PASS a WordPress-core-only archive is allowed, and core is never mistaken for a content folder PASS a foreign content folder is refused by name and an ordinary one is allowed PASS the content-folder classifier resolves a relocated content folder on the backup and restore sides PASS failed database export removes its partial SQL image PASS nontransaction diagnosis wins over misleading table-name tokens PASS legacy NULL and malformed log details decode to a safe empty array PASS OneDrive preserves exact raw cron bytes, autoload, and absence PASS OneDrive multisite continuity preserves live cron and projected new-blog absence PASS continuity SELECT errors and empty multisite membership fail closed PASS projected final continuity retries only projected authority and fails honestly PASS restore maintenance gate expires before mutation and contains unsafe mutation PASS maintenance publication and mutation remain bootstrap-safe across torn writes PASS database exactness prunes destination extras and rollback-created objects views first PASS restore probes fail closed on silent query cache and partial constraint failures PASS signed multisite scope includes current sites and rejects orphan or ambiguous shared authority PASS network success continuity excludes removed sites while rollback retains them PASS multisite compatibility refuses unsafe mappings and identifies exact per-site target PASS per-site filesystem authority isolates primary uploads and refuses unsafe legacy or subsite files PASS per-site signed preservation rejects tombstones before trust and mutation PASS core rollback capture accepts exact WordPress roots and self-verifies PASS restore preserves a sibling backup plugin the archive does not carry PASS filesystem rollback restores empty directories bytes and exact modes PASS permission preflight names the folder the web server cannot write PASS the preflight does not demand a parent this restore will never write PASS the exact deletion plan leaves the folders the archive holds alone PASS a site answering 503 is not reported as a site that is not answering PASS rollback restores every snapshot byte before it removes anything extra PASS rollback preflight rejects corrupt missing extra and special members before mutation PASS rollback never overwrites an out-of-scope hardlink peer PASS Windows rollback rename fallback replaces only the verified pathname PASS failed capture removes injected FIFO rollback entries PASS filesystem snapshot rejects inventory-to-copy byte drift PASS filesystem snapshot rejects torn in-place writes PASS filesystem snapshot rejects inode-to-symlink swaps PASS filesystem snapshot refuses uncapturable file-only path directories PASS filesystem snapshot fails closed on unknown or low capacity PASS filesystem snapshot rejects post-copy file hash and mode drift PASS provider diagnostics never retain transport URLs tokens or response bodies PASS percent placeholders round-trip PASS keyset cursor preserves unsigned BIGINT beyond PHP integer range PASS cloud SQL omits options and multisite sitemeta control plane PASS provider download and destination continuity fail closed PASS single-site topology comes from recovery snapshot PASS SQL classification and collation compatibility PASS restore protects log table through commented SQL PASS restore SQL failures never retain statements or raw customer content PASS serialized objects remain opaque PASS multisite mapping preserves topology PASS standalone installer rejects incomplete multisite archives PASS wp-config exact semantic verification PASS private staging rejects aliases and enforces 0700/0600 PASS the staging probe asks open_basedir before it touches the filesystem PASS credential crypto is authenticated, canonical, and fail closed PASS secret writes preserve existing autoload metadata and keep new secrets non-autoloaded PASS operation owner lease is atomic and exact-owner PASS shared provider gate bridges old and new workers fail closed PASS ZIP verifier rejects missing, empty, and truncated recovery members PASS standalone migration packaging stays disabled despite stale option PASS core scope archives only canonical WordPress-owned paths PASS backup round-trips empty directories and rejects selected symlinks PASS file-backed JSON reads are bounded single-link and inode-stable PASS backup source authority rejects replacement byte drift and mode drift PASS signed file modes restore nondefault executable zero-byte and Unicode files exactly PASS file mode authority rejects missing extra malformed colliding and tampered maps PASS incremental file modes merge inherited changed-only and tombstoned paths in lockstep PASS the member validator and recovery inspection accept the signed health report PASS file mode chmod failures and post-chmod drift fail closed PASS legacy file mode policy preserves existing and restricts recreated files with warning PASS rollback mode authority rejects tampered mode records before live mutation PASS rollback rejects a pre-mode pathname swap without changing the external inode PASS incremental composition prunes deleted empty directories and restores modes PASS stream extraction validates paths, bytes, CRC, and symlinks PASS restore progress transport failures remain non-terminal and stale callbacks cannot overwrite a verdict PASS restore status exposes only bounded health-failure codes PASS settings success feedback requires a verified commit marker PASS static release-integrity invariants PASS settings read-back accepts WordPress scalar storage but stays fail-closed PASS setup wizard mutations are atomic and lock-held PASS operator notices and dismissal reject subscriber and editor roles PASS OneDrive live-provider protocol harness PASS licensing transport and legacy migration CAS stay exact PASS strict SQL restore authority focused suite PASS recovery integrity shared-table authority focused suite PASS a signed archive authenticates against its own authority record PASS recovery inspection classifies directory members via the managed-dir sentinel PASS uninstall is exact and hard-aborts around queued or live destructive restore PASS arcade purge skips absent tables and preserves sibling rows PASS exclusion gates refuse a union of scoped lines that excludes every canary PASS reproof and snapshot-copy refusals name their path and drifted fields PASS log_event triage keeps every existing branch and is immune to path words PASS the activity log and the failure email give one cure, not two PASS a committed upload still sends its email, and says what needs attention PASS source-drift refusal stores its named path raw (twin shape) PASS every classed path-bearing refusal stores its path raw (twin shape) PASS an operation gate that cannot be claimed is not reported as busy PASS an excluded component root is pruned whole, so nothing under it is enumerated PASS the post-restore health check consults the archive exclusion policy PASS the save-time disclosure names every component a pattern empties, at both depths PASS the root-file filter can never smuggle a credential file into an archive PASS a boot-file reference this backup cannot carry is named at backup time PASS an older archive keeps its boot companions and says which it lacks PASS the untouched-companion sentence claims no cause and no untrue remedy PASS the backup-time skip warnings name the paths they skipped PASS a refusal for a newer archive names both versions instead of blaming age PASS the permission refusal is stated once, not twice PASS the post-restore reachability check stays silent when it cannot ask PASS an orphaned Fast Backup stops advertising itself as restorable PASS a restore refusal reaches the customer verdict and the failure log PASS the unclassifiable residue splits into adopt and refuse PASS adoption opens every root-file consumer at once and never leaks to the writer PASS the signed inventory adopts what it can place and refuses what it cannot PASS the .user.ini boot-reference claim is gated on the SAPI that serves the site PASS a relocated plugins folder is refused by name at backup and at restore PASS a relocated must-use plugins folder is refused by name, and an absent one is not PASS a relocated uploads folder is refused, a subsite uploads folder inside it is not PASS a relocated translations folder is refused, and both WordPress language defaults are allowed PASS a theme root outside the keyed themes folder is refused only when it holds a theme PASS an extra registered theme root that holds a theme does not stop a backup, and is disclosed PASS an empty relocated directory is tolerated exactly as an absent one is PASS a restore onto a relocated component directory refuses whatever that directory holds PASS the backup-eligibility test agrees with the walk on every case in the table PASS the ordinary layout produces no relocated-directory refusal, and a renamed content folder keys to itself PASS the frozen archive format has no field that could record a relocated directory PASS THE RE-DERIVED TABLE: every live cell, bytes against predicate against record PASS THE TRUTH TABLE: the M class, and the release gate composed per cell PASS no exclusion pattern can prune a subtree it does not name PASS an archive collision refusal names both colliding members All 127 OneDrive regression groups passed.