# What a firmware upgrade keeps (sysupgrade's keep list, PRD FWU-1/FWU-2, WP A-6). A plain upgrade removes every added package, so
# the list holds what makes the router the same device and lets the reinstall step bring ForestVPN back by itself:
#   identity   the machine key. Losing it makes a new device and leaves an orphan seat.
#   choices    the settings (uci) and the exit the person last chose (desired-location, a few bytes, written when it changes).
#   safety     release_seq, the newest signed release this router accepted: without it an upgrade would let an old signed file
#              be accepted again (the anti-rollback counter of `fv verify-release`); revoked_keys, the repository keys the signed
#              release named as revoked, so no install step puts one back (review-router M2); placed_keys, the fingerprints of the repository keys
#              feed-place placed (SEC-1 TM-002): the only key files a revocation may remove, so OpenWrt's own are never on it;
#              update_last_ok, the seq, issue time and digest of the release last accepted (the one-seq-one-document check and the no-answer clock)
#              (SEC-1 NEW-2): without it an upgrade lets a different document under the current seq be accepted once.
#   reinstall  the step and its hotplug entry, the software source line, the key that signs it.
#   hold       the armed flag (AD-1: "the kill switch has been armed on this router"). Under Strict the directory below also holds the
#              snapshot of the blocked table and the include that loads it (review-router M4): after an upgrade the devices stay
#              blocked until the reinstall brings the package back. Under Standard there is no snapshot, so the flag changes nothing.
# NEVER the session files (session.conf holds a private key; session.hop.json, state.json, reach.json) or tickets: the router asks
# for a new session after the upgrade (it may spend one connection). The state directory is never listed as a whole.
# A backup archive (LuCI) holds this list too, and so the machine key in clear: whoever has the archive can act as this router on
# the account (PRD FWU-4; no device-bound secret to wrap it with exists in the lab: gate FWU, E13). The status page says so.
/etc/forestvpn/machine.key
/etc/forestvpn/desired-location
/etc/forestvpn/release_seq
/etc/forestvpn/armed
/etc/forestvpn/revoked_keys
/etc/forestvpn/placed_keys
/etc/forestvpn/update_last_ok
/etc/config/forestvpn
/etc/forestvpn-reinstall/
/etc/hotplug.d/iface/90-forestvpn-reinstall
/etc/opkg/customfeeds.conf
/etc/apk/repositories.d/customfeeds.list
/etc/apk/keys/forestvpn-*
# opkg names a signing key by its fingerprint, so the directory is listed (24.10 keeps it already; older firmware may not).
# apk 25.12 keeps no key of ours without the line above.
/etc/opkg/keys/
