Every captured change carries its SHA-256-addressed content in BLOB_STORE. Restoring writes that content back to the original path — current file gets backed up to <path>.drift_restore_backup_<epoch> before overwrite.
| Target file | /etc/cron.d/drift_sense |
| Site | SSH-agent watch: /etc/cron.d on localhost-ssh-agent |
| Kind | ssh_agent |
| Captured at | 2026-07-12 23:14:05 |
| Captured SHA | d881083cab8f7e03293ca5488cf89f9af911b3185038a8783fa787012548d9e1 |
| File present | no (new file) |
| Size | unknown |
| Current SHA | |
| Same as captured? | no -- restore will change it |
<target>.drift_restore_backup_<epoch>, writes the captured content, verifies SHA post-write.