !is_dir($directory)) {
 			throw new \RuntimeException("Cannot create $directory");
 		}
-		return $this->withSharedLock($target, function (callable $refresh) use ($target, $snapshotId, $prefix, $directory, $stripPrefix, $heartbeat): int {
-			$own = LeaseService::throttled($refresh);
-			$beat = static function () use ($own, $heartbeat): void {
-				$own();
-				if ($heartbeat !== null) {
-					$heartbeat();
-				}
-			};
-			return $this->targets->repository($target)->restore($snapshotId, $directory, trim($prefix, '/') === '' ? '' : trim($prefix, '/') . '/', $stripPrefix, $beat);
-		}, 3600);
+		return $this->withSharedLock($target, fn () => $this->targets->repository($target)->restore($snapshotId, $directory, trim($prefix, '/') === '' ? '' : trim($prefix, '/') . '/'));
 	}
 
 	private function writeFile(Repository $repo, Folder $dest, string $relPath, array $entry): void {

lib/Service/TargetService.php

@@ -10,13 +10,10 @@ namespace OCA\NgBackup\Service;
 use OCA\NgBackup\Backend\ExternalStorageFactory;
 use OCA\NgBackup\Backend\IBackend;
 use OCA\NgBackup\Backend\StorageBackend;
-use OCA\NgBackup\Db\Snapshot;
-use OCA\NgBackup\Db\SnapshotMapper;
 use OCA\NgBackup\Db\Target;
 use OCA\NgBackup\Db\TargetMapper;
 use OCA\NgBackup\Repository\Repository;
 use OCP\App\IAppManager;
-use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\Security\ICrypto;
 use OCP\Server;
 
@@ -25,7 +22,7 @@ use OCP\Server;
  * object is built only while it is used; nothing is mounted. files_external is loaded for its
  * classes but its enabled/disabled state is left as the admin set it.
  */
-final class TargetService {
+class TargetService {
 	public function __construct(
 		private TargetMapper $mapper,
 		private KeyService $keys,
@@ -33,7 +30,6 @@ final class TargetService {
 		private IAppManager $appManager,
 		private \OCA\NgBackup\Db\DbIndexCache $indexCache,
 		private \OCA\NgBackup\Db\AppConfigCatalogAnchor $anchor,
-		private SnapshotMapper $snapshots,
 	) {
 	}
 
@@ -53,12 +49,6 @@ final class TargetService {
 		if (!preg_match('/^[A-Za-z0-9][A-Za-z0-9 _.-]{0,63}$/', $name)) {
 			throw new \InvalidArgumentException('Name: letters, digits, space, _ . - (max 64)');
 		}
-		// Without the native extension files_external falls back to the smbclient binary, which
-		// registers fine but cannot seek: the first backup then fails with "Seek failed". Refuse
-		// up front instead of letting the admin find out from a failed run.
-		if ($backend === 'smb' && !extension_loaded('smbclient')) {
-			throw new \InvalidArgumentException('The SMB backend needs the PHP smbclient extension (pecl install smbclient); the smbclient binary alone cannot seek and every backup would fail');
-		}
 		try {
 			$this->mapper->findByName($name);
 			throw new \InvalidArgumentException("A target named '$name' already exists");
@@ -88,62 +78,7 @@ final class TargetService {
 		$target->setBasePath(trim($basePath, '/'));
 		$target->setRepositoryId($repo->id());
 		$target->setCreatedAt(time());
-		$target = $this->mapper->insert($target);
-		if (!$created) {
-			// Disaster recovery: occ backup:list reads this local cache, not the repository
-			// directly, so a snapshot made by another installation must be backfilled here too.
-			$this->adoptSnapshots($target, $repo);
-		}
-		return ['target' => $target, 'created' => $created];
-	}
-
-	/**
-	 * A target's options are encrypted with Nextcloud's own instance secret (ICrypto), not
-	 * ng_backup's key, so changing that secret (occ backup:restore:full merging config.php)
-	 * would otherwise leave every target permanently undecryptable. Call $applySecretChange
-	 * (which must be the only thing that changes the secret) through here instead: every
-	 * target's options are decrypted first, then re-encrypted under whatever secret is active
-	 * once $applySecretChange returns.
-	 */
-	public function reencryptOptionsAround(callable $applySecretChange): mixed {
-		$plain = [];
-		foreach ($this->mapper->findAll() as $target) {
-			$plain[$target->getId()] = $this->options($target);
-		}
-		$result = $applySecretChange();
-		foreach ($this->mapper->findAll() as $target) {
-			if (!isset($plain[$target->getId()])) {
-				continue; // added by $applySecretChange itself; nothing to re-encrypt
-			}
-			$target->setOptions($this->crypto->encrypt(json_encode($plain[$target->getId()], JSON_THROW_ON_ERROR)));
-			$this->mapper->update($target);
-		}
-		return $result;
-	}
-
-	private function adoptSnapshots(Target $target, Repository $repo): void {
-		foreach ($repo->listSnapshots() as $snapshotId) {
-			try {
-				$this->snapshots->findOne($target->getId(), $snapshotId);
-				continue; // already known locally
-			} catch (DoesNotExistException) {
-			}
-			// One unreadable/corrupt snapshot must not stop the rest of the location's
-			// snapshots from being backfilled, nor abort adding the target itself.
-			try {
-				$meta = $repo->snapshotMeta($snapshotId);
-				$s = new Snapshot();
-				$s->setTargetId($target->getId());
-				$s->setSnapshotId($snapshotId);
-				$s->setKind((string)($meta['kind'] ?? 'full'));
-				$s->setLabel(($meta['label'] ?? '') !== '' ? $meta['label'] : null);
-				$s->setCreatedAt((int)strtotime((string)($meta['time'] ?? 'now')));
-				$s->setFiles((int)($meta['stats']['files'] ?? 0));
-				$s->setBytes((int)($meta['stats']['bytes'] ?? 0));
-				$this->snapshots->insert($s);
-			} catch (\Throwable) {
-			}
-		}
+		return ['target' => $this->mapper->insert($target), 'created' => $created];
 	}
 
 	/** @return list<Target> */
@@ -152,17 +87,7 @@ final class TargetService {
 	}
 
 	public function get(string $nameOrId): Target {
-		try {
-			return ctype_digit($nameOrId) ? $this->mapper->find((int)$nameOrId) : $this->mapper->findByName($nameOrId);
-		} catch (DoesNotExistException) {
-			throw new \InvalidArgumentException("No such location: $nameOrId");
-		}
-	}
-
-	/** Size limit for the data stored on this location (null = none). */
-	public function setMaxBytes(Target $target, ?int $maxBytes): Target {
-		$target->setMaxBytes($maxBytes);
-		return $this->mapper->update($target);
+		return ctype_digit($nameOrId) ? $this->mapper->find((int)$nameOrId) : $this->mapper->findByName($nameOrId);
 	}
 
 	public function setAppendOnly(Target $target, bool $appendOnly): Target {
@@ -184,7 +109,6 @@ final class TargetService {
 		if ($target->getRepositoryId() !== null && $repo->id() !== $target->getRepositoryId()) {
 			throw new \RuntimeException('The target now contains a different repository than when it was added');
 		}
-		$repo->setMaxBytes($target->getMaxBytes());
 		return $repo;
 	}
 

lib/Service/UserBackupService.php

@@ -1,66 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Service;
-
-use OCA\NgBackup\Db\Target;
-use OCA\NgBackup\UserMigration\RepositoryExportDestination;
-use OCA\NgBackup\UserMigration\UserMigrationServiceLocator;
-use OCP\IUser;
-use OCP\Lock\LockedException;
-use OCP\UserMigration\UserMigrationException;
-
-/**
- * Per-user backup via user_migration: every registered migrator's export streams straight into
- * the encrypted repository (no zip, no copy in the user's own storage, see
- * RepositoryExportDestination). Shares blobs with the full backup; prune() keeps a user export's
- * blobs referenced through its manifest under users/<uid>/.
- *
- * user_migration is an optional dependency (unlike files_external): without it, only this
- * per-user backup/restore is unavailable, the full backup still works.
- */
-final class UserBackupService {
-	public function __construct(
-		private TargetService $targets,
-		private LeaseService $leases,
-		private UserMigrationServiceLocator $locator,
-	) {
-	}
-
-	/** @throws UserMigrationException when user_migration is not enabled, or the export itself fails */
-	public function backupUser(Target $target, IUser $user): string {
-		$service = $this->locator->get();
-		return $this->withSharedLock($target, function (callable $refresh) use ($target, $user, $service) {
-			$repo = $this->targets->repository($target);
-			$dest = new RepositoryExportDestination($repo, $user->getUID(), LeaseService::throttled($refresh));
-			$service->export($dest, $user);
-			// A short exclusive lock around the catalog write only: the shared lock above
-			// allows another concurrent backup (full or per-user) to be writing the catalog at
-			// the same time. The repository is reopened inside the lock, so the write builds on
-			// the latest catalog generation instead of the one loaded before the lock was taken.
-			$this->withCatalogLock($target, fn () => $this->targets->repository($target)->recordUserExport($dest->manifestPath()));
-			return $dest->manifestPath();
-		});
-	}
-
-	private function withSharedLock(Target $target, callable $fn): mixed {
-		try {
-			// Refreshed by RepositoryExportDestination as it writes data, so a long export keeps it.
-			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 3600, $fn);
-		} catch (LockedException) {
-			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');
-		}
-	}
-
-	private function withCatalogLock(Target $target, callable $fn): mixed {
-		try {
-			return $this->leases->with(PruneService::catalogLockKey($target), LeaseService::EXCLUSIVE, 300, $fn);
-		} catch (LockedException) {
-			throw new \RuntimeException('Another catalog write for ' . $target->getName() . ' is in progress; try again');
-		}
-	}
-}

lib/Service/UserRestoreService.php

@@ -1,137 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Service;
-
-use OCA\NgBackup\Db\Target;
-use OCA\NgBackup\UserMigration\RepositoryExportDestination;
-use OCA\NgBackup\UserMigration\RepositoryImportSource;
-use OCA\NgBackup\UserMigration\UserMigrationServiceLocator;
-use OCP\EventDispatcher\IEventDispatcher;
-use OCP\Files\Events\Node\FilesystemTornDownEvent;
-use OCP\IUser;
-use OCP\IUserManager;
-use OCP\Lock\LockedException;
-use OCP\Security\ISecureRandom;
-use OCP\UserMigration\UserMigrationException;
-
-/**
- * Restoring a user from a user_migration export (see UserBackupService), never over an existing
- * account:
- *  - replace: a safety export of the current state goes into the repository first, then the
- *    account is deleted and recreated fresh from the backup, under the same uid;
- *  - as-backup: the backup is restored into a new account "<uid>-bak" (or "-bak-2", ...) instead,
- *    so an admin can compare and transfer by hand. Nextcloud cannot rename a uid, so the *backup*
- *    gets the new name, never the existing account.
- */
-final class UserRestoreService {
-	public const MODE_REPLACE = 'replace';
-	public const MODE_AS_BACKUP = 'as-backup';
-
-	public function __construct(
-		private TargetService $targets,
-		private LeaseService $leases,
-		private UserMigrationServiceLocator $locator,
-		private IUserManager $userManager,
-		private ISecureRandom $random,
-		private IEventDispatcher $events,
-	) {
-	}
-
-	/** @throws UserMigrationException when user_migration is not enabled, or the restore itself fails */
-	public function restoreUser(Target $target, string $manifestPath, string $mode = self::MODE_REPLACE): IUser {
-		$service = $this->locator->get();
-		return $this->withSharedLock($target, function (callable $refresh) use ($target, $manifestPath, $mode, $service): IUser {
-			$repo = $this->targets->repository($target);
-			// Only ever read a manifest the verified catalog actually recorded: a path alone
-			// (even one this app generated before) proves nothing about it still being current
-			// or genuine once the catalog's rollback protection is supposed to vouch for it.
-			if (!$repo->isRecordedUserExport($manifestPath)) {
-				throw new \InvalidArgumentException("$manifestPath is not a recorded user export for this location");
-			}
-			$beat = LeaseService::throttled($refresh);
-			$source = new RepositoryImportSource($repo, $manifestPath, $beat);
-			$originalUid = $source->getOriginalUid();
-
-			if ($mode === self::MODE_AS_BACKUP) {
-				$backupUid = $this->freeBackupUid($originalUid);
-				$user = $this->userManager->createUser($backupUid, $this->random->generate(32));
-				if ($user === false) {
-					throw new \RuntimeException("Could not create the account $backupUid");
-				}
-				try {
-					return $service->import($source, $user);
-				} catch (\Throwable $e) {
-					// A partially-imported, never-used account left behind is strictly worse
-					// than no account at all; the original source account was never touched.
-					$user->delete();
-					throw $e;
-				}
-			}
-
-			if ($mode !== self::MODE_REPLACE) {
-				throw new \InvalidArgumentException("Unknown restore mode: $mode");
-			}
-			$existing = $this->userManager->get($originalUid);
-			$safetyManifestPath = null;
-			if ($existing !== null) {
-				// Never import over a live account: export its current state first, so nothing
-				// is lost if the restore turns out to be the wrong choice.
-				$safety = new RepositoryExportDestination($repo, $originalUid, $beat);
-				$service->export($safety, $existing);
-				$safetyManifestPath = $safety->manifestPath();
-				// Same race as UserBackupService::backupUser(): reopen the repository inside the
-				// catalog lock so the write builds on the latest generation.
-				$this->withCatalogLock($target, fn () => $this->targets->repository($target)->recordUserExport($safetyManifestPath));
-				if (!$existing->delete()) {
-					throw new \RuntimeException("Could not delete the existing account $originalUid before restoring; its safety export is at $safetyManifestPath");
-				}
-				// IRootFolder caches a Folder per uid for the lifetime of this process; without
-				// this it would still hand the just-deleted account's (now storage-less) folder
-				// to the import below, and every write would fail.
-				$this->events->dispatchTyped(new FilesystemTornDownEvent());
-			}
-			try {
-				return $service->import($source, null);
-			} catch (\Throwable $e) {
-				// The original account is already gone at this point (or never existed); a
-				// failure here can only be reported, not undone in place. Its safety export
-				// (if any) is the recovery path, already recorded above.
-				throw new UserMigrationException(
-					"Could not restore $originalUid" . ($safetyManifestPath !== null ? "; its safety export is at $safetyManifestPath" : '') . ': ' . $e->getMessage(),
-					0,
-					$e,
-				);
-			}
-		});
-	}
-
-	private function freeBackupUid(string $uid): string {
-		$candidate = $uid . '-bak';
-		for ($n = 2; $this->userManager->userExists($candidate); $n++) {
-			$candidate = $uid . '-bak-' . $n;
-		}
-		return $candidate;
-	}
-
-	private function withSharedLock(Target $target, callable $fn): mixed {
-		try {
-			// Refreshed while the safety export writes and the import reads (see UserBackupService::withSharedLock()).
-			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 3600, $fn);
-		} catch (LockedException) {
-			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');
-		}
-	}
-
-	private function withCatalogLock(Target $target, callable $fn): mixed {
-		try {
-			return $this->leases->with(PruneService::catalogLockKey($target), LeaseService::EXCLUSIVE, 300, $fn);
-		} catch (LockedException) {
-			throw new \RuntimeException('Another catalog write for ' . $target->getName() . ' is in progress; try again');
-		}
-	}
-}

lib/Service/VerifyService.php

@@ -1,48 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Service;
-
-use OCA\NgBackup\Db\Target;
-use OCP\Lock\LockedException;
-
-/** Checksum audit of a snapshot (occ backup:verify), see Repository::verify(). */
-final class VerifyService {
-	public function __construct(
-		private TargetService $targets,
-		private LeaseService $leases,
-	) {
-	}
-
-	/** @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string} */
-	public function verify(Target $target, string $snapshotId, bool $deep = false): array {
-		return $this->run($target, $deep, fn (\OCA\NgBackup\Repository\Repository $repo, callable $heartbeat): array => $repo->verify($snapshotId, $deep, $heartbeat));
-	}
-
-	/** @return array{filesChecked:int, blobsChecked:int, bytesChecked:int, missing:list<string>, failed:list<string>, unreadable:list<string>, readError:string} */
-	public function verifyUserExport(Target $target, string $manifestPath, bool $deep = false): array {
-		return $this->run($target, $deep, fn (\OCA\NgBackup\Repository\Repository $repo, callable $heartbeat): array => $repo->verifyUserExport($manifestPath, $deep, $heartbeat));
-	}
-
-	private function run(Target $target, bool $deep, callable $fn): array {
-		$ttl = $deep ? 600 : 300;
-		try {
-			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, $ttl, function (callable $refresh) use ($target, $deep, $ttl, $fn): array {
-				$last = time();
-				$heartbeat = function () use ($refresh, $ttl, &$last): void {
-					if (time() - $last >= intdiv($ttl, 2)) {
-						$refresh();
-						$last = time();
-					}
-				};
-				return $fn($this->targets->repository($target), $heartbeat);
-			});
-		} catch (LockedException) {
-			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');
-		}
-	}
-}

lib/Settings/Admin.php

@@ -11,7 +11,7 @@ use OCP\AppFramework\Http\TemplateResponse;
 use OCP\Settings\ISettings;
 use OCP\Util;
 
-final class Admin implements ISettings {
+class Admin implements ISettings {
 	public function getForm(): TemplateResponse {
 		Util::addScript('ng_backup', 'ng_backup-admin');
 		Util::addStyle('ng_backup', 'ng_backup-admin');

lib/Settings/AdminSection.php

@@ -11,7 +11,7 @@ use OCP\IL10N;
 use OCP\IURLGenerator;
 use OCP\Settings\IIconSection;
 
-final class AdminSection implements IIconSection {
+class AdminSection implements IIconSection {
 	public function __construct(
 		private IL10N $l,
 		private IURLGenerator $url,

lib/SetupCheck/BackupStatusCheck.php

@@ -19,7 +19,7 @@ use OCP\SetupCheck\ISetupCheck;
 use OCP\SetupCheck\SetupResult;
 
 /** Shows the backup state in the admin overview (Security & setup warnings). */
-final class BackupStatusCheck implements ISetupCheck {
+class BackupStatusCheck implements ISetupCheck {
 	public function __construct(
 		private IL10N $l,
 		private IURLGenerator $url,

lib/UserMigration/RepositoryExportDestination.php

@@ -28,8 +28,6 @@ final class RepositoryExportDestination implements IExportDestination {
 	public function __construct(
 		private Repository $repo,
 		private string $uid,
-		/** Called while data is written (per chunk), to keep the location lease alive. */
-		private ?\Closure $heartbeat = null,
 	) {
 		$this->exportId = gmdate('Ymd\THis\Z') . '-' . bin2hex(random_bytes(4));
 	}
@@ -38,7 +36,6 @@ final class RepositoryExportDestination implements IExportDestination {
 		$writer = $this->repo->blobWriter($this->stats);
 		$writer->write($content);
 		$this->entries[self::norm($path)] = ['t' => 'f', 'b' => $writer->finish(), 's' => strlen($content)];
-		$this->beat();
 	}
 
 	public function addFileAsStream(string $path, $stream): void {
@@ -49,7 +46,6 @@ final class RepositoryExportDestination implements IExportDestination {
 				throw new UserMigrationException('Read error while exporting ' . $path);
 			}
 			$writer->write($chunk);
-			$this->beat();
 		}
 		$this->entries[self::norm($path)] = ['t' => 'f', 'b' => $writer->finish(), 's' => $writer->bytes()];
 	}
@@ -69,11 +65,8 @@ final class RepositoryExportDestination implements IExportDestination {
 				if ($stream === false) {
 					throw new \RuntimeException('Cannot read ' . $node->getPath());
 				}
-				try {
-					$this->addFileAsStream($target, $stream);
-				} finally {
-					fclose($stream);
-				}
+				$this->addFileAsStream($target, $stream);
+				fclose($stream);
 			}
 		}
 	}
@@ -96,12 +89,6 @@ final class RepositoryExportDestination implements IExportDestination {
 		return $this->stats;
 	}
 
-	private function beat(): void {
-		if ($this->heartbeat !== null) {
-			($this->heartbeat)();
-		}
-	}
-
 	private static function norm(string $path): string {
 		return trim($path, '/');
 	}

lib/UserMigration/RepositoryImportSource.php

@@ -8,7 +8,6 @@ declare(strict_types=1);
 namespace OCA\NgBackup\UserMigration;
 
 use OCA\NgBackup\Repository\Repository;
-use OCP\Files\File;
 use OCP\Files\Folder;
 use OCP\UserMigration\IImportSource;
 use OCP\UserMigration\UserMigrationException;
@@ -20,8 +19,6 @@ final class RepositoryImportSource implements IImportSource {
 	public function __construct(
 		private Repository $repo,
 		string $manifestPath,
-		/** Called while blobs are read, to keep the location lease alive. */
-		private ?\Closure $heartbeat = null,
 	) {
 		$this->manifest = json_decode($repo->getObject($manifestPath), true, 512, JSON_THROW_ON_ERROR);
 	}
@@ -33,18 +30,11 @@ final class RepositoryImportSource implements IImportSource {
 		return $data;
 	}
 
-	/** @return resource */
 	public function getFileAsStream(string $path) {
 		$entry = $this->entry($path, 'f');
 		// Phase 0: buffer in php://temp (memory up to 8 MiB, then a temp file for this one file).
 		$stream = fopen('php://temp/maxmemory:' . (8 * 1048576), 'w+b');
-		if ($stream === false) {
-			throw new UserMigrationException('Cannot buffer ' . $path);
-		}
 		foreach ($this->repo->readBlobs($entry['b']) as $data) {
-			if ($this->heartbeat !== null) {
-				($this->heartbeat)();
-			}
 			for ($done = 0, $len = strlen($data); $done < $len; $done += $n) {
 				$n = fwrite($stream, $done === 0 ? $data : substr($data, $done));
 				if ($n === false || $n === 0) {
@@ -61,7 +51,6 @@ final class RepositoryImportSource implements IImportSource {
 		$prefix = trim($path, '/');
 		$prefix = $prefix === '' ? '' : $prefix . '/';
 		$names = [];
-		/** @var string $p */
 		foreach (array_keys($this->manifest['entries']) as $p) {
 			if ($prefix === '' || str_starts_with($p, $prefix)) {
 				$rest = substr($p, strlen($prefix));
@@ -81,7 +70,6 @@ final class RepositoryImportSource implements IImportSource {
 		if (isset($this->manifest['entries'][$p])) {
 			return true;
 		}
-		/** @var string $k */
 		foreach (array_keys($this->manifest['entries']) as $k) {
 			if (str_starts_with($k, $p . '/')) {
 				return true;
@@ -103,25 +91,13 @@ final class RepositoryImportSource implements IImportSource {
 				$this->copyToFolder($sub, $path);
 			} else {
 				$stream = $this->getFileAsStream($path);
-				try {
-					if ($destination->nodeExists($name)) {
-						$existing = $destination->get($name);
-						if (!$existing instanceof File) {
-							throw new UserMigrationException("$path exists and is not a file");
-						}
-						$existing->putContent($stream);
-					} else {
-						$destination->newFile($name, $stream);
-					}
-				} finally {
-					// putContent()/newFile() already close the stream once they've consumed it:
-					// despite the @return resource docblock above, $stream is no longer a
-					// resource by the time we get here (verified against a real storage; a
-					// double fclose() throws a TypeError on PHP 8).
-					/** @psalm-suppress RedundantConditionGivenDocblockType */
-					if (is_resource($stream)) {
-						fclose($stream);
-					}
+				if ($destination->nodeExists($name)) {
+					$destination->get($name)->putContent($stream);
+				} else {
+					$destination->newFile($name, $stream);
+				}
+				if (is_resource($stream)) {
+					fclose($stream);
 				}
 			}
 		}

lib/UserMigration/UserMigrationInstaller.php

@@ -1,77 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\UserMigration;
-
-use OCP\App\AppPathNotFoundException;
-use OCP\App\IAppManager;
-use Symfony\Component\Console\Input\InputInterface;
-use Symfony\Component\Console\Output\OutputInterface;
-use Symfony\Component\Console\Helper\QuestionHelper;
-use Symfony\Component\Console\Question\ConfirmationQuestion;
-
-/**
- * Installs or enables the optional user_migration app, but only when the administrator asked for it
- * (occ prompt or --install-user-migration). Runs occ in a child process, as the admin would.
- */
-final class UserMigrationInstaller {
-	private const APP = 'user_migration';
-
-	public function __construct(
-		private IAppManager $appManager,
-	) {
-	}
-
-	public function isEnabled(): bool {
-		return $this->appManager->isEnabledForAnyone(self::APP);
-	}
-
-	private function codeIsPresent(): bool {
-		try {
-			$this->appManager->getAppPath(self::APP);
-			return true;
-		} catch (AppPathNotFoundException) {
-			return false;
-		}
-	}
-
-	/** Installs (from the app store, if missing) and enables user_migration; throws on failure. */
-	public function install(): void {
-		$args = $this->codeIsPresent() ? ['app:enable', self::APP] : ['app:install', self::APP];
-		/** @psalm-suppress UndefinedClass */
-		$occ = \OC::$SERVERROOT . '/occ';
-		$command = implode(' ', array_map('escapeshellarg', [PHP_BINARY, $occ, ...$args])) . ' 2>&1';
-		exec($command, $lines, $code);
-		if ($code !== 0) {
-			throw new \RuntimeException("occ " . implode(' ', $args) . " failed:\n" . implode("\n", $lines));
-		}
-	}
-
-	/**
-	 * Returns when user_migration is enabled. Otherwise asks the administrator (interactive shell) or
-	 * requires --install-user-migration, and throws when neither gives consent.
-	 *
-	 * @throws \RuntimeException
-	 */
-	public function ensureEnabled(InputInterface $input, OutputInterface $output): void {
-		if ($this->isEnabled()) {
-			return;
-		}
-		$consent = $input->getOption('install-user-migration') === true;
-		if (!$consent && $input->isInteractive()) {
-			$consent = (new QuestionHelper())->ask($input, $output, new ConfirmationQuestion(
-				'The user_migration app is not enabled. Install and enable it now? [y/N] ', false)) === true;
-		}
-		if (!$consent) {
-			throw new \RuntimeException('The user_migration app is not enabled; per-user backup/restore needs it. Run "occ '
-				. 'app:install ' . self::APP . '" and "occ app:enable ' . self::APP . '", or repeat with --install-user-migration');
-		}
-		$output->writeln('Installing and enabling user_migration (approved by the administrator)...');
-		$this->install();
-		throw new \RuntimeException('user_migration is installed and enabled; run this command again');
-	}
-}

lib/UserMigration/UserMigrationServiceLocator.php

@@ -1,35 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\UserMigration;
-
-use OCP\App\IAppManager;
-use OCP\Server;
-use OCP\UserMigration\UserMigrationException;
-
-/**
- * Resolves user_migration's own (internal, non-public) UserMigrationService on demand.
- *
- * Unlike files_external, user_migration is an optional dependency: without it, only per-user
- * backup/restore is unavailable, the full backup still works. The class is never autoloaded by
- * composer; everything that touches it is behind this one class.
- */
-final class UserMigrationServiceLocator {
-	public function __construct(
-		private IAppManager $appManager,
-	) {
-	}
-
-	/** @throws UserMigrationException when user_migration is not enabled anywhere */
-	public function get(): object {
-		if (!$this->appManager->isEnabledForAnyone('user_migration')) {
-			throw new UserMigrationException('The user_migration app is not enabled; per-user backup/restore is unavailable');
-		}
-		$this->appManager->loadApp('user_migration');
-		return Server::get(\OCA\UserMigration\Service\UserMigrationService::class);
-	}
-}

psalm-baseline.xml

@@ -1,490 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<files psalm-version="6.19.1@e2ca44251c1f1aa2e35452d426895746b47de64e">
-  <file src="lib/Backend/ExternalStorageFactory.php">
-    <MissingClosureParamType>
-      <code><![CDATA[$p]]></code>
-      <code><![CDATA[$p]]></code>
-    </MissingClosureParamType>
-    <MissingClosureReturnType>
-      <code><![CDATA[fn ($p) => $p->jsonSerialize()]]></code>
-      <code><![CDATA[fn ($p) => $p->jsonSerialize()]]></code>
-    </MissingClosureReturnType>
-  </file>
-  <file src="lib/Backend/IBackend.php">
-    <MissingParamType>
-      <code><![CDATA[$stream]]></code>
-    </MissingParamType>
-  </file>
-  <file src="lib/Backend/LocalBackend.php">
-    <MissingParamType>
-      <code><![CDATA[$stream]]></code>
-    </MissingParamType>
-    <TypeDoesNotContainType>
-      <code><![CDATA[$out !== false]]></code>
-    </TypeDoesNotContainType>
-  </file>
-  <file src="lib/Backend/StorageBackend.php">
-    <MissingParamType>
-      <code><![CDATA[$stream]]></code>
-    </MissingParamType>
-  </file>
-  <file src="lib/BackgroundJob/BackupJob.php">
-    <MissingParamType>
-      <code><![CDATA[$argument]]></code>
-    </MissingParamType>
-  </file>
-  <file src="lib/BackgroundJob/RestoreJob.php">
-    <MissingParamType>
-      <code><![CDATA[$argument]]></code>
-    </MissingParamType>
-  </file>
-  <file src="lib/Command/Browse.php">
-    <InvalidOperand>
-      <code><![CDATA[$b /= 1024]]></code>
-    </InvalidOperand>
-  </file>
-  <file src="lib/Command/KeyConfirm.php">
-    <UndefinedInterfaceMethod>
-      <code><![CDATA[ask]]></code>
-      <code><![CDATA[ask]]></code>
-    </UndefinedInterfaceMethod>
-  </file>
-  <file src="lib/Command/KeyImport.php">
-    <UndefinedInterfaceMethod>
-      <code><![CDATA[ask]]></code>
-    </UndefinedInterfaceMethod>
-  </file>
-  <file src="lib/Command/KeyInit.php">
-    <UndefinedInterfaceMethod>
-      <code><![CDATA[ask]]></code>
-      <code><![CDATA[ask]]></code>
-    </UndefinedInterfaceMethod>
-  </file>
-  <file src="lib/Command/KeySlots.php">
-    <UndefinedInterfaceMethod>
-      <code><![CDATA[ask]]></code>
-      <code><![CDATA[ask]]></code>
-    </UndefinedInterfaceMethod>
-  </file>
-  <file src="lib/Command/Prune.php">
-    <PossiblyFalseOperand>
-      <code><![CDATA[json_encode($this->prune->policy()->toArray())]]></code>
-    </PossiblyFalseOperand>
-  </file>
-  <file src="lib/Command/RunBackup.php">
-    <PossiblyNullArgument>
-      <code><![CDATA[$run->getSnapshotId()]]></code>
-    </PossiblyNullArgument>
-  </file>
-  <file src="lib/Command/Status.php">
-    <RiskyTruthyFalsyComparison>
-      <code><![CDATA[$c]]></code>
-      <code><![CDATA[$r->getFinishedAt()]]></code>
-    </RiskyTruthyFalsyComparison>
-  </file>
-  <file src="lib/Command/TargetAdd.php">
-    <PossiblyNullArgument>
-      <code><![CDATA[$r['target']->getRepositoryId()]]></code>
-    </PossiblyNullArgument>
-    <PossiblyUndefinedArrayOffset>
-      <code><![CDATA[$v]]></code>
-    </PossiblyUndefinedArrayOffset>
-  </file>
-  <file src="lib/Command/TargetBackends.php">
-    <UndefinedClass>
-      <code><![CDATA[Base]]></code>
-    </UndefinedClass>
-  </file>
-  <file src="lib/Command/TargetLimit.php">
-    <InvalidOperand>
-      <code><![CDATA[(float)$m[1] * $factor]]></code>
-    </InvalidOperand>
-  </file>
-  <file src="lib/Command/TargetList.php">
-    <UndefinedClass>
-      <code><![CDATA[Base]]></code>
-    </UndefinedClass>
-  </file>
-  <file src="lib/Command/TargetTrustCurrent.php">
-    <UndefinedInterfaceMethod>
-      <code><![CDATA[ask]]></code>
-    </UndefinedInterfaceMethod>
-  </file>
-  <file src="lib/Command/Trash.php">
-    <RedundantCastGivenDocblockType>
-      <code><![CDATA[(string)($info['time'] ?? '')]]></code>
-    </RedundantCastGivenDocblockType>
-  </file>
-  <file src="lib/Controller/AdminApiController.php">
-    <InvalidOperand>
-      <code><![CDATA[$maxGb * 1073741824]]></code>
-      <code><![CDATA[$maxGb * 1073741824]]></code>
-    </InvalidOperand>
-    <PossiblyNullArgument>
-      <code><![CDATA[$r->getSnapshotId()]]></code>
-    </PossiblyNullArgument>
-  </file>
-  <file src="lib/Crypto/StreamCipher.php">
-    <MissingParamType>
-      <code><![CDATA[$in]]></code>
-      <code><![CDATA[$out]]></code>
-    </MissingParamType>
-    <PossiblyFalseArgument>
-      <code><![CDATA[$in]]></code>
-      <code><![CDATA[$in]]></code>
-      <code><![CDATA[$in]]></code>
-      <code><![CDATA[$in]]></code>
-      <code><![CDATA[$in]]></code>
-      <code><![CDATA[$in]]></code>
-      <code><![CDATA[$out]]></code>
-      <code><![CDATA[$out]]></code>
-      <code><![CDATA[$out]]></code>
-      <code><![CDATA[$out]]></code>
-      <code><![CDATA[$out]]></code>
-      <code><![CDATA[$out]]></code>
-    </PossiblyFalseArgument>
-    <PossiblyInvalidArrayAccess>
-      <code><![CDATA[unpack('N', $len)[1]]]></code>
-    </PossiblyInvalidArrayAccess>
-  </file>
-  <file src="lib/Db/AppConfigCatalogAnchor.php">
-    <PossiblyFalseArgument>
-      <code><![CDATA[json_encode(['gen' => $gen, 'hash' => $hash])]]></code>
-    </PossiblyFalseArgument>
-  </file>
-  <file src="lib/Db/DbDumper.php">
-    <InvalidArrayOffset>
-      <code><![CDATA[$info['sha256']]]></code>
-      <code><![CDATA[$manifest['sequences']]]></code>
-    </InvalidArrayOffset>
-    <MissingClosureReturnType>
-      <code><![CDATA[fn ($c) => $end[array_search($c, $columns, true)]]]></code>
-      <code><![CDATA[fn ($c) => $q($c)]]></code>
-      <code><![CDATA[fn (string $c) => $this->db->quoteIdentifier($c)]]></code>
-      <code><![CDATA[fn (string $c) => $this->db->quoteIdentifier($c)]]></code>
-    </MissingClosureReturnType>
-    <PossiblyFalseArgument>
-      <code><![CDATA[$value]]></code>
-    </PossiblyFalseArgument>
-    <PossiblyNullArgument>
-      <code><![CDATA[$columns]]></code>
-    </PossiblyNullArgument>
-    <UndefinedClass>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[$this->db]]></code>
-      <code><![CDATA[TransactionIsolationLevel]]></code>
-      <code><![CDATA[\Doctrine\DBAL\ParameterType]]></code>
-      <code><![CDATA[\Doctrine\DBAL\ParameterType]]></code>
-      <code><![CDATA[\Doctrine\DBAL\ParameterType]]></code>
-      <code><![CDATA[\Doctrine\DBAL\Platforms\PostgreSQLPlatform]]></code>
-      <code><![CDATA[\Doctrine\DBAL\Platforms\PostgreSQLPlatform]]></code>
-      <code><![CDATA[\Doctrine\DBAL\Platforms\PostgreSQLPlatform]]></code>
-      <code><![CDATA[\Doctrine\DBAL\Schema\Table]]></code>
-      <code><![CDATA[\Doctrine\DBAL\Schema\Table]]></code>
-      <code><![CDATA[\Doctrine\DBAL\Schema\Table]]></code>
-      <code><![CDATA[private]]></code>
-    </UndefinedClass>
-  </file>
-  <file src="lib/Db/Run.php">
-    <PropertyNotSetInConstructor>
-      <code><![CDATA[Run]]></code>
-    </PropertyNotSetInConstructor>
-  </file>
-  <file src="lib/Db/Snapshot.php">
-    <PropertyNotSetInConstructor>
-      <code><![CDATA[Snapshot]]></code>
-    </PropertyNotSetInConstructor>
-  </file>
-  <file src="lib/Db/Target.php">
-    <PropertyNotSetInConstructor>
-      <code><![CDATA[Target]]></code>
-    </PropertyNotSetInConstructor>
-  </file>
-  <file src="lib/Job/BackupRun.php">
-    <ArgumentTypeCoercion>
-      <code><![CDATA[$blobs]]></code>
-    </ArgumentTypeCoercion>
-    <MissingParamType>
-      <code><![CDATA[$fh]]></code>
-    </MissingParamType>
-    <PossiblyUndefinedArrayOffset>
-      <code><![CDATA[$mtime]]></code>
-      <code><![CDATA[$state['phase']]]></code>
-      <code><![CDATA[$state['stats']]]></code>
-    </PossiblyUndefinedArrayOffset>
-  </file>
-  <file src="lib/Job/ParentCursor.php">
-    <PossiblyNullReference>
-      <code><![CDATA[next]]></code>
-    </PossiblyNullReference>
-  </file>
-  <file src="lib/Job/TreeWalker.php">
-    <RedundantCastGivenDocblockType>
-      <code><![CDATA[(string)$name]]></code>
-    </RedundantCastGivenDocblockType>
-  </file>
-  <file src="lib/Migration/Version000001Date20261002000000.php">
-    <UndefinedDocblockClass>
-      <code><![CDATA[$schema->createTable('ngb_targets')]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-    </UndefinedDocblockClass>
-  </file>
-  <file src="lib/Migration/Version000002Date20261002010000.php">
-    <UndefinedDocblockClass>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-    </UndefinedDocblockClass>
-  </file>
-  <file src="lib/Migration/Version000003Date20261002020000.php">
-    <UndefinedDocblockClass>
-      <code><![CDATA[$schema->getTable('ngb_targets')]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-    </UndefinedDocblockClass>
-  </file>
-  <file src="lib/Migration/Version000004Date20261002030000.php">
-    <UndefinedDocblockClass>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-    </UndefinedDocblockClass>
-  </file>
-  <file src="lib/Migration/Version000005Date20261002040000.php">
-    <UndefinedDocblockClass>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-      <code><![CDATA[$t]]></code>
-    </UndefinedDocblockClass>
-  </file>
-  <file src="lib/Repository/BlobIndex.php">
-    <PossiblyFalseArgument>
-      <code><![CDATA[$stream]]></code>
-      <code><![CDATA[$stream]]></code>
-    </PossiblyFalseArgument>
-  </file>
-  <file src="lib/Repository/Catalog.php">
-    <PossiblyFalseArgument>
-      <code><![CDATA[$stream]]></code>
-      <code><![CDATA[$stream]]></code>
-    </PossiblyFalseArgument>
-  </file>
-  <file src="lib/Repository/PackWriter.php">
-    <InvalidPropertyAssignmentValue>
-      <code><![CDATA[$this->buffer]]></code>
-    </InvalidPropertyAssignmentValue>
-    <PossiblyFalsePropertyAssignmentValue>
-      <code><![CDATA[fopen('php://temp/maxmemory:' . ($this->targetSize + 8 * 1048576), 'w+b')]]></code>
-    </PossiblyFalsePropertyAssignmentValue>
-    <RedundantPropertyInitializationCheck>
-      <code><![CDATA[isset($this->buffer)]]></code>
-    </RedundantPropertyInitializationCheck>
-  </file>
-  <file src="lib/Repository/Repository.php">
-    <InvalidOperand>
-      <code><![CDATA[strlen($data) * 0.95]]></code>
-    </InvalidOperand>
-    <InvalidReturnStatement>
-      <code><![CDATA[['snapshot' => $snapshotId] + $stats]]></code>
-    </InvalidReturnStatement>
-    <InvalidReturnType>
-      <code><![CDATA[array{snapshot:string, files:int, reused:int, read:int, newBlobs:int, dupBlobs:int, uploaded:int}]]></code>
-    </InvalidReturnType>
-    <MissingParamType>
-      <code><![CDATA[$fh]]></code>
-    </MissingParamType>
-    <PossiblyFalseArgument>
-      <code><![CDATA[$encrypted]]></code>
-      <code><![CDATA[$encrypted]]></code>
-      <code><![CDATA[$encrypted]]></code>
-      <code><![CDATA[$encrypted]]></code>
-      <code><![CDATA[$fh]]></code>
-      <code><![CDATA[$plain]]></code>
-      <code><![CDATA[$plain]]></code>
-      <code><![CDATA[$plain]]></code>
-      <code><![CDATA[$plain]]></code>
-      <code><![CDATA[$plain]]></code>
-      <code><![CDATA[$plain]]></code>
-      <code><![CDATA[$plain]]></code>
-      <code><![CDATA[$plain]]></code>
-      <code><![CDATA[$plain]]></code>
-      <code><![CDATA[$s]]></code>
-      <code><![CDATA[$s]]></code>
-      <code><![CDATA[$tree]]></code>
-      <code><![CDATA[$tree]]></code>
-      <code><![CDATA[$tree]]></code>
-      <code><![CDATA[$tree]]></code>
-      <code><![CDATA[$tree]]></code>
-      <code><![CDATA[$tree]]></code>
-      <code><![CDATA[$tree]]></code>
-      <code><![CDATA[$tree]]></code>
-      <code><![CDATA[$tree]]></code>
-      <code><![CDATA[$tree]]></code>
-    </PossiblyFalseArgument>
-    <PossiblyUndefinedArrayOffset>
-      <code><![CDATA[$stats['files']]]></code>
-      <code><![CDATA[$stats['reused']]]></code>
-    </PossiblyUndefinedArrayOffset>
-    <PropertyNotSetInConstructor>
-      <code><![CDATA[$catalog]]></code>
-    </PropertyNotSetInConstructor>
-  </file>
-  <file src="lib/Service/AlertService.php">
-    <InvalidOperand>
-      <code><![CDATA[$bytes / $limit * 100]]></code>
-      <code><![CDATA[0.8 * $limit]]></code>
-    </InvalidOperand>
-    <PossiblyFalseOperand>
-      <code><![CDATA[json_encode(array_diff_key($params, ['actor' => 1]), JSON_UNESCAPED_SLASHES)]]></code>
-    </PossiblyFalseOperand>
-  </file>
-  <file src="lib/Service/BackupService.php">
-    <InvalidOperand>
-      <code><![CDATA[$deadline - microtime(true) + 120]]></code>
-    </InvalidOperand>
-    <UndefinedClass>
-      <code><![CDATA[\OC]]></code>
-      <code><![CDATA[\OC]]></code>
-    </UndefinedClass>
-    <UndefinedInterfaceMethod>
-      <code><![CDATA[getInner]]></code>
-    </UndefinedInterfaceMethod>
-  </file>
-  <file src="lib/Service/KeyService.php">
-    <ArgumentTypeCoercion>
-      <code><![CDATA[array_diff(range(1, self::MAX_SLOTS), $used)]]></code>
-    </ArgumentTypeCoercion>
-    <LessSpecificReturnStatement>
-      <code><![CDATA[array_map(fn ($s) => ['slot' => $s['slot'], 'label' => $s['label'], 'created' => $s['created']], $this->wrappedKey()['slots'])]]></code>
-    </LessSpecificReturnStatement>
-    <MissingClosureParamType>
-      <code><![CDATA[$s]]></code>
-      <code><![CDATA[$s]]></code>
-    </MissingClosureParamType>
-    <MissingClosureReturnType>
-      <code><![CDATA[static fn (string $c) => strtoupper(preg_replace('/[^A-Za-z0-9]/', '', $c) ?? '')]]></code>
-    </MissingClosureReturnType>
-    <MoreSpecificReturnType>
-      <code><![CDATA[list<array{slot:int, label:string, created:int}>]]></code>
-    </MoreSpecificReturnType>
-    <PossiblyFalseArgument>
-      <code><![CDATA[base64_decode($this->crypto->decrypt($enc), true)]]></code>
-    </PossiblyFalseArgument>
-  </file>
-  <file src="lib/Service/PruneService.php">
-    <LessSpecificReturnStatement>
-      <code><![CDATA[['kept' => $keep, 'forgotten' => $forget, 'purged' => $purged, 'prune' => $prune]]]></code>
-    </LessSpecificReturnStatement>
-    <MissingClosureReturnType>
-      <code><![CDATA[fn () => $fn()]]></code>
-    </MissingClosureReturnType>
-    <MoreSpecificReturnType>
-      <code><![CDATA[array{kept: array<string, list<string>>, forgotten: list<string>, purged: list<string>, prune: array}]]></code>
-    </MoreSpecificReturnType>
-  </file>
-  <file src="lib/Service/RestoreFullService.php">
-    <EmptyArrayAccess>
-      <code><![CDATA[$backupConfig[$key]]]></code>
-    </EmptyArrayAccess>
-    <UndefinedInterfaceMethod>
-      <code><![CDATA[getInner]]></code>
-    </UndefinedInterfaceMethod>
-    <UnresolvableInclude>
-      <code><![CDATA[include $path]]></code>
-    </UnresolvableInclude>
-  </file>
-  <file src="lib/Service/RestoreService.php">
-    <LessSpecificReturnStatement>
-      <code><![CDATA[array_values($children)]]></code>
-    </LessSpecificReturnStatement>
-    <MissingDependency>
-      <code><![CDATA[$this->root]]></code>
-      <code><![CDATA[private]]></code>
-    </MissingDependency>
-    <MoreSpecificReturnType>
-      <code><![CDATA[list<array{name:string, type:string, size:int, mtime:int|null, files:int}>]]></code>
-    </MoreSpecificReturnType>
-    <PossiblyFalseArgument>
-      <code><![CDATA[$in]]></code>
-      <code><![CDATA[$out]]></code>
-      <code><![CDATA[$out]]></code>
-    </PossiblyFalseArgument>
-    <PossiblyNullArrayOffset>
-      <code><![CDATA[$children]]></code>
-      <code><![CDATA[$children]]></code>
-    </PossiblyNullArrayOffset>
-    <RedundantCastGivenDocblockType>
-      <code><![CDATA[(string)$relPath]]></code>
-      <code><![CDATA[(string)$relPath]]></code>
-    </RedundantCastGivenDocblockType>
-  </file>
-  <file src="lib/Service/TargetService.php">
-    <InvalidReturnStatement>
-      <code><![CDATA[$this->factory()->describeBackends()]]></code>
-    </InvalidReturnStatement>
-    <InvalidReturnType>
-      <code><![CDATA[list<array{id:string, name:string, auth:list<string>, parameters:array}>]]></code>
-    </InvalidReturnType>
-    <UndefinedDocblockClass>
-      <code><![CDATA[Server::get(\OCA\Files_External\Service\BackendService::class)]]></code>
-    </UndefinedDocblockClass>
-    <UnresolvableInclude>
-      <code><![CDATA[require_once $path . '/composer/autoload.php']]></code>
-    </UnresolvableInclude>
-  </file>
-</files>

psalm.xml

@@ -1,54 +0,0 @@
-<?xml version="1.0"?>
-<!-- SPDX-FileCopyrightText: 2026 Dillard Blom -->
-<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
-<psalm
-    errorLevel="2"
-    resolveFromConfigFile="true"
-    findUnusedBaselineEntry="true"
-    findUnusedCode="false"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xmlns="https://getpsalm.org/schema/config"
-    xsi:schemaLocation="https://getpsalm.org/schema/config vendor/vimeo/psalm/config.xsd"
-    errorBaseline="psalm-baseline.xml"
->
-    <projectFiles>
-        <directory name="lib" />
-        <ignoreFiles>
-            <directory name="vendor" />
-        </ignoreFiles>
-    </projectFiles>
-
-    <!-- Interface-only stubs for Nextcloud's public API, not autoloaded at runtime: scanned for
-         type resolution only, never reported on. lib/ must only use OCP\, never internal OC\
-         classes, since those differ between the supported Nextcloud versions (PLAN.md section 6). -->
-    <extraFiles>
-        <directory name="vendor/nextcloud/ocp/OCP" />
-        <directory name="vendor/nextcloud/ocp/NCU" />
-    </extraFiles>
-
-    <issueHandlers>
-        <UndefinedClass>
-            <errorLevel type="suppress">
-                <!-- Provided by files_external at runtime; not a composer dependency (PLAN.md 3.5). -->
-                <referencedClass name="OCA\Files_External\**" />
-                <!-- Provided by user_migration at runtime, an optional dependency (PLAN.md 3.8). -->
-                <referencedClass name="OCA\UserMigration\**" />
-            </errorLevel>
-        </UndefinedClass>
-        <UndefinedDocblockClass>
-            <errorLevel type="suppress">
-                <!-- Server::get()'s templated return type resolving the users_migration class-string
-                     constant below; same reason as the UndefinedClass suppression above. -->
-                <referencedClass name="OCA\UserMigration\**" />
-            </errorLevel>
-        </UndefinedDocblockClass>
-        <!-- The #[\Override] attribute convention (PHP 8.3+) adds no behaviour; this app supports
-             PHP 8.1+, and applying it to every interface-implementing method project-wide is pure
-             ceremony with no bug-catching value, so it's suppressed rather than papered over. -->
-        <MissingOverrideAttribute>
-            <errorLevel type="suppress">
-                <directory name="lib" />
-            </errorLevel>
-        </MissingOverrideAttribute>
-    </issueHandlers>
-</psalm>

src/AdminSettings.vue

@@ -11,23 +11,12 @@
 		</NcSettingsSection>
 
 		<template v-if="status">
-			<div class="ngb-tabs">
-				<NcButton :variant="tab === 'backup' ? 'primary' : 'secondary'" @click="tab = 'backup'">{{ t('ng_backup', 'Backup and restore') }}</NcButton>
-				<NcButton :variant="tab === 'settings' ? 'primary' : 'secondary'" @click="tab = 'settings'">{{ t('ng_backup', 'Settings') }}</NcButton>
-			</div>
-
-			<template v-if="tab === 'settings'">
-				<KeySetup :status="status" @changed="refresh" />
-				<Locations v-if="status.key.everConfirmed" :status="status" @changed="refresh" />
+			<KeySetup :status="status" @changed="refresh" />
+			<template v-if="status.key.everConfirmed">
+				<Locations :status="status" @changed="refresh" />
+				<Backups v-if="status.targets.length" :status="status" @changed="refresh" />
+				<RestoreBrowser v-if="status.targets.length" :status="status" @changed="refresh" />
 			</template>
-			<template v-else-if="status.key.everConfirmed">
-				<template v-if="status.targets.length">
-					<Backups :status="status" @changed="refresh" />
-					<RestoreBrowser :status="status" @changed="refresh" />
-				</template>
-				<NcNoteCard v-else type="info">{{ t('ng_backup', 'Add a backup location under "Settings" first.') }}</NcNoteCard>
-			</template>
-			<NcNoteCard v-else type="warning">{{ t('ng_backup', 'Set up the backup key under "Settings" first.') }}</NcNoteCard>
 		</template>
 	</div>
 </template>
@@ -35,7 +24,6 @@
 <script setup>
 import { onBeforeUnmount, onMounted, ref } from 'vue'
 import { t } from '@nextcloud/l10n'
-import NcButton from '@nextcloud/vue/components/NcButton'
 import NcLoadingIcon from '@nextcloud/vue/components/NcLoadingIcon'
 import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
 import NcSettingsSection from '@nextcloud/vue/components/NcSettingsSection'
@@ -47,20 +35,12 @@ import RestoreBrowser from './components/RestoreBrowser.vue'
 
 const status = ref(null)
 const error = ref('')
-const tab = ref('settings')
-let tabInitialized = false
 let timer = null
 
 async function refresh() {
 	try {
 		status.value = await api.status()
 		error.value = ''
-		// Default to the daily-use tab once the key is set up; stay on Settings otherwise.
-		// Only decided on first load, so switching tabs ourselves isn't undone by polling.
-		if (!tabInitialized) {
-			tab.value = status.value.key.everConfirmed ? 'backup' : 'settings'
-			tabInitialized = true
-		}
 	} catch (e) {
 		error.value = e.message
 	}
@@ -79,10 +59,4 @@ onBeforeUnmount(() => clearTimeout(timer))
 .ng-backup :deep(.settings-section) {
 	max-width: 900px;
 }
-.ngb-tabs {
-	display: flex;
-	gap: 8px;
-	/* Same inline margin as NcSettingsSection, so the tabs line up with the section content */
-	margin: 0 calc(var(--default-grid-baseline) * 7) 12px;
-}
 </style>

src/api.js

@@ -29,7 +29,6 @@ export default {
 	addTarget: (target) => call('post', '/targets', target),
 	removeTarget: (id) => call('delete', `/targets/${id}`),
 	testTarget: (id) => call('post', `/targets/${id}/test`),
-	setTargetLimit: (id, maxGb) => call('put', `/targets/${id}/limit`, { maxGb }),
 	startBackup: (targetId, label) => call('post', '/backups', { targetId, label }),
 	setSchedule: (time) => call('put', '/schedule', { time }),
 	snapshots: (targetId) => call('get', `/targets/${targetId}/snapshots`),

src/components/Backups.vue

@@ -30,32 +30,28 @@
 			</div>
 		</template>
 
-		<div v-if="status.runs.length" class="ngb-table-wrap">
-			<table class="ngb-table">
-				<thead>
-					<tr>
-						<th>{{ t('ng_backup', 'Started') }}</th>
-						<th>{{ t('ng_backup', 'Location') }}</th>
-						<th>{{ t('ng_backup', 'Kind') }}</th>
-						<th>{{ t('ng_backup', 'Restore point') }}</th>
-						<th>{{ t('ng_backup', 'Status') }}</th>
-						<th>{{ t('ng_backup', 'Files') }}</th>
-						<th>{{ t('ng_backup', 'Uploaded') }}</th>
-					</tr>
-				</thead>
-				<tbody>
-					<tr v-for="run in status.runs" :key="run.id" :title="run.error || ''">
-						<td>{{ new Date(run.startedAt * 1000).toLocaleString() }}</td>
-						<td>{{ targetName(run.targetId) }}</td>
-						<td>{{ run.kind }}</td>
-						<td>{{ run.snapshot ? new Date(run.snapshot.createdAt * 1000).toLocaleString() + (run.snapshot.label ? ' – ' + run.snapshot.label : '') : '' }}</td>
-						<td :class="'ngb-' + run.status">{{ run.status }}{{ run.status === 'running' ? ' (' + run.phase + ')' : '' }}{{ run.error ? ': ' + run.error : '' }}</td>
-						<td>{{ run.stats?.files?.files ?? run.stats?.restored ?? '' }}</td>
-						<td>{{ run.stats?.files ? formatSize(run.stats.files.uploaded) : '' }}</td>
-					</tr>
-				</tbody>
-			</table>
-		</div>
+		<table v-if="status.runs.length" class="ngb-table">
+			<thead>
+				<tr>
+					<th>{{ t('ng_backup', 'Started') }}</th>
+					<th>{{ t('ng_backup', 'Location') }}</th>
+					<th>{{ t('ng_backup', 'Kind') }}</th>
+					<th>{{ t('ng_backup', 'Status') }}</th>
+					<th>{{ t('ng_backup', 'Files') }}</th>
+					<th>{{ t('ng_backup', 'Uploaded') }}</th>
+				</tr>
+			</thead>
+			<tbody>
+				<tr v-for="run in status.runs" :key="run.id" :title="run.error || ''">
+					<td>{{ new Date(run.startedAt * 1000).toLocaleString() }}</td>
+					<td>{{ targetName(run.targetId) }}</td>
+					<td>{{ run.kind }}</td>
+					<td :class="'ngb-' + run.status">{{ run.status }}{{ run.status === 'running' ? ' (' + run.phase + ')' : '' }}{{ run.error ? ': ' + run.error : '' }}</td>
+					<td>{{ run.stats?.files?.files ?? run.stats?.restored ?? '' }}</td>
+					<td>{{ run.stats?.files ? formatSize(run.stats.files.uploaded) : '' }}</td>
+				</tr>
+			</tbody>
+		</table>
 	</NcSettingsSection>
 </template>
 
@@ -128,7 +124,6 @@ async function saveSchedule() {
 <style scoped>
 .ngb-row { display: flex; gap: 8px; align-items: flex-end; flex-wrap: wrap; margin-bottom: 12px; }
 .ngb-time { max-width: 260px; }
-.ngb-table-wrap { overflow-x: auto; }
 .ngb-table { width: 100%; border-collapse: collapse; }
 .ngb-table th, .ngb-table td { text-align: start; padding: 4px 8px; border-bottom: 1px solid var(--color-border); }
 .ngb-failed { color: var(--color-error-text); }

src/components/KeySetup.vue

@@ -36,7 +36,7 @@
 						<td>{{ t('ng_backup', 'Slot {n}', { n: slot.slot }) }}</td>
 						<td><strong>{{ slot.label }}</strong></td>
 						<td class="ngb-muted">{{ slot.created ? new Date(slot.created * 1000).toLocaleDateString() : '' }}</td>
-						<td class="ngb-actions">
+						<td>
 							<NcButton variant="tertiary" @click="openSlotForm(slot)">{{ t('ng_backup', 'New passphrase') }}</NcButton>
 							<NcButton v-if="status.key.slots.length > 1" variant="tertiary" @click="removeSlot(slot)">{{ t('ng_backup', 'Remove') }}</NcButton>
 						</td>
@@ -162,6 +162,5 @@ const confirm = () => guarded(async () => {
 .ngb-form, .ngb-confirm { display: flex; flex-direction: column; gap: 12px; max-width: 600px; margin: 8px 0; }
 .ngb-row { display: flex; gap: 8px; }
 .ngb-table td { padding: 2px 12px 2px 0; }
-.ngb-actions { display: flex; gap: 4px; }
 h3 { margin-top: 16px; font-weight: bold; }
 </style>

src/components/Locations.vue

@@ -8,8 +8,7 @@
 		<ul v-if="status.targets.length" class="ngb-list">
 			<li v-for="target in status.targets" :key="target.id">
 				<strong>{{ target.name }}</strong>
-				<span class="ngb-muted">{{ target.backend }} · {{ target.path }}{{ target.appendOnly ? ' · ' + t('ng_backup', 'append-only') : '' }}</span>
-				<span :class="usageClass(target)">{{ usageText(target) }}</span>
+				<span class="ngb-muted">{{ target.backend }} · {{ target.path }}</span>
 				<span v-if="tests[target.id]" :class="tests[target.id].ok ? 'ngb-ok' : 'ngb-err'">
 					{{ tests[target.id].ok ? t('ng_backup', 'OK, {n} snapshots', { n: tests[target.id].snapshots }) : tests[target.id].error }}
 				</span>
@@ -29,8 +28,6 @@
 				<NcTextField v-else v-model="form.options[field.key]" :label="field.label + (field.optional ? '' : ' *')" />
 			</template>
 			<NcTextField v-model="form.path" :label="t('ng_backup', 'Folder on the location for the backups')" />
-			<NcTextField v-model="form.maxGb" type="number" min="0" :label="t('ng_backup', 'Maximum size in GiB')"
-				:helper-text="form.maxGb ? t('ng_backup', 'Backups stop at this size; administrators are warned at 80%.') : t('ng_backup', 'Empty = unlimited: everything stored is billed by your provider, and nothing stops a backup that keeps growing.')" />
 			<div class="ngb-row">
 				<NcButton type="submit" variant="primary" :disabled="busy || !form.name || !backend || !auth">{{ t('ng_backup', 'Connect and add') }}</NcButton>
 				<NcButton @click="adding = false">{{ t('ng_backup', 'Cancel') }}</NcButton>
@@ -64,18 +61,7 @@ const backends = ref([])
 const backend = ref(null)
 const auth = ref(null)
 const tests = reactive({})
-const form = reactive({ name: '', path: 'ng_backup', options: {}, maxGb: '' })
-
-const gib = (b) => (b / 1073741824).toFixed(1) + ' GiB'
-function usageText(target) {
-	if (target.storedBytes === null || target.storedBytes === undefined) {
-		return target.maxBytes ? t('ng_backup', 'limit {limit}', { limit: gib(target.maxBytes) }) : t('ng_backup', 'no limit')
-	}
-	return target.maxBytes
-		? t('ng_backup', '{used} of {limit}', { used: gib(target.storedBytes), limit: gib(target.maxBytes) })
-		: t('ng_backup', '{used} stored, no limit', { used: gib(target.storedBytes) })
-}
-const usageClass = (target) => (target.maxBytes && target.storedBytes >= 0.8 * target.maxBytes) ? 'ngb-err' : 'ngb-muted'
+const form = reactive({ name: '', path: 'ng_backup', options: {} })
 
 // files_external DefinitionParameter: type 0 text, 1 boolean, 2 password; flag 1 = optional, 4 = hidden
 const toFields = (params) => Object.entries(params || {})
@@ -104,11 +90,9 @@ async function add() {
 	busy.value = true
 	error.value = ''
 	try {
-		await confirmPassword()
-		await api.addTarget({ name: form.name, backend: backend.value.id, auth: auth.value.id, options: form.options, path: form.path,
-			maxGb: form.maxGb === '' ? null : Number(form.maxGb) })
+		await api.addTarget({ name: form.name, backend: backend.value.id, auth: auth.value.id, options: form.options, path: form.path })
 		adding.value = false
-		Object.assign(form, { name: '', path: 'ng_backup', options: {}, maxGb: '' })
+		Object.assign(form, { name: '', path: 'ng_backup', options: {} })
 		emit('changed')
 	} catch (e) {
 		error.value = e.message

src/components/RestoreBrowser.vue

@@ -7,7 +7,7 @@
 		:description="t('ng_backup', 'Pick a restore point and a user folder or file. Restores run in the background and go through Nextcloud, so overwritten files keep their old content as a version and removed files go to the trash.')">
 		<div class="ngb-row">
 			<NcSelect v-model="target" :options="status.targets" label="name" :input-label="t('ng_backup', 'Location')" :clearable="false" />
-			<NcSelect v-if="target" v-model="snapshot" :options="snapshots" label="displayLabel" class="ngb-snapshot" :input-label="t('ng_backup', 'Restore point')" :clearable="false" />
+			<NcSelect v-if="target" v-model="snapshot" :options="snapshots" :get-option-label="snapshotLabel" :input-label="t('ng_backup', 'Restore point')" :clearable="false" />
 		</div>
 
 		<template v-if="snapshot">
@@ -30,7 +30,7 @@
 			<NcButton v-if="restorable(path) && path !== selected" variant="tertiary" @click="selected = path">{{ t('ng_backup', 'Select this folder') }}</NcButton>
 
 			<div v-if="selected" class="ngb-restore">
-				<p>{{ t('ng_backup', 'Selected: {path}, from the restore point of {date}', { path: selected, date: snapshotLabel(snapshot) }) }}</p>
+				<p>{{ t('ng_backup', 'Selected: {path}', { path: selected }) }}</p>
 				<NcCheckboxRadioSwitch v-for="m in modes" :key="m.id" v-model="mode" :value="m.id" type="radio" name="ngb-mode">{{ m.label }}</NcCheckboxRadioSwitch>
 				<NcButton variant="primary" :disabled="busy" @click="restore">{{ t('ng_backup', 'Restore') }}</NcButton>
 			</div>
@@ -69,7 +69,7 @@ const busy = ref(false)
 const error = ref('')
 const message = ref('')
 const modes = [
-	{ id: 'new-folder', label: t('ng_backup', 'Into a new folder "Restored {date}" (nothing existing is changed)', { date: 'YYYY-MM-DD HH.MM' }) },
+	{ id: 'new-folder', label: t('ng_backup', 'Into a new folder "Restored <date>" (nothing existing is changed)') },
 	{ id: 'merge', label: t('ng_backup', 'Into the original place, overwrite (old content kept as a version)') },
 	{ id: 'replace', label: t('ng_backup', 'Into the original place, overwrite and move files that are not in the backup to the trash') },
 ]
@@ -84,8 +84,7 @@ const crumbs = computed(() => {
 
 watch(target, async (tg) => {
 	snapshot.value = null
-	const list = tg ? await api.snapshots(tg.id) : []
-	snapshots.value = list.map(s => ({ ...s, displayLabel: snapshotLabel(s) }))
+	snapshots.value = tg ? await api.snapshots(tg.id) : []
 	snapshot.value = snapshots.value[0] ?? null
 }, { immediate: true })
 watch(snapshot, () => { selected.value = ''; open('data') })
@@ -124,7 +123,6 @@ async function restore() {
 
 <style scoped>
 .ngb-row { display: flex; gap: 12px; flex-wrap: wrap; margin-bottom: 12px; }
-.ngb-row :deep(.ngb-snapshot) { min-width: min(360px, 100%); }
 .ngb-crumbs { display: flex; align-items: center; flex-wrap: wrap; }
 .ngb-entries li { display: flex; align-items: center; gap: 12px; min-height: 36px; }
 .ngb-entries li.selected { background: var(--color-primary-element-light); border-radius: var(--border-radius); }

tests/Unit/Job/BackupRunTest.php

@@ -27,14 +27,13 @@ class BackupRunTest extends TestCase {
 
 		$state = BackupRun::start($src);
 		$steps = 0;
-		while ($state['phase'] !== 'commit' && $steps < 500) {
+		while ($state['phase'] !== 'done' && $steps < 500) {
 			// Fresh repository object per step, state through JSON: as separate processes would.
 			$repo = Repository::openWithKey($backend, $keys);
 			$state = json_decode(json_encode(BackupRun::step($repo, $state, microtime(true) + 0.05)), true);
 			$steps++;
 		}
-		$this->assertSame('commit', $state['phase']);
-		Repository::openWithKey($backend, $keys)->recordSnapshot($state['snapshot']);
+		$this->assertSame('done', $state['phase']);
 		$this->assertGreaterThan(2, $steps, 'the run was actually split into steps');
 
 		$target = $this->tempDir();
@@ -51,7 +50,7 @@ class BackupRunTest extends TestCase {
 
 		$state = BackupRun::start($src);
 		$mutated = false;
-		for ($i = 0; $i < 500 && $state['phase'] !== 'commit'; $i++) {
+		for ($i = 0; $i < 500 && $state['phase'] !== 'done'; $i++) {
 			$state = BackupRun::step(Repository::openWithKey($backend, $keys), $state, microtime(true) + 0.01);
 			if (!$mutated && $state['cur'] !== null && $state['cur']['offset'] > 0) {
 				$fh = fopen("$src/big.bin", 'r+b');
@@ -61,8 +60,6 @@ class BackupRunTest extends TestCase {
 				$mutated = true;
 			}
 		}
-		$this->assertSame('commit', $state['phase']);
-		Repository::openWithKey($backend, $keys)->recordSnapshot($state['snapshot']);
 		$this->assertTrue($mutated);
 		$this->assertGreaterThanOrEqual(1, $state['stats']['retried'] ?? 0);
 		$target = $this->tempDir();
@@ -81,17 +78,14 @@ class BackupRunTest extends TestCase {
 		Repository::initWithKey($backend, $keys, $keys->wrap('pw'));
 		$run = function (?string $parent) use ($backend, $src, $keys): array {
 			$state = BackupRun::start(['data' => $src], $parent);
-			for ($i = 0; $i < 2000 && $state['phase'] !== 'commit'; $i++) {
+			for ($i = 0; $i < 2000 && $state['phase'] !== 'done'; $i++) {
 				$state = json_decode(json_encode(BackupRun::step(Repository::openWithKey($backend, $keys), $state, microtime(true))), true);
 			}
-			if ($state['phase'] === 'commit') {
-				Repository::openWithKey($backend, $keys)->recordSnapshot($state['snapshot']);
-			}
 			return $state;
 		};
 		$first = $run(null);
 		$second = $run($first['snapshot']);
-		$this->assertSame('commit', $second['phase']);
+		$this->assertSame('done', $second['phase']);
 		$this->assertGreaterThan(150, $second["steps"], "one file per step");
 		$this->assertSame(0, $second['stats']['read'], 'merge-join with the parent across steps reuses every file');
 		$this->assertSame(200, $second['stats']['reused']);

tests/Unit/Repository/CrashSafetyTest.php

@@ -1,106 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// SPDX-FileCopyrightText: 2026 Dillard Blom
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-namespace OCA\NgBackup\Tests\Unit\Repository;
-
-use OCA\NgBackup\Backend\LocalBackend;
-use OCA\NgBackup\Crypto\KeyRing;
-use OCA\NgBackup\Job\BackupRun;
-use OCA\NgBackup\Repository\Repository;
-use OCA\NgBackup\Repository\RepositoryException;
-use OCA\NgBackup\Tests\Unit\TempDirTrait;
-use PHPUnit\Framework\TestCase;
-
-/** Data-safety cases found in the pre-beta review. */
-class CrashSafetyTest extends TestCase {
-	use TempDirTrait;
-
-	public function testListingKeepsNamesThatOnlyLookLikeTemporaryFiles(): void {
-		$root = $this->tempDir();
-		$backend = new LocalBackend($root);
-		mkdir("$root/users/john.part-time", 0700, true);
-		file_put_contents("$root/users/john.part-time/20261006T120000Z-aaaa0001", 'x');
-		file_put_contents("$root/users/upload.part-deadbeef", 'partial');
-		$this->assertSame(['users/john.part-time/20261006T120000Z-aaaa0001'], $backend->list('users'));
-	}
-
-	public function testPruneStopsWhenARecordedExportManifestIsMissing(): void {
-		$root = $this->tempDir();
-		$backend = new LocalBackend($root);
-		$keys = KeyRing::generate();
-		$repo = Repository::initWithKey($backend, $keys, $keys->wrap('pw'));
-		$stats = [];
-		$blob = $repo->storeData(random_bytes(1000), $stats);
-		$repo->flushPacks();
-		$path = 'users/alice/20261006T120000Z-aaaa0001';
-		$repo->putObject($path, json_encode(['uid' => 'alice', 'entries' => ['f.txt' => ['t' => 'f', 'b' => [$blob], 's' => 1000]]]));
-		$repo->recordUserExport($path);
-		unlink("$root/$path");
-
-		$packsBefore = $backend->list('packs');
-		try {
-			Repository::openWithKey($backend, $keys)->prune();
-			$this->fail('prune must refuse while a recorded export is missing');
-		} catch (RepositoryException $e) {
-			$this->assertStringContainsString('missing on the location', $e->getMessage());
-		}
-		$this->assertSame($packsBefore, $backend->list('packs'), 'no pack was deleted');
-	}
-
-	public function testForgetAndUntrashKeepTheSnapshotRestorable(): void {
-		$src = $this->tempDir();
-		file_put_contents("$src/a.txt", 'hello');
-		$root = $this->tempDir();
-		$backend = new LocalBackend($root);
-		$keys = KeyRing::generate();
-		Repository::initWithKey($backend, $keys, $keys->wrap('pw'));
-		$state = BackupRun::start($src);
-		while ($state['phase'] !== 'commit') {
-			$state = BackupRun::step(Repository::openWithKey($backend, $keys), $state, microtime(true) + 5);
-		}
-		Repository::openWithKey($backend, $keys)->recordSnapshot($state['snapshot']);
-		$id = $state['snapshot'];
-
-		Repository::openWithKey($backend, $keys)->forget($id, 'test');
-		$repo = Repository::openWithKey($backend, $keys);
-		$this->assertSame([], $repo->listSnapshots());
-		$this->assertArrayHasKey($id, $repo->trash());
-		$this->assertFalse($backend->exists('snapshots/' . $id), 'original removed after the catalog switch');
-
-		$repo->untrash($id);
-		$repo = Repository::openWithKey($backend, $keys);
-		$this->assertSame([$id], $repo->listSnapshots());
-		$this->assertSame([], $repo->trash());
-		$target = $this->tempDir();
-		$repo->restore($id, $target);
-		$this->assertSame('hello', file_get_contents("$target/a.txt"));
-	}
-
-	public function testFileThatKeepsChangingDoesNotStallTheRun(): void {
-		$src = $this->tempDir();
-		file_put_contents("$src/live.db", random_bytes(3 * Repository::BLOB_SIZE));
-		$root = $this->tempDir();
-		$backend = new LocalBackend($root);
-		$keys = KeyRing::generate();
-		Repository::initWithKey($backend, $keys, $keys->wrap('pw'));
-
-		$state = BackupRun::start($src);
-		$n = 0;
-		for ($i = 0; $i < 50 && $state['phase'] !== 'commit'; $i++) {
-			$state = BackupRun::step(Repository::openWithKey($backend, $keys), $state, microtime(true) + 0.001);
-			// Rewrite the file after every step: it never stays the same between two steps.
-			$fh = fopen("$src/live.db", 'r+b');
-			fwrite($fh, random_bytes(16));
-			fclose($fh);
-			touch("$src/live.db", time() + ++$n);
-			clearstatcache();
-		}
-		$this->assertSame('commit', $state['phase'], 'the run finishes instead of retrying forever');
-		$this->assertSame(1, $state['stats']['changing'] ?? 0);
-		$this->assertSame(['live.db'], BackupRun::warnings($state)['changing']);
-	}
-}