on 15th Dec, gnucash mysteriously rolled back to 08th Dec's backup

[Zhang Weiwu]

Short story:

    what can be the reason that on 15th morning gnucash loaded the
    historical version of 08th instead of the last version (on 09th)?


Long story:

    Today my user complain to me that she believes GnuCash lost a few
    invoices she created. She could proof she sent invoice #59 to
    customer on 9th, and in today's version of gnucash the #59 invoice
    is missing. Further investigation shows some other invoices are
    lost. A look at historical file made it clear:

    yuliansu at Andalusia:~/Financial/gnucash$ ls -l rss.gnucash.201012*.xac
    -rw-r--r-- 1 yuliansu users 84741 2010-11-29 15:21
    rss.gnucash.20101208150756.xac
    -rw-r--r-- 1 yuliansu users 85335 2010-12-08 15:07
    rss.gnucash.20101208151351.xac
    -rw-r--r-- 1 yuliansu users 85799 2010-12-08 15:13
    rss.gnucash.20101208152144.xac
    -rw-r--r-- 1 yuliansu users 85797 2010-12-08 15:21
    rss.gnucash.20101208154717.xac
    -rw-r--r-- 1 yuliansu users 86048 2010-12-08 15:47
    rss.gnucash.20101208155328.xac
    -rw-r--r-- 1 yuliansu users 86349 2010-12-08 15:53
    rss.gnucash.20101209085802.xac
    -rw-r--r-- 1 yuliansu users 86348 2010-12-09 08:58
    rss.gnucash.20101209090328.xac
    -rw-r--r-- 1 yuliansu users 86349 2010-12-09 09:03
    rss.gnucash.20101209092553.xac
    -rw-r--r-- 1 yuliansu users 86636 2010-12-09 09:25
    rss.gnucash.20101209093103.xac
    -rw-r--r-- 1 yuliansu users 86586 2010-12-09 09:31
    rss.gnucash.20101209094231.xac
    -rw-r--r-- 1 yuliansu users 86590 2010-12-09 09:42
    rss.gnucash.20101209102015.xac
    -rw-r--r-- 1 yuliansu users 86590 2010-12-09 10:20
    rss.gnucash.20101209180143.xac
    -rw-r--r-- 1 yuliansu users 86586 2010-12-09 18:01
    rss.gnucash.20101209182652.xac
    -rw-r--r-- 1 yuliansu users 86590 2010-12-09 18:26
    rss.gnucash.20101209183250.xac
    -rw-r--r-- 1 yuliansu users 86919 2010-12-09 18:32
    rss.gnucash.20101210103702.xac
    -rw-r--r-- 1 yuliansu users 87268 2010-12-10 10:37
    rss.gnucash.20101210164240.xac
    -rw-r--r-- 1 yuliansu users 84741 2010-11-29 15:21
    rss.gnucash.20101215100749.xac
    -rw-r--r-- 1 yuliansu users 85128 2010-12-15 10:07
    rss.gnucash.20101215101958.xac
    -rw-r--r-- 1 yuliansu users 85129 2010-12-15 10:19
    rss.gnucash.20101215104658.xac
    -rw-r--r-- 1 yuliansu users 85128 2010-12-15 10:46
    rss.gnucash.20101215143206.xac
    -rw-r--r-- 1 yuliansu users 85124 2010-12-15 14:32
    rss.gnucash.20101215143859.xac
    -rw-r--r-- 1 yuliansu users 85612 2010-12-15 14:38
    rss.gnucash.20101215144411.xac
    -rw-r--r-- 1 yuliansu users 85835 2010-12-15 14:44
    rss.gnucash.20101215145138.xac
    -rw-r--r-- 1 yuliansu users 86625 2010-12-15 14:51
    rss.gnucash.20101215145748.xac
    -rw-r--r-- 1 yuliansu users 86947 2010-12-15 14:57
    rss.gnucash.20101215150317.xac
    -rw-r--r-- 1 yuliansu users 87320 2010-12-15 15:03
    rss.gnucash.20101215152911.xac
    -rw-r--r-- 1 yuliansu users 87320 2010-12-15 15:29
    rss.gnucash.20101217121046.xac
    -rw-r--r-- 1 yuliansu users 87795 2010-12-17 12:10
    rss.gnucash.20101217163021.xac
    -rw-r--r-- 1 yuliansu users 87874 2010-12-17 16:30
    rss.gnucash.20101217163611.xac
    -rw-r--r-- 1 yuliansu users 88352 2010-12-17 16:36
    rss.gnucash.20101217164157.xac

    The result shows, that .xac file size keep increasing until
    20101215100749 when it suddenly drop from 87268 bytes to 84741
    bytes, and keep growing since then.

    Look closer it shows 84741 is also the size of 20101208150756.xac.
    Run a diff(1) between them, turns out the two files are identical.

    So, what happened is, on 15th morning, gnucash managed to load
    20101208150756.xac and used that as the main .gnucash file. Or, the
    user did it.

    It's hard to believe my user did it herself, as she don't remember
    doing so and she didn't know how to rename extension name part of a
    filename, she wouldn't have made a cope of the .xac and rename it to
    the main .gnucash file. It becomes a mystery.   

    Besides my user, no one else touched the computer. The only "person"
    other than my user that might touched the computer might be a small
    backup script. I checked the backup script and found following its
    program logic, it should not be able to do any write operation to
    anything in user's home directory except in some exceptional cases
    might write to the hidden files in the home directory, a.k.a.
    ~/.[^.]* which should include .gnucash. In short the backup script
    is not capable of writing to ~/Financial/gnucash where main data is
    stored in, but with a small chance may write to .gnucash.

    So my question at this point is, can a change in .gnucash result
    gnucash loading a historical version of .xac file and use it as main
    .gnucash data file (and write to the main .gnucash data file)?

    thanks for helping solve the mystery in advance.