Every captured change carries its SHA-256-addressed content in BLOB_STORE. Restoring writes that content back to the original path — current file gets backed up to <path>.drift_restore_backup_<epoch> before overwrite.
| Target file | /var/www/vhosts/3dshawn.com/affiliate.3dshawn.com/twofa.cgi |
| Site | AffSoft (affiliate.3dshawn.com) on local |
| Kind | local |
| Captured at | 2026-07-01 13:48:14 |
| Captured SHA | 9b11c905be3ee4c317ed5ba51e7cfb5dd54e6b171fd1f74b332391f9ca77ba43 |
| File present | yes |
| Size | 8518 bytes |
| Current SHA | 9b11c905be3e |
| Same as captured? | yes -- no-op |
<target>.drift_restore_backup_<epoch>, writes the captured content, verifies SHA post-write.