SFPCKUSR32 - Safety, Backups, and Restore Procedure
===================================================

SFPCKUSR32 is approved for MANUAL OFFLINE use only. It must not run while a
Spitfire node process or caller can access the user database.

OFFLINE CHECKLIST
-----------------

1. Close all Spitfire node windows, including idle nodes.
2. Prevent caller access at the listener, gateway, or host level.
3. Stop SFToss32 and every other Spitfire maintenance utility.
4. Confirm MESSAGE\SFTOSS.BSY does not already exist.
5. Run the exact intended command with /DRYRUN.
6. Review every WOULD-PURGE record.
7. Confirm there are zero validation errors.
8. Run the same command without /DRYRUN only when the list is correct.

SFWHOSON.DAT is checked for active callers, but it cannot prove that idle node
processes are closed. The shared SFTOSS.BSY marker coordinates cooperating
maintenance tools; Spitfire itself is not a complete participant in that lock.

WRITE SEQUENCE
--------------

Each real pack:

1. Atomically acquires MESSAGE\SFTOSS.BSY.
2. Refuses active callers reported by WORK\SFWHOSON.DAT.
3. Validates and hashes SFUSERS.DAT, SFUSERS.PTR, and every SFMSGxx.LMR.
4. Builds and verifies staged DAT, PTR, LMR, and SFPURGED.USR files.
5. Creates and verifies a timestamped backup.
6. Rechecks caller state, lock ownership, and original file hashes.
7. Replaces the selected files.
8. Verifies every committed file.
9. Attempts verified rollback after a detected commit or verification failure.
10. Removes only the shared lock created by the current run.

LMR files retain their original physical size. Removed user slots are deleted
logically, retained slots shift left in user order, and remaining capacity is
zero-filled.

BACKUP CONTENTS
---------------

Default root:

  <Spitfire HOME>\SFPCKUSR-BACKUPS

Each run creates:

  SFPCKUSR-YYYYMMDD-HHMMSS

The backup includes the pre-pack copies of:

  WORK\SFUSERS.DAT
  WORK\SFUSERS.PTR
  WORK\SFWHOSON.DAT
  MESSAGE\SFMSGxx.LMR for every existing conference
  WORK\SFPURGED.USR when present
  MANIFEST.TXT
  RESTORE_WARNING.TXT

Every database copy is verified before commit.

RESTORE WARNING
---------------

The backup is intended for immediate rollback while all nodes remain offline.
After callers return, restoring it discards newer caller-database changes and
last-message-read progress.

Restore SFUSERS.DAT, SFUSERS.PTR, and every SFMSGxx.LMR together as one matched
set. Do not restore only one file from the set.

SUCCESS CHECKLIST
-----------------

Before reopening the BBS, require:

  Commit: COMPLETE
  Post-write verification: PASS
  WRITE RESULT: SUCCESS
  Shared SFTOSS.BSY lock: RELEASED
  Errors: 0
  Exit code: 0

Also confirm MESSAGE\SFTOSS.BSY is absent and no *.SFPNEW files remain. Start
one node and test a normal login and message-conference access before restoring
full service.
