Phase 7/9: Cut over Browse and Restore, restore history, and restore tests to job_id

[borg-codex-bot]

Parent: #447

Depends on: Phase 6/9

Delivery branch: codex/issue-447-immutable-job-ids

Delivery model: This phase is committed to the shared #447 integration branch and the single draft pull request against main. It is not merged or released independently.

Objective

Convert Browse and Restore, restore execution/history, and the complete restore-test lifecycle to immutable job_id while preserving access to archives under current and previous prefixes in the current repository.

Browse and Restore

• Select and address jobs by job_id.
• Resolve the one current repository assignment from canonical metadata.
• Use the ordered archive_prefixes list for archive discovery and filtering.
• Keep the current prefix visibly distinguishable from historical prefixes.
• Never add the UUID to Borg archive filters merely for identity.
• Do not search historical repositories or move archives after repository changes.
• Preserve the warning boundary owned by Warn and require confirmation before changing a job repository #452.

Restore execution and history

• Submit job_id for precheck, archive browsing and restore execution.
• Persist the ID plus job name, repository, archive prefix, location and archive snapshots for each run.
• Key active restore state, summary, detail and history indexes by stable restore/run IDs and job_id relationships.
• Keep historical restores readable after job name or prefix changes.
• Preserve deleted-job restore history without presenting the deleted job as active.
• Classify ambiguous legacy restore records instead of guessing.

Restore tests

• Rename active canonical policy/result files from <job_key>.test to <job_id>.test during migration.
• Store job_id in result payloads and policy associations.
• Submit IDs for scheduled and manual tests.
• Key plan rows, proof maps, reminders and overdue state by ID.
• Preserve proof status when job name or archive prefix changes.
• Retain archive, repository, prefix, location and display-name snapshots.
• Keep deleted-job historical test results without adding them to the active plan.

Migration behavior

• Convert unambiguous active restore-test and restore-history references.
• Preserve existing result files in the snapshot before renaming or rewriting.
• Resolve collision and partial-result cases deterministically.
• Do not delete files that cannot be assigned safely.
• Verification must ensure every active restore-test policy references an existing canonical job.

Tests

• archive discovery across current and historical prefixes;
• current-repository-only boundary after a repository change;
• browse, restore precheck and restore execution by ID;
• persisted restore history across name/prefix edits;
• migration of .test files, policies, results, schedules and reminders;
• proof and overdue continuity;
• deleted jobs and unassigned legacy records;
• collision, interruption and retry behavior;
• German and English UI behavior.

Test-channel policy

Do not publish a test-channel version yet. Configuration transfer, deletion, diagnostics and final startup migration activation still need to be completed and verified.

Acceptance criteria

• Browse and Restore uses job_id and the current repository with all stored prefixes.
• Restore runs and history retain stable identity across edits.
• Restore-test plans, results, proof and reminders use IDs.
• Legacy records are preserved, mapped or explicitly classified.
• No archive or restore artifact is silently deleted or moved.

[borg-codex-bot]

Phase 7 is implemented on codex/issue-447-immutable-job-ids in draft PR #480.

Commit: 541934b42531de01d4b5300df1db517fcd2bb9f0.

• Browse/precheck/download/execution select job_id and only the current
  repository with its ordered prefix history.
• Restore runs keep full run IDs and captured repository/name/prefix/location
  snapshots. History remains readable across edits/deletion; failed history
  writes are retained for restart retry.
• Restore-test plans, policies, scheduled/manual invocation, result payloads and
  reminder correlation use UUIDs. Tests select the latest archive owned by that
  job; proof survives suitable name/prefix edits and becomes stale after a move.
• Ambiguous legacy/JSON ownership cannot create active jobs, satisfy proof or
  authorize overwriting an existing result. Migration peer checks cover the new
  descriptor fields; the migration itself remains inactive.
• 282 distinct focused tests passed, including migration partial/retry cases,
  real Borg restore/proof, normal and activity-mode backups, and DE/EN frontend
  behavior. Real HTTP smoke, syntax checks and diff checks passed.

Maintainer contract: docs/maintainer/canonical-restore.md.

No preflight/build/test-channel or stable release at this intermediate checkpoint,
per the approved #447 integration workflow. Continue with #478; guarded migration
activation, final preflight and the first complete test candidate belong to #479.