* fix(update): reject unattributed database writes during Doctor
Keep the captured fingerprint baseline through Doctor settlement. Maintenance ownership does not exclude independent SQLite writers, so any observed change, including a new database, must refuse automatic restoration through the existing receipt contract. Preserve current databases and the existing actionable recovery guidance without adding schema or transaction receipt infrastructure.
Forward-port the conservative safety correction from c3c20e0241 onto the current capture owner.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
Co-authored-by: vyctorbrzezowski <51521767+vyctorbrzezowski@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
* test(update): expect Doctor-time writes to disable automatic database restore
Rebasing onto main surfaced two receipts that relied on interval-wide
attribution: the NOCOW physical replacement (#160877) and Doctor's own
schema upgrade during legacy-root relocation. Under the conservative
policy neither is attributable, so both receipts are ineligible for
automatic restoration.
---------
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
Co-authored-by: vyctorbrzezowski <51521767+vyctorbrzezowski@users.noreply.github.com>
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com>
65a3cce3b9