PASS a WordPress-core-only archive is allowed, and core is never mistaken for a content folder PASS a foreign content folder is refused by name and an ordinary one is allowed PASS the content-folder classifier resolves a relocated content folder on the backup and restore sides PASS token writes preserve existing autoload metadata and roll back exactly PASS bounded JSON parser rejects decoded duplicate object keys at every nesting level PASS restore and Verify and Trust reject raw manifests with escaped duplicate authority keys PASS signed integrity verification rejects escaped duplicate nested authority before HMAC adoption PASS ZIP creation refuses missing caller-prevalidated SQL authority before staging PASS same-size SQL swap after lazy addFile cannot enter the signed member set PASS final manifest bytes are exact HMAC inputs and outer archive swaps abort signing PASS unchanged incremental source reproof catches same-size mtime-restored byte drift PASS source authority reproof catches same-byte inode-number-reuse replacement PASS restore maintenance gate expires before mutation and contains unsafe mutation PASS continuity snapshot derives provider cron from the exact captured row set PASS verified provider refresh authorizes only the Google access-token rotation PASS continuity replay preserves exact raw cron bytes, autoload, and absence PASS multisite continuity preserves live cron and projected new-blog absence PASS maintenance publication and mutation remain bootstrap-safe across torn writes PASS database exactness prunes destination extras and rollback-created objects views first PASS restore probes fail closed on silent query cache and partial constraint failures PASS signed multisite scope includes current sites and rejects orphan or ambiguous shared authority PASS network success continuity excludes removed sites while rollback retains them PASS multisite compatibility refuses unsafe mappings and identifies an exact per-site target PASS per-site filesystem authority isolates primary uploads and refuses unsafe legacy or subsite files PASS signed preserve policy rejects contradictory trust authority and blocks defensive live copy PASS both member gates accept the signed backup health report PASS C1 preserves percent bytes and serialized lengths PASS cloud SQL drops both providers control jobs while live schedules and epochs persist PASS exporter uses one checked raw write and checks flush/close PASS database export bootstraps shared-table authority from the live WordPress connection PASS snapshot commands and isolated connection are used PASS nontransactional tables and missing column metadata fail closed PASS nontransaction diagnosis wins over misleading table-name tokens PASS wfhoover is the only name-exact volatile table removed from export scope PASS transient snapshot errors are retried while permanent failures fail closed PASS legacy NULL and malformed log details decode to a safe empty array PASS keyset cursor preserves unsigned BIGINT beyond PHP integer range PASS schema-object discovery and definition errors fail closed PASS export records the source schema faithfully unless the operator opts in PASS opted-in export translation preserves binary and sensitive collations verbatim PASS opted-in export translation rewrites only accent- and case-insensitive collations PASS standalone installer still translates the portable ai_ci family at restore time PASS cloud SQL redacts credentials for a table prefix with no trailing underscore PASS ZIP component validation allows legal consecutive dots PASS streamed extraction writes valid nested members byte-for-byte PASS archive swap cannot pass authenticated extraction records PASS archive verification rejects case and file-directory collisions PASS Unix symlink/device/FIFO/socket ZIP members are rejected PASS extraction rejects pre-existing symlink parents and duplicate targets PASS safe walker emits directories and skips every selected symlink PASS signed empty-directory inventory is required and restores exact modes PASS signed file modes restore exact regular bytes before final directory modes PASS degraded non-POSIX mode gate still proves confined regular inode and bytes PASS file-mode application binds chmod to the authenticated inode and fails closed PASS new mode authority rejects downgrade malformed extra and aliased maps PASS Verify and Trust refuses a stripped current-writer mode manifest PASS incremental mode map replaces changed modes and drops tombstones in lockstep PASS legacy mode policy preserves existing permissions and constrains new files PASS backup member resolver accepts root or exactly one protected payload PASS 20 concurrent lease claims produce exactly one owner PASS lease survives option replacement and enforces exact owner/stale takeover PASS lease reader bounds allocation and rejects literal or escaped duplicate authority PASS installer classifies commented single INSERT/CREATE chunks PASS restore protects its log table when dump statements have leading comments PASS core root restore includes ordinary files and excludes recovery internals PASS installer preserves serialized objects without mutation/fatal PASS multisite URL mapping preserves subdomains and relative paths PASS config replacement and full multisite semantic verification are exact PASS unsafe standalone migration installer is disabled and never packaged PASS false-success and omission guards remain wired PASS restore uses locked SQL authority and automatic exact rollback PASS core rollback capture accepts only the exact WordPress core directory roots and self-verifies PASS filesystem rollback restores root-level and zero-byte core files PASS rollback capture rejects restore-invalid case collisions before mutation PASS filesystem rollback restores empty directories bytes and exact modes PASS rollback preflight rejects corrupt missing extra and special members before mutation PASS rollback preflight rejects internally consistent mode-record tampering before mutation PASS rollback JSON rejects escaped duplicates and oversized authority before mutation PASS rollback atomically detaches managed hardlinks without touching out-of-scope peers PASS failed capture removes injected FIFO rollback entries PASS filesystem snapshot rejects inventory-to-copy byte drift PASS snapshot-copy state refusal names its path and cause PASS filesystem snapshot rejects torn in-place writes PASS filesystem snapshot rejects inode-to-symlink swaps PASS filesystem snapshot refuses uncapturable file-only path directories PASS filesystem snapshot fails closed on unknown low or falling capacity PASS filesystem snapshot rejects post-copy file hash and mode drift PASS settings read-back accepts WordPress scalar storage but stays fail-closed PASS restore progress transport failures remain non-terminal and stale callbacks cannot overwrite a verdict PASS restore status exposes only bounded health-failure codes PASS operator notices and dismissal reject subscriber and editor roles PASS seeded single-site and multisite uninstall preserve sibling data PASS arcade purge skips absent tables and preserves sibling rows PASS Google provider protocol, pagination, marker, and stable-folder gates pass PASS licensing transport and legacy migration CAS stay exact PASS strict SQL restore authority focused suite passes PASS recovery integrity shared-table authority focused suite passes PASS build scripts exclude QA evidence and ship integrity helpers PASS Verify and Trust accepts in-scope directory members and refuses hostile ones PASS restore copy traverses populated policy-preserved directories only PASS real-matcher restore copy restores children of a non-hereditarily excluded dir PASS exclusion gates refuse a union of scoped lines that excludes every canary PASS log_event triage keeps every existing branch and is immune to path words PASS the activity log and the failure email give one cure, not two PASS a run lease that cannot be claimed is not reported as busy PASS copy-loop refusals record named first-note-wins explanations per class PASS an excluded component root is pruned whole, so nothing under it is enumerated PASS a component absent WITHOUT an exclusion is still enumerated and still deletable PASS a legacy archive that recorded no exclusion policy still fails an absent component loudly PASS permission preflight names the folder the web server cannot write PASS the preflight does not demand a parent this restore will never write PASS a site answering 503 is not reported as a site that is not answering PASS a sibling backup plugin the archive does not carry is preserved PASS the exact deletion plan never prunes a folder the archive holds PASS the rollback deletion plan separates type conflicts from destination-only extras PASS the root-file filter can never smuggle a credential file into an archive PASS a boot-file reference this backup cannot carry is named at backup time PASS an older archive keeps its boot companions and says which it lacks PASS the untouched-companion sentence claims no cause and no untrue remedy PASS the backup-time skip warnings name the paths they skipped PASS a refusal for a newer archive names both versions instead of blaming age PASS the permission refusal is stated once, not twice PASS the post-restore reachability check stays silent when it cannot ask PASS an orphaned Fast Backup stops advertising itself as restorable PASS a restore refusal reaches the customer verdict and the failure log PASS the staging probe asks open_basedir before it touches the filesystem PASS every classed path-bearing refusal stores its path raw (twin shape) PASS the unclassifiable residue splits into adopt and refuse PASS adoption opens every root-file consumer at once and never leaks to the writer PASS the signed inventory adopts what it can place and refuses what it cannot PASS the .user.ini boot-reference claim is gated on the SAPI that serves the site PASS a relocated plugins folder is refused by name at backup and at restore PASS a relocated must-use plugins folder is refused by name, and an absent one is not PASS a relocated uploads folder is refused, a subsite uploads folder inside it is not PASS a relocated translations folder is refused, and both WordPress language defaults are allowed PASS a theme root outside the keyed themes folder is refused only when it holds a theme PASS an extra registered theme root that holds a theme does not stop a backup, and is disclosed PASS an empty relocated directory is tolerated exactly as an absent one is PASS a restore onto a relocated component directory refuses whatever that directory holds PASS the backup-eligibility test agrees with the walk on every case in the table PASS no exclusion pattern can prune a subtree it does not name PASS the walk and the guard share one heredity proof, by source PASS the ordinary layout produces no relocated-directory refusal, and a renamed content folder keys to itself PASS the frozen archive format has no field that could record a relocated directory PASS THE RE-DERIVED TABLE: every live cell, bytes against predicate against record PASS THE TRUTH TABLE: the M class, and the release gate composed per cell PASS HEREDITY: proved from the matchers, not from witnesses 147 passed, 0 failed