# Backup — verification record

How the three backup mechanisms have actually been exercised, so a future
reader knows what's proven vs. assumed. Re-verify after touching
`BackupManager`, `AgeBackupCrypto`, or the manifest backup rules.

## Google Auto Backup (new-device restore) — emulator demo, 2026-06-11

Run on a throwaway API-35 AVD with the **local** backup transport
(`bmgr transport com.android.localtransport/.LocalTransport`), which is
deterministic and stands in for the Google transport.

Verified by screenshot:
- Settings status card reads "Google-sikkerhetskopi aktiv (kryptert)" (not the
  red "ikke satt opp") with a passphrase set and no S3.
- `bmgr backupnow` → `pm clear` (simulated new device) → `bmgr restore`: the
  age blob `files/gbackup/latest.json.age` returns and the DB is empty.
- The Today screen then shows the "Kryptert sikkerhetskopi funnet" card with a
  passphrase prompt.

Verified by instrumented test (`CloudBackupRoundTripTest`, green on emulator) —
this covers the final decrypt+import step, which ADB/uiautomator can't tap
reliably (the Compose dialog reports a phantom node and touch isn't delivered
to the button behind the soft keyboard — a harness quirk, not an app bug):
- `writeThenRestoreOnEmptyDb`: blob written → empty DB → `pendingCloudRestore`
  fires → `import(blob, passphrase)` brings the exact data back.
- `wrongPassphraseFailsAndKeepsDbEmpty`: wrong passphrase throws, DB stays empty.
- `noPassphraseRemovesBlob`: clearing the passphrase deletes the blob.
- `testBackupWithOnlyPassphraseSucceeds` / `…NothingConfiguredThrows`: the
  passphrase-only "Test backup" path succeeds instead of erroring.

Not yet done on real hardware: the true new-device round-trip via the Google
transport (uninstall + reinstall). Safe protocol when attempted — file-export
first as a safety net, then `bmgr backupnow` → uninstall → reinstall.

Note: scrypt work factor is 15, not age's desktop default 18 — 18 needs a
256 MiB working set and OOM-crashes inside a normal Android heap. 15 = 32 MiB;
`largeHeap` covers decrypting foreign files made at 18.

## S3 / Garage — not yet verified end to end

The SigV4 signer is unit-tested against AWS's published example, and
`listAllKeys`/`parseListKeys` are unit-tested, but no real PUT/GET against a
live Garage bucket has run yet (no bucket available). Pending: configure
credentials, "Test backup nå", then confirm the object and `age -d` it.

## File export/import — verified

Exercised on-device in earlier sessions: encrypted export → import round-trip,
and v1→v2 backup-format conversion (`BackupSerializerTest`).