Marc-André Bombeck 16d1b542a5 fix(backup): keep an erased account's copy out of admin accounts ...

A restore read the account settings under the operator's AI endpoint
policy whenever the receiving account was an admin. For a copy put into
a chosen account, the settings were written by the erased account's
owner, not by the operator, yet an admin account could be chosen as the
target, and an ordinary target promoted later got the same trust.

Admin accounts are now refused as a target, in the check and the
picker, with backup.target.admin_account. A copy uploaded into a chosen
account is stored as RETARGETED_UPLOAD_<ms>, and its restore never reads
its settings as the operator's, whatever the account's role is by then.

2026-10-29 21:36:33 +01:00

..

migrations

feat(v1.4): multi-tenant prep — off-host backup, encryption-key versioning, worker/web split, native-Bearer UA gating (#135)

2026-05-08 14:33:39 +02:00

apple-health-distance-repair.md

fix(ops): stop the distance repair losing its rollup tail in silence

2026-09-10 00:37:15 +02:00

attempt-number-semantics.md

fix(integrations): log a failed sync as a signal, not an audit row

2026-10-20 10:03:30 +02:00

backup-restore.md

fix(backup): keep an erased account's copy out of admin accounts

2026-10-29 21:36:33 +01:00

blood-pressure-missing-diastolic.md

fix(idempotency): replay a key only for the same request body

2026-10-04 10:14:22 +02:00

deploy.md

Merge the release with the security review fixes into the data-safety review fixes

2026-10-25 18:36:54 +01:00

disaster-recovery.md

fix(db-backup): keep instances apart in a shared bucket, and no decrypted dump behind

2026-10-25 17:30:29 +01:00

encryption-key-rotation.md

fix(recovery): the database dumps count in the keys the backups still need

2026-10-25 17:20:16 +01:00

env-check.md

Correct operator runbooks against the current code

2026-08-27 12:18:34 +02:00

heap-diagnostics.md

feat(observability): break the heap sample down by V8 space

2026-10-20 20:27:24 +02:00

intake-repair.md

refactor(medications): drop the compliance rollup table that nothing reads

2026-10-20 13:01:45 +02:00

measurement-maintenance.md

fix(auth): issue a Secure session cookie under the __Host- prefix

2026-10-25 17:44:31 +01:00

mfa-enforcement.md

docs(security): note that required-MFA prompts but does not wall the API

2026-06-27 22:23:54 +02:00

migration-0409-plaintext-location.md

docs(ops): add the recovery steps for an upgrade stopped at migration 0409

2026-10-16 03:57:46 +02:00

password-reset.md

fix(image): ship the operator scripts the runbooks run in the container

2026-09-26 15:26:03 +02:00

postgres-major-upgrade.md

docs: say what deletion keeps and for how long, and drop stale claims

2026-10-25 16:47:00 +01:00

query-statistics.md

ops: load pg_stat_statements in the bundled database

2026-10-08 15:01:02 +02:00

security-recovery.md

docs(01-09): document security contract changes

2026-07-29 14:08:37 +02:00

tls-cert-pin.md

Correct operator runbooks against the current code

2026-08-27 12:18:34 +02:00