[grojof]

Second audit, group A: the paths that remove or overwrite. Each fix is checked by running it (tools/verify_data_safety.py).

• Install over an existing instance removed it. A new instance now needs a free name: no system account or service, and nothing on the host under it. Ctrl+C at the confirmation runs nothing. A failure while applying previews the undo of only what that run made, and asks first.
• Purge dropped other instances' databases and filestores on a shared data dir, and dropped a shared role. It now selects databases by owner or exact name, refuses superusers, drops databases before their files, and removes only the selected filestores from a shared data dir. The Linux user is removed only when the tool made it.
• chown -R /var/log/odoo on every install. The directory is now root's, each instance owns its own log, and logrotate no longer uses su.
• Delete instance checks the database owner and drops the database before removing the config. It reloads nginx only if it is installed, reads the legacy config location, and removes the logrotate policy.
• Copies chown only what belongs to the target, move an existing filestore aside and copy into the target. A refresh asks for REPLACE <target>, and a replica's filestore goes to its configured data dir.
• Backups: the backup directory must be dedicated, retention keeps the newest by name, and DB names read from file names are validated.

OpenSpec: 2026-10-08-guard-destructive-paths (7 specs).

Assisted-by: Claude