Day zero of the rescue project has a hash list

The client arrives orphaned: their developer stopped answering in March, and everything lives on a hosting account with one password. Kickoff is an intake. One POST registers the old host as an SFTP backend; it mounts as a folder; you copy everything in.

Then every file gets a ?sha256: one GET each, and the hex strings become the day-zero manifest. A snapshot aliased day-zero freezes the imported state, and the file journal records every change from this minute forward.

Six weeks later, someone asks whether the checkout was already broken when you inherited it. You don't remember. You don't have to: you look it up, against a manifest older than your first commit.

Every rescue starts with receipts.