The orphan thin check runs only after a failed snapshot backup (R-1012 follow-up, unreleased)

v0.159.0/v0.159.1 ran the check before every snapshot-mode whole-guest backup, which takes a
metadata snapshot of the live pool. Now explainFailure (vzdump start or task failure) is its only
caller; the finding is still appended to the failed backup's error. Tests: failure = 1 call,
success = 0 calls; red-proved against the v0.159.1 runner.go (2 calls / calls=1).

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/backup/runner.go

@@ -62,8 +62,9 @@ type BackupRunner struct {
 	// this target, so a leftover from a power cut cannot hold the space this backup needs. nil = nothing.
 	beforeBackup func(ctx context.Context, storage string, vmid int)
 	// thinCheck (R-1012) names an orphan thin device in the guest's pools in plain words ("" = none / not checked). It
-	// runs before a snapshot-mode backup (a WARN in the log) and again when the vzdump fails, so the failure the
-	// controller mails to the operator says why. It never removes anything. nil = not wired.
+	// runs ONLY when a snapshot-mode vzdump has failed (start or task), so the failure the controller mails to the
+	// operator says why; a successful backup never runs it (it takes a metadata snapshot of the live pool). It never
+	// removes anything. nil = not wired.
 	thinCheck func(ctx context.Context, vmid int) string
 	logger    *slog.Logger
 	now       func() time.Time
@@ -117,8 +118,8 @@ func (r *BackupRunner) SetBeforeBackup(fn func(ctx context.Context, storage stri
 // SetThinCheck wires the R-1012 orphan check (see BackupRunner.thinCheck).
 func (r *BackupRunner) SetThinCheck(fn func(ctx context.Context, vmid int) string) { r.thinCheck = fn }
 
-// explainFailure appends the orphan finding to a failed snapshot-mode backup's error. A FRESH check (not the one from
-// before the run): the failure itself may be what made the orphan. Bounded, so a stuck helper cannot hold the job.
+// explainFailure appends the orphan finding to a failed snapshot-mode backup's error — the only place the check runs, so
+// it sees the pool as the failure left it. Bounded, so a stuck helper cannot hold the job.
 func (r *BackupRunner) explainFailure(ctx context.Context, vmid int, rec *hub.Backup) {
 	if r.thinCheck == nil || r.mode != proxmox.ModeSnapshot {
 		return
@@ -221,11 +222,8 @@ func (r *BackupRunner) backup(ctx context.Context, vmid int, onSnapshot func())
 		return rec, fmt.Errorf("backup: %s", rec.Error)
 	}
 
-	if r.thinCheck != nil && r.mode == proxmox.ModeSnapshot {
-		if why := r.thinCheck(ctx, vmid); why != "" {
-			r.logger.Warn("backup: an orphan thin device may make this snapshot backup fail (R-1012)", "vmid", vmid, "finding", why)
-		}
-	}
+	// R-1012: no orphan check here. It takes a metadata snapshot of the live pool, and its answer is only needed when the
+	// snapshot step has failed — explainFailure runs it then (pinned by TestBackup_ThinCheck_SilentWhenNotApplicable).
 	upid, err := r.api.Vzdump(ctx, proxmox.VzdumpOptions{
 		VMID: vmid, Storage: r.target, Mode: r.mode, Notes: r.notes,
 		PruneBackups: r.localPruneSpec(ctx), // local target → keep-last=N; PBS/unknown → "" (no prune)