Merge PR #478

docs/web.md

@@ -111,9 +111,10 @@ are the same in every version, so serve them with `Cache-Control: no-cache` (not
     (`originals/<hash>/<file name>`, so an unzipped backup is browsable; entries are stored, not
     compressed; at most 4 GB). **File ▸ Restore Library from Backup…** reads such a zip into a
     new library folder (`library-restored-<time>/`; originals already stored are skipped, every
-    entry's checksum is verified) and only then switches to it (`active-library` names the
-    folder in use) and reloads: the previous library stays in storage. Both are web-only
-    (`file.backupLibrary`, `file.restoreLibrary`; the desktop library is a folder).
+    entry's checksum is verified, and each restored original must match its content hash) and
+    only then switches to it (`active-library` names the folder in use) and reloads: the previous
+    library stays in storage. Both are web-only (`file.backupLibrary`, `file.restoreLibrary`; the
+    desktop library is a folder).
   - A failed save (quota exceeded, storage cleared) is not silent: the catalog then refuses new
     writes, so commands report `saved in memory but not written`, the top bar shows the unsaved
     warning (as on the desktop, see `docs/control-protocol.md`), and saving is retried every