From 2bb12fee08a3015f8c96b23c70724590acdd11c8 Mon Sep 17 00:00:00 2001
From: Sascha Haase <sascha@example.com>
Date: Fri, 29 May 2026 22:08:15 +0200
Subject: [PATCH 1/2] feat: wire Serilog logging, dynamic post-restore
 checklist, e2e verification script

1. Serilog logging (foundational):
   - Add Serilog + RollingFile NuGet packages to App project
   - Configure rolling file sink in Program.Main -> %LOCALAPPDATA%\ClaudePortable\logs\
   - Wire UiLogSink.Append() to also write to Serilog for dual output (file + UI Logs tab)
   - GUI App.cs initializes ForSubLogger() so both CLI and GUI share the same log stream

2. Dynamic post-restore checklist (actionable):
   - Rewrite PostRestoreChecklistBuilder.Build() with dynamic content:
     * Version gate warnings (Warn/Block levels with specific guidance)
     * Plugin reinstall hints from .claude/plugins/ directory scan
     * Safety backup paths listing
     * Per-target restore summary (files written, skipped, warnings)
   - RestoreEngine now generates checklist via builder instead of copying static file
   - Add PostRestoreChecklistPath property + OpenChecklistCommand to MainViewModel
   - Add 'Open Checklist' button in Restore tab XAML (visible only after restore)
   - Add StringToVisibleConverter for conditional button visibility

3. E2E verification script:
   - Write scripts/e2e-verify.ps1 with 6-step automated validation:
     * ZIP extraction and SHA-256 integrity check
     * Manifest schema validation (required fields, version)
     * Backup content directory verification
     * Credential exclusion assertions (tokens.dat, Login Data*, Cookies*, config.json)
     * MCP server key comparison against expected list
     * Post-restore checklist file existence and section validation
   - Update docs/e2e-test.md to reference the working script
---
 docs/e2e-test.md                              |  20 +-
 scripts/e2e-verify.ps1                        | 253 ++++++++++++++++++
 .../ClaudePortable.App.csproj                 |   2 +
 src/ClaudePortable.App/Program.cs             |  23 +-
 src/ClaudePortable.App/Ui/App.cs              |   5 +
 .../Ui/Converters/StringToVisibleConverter.cs |  15 ++
 .../Ui/Services/UiLogSink.cs                  |   3 +
 .../Ui/ViewModels/MainViewModel.cs            |  35 +++
 .../Ui/Views/MainWindow.xaml                  |   5 +
 .../Post/PostRestoreChecklistBuilder.cs       | 132 +++++++--
 .../Restore/RestoreEngine.cs                  |  10 +-
 11 files changed, 464 insertions(+), 39 deletions(-)
 create mode 100644 scripts/e2e-verify.ps1
 create mode 100644 src/ClaudePortable.App/Ui/Converters/StringToVisibleConverter.cs

diff --git a/docs/e2e-test.md b/docs/e2e-test.md
index 003c22b..7a0a948 100644
--- a/docs/e2e-test.md
+++ b/docs/e2e-test.md
@@ -67,10 +67,16 @@ Run this before tagging a release that changes anything in `ClaudePortable.Core`
 
 ## Automating the verification (optional)
 
-A PowerShell verification script template lives in `scripts/e2e-verify.ps1` (TODO, not yet written). It should:
-1. Check `Test-Path` for each path in `WindowsPathDiscovery`.
-2. Read the restored `claude_desktop_config.json`, assert `mcpServers` keys match the pre-backup capture.
-3. Read `extensions-installations.json`, diff extensions list against the backup manifest `sourcePaths`.
-4. Assert `config.json` was NOT restored (file size should be 0 or absent).
-
-This script is a follow-up; see the "Automate E2E verification" issue on the repo.
+A PowerShell verification script lives in `scripts/e2e-verify.ps1`. It:
+1. Extracts the backup ZIP to a temp directory.
+2. Validates `manifest.json` schema, required fields, and SHA-256 integrity.
+3. Checks that expected backup content directories exist with file counts.
+4. Asserts credential-bearing files (`tokens.dat`, `Login Data*`, `Cookies*`, `config.json`) are correctly excluded.
+5. Verifies MCP server keys in `claude_desktop_config.json` against an optional expected list.
+6. Checks that a post-restore checklist markdown was generated with required sections.
+
+Usage:
+```powershell
+.\scripts\e2e-verify.ps1 -BackupZip ".\claude-backup_20260529.zip"
+.\scripts\e2e-verify.ps1 -BackupZip ".\backup.zip" -ExpectedMcpServers @("gmail", "slack")
+```
diff --git a/scripts/e2e-verify.ps1 b/scripts/e2e-verify.ps1
new file mode 100644
index 0000000..637756e
--- /dev/null
+++ b/scripts/e2e-verify.ps1
@@ -0,0 +1,253 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+    Automated E2E verification for ClaudePortable backup/restore roundtrip.
+.DESCRIPTION
+    Validates that a restored backup ZIP contains expected files, correct
+    exclusions, and consistent manifest data. Designed to run on VM-B
+    after a restore from VM-A in the OneDrive roundtrip test playbook.
+
+    Usage:
+        .\e2e-verify.ps1 -BackupZip "C:\OneDrive\ClaudePortable\claude-backup_20260529.zip"
+        .\e2e-verify.ps1 -BackupZip ".\backup.zip" -RestoreDir "C:\Temp\restore-check"
+.PARAMETER BackupZip
+    Path to the backup ZIP file to verify.
+.PARAMETER RestoreDir
+    Directory where the ZIP will be extracted for inspection. Defaults to
+    a temp folder under $env:TEMP\ClaudePortable\e2e-verify-<guid>.
+.PARAMETER ExpectedMcpServers
+    Optional JSON array of expected MCP server keys (from pre-backup capture).
+    Used to assert that mcpServers in claude_desktop_config.json match.
+.EXAMPLE
+    .\e2e-verify.ps1 -BackupZip ".\claude-backup_20260529.zip"
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$BackupZip,
+
+    [string]$RestoreDir,
+
+    [string[]]$ExpectedMcpServers
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+# --- Helpers ---
+$passed = 0
+$failed = 0
+$warnings = 0
+
+function Write-Result {
+    param(
+        [string]$Name,
+        [bool]$Ok,
+        [string]$Detail = '',
+        [switch]$Warning
+    )
+    $icon = if ($Ok) { '[PASS]' } elseif ($Warning) { '[WARN]' } else { '[FAIL]' }
+    $color = if ($Ok) { 'Green' } elseif ($Warning) { 'Yellow' } else { 'Red' }
+    Write-Host "$icon $Name" -ForegroundColor $color
+    if ($Detail) { Write-Host "       $Detail" -ForegroundColor DarkGray }
+    if ($Ok) { $script:passed++ }
+    elseif ($Warning) { $script:warnings++ }
+    else { $script:failed++ }
+}
+
+function Test-PathExists {
+    param([string]$Path, [string]$Label)
+    if (Test-Path $Path -PathType Leaf) { return $true }
+    Write-Host "       Expected file not found: $Path" -ForegroundColor DarkRed
+    return $false
+}
+
+function Test-DirExists {
+    param([string]$Path, [string]$Label)
+    if (Test-Path $Path -PathType Container) { return $true }
+    Write-Host "       Expected directory not found: $Path" -ForegroundColor DarkRed
+    return $false
+}
+
+# --- Pre-flight ---
+Write-Host ''
+Write-Host '========================================' -ForegroundColor Cyan
+Write-Host '  ClaudePortable E2E Verification' -ForegroundColor Cyan
+Write-Host '========================================' -ForegroundColor Cyan
+Write-Host ''
+
+if (-not (Test-Path $BackupZip)) {
+    Write-Error "Backup ZIP not found: $BackupZip"
+    exit 1
+}
+
+$zipSha = (Get-FileHash $BackupZip -Algorithm SHA256).Hash.ToLower()
+Write-Host "[INFO] ZIP SHA-256: $zipSha" -ForegroundColor DarkCyan
+
+if (-not $RestoreDir) {
+    $RestoreDir = Join-Path $env:TEMP "ClaudePortable\e2e-verify-$((New-Guid).ToString('N'))"
+}
+New-Item -ItemType Directory -Force -Path $RestoreDir | Out-Null
+
+# --- 1. Extract ZIP ---
+Write-Host '[1/6] Extracting backup ZIP...' -ForegroundColor Yellow
+try {
+    Add-Type -AssemblyName System.IO.Compression.FileSystem
+    [System.IO.Compression.ZipFile]::ExtractToDirectory($BackupZip, $RestoreDir)
+    Write-Result 'ZIP extraction' $true
+} catch {
+    Write-Result 'ZIP extraction' $false "Could not extract: $_"
+    exit 2
+}
+
+# --- 2. Validate manifest.json ---
+Write-Host '[2/6] Validating manifest...' -ForegroundColor Yellow
+$manifestPath = Join-Path $RestoreDir 'manifest.json'
+if (-not (Test-PathExists $manifestPath 'manifest.json')) {
+    Write-Result 'Manifest validation' $false 'manifest.json not found in ZIP root'
+} else {
+    try {
+        $manifest = Get-Content $manifestPath -Raw | ConvertFrom-Json
+        Write-Result 'Manifest JSON parse' $true
+
+        # Schema version
+        if ($manifest.schemaVersion -ge 1) {
+            Write-Result 'Schema version' $true "v$($manifest.schemaVersion)"
+        } else {
+            Write-Result 'Schema version' $false "Unexpected schemaVersion: $($manifest.schemaVersion)"
+        }
+
+        # Required fields
+        $requiredFields = @('createdAt', 'hostname', 'windowsUser', 'retentionTier', 'sourcePaths', 'archiveTargets', 'sizeBytes', 'fileCount', 'sha256')
+        foreach ($field in $requiredFields) {
+            if ($null -ne $manifest.$field) {
+                Write-Result "Manifest field: $field" $true
+            } else {
+                Write-Result "Manifest field: $field" $false 'Field is null or missing'
+            }
+        }
+
+        # SHA-256 consistency check
+        if ($manifest.sha256 -and $manifest.sha256.ToLower() -eq $zipSha) {
+            Write-Result 'SHA-256 integrity' $true 'ZIP hash matches manifest'
+        } elseif ($manifest.sha256) {
+            Write-Result 'SHA-256 integrity' $false "Expected $($manifest.sha256), got $zipSha"
+        } else {
+            Write-Result 'SHA-256 integrity' $false 'Manifest has no sha256 field' -Warning
+        }
+
+        # Source paths sanity
+        if ($manifest.sourcePaths.Count -gt 0) {
+            Write-Result 'Source paths populated' $true "$($manifest.sourcePaths.Count) entries"
+        } else {
+            Write-Result 'Source paths populated' $false 'No source paths in manifest'
+        }
+
+        # Archive targets sanity
+        if ($manifest.archiveTargets.Count -gt 0) {
+            Write-Result 'Archive targets populated' $true "$($manifest.archiveTargets.Count) entries"
+        } else {
+            Write-Result 'Archive targets populated' $false 'No archive targets in manifest'
+        }
+
+    } catch {
+        Write-Result 'Manifest validation' $false "Parse error: $_"
+    }
+}
+
+# --- 3. Check expected backup content ---
+Write-Host '[3/6] Checking backup content...' -ForegroundColor Yellow
+$expectedDirs = @(
+    @{ Path = 'claude-desktop/appdata'; Label = 'Claude Desktop appdata' },
+    @{ Path = 'claude-code/dotclaude'; Label = 'Claude Code .claude' }
+)
+
+foreach ($item in $expectedDirs) {
+    $zipPath = Join-Path $RestoreDir "$($item.Path)"
+    if (Test-DirExists $zipPath $item.Label) {
+        $fileCount = (Get-ChildItem $zipPath -Recurse -File).Count
+        Write-Result "Content: $($item.Label)" $true "$fileCount files"
+    } else {
+        Write-Result "Content: $($item.Label)" $false 'Directory not found in backup'
+    }
+}
+
+# --- 4. Check credential exclusions ---
+Write-Host '[4/6] Checking credential exclusions...' -ForegroundColor Yellow
+$excludedPatterns = @(
+    @{ Pattern = '**/tokens.dat'; Label = 'OAuth tokens (tokens.dat)' },
+    @{ Pattern = '**/Login Data*'; Label = 'Browser login data' },
+    @{ Pattern = '**/Cookies*'; Label = 'Browser cookies' },
+    @{ Pattern = '**/config.json'; Label = 'Claude config with tokenCache' }
+)
+
+foreach ($item in $excludedPatterns) {
+    $matches = Get-ChildItem -Path $RestoreDir -Recurse -File -Filter $item.Pattern -ErrorAction SilentlyContinue
+    if ($matches.Count -eq 0) {
+        Write-Result "Exclusion: $($item.Label)" $true 'Not found (correctly excluded)'
+    } else {
+        Write-Result "Exclusion: $($item.Label)" $false "Found $($matches.Count) file(s): $($matches.FullName -join ', ')"
+    }
+}
+
+# --- 5. MCP server verification ---
+Write-Host '[5/6] Checking MCP servers...' -ForegroundColor Yellow
+$configPath = Join-Path $RestoreDir 'claude-desktop/appdata/claude_desktop_config.json'
+if (Test-PathExists $configPath 'claude_desktop_config.json') {
+    try {
+        $config = Get-Content $configPath -Raw | ConvertFrom-Json
+        if ($null -ne $config.mcpServers) {
+            $mcpKeys = @($config.mcpServers.PSObject.Properties.Name)
+            Write-Result 'MCP servers in config' $true "$($mcpKeys.Count) server(s): $($mcpKeys -join ', ')"
+
+            if ($ExpectedMcpServers.Count -gt 0) {
+                $missing = $ExpectedMcpServers | Where-Object { $_ -notin $mcpKeys }
+                if ($missing.Count -eq 0) {
+                    Write-Result 'MCP servers match expected' $true 'All expected servers present'
+                } else {
+                    Write-Result 'MCP servers match expected' $false "Missing: $($missing -join ', ')"
+                }
+            }
+        } else {
+            Write-Result 'MCP servers in config' $false 'mcpServers key not found' -Warning
+        }
+    } catch {
+        Write-Result 'MCP servers parse' $false "Parse error: $_" -Warning
+    }
+} else {
+    Write-Result 'claude_desktop_config.json' $false 'Not found in backup' -Warning
+}
+
+# --- 6. Post-restore checklist ---
+Write-Host '[6/6] Checking post-restore checklist...' -ForegroundColor Yellow
+$checklistPattern = 'post-restore-checklist-*.md'
+$checklistFiles = Get-ChildItem -Path $env:LOCALAPPDATA\ClaudePortable -Filter $checklistPattern -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending
+
+if ($checklistFiles.Count -gt 0) {
+    $latestChecklist = $checklistFiles[0]
+    Write-Result 'Post-restore checklist exists' $true $latestChecklist.Name
+
+    $content = Get-Content $latestChecklist.FullName -Raw
+    $requiredSections = @('Required Steps', 'Safety Backups', 'Troubleshooting')
+    foreach ($section in $requiredSections) {
+        if ($content -match [regex]::Escape($section)) {
+            Write-Result "Checklist section: $section" $true
+        } else {
+            Write-Result "Checklist section: $section" $false 'Section not found'
+        }
+    }
+} else {
+    Write-Result 'Post-restore checklist exists' $false 'No checklist file found in %LOCALAPPDATA%\ClaudePortable\' -Warning
+}
+
+# --- Summary ---
+Write-Host ''
+Write-Host '========================================' -ForegroundColor Cyan
+Write-Host "  Results: $passed passed, $failed failed, $warnings warnings" -ForegroundColor $(if ($failed -eq 0) { 'Green' } else { 'Red' })
+Write-Host '========================================' -ForegroundColor Cyan
+Write-Host ''
+
+# Cleanup
+try { Remove-Item $RestoreDir -Recurse -Force -ErrorAction SilentlyContinue } catch { }
+
+exit $(if ($failed -gt 0) { 1 } else { 0 })
diff --git a/src/ClaudePortable.App/ClaudePortable.App.csproj b/src/ClaudePortable.App/ClaudePortable.App.csproj
index 3ca7892..b3c021c 100644
--- a/src/ClaudePortable.App/ClaudePortable.App.csproj
+++ b/src/ClaudePortable.App/ClaudePortable.App.csproj
@@ -7,6 +7,8 @@
   </ItemGroup>
 
   <ItemGroup>
+    <PackageReference Include="Serilog" Version="4.2.0" />
+    <PackageReference Include="Serilog.Sinks.RollingFile" Version="4.1.0" />
     <PackageReference Include="System.CommandLine" Version="2.0.0-beta4.22272.1" />
   </ItemGroup>
 
diff --git a/src/ClaudePortable.App/Program.cs b/src/ClaudePortable.App/Program.cs
index 82f686c..dce04c1 100644
--- a/src/ClaudePortable.App/Program.cs
+++ b/src/ClaudePortable.App/Program.cs
@@ -1,6 +1,7 @@
 using System.CommandLine;
 using System.Runtime.InteropServices;
 using ClaudePortable.App.Commands;
+using Serilog;
 using UiApp = ClaudePortable.App.Ui.App;
 
 namespace ClaudePortable.App;
@@ -12,6 +13,8 @@ public static class Program
     [STAThread]
     public static int Main(string[] args)
     {
+        ConfigureLogging();
+
         if (args.Length == 0 || args.Contains("--gui"))
         {
             return UiApp.RunGui();
@@ -60,4 +63,22 @@ private static void EnsureConsoleForCli()
     [DllImport("kernel32.dll", SetLastError = true)]
     [return: MarshalAs(UnmanagedType.Bool)]
     private static extern bool AttachConsole(int processId);
-}
+
+    private static void ConfigureLogging()
+    {
+        var logDir = Path.Combine(
+            Environment.ExpandEnvironmentVariables("%LOCALAPPDATA%"),
+            "ClaudePortable",
+            "logs");
+        Directory.CreateDirectory(logDir);
+
+        Log.Logger = new LoggerConfiguration()
+            .MinimumLevel.Information()
+            .WriteTo.File(
+                Path.Combine(logDir, "claudeportable-.log"),
+                rollingInterval: RollingInterval.Day,
+                retainedFileCountLimit: 30,
+                outputTemplate: "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level:u3}] {Message:lj}{NewLine}{Exception}")
+            .WriteTo.Console()
+            .CreateLogger();
+    }
diff --git a/src/ClaudePortable.App/Ui/App.cs b/src/ClaudePortable.App/Ui/App.cs
index 8998185..0528ad2 100644
--- a/src/ClaudePortable.App/Ui/App.cs
+++ b/src/ClaudePortable.App/Ui/App.cs
@@ -2,6 +2,7 @@
 using System.Runtime.Versioning;
 using System.Windows;
 using ClaudePortable.App.Ui.Views;
+using Serilog;
 
 namespace ClaudePortable.App.Ui;
 
@@ -15,6 +16,10 @@ public static int RunGui()
             ShutdownMode = ShutdownMode.OnExplicitShutdown,
         };
 
+        // Wire Serilog as a secondary sink for the GUI so log lines
+        // appear both in the file and in the UiLogSink (Logs tab).
+        Log.Logger = Log.Logger.ForSubLogger();
+
         LoadThemeResources(app);
 
         var tray = new TrayIcon();
diff --git a/src/ClaudePortable.App/Ui/Converters/StringToVisibleConverter.cs b/src/ClaudePortable.App/Ui/Converters/StringToVisibleConverter.cs
new file mode 100644
index 0000000..c69b0f8
--- /dev/null
+++ b/src/ClaudePortable.App/Ui/Converters/StringToVisibleConverter.cs
@@ -0,0 +1,15 @@
+using System.Globalization;
+using System.Windows.Data;
+
+namespace ClaudePortable.App.Ui.Converters;
+
+public sealed class StringToVisibleConverter : IValueConverter
+{
+    public object Convert(object? value, Type targetType, object? parameter, CultureInfo culture)
+    {
+        return !string.IsNullOrEmpty(value as string) ? Visibility.Visible : Visibility.Collapsed;
+    }
+
+    public object ConvertBack(object? value, Type targetType, object? parameter, CultureInfo culture)
+        => throw new NotSupportedException();
+}
diff --git a/src/ClaudePortable.App/Ui/Services/UiLogSink.cs b/src/ClaudePortable.App/Ui/Services/UiLogSink.cs
index e3fd670..3339a7c 100644
--- a/src/ClaudePortable.App/Ui/Services/UiLogSink.cs
+++ b/src/ClaudePortable.App/Ui/Services/UiLogSink.cs
@@ -1,5 +1,6 @@
 using System.Collections.ObjectModel;
 using System.Globalization;
+using Serilog;
 
 namespace ClaudePortable.App.Ui.Services;
 
@@ -18,5 +19,7 @@ public void Append(string line)
         {
             Entries.RemoveAt(0);
         }
+
+        Log.Information("{Message}", line);
     }
 }
diff --git a/src/ClaudePortable.App/Ui/ViewModels/MainViewModel.cs b/src/ClaudePortable.App/Ui/ViewModels/MainViewModel.cs
index 6e153e6..3d299e7 100644
--- a/src/ClaudePortable.App/Ui/ViewModels/MainViewModel.cs
+++ b/src/ClaudePortable.App/Ui/ViewModels/MainViewModel.cs
@@ -115,10 +115,19 @@ public bool ProgressIsIndeterminate
     public AsyncRelayCommand RestoreCommand { get; }
     public AsyncRelayCommand RestoreFromFileCommand { get; }
     public RelayCommand PickTargetProfileCommand { get; }
+    public RelayCommand OpenChecklistCommand { get; }
 
     public TargetEntry? SelectedTarget { get; set; }
     public BackupEntry? SelectedBackup { get; set; }
 
+    private string _postRestoreChecklistPath = string.Empty;
+
+    public string PostRestoreChecklistPath
+    {
+        get => _postRestoreChecklistPath;
+        private set => SetField(ref _postRestoreChecklistPath, value);
+    }
+
     public MainViewModel()
     {
         foreach (var path in _store.Load())
@@ -149,6 +158,7 @@ public MainViewModel()
         RestoreCommand = new AsyncRelayCommand(RestoreAsync, () => SelectedBackup is not null);
         RestoreFromFileCommand = new AsyncRelayCommand(RestoreFromFileAsync);
         PickTargetProfileCommand = new RelayCommand(PickTargetProfile);
+        OpenChecklistCommand = new RelayCommand(OpenChecklist, () => !string.IsNullOrEmpty(PostRestoreChecklistPath));
 
         _ = RefreshAsync();
     }
@@ -376,6 +386,8 @@ private async Task RunRestoreAsync(string zipPath, string displayName)
             var totalWarnings = outcome.PerTargetReports.Sum(r => r.Warnings.Count);
             UiLogSink.Instance.Append($"restore complete. safety backups: {outcome.SafetyBackups.Count}, warnings: {totalWarnings}");
             UiLogSink.Instance.Append($"version gate: {outcome.VersionGate.Level} - {outcome.VersionGate.Message}");
+
+            PostRestoreChecklistPath = outcome.PostRestoreChecklistPath;
             Status = totalWarnings == 0
                 ? $"Restore complete. Checklist: {outcome.PostRestoreChecklistPath}"
                 : $"Restore complete with {totalWarnings} warning(s). See Logs tab.";
@@ -467,6 +479,29 @@ private static async Task<bool> EnsureClaudeDesktopClosedAsync()
         return System.Diagnostics.Process.GetProcessesByName("Claude").Length == 0;
     }
 
+    private void OpenChecklist()
+    {
+        if (string.IsNullOrEmpty(PostRestoreChecklistPath) || !File.Exists(PostRestoreChecklistPath))
+        {
+            Status = "No checklist available yet. Run a restore first.";
+            return;
+        }
+
+        try
+        {
+            System.Diagnostics.Process.Start(new System.Diagnostics.ProcessStartInfo
+            {
+                FileName = PostRestoreChecklistPath,
+                UseShellExecute = true,
+            });
+            Status = $"Opened checklist: {PostRestoreChecklistPath}";
+        }
+        catch (Exception ex)
+        {
+            Status = $"Could not open checklist: {ex.Message}";
+        }
+    }
+
     /// <summary>
     /// For every detected sync client (OneDrive, Dropbox, GDrive Desktop, ...)
     /// check whether the user already has a folder called "ClaudePortable"
diff --git a/src/ClaudePortable.App/Ui/Views/MainWindow.xaml b/src/ClaudePortable.App/Ui/Views/MainWindow.xaml
index db6eb36..63060c6 100644
--- a/src/ClaudePortable.App/Ui/Views/MainWindow.xaml
+++ b/src/ClaudePortable.App/Ui/Views/MainWindow.xaml
@@ -14,6 +14,7 @@
         TextOptions.TextRenderingMode="Grayscale">
     <Window.Resources>
         <conv:ManagedByToBrushConverter x:Key="ManagedByToBrush" />
+        <conv:StringToVisibleConverter x:Key="StringToVisible" />
     </Window.Resources>
     <DockPanel Background="#262624">
 
@@ -295,6 +296,10 @@
                                 Margin="0,0,8,0" />
                         <Button Content="Restore from file..."
                                 Command="{Binding RestoreFromFileCommand}" />
+                        <Button Content="Open Checklist"
+                                Command="{Binding OpenChecklistCommand}"
+                                Margin="8,0,0,0"
+                                Visibility="{Binding PostRestoreChecklistPath, Converter={StaticResource StringToVisible}}" />
                     </StackPanel>
 
                     <Expander Grid.Row="5" Margin="0,16,0,0"
diff --git a/src/ClaudePortable.Core/Post/PostRestoreChecklistBuilder.cs b/src/ClaudePortable.Core/Post/PostRestoreChecklistBuilder.cs
index c2e74ba..92db124 100644
--- a/src/ClaudePortable.Core/Post/PostRestoreChecklistBuilder.cs
+++ b/src/ClaudePortable.Core/Post/PostRestoreChecklistBuilder.cs
@@ -1,33 +1,113 @@
+using ClaudePortable.Core.Manifest;
+using ClaudePortable.Core.Restore;
+
 namespace ClaudePortable.Core.Post;
 
 public static class PostRestoreChecklistBuilder
 {
-    public static string Build()
+    public static string Build(
+        BackupManifest manifest,
+        VersionGateResult versionGate,
+        IReadOnlyList<string> safetyBackups,
+        IReadOnlyList<RestoreTargetReport> targetReports)
     {
-        return """
-            # Post-Restore-Checkliste
-
-            Folgende Schritte musst du manuell erledigen, nachdem das Restore abgeschlossen ist:
-
-            ## Pflicht-Schritte
-            - [ ] Claude Desktop starten und einmal einloggen
-            - [ ] Claude Code: `claude login` ausführen
-            - [ ] Jeden Connector einmal neu autorisieren (Gmail, Slack, GDrive etc.)
-            - [ ] `claude plugin sync` ausführen, damit installierte Plugins geladen werden
-
-            ## Gesicherte Ordner (Safety-Backups)
-            Alter Zustand wurde unter `<ordner>_backup_YYYY-MM-DD-HHmmss` gesichert.
-            Nach erfolgreicher Verifikation kannst du diese Backups loeschen.
-
-            ## Troubleshooting
-            - **Chat-Historie leer:** Claude-Desktop-Version pruefen. Bei Mismatch mit Backup-Version ist die Chat-History-Migration nicht garantiert.
-            - **Plugins laden nicht:** `claude plugin install <name>` manuell fuer jedes Plugin aus `.claude/plugins/`.
-            - **Connectoren funktionieren nicht:** Neu autorisieren. Tokens werden bewusst nicht gesichert.
-
-            ## Scope-Hinweis
-            Dieses Tool sichert keine OAuth-Refresh-Tokens, keine API-Keys, keine DPAPI-Blobs.
-            Das ist Absicht: diese Artefakte sind user- und maschinengebunden und auf einem
-            anderen PC ohnehin ungueltig.
-            """;
+        var sb = new System.Text.StringBuilder();
+
+        sb.AppendLine("# Post-Restore Checklist\n");
+        sb.AppendLine($"Backup from: **{manifest.Hostname}** ({manifest.WindowsUser}) — {manifest.CreatedAt:yyyy-MM-dd HH:mm} UTC\n");
+        sb.AppendLine($"Claude Desktop version in backup: `{manifest.ClaudeDesktopVersion ?? "unknown"}`\n");
+
+        // Version gate warning
+        if (versionGate.Level == VersionGateLevel.Warn)
+        {
+            sb.AppendLine("## ⚠ Version Mismatch Detected\n");
+            sb.AppendLine($"> **{versionGate.Message}**\n");
+            sb.AppendLine("- [ ] Be aware that chat history migration may not be guaranteed due to LevelDB schema differences\n");
+        }
+        else if (versionGate.Level == VersionGateLevel.Block)
+        {
+            sb.AppendLine("## 🚫 Major Version Mismatch\n");
+            sb.AppendLine($"> **{versionGate.Message}**\n");
+            sb.AppendLine("- [ ] Chat history may be corrupted or unreadable — verify carefully\n");
+        }
+
+        // Required steps
+        sb.AppendLine("## Required Steps\n");
+        sb.AppendLine("- [ ] Start Claude Desktop and sign in once\n");
+        sb.AppendLine("- [ ] Claude Code: run `claude login`\n");
+        sb.AppendLine("- [ ] Re-authorize each connector (Gmail, Slack, GDrive, etc.)\n");
+        sb.AppendLine("- [ ] Run `claude plugin sync` to reload installed plugins\n");
+
+        // Plugin reinstall hint
+        var pluginDir = Path.Combine(
+            Environment.ExpandEnvironmentVariables("%USERPROFILE%"),
+            ".claude", "plugins");
+        if (Directory.Exists(pluginDir))
+        {
+            var plugins = Directory.GetDirectories(pluginDir).Select(Path.GetFileName).Where(n => !string.IsNullOrEmpty(n)).ToList();
+            if (plugins.Count > 0)
+            {
+                sb.AppendLine("\n## Plugin Reinstallation\n");
+                sb.AppendLine($"Found {plugins.Count} plugin(s) in `.claude/plugins/`. Run `claude plugin install <name>` for each:\n");
+                foreach (var p in plugins.Take(20))
+                {
+                    sb.AppendLine($"- [ ] `{p}`");
+                }
+                if (plugins.Count > 20)
+                {
+                    sb.AppendLine($"- ... and {plugins.Count - 20} more\n");
+                }
+            }
+        }
+
+        // Safety backups
+        sb.AppendLine("\n## Safety Backups\n");
+        if (safetyBackups.Count > 0)
+        {
+            sb.AppendLine("The following folders were backed up before restore:\n");
+            foreach (var backup in safetyBackups)
+            {
+                sb.AppendLine($"- `{backup}`\n");
+            }
+            sb.AppendLine("You can delete these after verifying the restore succeeded.\n");
+        }
+        else
+        {
+            sb.AppendLine("No existing folders were found — nothing was backed up before overlay.\n");
+        }
+
+        // Target reports
+        if (targetReports.Count > 0)
+        {
+            sb.AppendLine("## Restore Summary\n");
+            foreach (var report in targetReports)
+            {
+                var status = report.FilesWritten == 0 && report.Warnings.Count == 1 && report.Warnings[0].StartsWith("Not present", StringComparison.Ordinal)
+                    ? "SKIPPED (not in backup)"
+                    : report.SafetyBackedUp
+                        ? $"RESTORED ({report.FilesWritten} files, safety backup created)"
+                        : $"OVERLAY ({report.FilesWritten} files written)";
+                sb.AppendLine($"### `{report.ArchivePrefix}`\n");
+                sb.AppendLine($"Target: `{report.TargetFolder}`\n");
+                sb.AppendLine($"Status: {status}\n");
+                foreach (var warning in report.Warnings)
+                {
+                    sb.AppendLine($"> ⚠ {warning}\n");
+                }
+            }
+        }
+
+        // Troubleshooting
+        sb.AppendLine("## Troubleshooting\n");
+        sb.AppendLine("- **Chat history empty:** Check Claude Desktop version. Mismatch with backup version means chat history migration is not guaranteed.\n");
+        sb.AppendLine("- **Plugins not loading:** Run `claude plugin install <name>` manually for each plugin from `.claude/plugins/`.\n");
+        sb.AppendLine("- **Connectors not working:** Re-authorize. Tokens are intentionally not backed up.\n");
+
+        // Scope note
+        sb.AppendLine("\n## Scope Note\n");
+        sb.AppendLine("This tool does NOT back up OAuth refresh tokens, API keys, or DPAPI-protected credentials.\n");
+        sb.AppendLine("This is intentional: these artifacts are user- and machine-bound and would be invalid on another PC anyway.\n");
+
+        return sb.ToString();
     }
 }
diff --git a/src/ClaudePortable.Core/Restore/RestoreEngine.cs b/src/ClaudePortable.Core/Restore/RestoreEngine.cs
index b54aeba..d981781 100644
--- a/src/ClaudePortable.Core/Restore/RestoreEngine.cs
+++ b/src/ClaudePortable.Core/Restore/RestoreEngine.cs
@@ -4,6 +4,7 @@
 using ClaudePortable.Core.Abstractions;
 using ClaudePortable.Core.Discovery;
 using ClaudePortable.Core.Manifest;
+using ClaudePortable.Core.Post;
 
 namespace ClaudePortable.Core.Restore;
 
@@ -139,16 +140,15 @@ public async Task<RestoreOutcome> RestoreAsync(
                     warnings));
             }
 
-            var checklistSource = Path.Combine(tempRoot, "post-restore-checklist.md");
             var checklistDest = Path.Combine(
                 Environment.ExpandEnvironmentVariables("%LOCALAPPDATA%"),
                 "ClaudePortable",
                 $"post-restore-checklist-{now.UtcDateTime:yyyy-MM-dd-HHmmss}.md");
             Directory.CreateDirectory(Path.GetDirectoryName(checklistDest)!);
-            if (File.Exists(checklistSource))
-            {
-                File.Copy(checklistSource, checklistDest, overwrite: true);
-            }
+
+            var checklistContent = PostRestoreChecklistBuilder.Build(
+                manifest, gate, safetyBackups, perTargetReports);
+            await File.WriteAllTextAsync(checklistDest, checklistContent, cancellationToken).ConfigureAwait(false);
 
             return new RestoreOutcome(manifest, safetyBackups, checklistDest, gate, perTargetReports);
         }

From 7f42753db6a9c1b4bece146ebccbaae77071488b Mon Sep 17 00:00:00 2001
From: Sascha <sascha.haase@textiletsg.com>
Date: Sat, 30 May 2026 00:39:56 +0200
Subject: [PATCH 2/2] fix: make PR #9 build and correct the e2e verification
 script

The logging/checklist/e2e changes did not compile in either project and the
e2e script produced false results. Fixes:

Core (ClaudePortable.Core):
- PostRestoreChecklistBuilder: import ClaudePortable.Core.Abstractions
  (RestoreTargetReport lives there) and pass CultureInfo.InvariantCulture to
  every interpolated AppendLine (CA1305 under AnalysisMode=Recommended).
- Re-add parameterless Build() overload so BackupEngine.BuildChecklistEntry
  still compiles and the backup zip keeps its embedded checklist.

App (ClaudePortable.App):
- csproj: drop non-existent Serilog.Sinks.RollingFile 4.1.0; add
  Serilog.Sinks.File 7.0.0 and Serilog.Sinks.Console 6.1.1 (the packages
  WriteTo.File/WriteTo.Console actually require).
- Program.cs: add missing Program class closing brace; pass
  formatProvider: CultureInfo.InvariantCulture to the File/Console sinks.
- App.cs: remove the non-existent Log.Logger.ForSubLogger() call.
- StringToVisibleConverter: add using System.Windows; for Visibility.

scripts/e2e-verify.ps1:
- manifest.sha256 is a content hash, not the zip-file hash; assert it is a
  64-char hex digest instead of comparing to Get-FileHash of the zip.
- credential exclusion checks matched nothing (-Filter ignores **/), so they
  always passed; match by file name, and assert the specific
  claude-desktop/appdata/config.json path.
- count dictionary keys via PSObject.Properties (intrinsic .Count is 1).
- guard $ExpectedMcpServers under StrictMode.

Build: dotnet build -c Release -> 0 warnings, 0 errors.
Tests: dotnet test -c Release -> 98 passed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 scripts/e2e-verify.ps1                        | 63 ++++++++++++-------
 .../ClaudePortable.App.csproj                 |  3 +-
 src/ClaudePortable.App/Program.cs             |  7 ++-
 src/ClaudePortable.App/Ui/App.cs              |  5 --
 .../Ui/Converters/StringToVisibleConverter.cs |  1 +
 .../Post/PostRestoreChecklistBuilder.cs       | 58 +++++++++++++----
 6 files changed, 94 insertions(+), 43 deletions(-)

diff --git a/scripts/e2e-verify.ps1 b/scripts/e2e-verify.ps1
index 637756e..36c7cea 100644
--- a/scripts/e2e-verify.ps1
+++ b/scripts/e2e-verify.ps1
@@ -127,25 +127,29 @@ if (-not (Test-PathExists $manifestPath 'manifest.json')) {
             }
         }
 
-        # SHA-256 consistency check
-        if ($manifest.sha256 -and $manifest.sha256.ToLower() -eq $zipSha) {
-            Write-Result 'SHA-256 integrity' $true 'ZIP hash matches manifest'
-        } elseif ($manifest.sha256) {
-            Write-Result 'SHA-256 integrity' $false "Expected $($manifest.sha256), got $zipSha"
+        # Manifest sha256 is a CONTENT hash (sorted relativePath + file bytes;
+        # see ZipArchiveWriter.ComputeContentHashAsync), NOT the hash of the
+        # .zip container - a zip cannot embed its own file hash. So assert the
+        # field is a well-formed digest, not that it equals the zip-file hash.
+        if ($manifest.sha256 -and $manifest.sha256 -match '^[0-9a-fA-F]{64}$') {
+            Write-Result 'Manifest content hash present' $true "sha256=$($manifest.sha256)"
         } else {
-            Write-Result 'SHA-256 integrity' $false 'Manifest has no sha256 field' -Warning
+            Write-Result 'Manifest content hash present' $false 'sha256 missing or not a 64-char hex digest'
         }
 
-        # Source paths sanity
-        if ($manifest.sourcePaths.Count -gt 0) {
-            Write-Result 'Source paths populated' $true "$($manifest.sourcePaths.Count) entries"
+        # sourcePaths / archiveTargets serialize as JSON objects (C# Dictionary),
+        # so count their properties - the intrinsic .Count is always 1 on a
+        # PSCustomObject regardless of key count.
+        $sourceCount = @($manifest.sourcePaths.PSObject.Properties).Count
+        if ($sourceCount -gt 0) {
+            Write-Result 'Source paths populated' $true "$sourceCount entries"
         } else {
             Write-Result 'Source paths populated' $false 'No source paths in manifest'
         }
 
-        # Archive targets sanity
-        if ($manifest.archiveTargets.Count -gt 0) {
-            Write-Result 'Archive targets populated' $true "$($manifest.archiveTargets.Count) entries"
+        $targetCount = @($manifest.archiveTargets.PSObject.Properties).Count
+        if ($targetCount -gt 0) {
+            Write-Result 'Archive targets populated' $true "$targetCount entries"
         } else {
             Write-Result 'Archive targets populated' $false 'No archive targets in manifest'
         }
@@ -173,23 +177,36 @@ foreach ($item in $expectedDirs) {
 }
 
 # --- 4. Check credential exclusions ---
+# DefaultExclusions.Globs removes these. Match by file NAME across the tree:
+# Get-ChildItem -Filter does not understand '**/' or path separators, so the
+# original globbed patterns silently matched nothing and always reported PASS.
 Write-Host '[4/6] Checking credential exclusions...' -ForegroundColor Yellow
-$excludedPatterns = @(
-    @{ Pattern = '**/tokens.dat'; Label = 'OAuth tokens (tokens.dat)' },
-    @{ Pattern = '**/Login Data*'; Label = 'Browser login data' },
-    @{ Pattern = '**/Cookies*'; Label = 'Browser cookies' },
-    @{ Pattern = '**/config.json'; Label = 'Claude config with tokenCache' }
-)
+$allFiles = Get-ChildItem -Path $RestoreDir -Recurse -File -ErrorAction SilentlyContinue
 
-foreach ($item in $excludedPatterns) {
-    $matches = Get-ChildItem -Path $RestoreDir -Recurse -File -Filter $item.Pattern -ErrorAction SilentlyContinue
-    if ($matches.Count -eq 0) {
+$nameExclusions = @(
+    @{ Match = { $_.Name -eq 'tokens.dat' };    Label = 'OAuth tokens (tokens.dat)' },
+    @{ Match = { $_.Name -like 'Login Data*' }; Label = 'Browser login data' },
+    @{ Match = { $_.Name -like 'Cookies*' };    Label = 'Browser cookies' }
+)
+foreach ($item in $nameExclusions) {
+    $hits = @($allFiles | Where-Object $item.Match)
+    if ($hits.Count -eq 0) {
         Write-Result "Exclusion: $($item.Label)" $true 'Not found (correctly excluded)'
     } else {
-        Write-Result "Exclusion: $($item.Label)" $false "Found $($matches.Count) file(s): $($matches.FullName -join ', ')"
+        Write-Result "Exclusion: $($item.Label)" $false "Found $($hits.Count) file(s): $($hits.FullName -join ', ')"
     }
 }
 
+# config.json is excluded ONLY at the specific path claude-desktop/appdata/config.json
+# (DefaultExclusions.Globs). Other config.json files are legitimately backed up,
+# so assert that exact path is absent rather than every config.json.
+$claudeConfig = Join-Path $RestoreDir 'claude-desktop/appdata/config.json'
+if (-not (Test-Path $claudeConfig -PathType Leaf)) {
+    Write-Result 'Exclusion: Claude config (claude-desktop/appdata/config.json)' $true 'Not found (correctly excluded)'
+} else {
+    Write-Result 'Exclusion: Claude config (claude-desktop/appdata/config.json)' $false "Present: $claudeConfig"
+}
+
 # --- 5. MCP server verification ---
 Write-Host '[5/6] Checking MCP servers...' -ForegroundColor Yellow
 $configPath = Join-Path $RestoreDir 'claude-desktop/appdata/claude_desktop_config.json'
@@ -200,7 +217,7 @@ if (Test-PathExists $configPath 'claude_desktop_config.json') {
             $mcpKeys = @($config.mcpServers.PSObject.Properties.Name)
             Write-Result 'MCP servers in config' $true "$($mcpKeys.Count) server(s): $($mcpKeys -join ', ')"
 
-            if ($ExpectedMcpServers.Count -gt 0) {
+            if ($ExpectedMcpServers -and $ExpectedMcpServers.Count -gt 0) {
                 $missing = $ExpectedMcpServers | Where-Object { $_ -notin $mcpKeys }
                 if ($missing.Count -eq 0) {
                     Write-Result 'MCP servers match expected' $true 'All expected servers present'
diff --git a/src/ClaudePortable.App/ClaudePortable.App.csproj b/src/ClaudePortable.App/ClaudePortable.App.csproj
index b3c021c..8e2f7c8 100644
--- a/src/ClaudePortable.App/ClaudePortable.App.csproj
+++ b/src/ClaudePortable.App/ClaudePortable.App.csproj
@@ -8,7 +8,8 @@
 
   <ItemGroup>
     <PackageReference Include="Serilog" Version="4.2.0" />
-    <PackageReference Include="Serilog.Sinks.RollingFile" Version="4.1.0" />
+    <PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
+    <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
     <PackageReference Include="System.CommandLine" Version="2.0.0-beta4.22272.1" />
   </ItemGroup>
 
diff --git a/src/ClaudePortable.App/Program.cs b/src/ClaudePortable.App/Program.cs
index dce04c1..9a14385 100644
--- a/src/ClaudePortable.App/Program.cs
+++ b/src/ClaudePortable.App/Program.cs
@@ -1,4 +1,5 @@
 using System.CommandLine;
+using System.Globalization;
 using System.Runtime.InteropServices;
 using ClaudePortable.App.Commands;
 using Serilog;
@@ -78,7 +79,9 @@ private static void ConfigureLogging()
                 Path.Combine(logDir, "claudeportable-.log"),
                 rollingInterval: RollingInterval.Day,
                 retainedFileCountLimit: 30,
-                outputTemplate: "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level:u3}] {Message:lj}{NewLine}{Exception}")
-            .WriteTo.Console()
+                outputTemplate: "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level:u3}] {Message:lj}{NewLine}{Exception}",
+                formatProvider: CultureInfo.InvariantCulture)
+            .WriteTo.Console(formatProvider: CultureInfo.InvariantCulture)
             .CreateLogger();
     }
+}
diff --git a/src/ClaudePortable.App/Ui/App.cs b/src/ClaudePortable.App/Ui/App.cs
index 0528ad2..8998185 100644
--- a/src/ClaudePortable.App/Ui/App.cs
+++ b/src/ClaudePortable.App/Ui/App.cs
@@ -2,7 +2,6 @@
 using System.Runtime.Versioning;
 using System.Windows;
 using ClaudePortable.App.Ui.Views;
-using Serilog;
 
 namespace ClaudePortable.App.Ui;
 
@@ -16,10 +15,6 @@ public static int RunGui()
             ShutdownMode = ShutdownMode.OnExplicitShutdown,
         };
 
-        // Wire Serilog as a secondary sink for the GUI so log lines
-        // appear both in the file and in the UiLogSink (Logs tab).
-        Log.Logger = Log.Logger.ForSubLogger();
-
         LoadThemeResources(app);
 
         var tray = new TrayIcon();
diff --git a/src/ClaudePortable.App/Ui/Converters/StringToVisibleConverter.cs b/src/ClaudePortable.App/Ui/Converters/StringToVisibleConverter.cs
index c69b0f8..0329d68 100644
--- a/src/ClaudePortable.App/Ui/Converters/StringToVisibleConverter.cs
+++ b/src/ClaudePortable.App/Ui/Converters/StringToVisibleConverter.cs
@@ -1,4 +1,5 @@
 using System.Globalization;
+using System.Windows;
 using System.Windows.Data;
 
 namespace ClaudePortable.App.Ui.Converters;
diff --git a/src/ClaudePortable.Core/Post/PostRestoreChecklistBuilder.cs b/src/ClaudePortable.Core/Post/PostRestoreChecklistBuilder.cs
index 92db124..5a2c1e4 100644
--- a/src/ClaudePortable.Core/Post/PostRestoreChecklistBuilder.cs
+++ b/src/ClaudePortable.Core/Post/PostRestoreChecklistBuilder.cs
@@ -1,3 +1,5 @@
+using System.Globalization;
+using ClaudePortable.Core.Abstractions;
 using ClaudePortable.Core.Manifest;
 using ClaudePortable.Core.Restore;
 
@@ -14,20 +16,20 @@ public static string Build(
         var sb = new System.Text.StringBuilder();
 
         sb.AppendLine("# Post-Restore Checklist\n");
-        sb.AppendLine($"Backup from: **{manifest.Hostname}** ({manifest.WindowsUser}) — {manifest.CreatedAt:yyyy-MM-dd HH:mm} UTC\n");
-        sb.AppendLine($"Claude Desktop version in backup: `{manifest.ClaudeDesktopVersion ?? "unknown"}`\n");
+        sb.AppendLine(CultureInfo.InvariantCulture, $"Backup from: **{manifest.Hostname}** ({manifest.WindowsUser}) — {manifest.CreatedAt:yyyy-MM-dd HH:mm} UTC\n");
+        sb.AppendLine(CultureInfo.InvariantCulture, $"Claude Desktop version in backup: `{manifest.ClaudeDesktopVersion ?? "unknown"}`\n");
 
         // Version gate warning
         if (versionGate.Level == VersionGateLevel.Warn)
         {
             sb.AppendLine("## ⚠ Version Mismatch Detected\n");
-            sb.AppendLine($"> **{versionGate.Message}**\n");
+            sb.AppendLine(CultureInfo.InvariantCulture, $"> **{versionGate.Message}**\n");
             sb.AppendLine("- [ ] Be aware that chat history migration may not be guaranteed due to LevelDB schema differences\n");
         }
         else if (versionGate.Level == VersionGateLevel.Block)
         {
             sb.AppendLine("## 🚫 Major Version Mismatch\n");
-            sb.AppendLine($"> **{versionGate.Message}**\n");
+            sb.AppendLine(CultureInfo.InvariantCulture, $"> **{versionGate.Message}**\n");
             sb.AppendLine("- [ ] Chat history may be corrupted or unreadable — verify carefully\n");
         }
 
@@ -48,14 +50,14 @@ public static string Build(
             if (plugins.Count > 0)
             {
                 sb.AppendLine("\n## Plugin Reinstallation\n");
-                sb.AppendLine($"Found {plugins.Count} plugin(s) in `.claude/plugins/`. Run `claude plugin install <name>` for each:\n");
+                sb.AppendLine(CultureInfo.InvariantCulture, $"Found {plugins.Count} plugin(s) in `.claude/plugins/`. Run `claude plugin install <name>` for each:\n");
                 foreach (var p in plugins.Take(20))
                 {
-                    sb.AppendLine($"- [ ] `{p}`");
+                    sb.AppendLine(CultureInfo.InvariantCulture, $"- [ ] `{p}`");
                 }
                 if (plugins.Count > 20)
                 {
-                    sb.AppendLine($"- ... and {plugins.Count - 20} more\n");
+                    sb.AppendLine(CultureInfo.InvariantCulture, $"- ... and {plugins.Count - 20} more\n");
                 }
             }
         }
@@ -67,7 +69,7 @@ public static string Build(
             sb.AppendLine("The following folders were backed up before restore:\n");
             foreach (var backup in safetyBackups)
             {
-                sb.AppendLine($"- `{backup}`\n");
+                sb.AppendLine(CultureInfo.InvariantCulture, $"- `{backup}`\n");
             }
             sb.AppendLine("You can delete these after verifying the restore succeeded.\n");
         }
@@ -87,12 +89,12 @@ public static string Build(
                     : report.SafetyBackedUp
                         ? $"RESTORED ({report.FilesWritten} files, safety backup created)"
                         : $"OVERLAY ({report.FilesWritten} files written)";
-                sb.AppendLine($"### `{report.ArchivePrefix}`\n");
-                sb.AppendLine($"Target: `{report.TargetFolder}`\n");
-                sb.AppendLine($"Status: {status}\n");
+                sb.AppendLine(CultureInfo.InvariantCulture, $"### `{report.ArchivePrefix}`\n");
+                sb.AppendLine(CultureInfo.InvariantCulture, $"Target: `{report.TargetFolder}`\n");
+                sb.AppendLine(CultureInfo.InvariantCulture, $"Status: {status}\n");
                 foreach (var warning in report.Warnings)
                 {
-                    sb.AppendLine($"> ⚠ {warning}\n");
+                    sb.AppendLine(CultureInfo.InvariantCulture, $"> ⚠ {warning}\n");
                 }
             }
         }
@@ -110,4 +112,36 @@ public static string Build(
 
         return sb.ToString();
     }
+
+    // Generic static checklist embedded in the backup zip at backup time
+    // (see BackupEngine.BuildChecklistEntry). Restore regenerates a richer,
+    // manifest-aware checklist via the overload above and ignores this copy;
+    // it is kept so the archive stays self-describing on its own.
+    public static string Build()
+    {
+        return """
+            # Post-Restore Checklist
+
+            Steps to complete manually after a restore finishes.
+
+            ## Required Steps
+            - [ ] Start Claude Desktop and sign in once
+            - [ ] Claude Code: run `claude login`
+            - [ ] Re-authorize each connector (Gmail, Slack, GDrive, etc.)
+            - [ ] Run `claude plugin sync` to reload installed plugins
+
+            ## Safety Backups
+            Existing folders are moved aside to `<folder>_backup_<timestamp>` before overlay.
+            Delete them once you have verified the restore succeeded.
+
+            ## Troubleshooting
+            - **Chat history empty:** Check the Claude Desktop version. A mismatch with the backup version means chat-history migration is not guaranteed.
+            - **Plugins not loading:** Run `claude plugin install <name>` for each plugin in `.claude/plugins/`.
+            - **Connectors not working:** Re-authorize them. Tokens are intentionally not backed up.
+
+            ## Scope Note
+            This tool does NOT back up OAuth refresh tokens, API keys, or DPAPI-protected credentials.
+            They are user- and machine-bound and would be invalid on another PC anyway.
+            """;
+    }
 }