GL-5: explicit rootfs override for DR restore (live-discovered PVE constraint)

The live validation hit PVE's all-or-nothing restore rule: mpN params
without an explicit rootfs -> HTTP 500 "mount points configured, but
'rootfs' not set" (the same constraint restoretest.go:211 documents for the
live-config path; the spike never ran an override restore). The lost guest
has no live config, so the rootfs SIZE now comes from the archive's own
embedded config via NEW Client.ExtractArchiveConfig (GET vzdump/
extractconfig - verified live: answers 200 under the scoped agent token;
PBS keys stay server-side, the spike's candidate-1 rejection holds; used
for the SIZE ONLY - the bind layout stays the platform constants).
Unparseable/unreadable archive config -> clean refusal before any restore.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/reconcile/bringup_test.go

@@ -792,13 +792,19 @@ func TestRunBringUp_DRStructuralBindOverridesAndSwap(t *testing.T) {
 		t.Fatalf("expected one restore, got %+v", api.restores)
 	}
 	ov := api.restores[0].MountOverrides
+	// rootfs rides along explicitly (PVE refuses mpN params without it — hit live in the GL-5
+	// validation), sized from the ARCHIVE's embedded config (the fake serves size=8G).
 	want := map[string]string{
-		"mp8": "local-lvm:1,mp=/mnt/felhom-drives,backup=0",
-		"mp9": "local-lvm:1,mp=/etc/felhom-bootstrap,backup=0",
+		"rootfs": "local-lvm:8",
+		"mp8":    "local-lvm:1,mp=/mnt/felhom-drives,backup=0",
+		"mp9":    "local-lvm:1,mp=/etc/felhom-bootstrap,backup=0",
 	}
-	if len(ov) != 2 || ov["mp8"] != want["mp8"] || ov["mp9"] != want["mp9"] {
+	if len(ov) != 3 || ov["rootfs"] != want["rootfs"] || ov["mp8"] != want["mp8"] || ov["mp9"] != want["mp9"] {
 		t.Fatalf("MountOverrides = %+v, want exactly %+v", ov, want)
 	}
+	if len(api.extracts) != 1 || api.extracts[0] != "local:backup/customer.tar.zst" {
+		t.Fatalf("the rootfs size must come from the archive's extracted config: %+v", api.extracts)
+	}
 	// 4d: mp9 host dir created under the engine state dir …
 	bootDir := structuralBootHostDir(sd, vmid)
 	if st, err := os.Stat(bootDir); err != nil || !st.IsDir() {
@@ -901,8 +907,8 @@ func TestRunBringUp_DRArchiveWithoutMp9(t *testing.T) {
 		t.Fatalf("dr bring-up of an mp9-less archive must pass, got %+v", res)
 	}
 	ov := api.restores[0].MountOverrides
-	if len(ov) != 2 || ov["mp8"] == "" || ov["mp9"] == "" {
-		t.Fatalf("overrides are constants — both mpN must be named regardless of the archive: %+v", ov)
+	if len(ov) != 3 || ov["mp8"] == "" || ov["mp9"] == "" || ov["rootfs"] == "" {
+		t.Fatalf("overrides are constants (+explicit rootfs) — both mpN must be named regardless of the archive: %+v", ov)
 	}
 	if len(fr.cmds) != 3 {
 		t.Fatalf("4d must run identically (mkdir + 2 pct sets), got %v", fr.cmds)
@@ -971,3 +977,43 @@ func TestRunBringUp_DRUnusedDeleteFailureWarns(t *testing.T) {
 		t.Fatalf("residue must surface as a warning: %+v", res.StartWarnings)
 	}
 }
+
+// GL-5: the archive-config rootfs parse — current-config line wins, snapshot sections never shadow
+// it, absent/unparseable → 0 (which makes the DR bring-up refuse rather than guess a size).
+func TestArchiveRootfsSizeGB(t *testing.T) {
+	full := "hostname: demo\nrootfs: local-lvm:vm-9201-disk-0,size=32G\nmp0: local-lvm:vm-9201-disk-1,mp=/var/lib/docker,size=200G\n"
+	if got := archiveRootfsSizeGB(full); got != 32 {
+		t.Errorf("full config: got %d, want 32", got)
+	}
+	snap := "hostname: demo\n\n[before-upgrade]\nrootfs: local-lvm:vm-9201-disk-9,size=99G\n"
+	if got := archiveRootfsSizeGB(snap); got != 0 {
+		t.Errorf("a snapshot section's rootfs must NOT shadow an absent current one: got %d, want 0", got)
+	}
+	if got := archiveRootfsSizeGB("hostname: demo\n"); got != 0 {
+		t.Errorf("no rootfs line: got %d, want 0", got)
+	}
+}
+
+// GL-5: an unreadable archive config fails the DR bring-up BEFORE any restore (no rootfs size =
+// the restore would fail anyway; refuse cleanly, nothing to roll back).
+func TestRunBringUp_DRExtractConfigFailureRefuses(t *testing.T) {
+	const vmid = 8206
+	api := &fakeAPI{cfg: map[int]proxmox.GuestConfig{vmid: scratchCfg()}}
+	api.extractErr = errors.New("proxmox: GET extractconfig -> HTTP 500: volume not found")
+	e, _, _, q := newDREngine(t, api)
+	defer q.Close()
+
+	res := e.RunBringUp(context.Background(), BringUpSpec{
+		Mode: ModeDRGuestLoss, Archive: "local:backup/gone.tar.zst", VMID: vmid,
+		RestoreStorage: "local-lvm",
+	})
+	if res.Err == nil || !strings.Contains(res.Err.Error(), "extract archive config") {
+		t.Fatalf("extract failure must refuse naming the step, got %+v", res)
+	}
+	if len(api.restores) != 0 {
+		t.Fatalf("the refusal must fire BEFORE any restore, got %+v", api.restores)
+	}
+	if len(api.destroys) != 0 {
+		t.Fatalf("nothing was created — nothing to roll back, got %+v", api.destroys)
+	}
+}