Rolling back erases the afternoon unless you snapshot it first

A library's public terminal is a container with display-1 on a locked-down browser, and a cron line that GETs /api/v1/display/screenshot every sixty seconds into the history. At 16:10 someone got past kiosk mode. By 16:40 the desk wants it back to normal and the security officer wants to know what happened.

Restore is destructive. PUT the golden snapshot and the current disk is discarded, including /hoody/storage/hoody-display/screenshots, where every capture since noon sits. Roll back first and the afternoon is gone.

So the order is fixed. POST a snapshot with alias incident-1610, no expiry. Restore golden; the terminal is clean in under a minute. Copy a container from incident-1610 and read GET /api/v1/display/screenshots on the copy: every capture between 16:10 and 16:40, each fetchable by timestamp, none of it having left the box.

The runbook is three words: freeze, fix, look.