test: qualify quiesced deployment snapshots and rollback

scripts/deploy-unraid.sh

@@ -1,5 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
+# Backup receipts include environment secrets. Protect them at creation, not only
+# after chmod, so a failed copy/inspect never leaves a world-readable partial file.
+umask 077
 # Run on Unraid after building both images. Never source secret values into logs.
 ROOT=/mnt/user/appdata/hope-voice
 ENV_FILE="$ROOT/runtime.env"
@@ -66,6 +69,25 @@ for name in voice hope-control; do
   fi
 done
 
+# Accounts are quiesced before SQLite/WAL and product uploads are copied.
+# Migrations are additive; rollback containers retain the new database. The
+# snapshot is separately retained for operator-approved data restoration, never
+# silently overwrite messages created after deployment.
+tar -C "$ROOT" -czf "$BACKUP/account-state.tgz" accounts
+chmod 600 "$BACKUP/account-state.tgz"
+cp "$ROOT/runtime.env" "$BACKUP/runtime.env"
+cp "$ROOT/voice.env" "$BACKUP/voice.env"
+cp "$ROOT/livekit.yaml" "$BACKUP/livekit.yaml"
+chmod 600 "$BACKUP/runtime.env" "$BACKUP/voice.env" "$BACKUP/livekit.yaml"
+
+# Per-account Hermes homes remain mounted in place. No container/data migration
+# may delete these roots. Record the exact old identities without revealing envs.
+for name in voice hope-control; do
+  if [ -n "${ORIGINAL[$name]}" ]; then
+    docker inspect --format '{{.Id}}' "${ORIGINAL[$name]}" > "$BACKUP/$name-container-id.txt"
+  fi
+done
+
 docker run -d --name hope-control --network host --restart unless-stopped \
   --env-file "$ENV_FILE" \
   -e CONTROL_DB_PATH=/var/lib/hope/accounts.sqlite3 \