Media restore now stops both mealquest-media-backup.timer and the service, checks that neither is active and no rsync runs, and records the NAS file count before media/ is touched; a post-condition compares local and NAS counts before the timer starts again, so an rsync --delete never sees an empty or partial media directory. The shortcut restore snippet in "Media — nightly rsync" now points at that procedure. First deploy sets MEALQUEST_BIND_ADDRESS to 10.60.1.14 explicitly (the template ships 127.0.0.1) and shows the resulting 10.60.1.14:8090 publish. Record the Authentik client ID and the actual DNS records. App-key rotation no longer sends the operator to re-entry flows that do not exist: it pre-checks that no _ct column holds a value, refuses to rotate otherwise, and marks the LLM, recipe-search (Feature 10), Calendar (Feature 16) and Chat (Feature 19) re-entry flows as planned. Task: 876134bc-9f1c-46b3-bc3c-0d889c2fd5f6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>