After a power cut: remove the dead half-written backup (R-1006); a backup task from before the boot is not in flight (R-1008)

internal/backup/r685_space_test.go

@@ -81,3 +81,28 @@ func TestR685_FailsOpen(t *testing.T) {
 		}
 	}
 }
+
+// TestR1006_LeftoverCleanupRunsBeforeThePreflight — the night of 2026-10-14: a 12.2 GB half-written archive from a power
+// cut held the space, so every later backup was skipped. The cleanup step runs BEFORE the preflight reads the free space:
+// here it „removes" the leftover (free 4 → 16 GiB) and the backup then fits and runs.
+//
+// RED-PROOF: drop the r.beforeBackup call from backup() (or move it after spaceFits) → the backup is skipped → fails.
+func TestR1006_LeftoverCleanupRunsBeforeThePreflight(t *testing.T) {
+	api := spaceAPI(4*gib, 8182759056, "dir")
+	r := NewBackupRunner(api, "local", proxmox.ModeSnapshot, "", "keep-last=1", quiet())
+	var got []string
+	r.SetBeforeBackup(func(_ context.Context, storage string, vmid int) {
+		got = append(got, storage)
+		if vmid != 9201 {
+			t.Errorf("cleanup asked for vmid %d", vmid)
+		}
+		api.storages[0].Avail = 16 * gib
+	})
+	_, _ = r.Backup(context.Background(), 9201)
+	if len(got) != 1 || got[0] != "local" {
+		t.Fatalf("the cleanup must run once for this target, got %v", got)
+	}
+	if len(api.vzdumps) != 1 {
+		t.Fatalf("after the cleanup freed the space the backup must run, vzdumps=%d", len(api.vzdumps))
+	}
+}

internal/backup/runner.go

@@ -58,8 +58,11 @@ type BackupRunner struct {
 	// tier cannot have that accident — its keep_last defaults to 0 (never prune), so any value
 	// there is a deliberate act.
 	allowPBSPrune bool
-	logger        *slog.Logger
-	now           func() time.Time
+	// beforeBackup runs just before the space preflight (R-1006): it removes a dead half-written vzdump of this guest on
+	// this target, so a leftover from a power cut cannot hold the space this backup needs. nil = nothing.
+	beforeBackup func(ctx context.Context, storage string, vmid int)
+	logger       *slog.Logger
+	now          func() time.Time
 	// rejected remembers the volids already announced by warnRejectedArchiveOnce, so an incomplete
 	// archive is reported ONCE rather than on every 5-minute due-check. Bounded in practice: one
 	// entry per aborted upload, and a process restart clears it. Guarded by rejectedMu because the
@@ -102,6 +105,11 @@ func NewBackupRunnerFull(api BackupAPI, target string, mode proxmox.BackupMode,
 		now: func() time.Time { return time.Now().UTC() }}
 }
 
+// SetBeforeBackup sets the step run just before the space preflight (R-1006: the dead-leftover cleanup).
+func (r *BackupRunner) SetBeforeBackup(fn func(ctx context.Context, storage string, vmid int)) {
+	r.beforeBackup = fn
+}
+
 // localPruneSpec returns the `--prune-backups` spec to apply to THIS backup, or "" to skip pruning. It
 // applies the configured retention ONLY when the target is a non-PBS storage — PBS offsite retention is a
 // separate lifecycle and must never be pruned by the per-run flag (§9). Fail-safe: if the target's type
@@ -183,6 +191,9 @@ func (r *BackupRunner) backup(ctx context.Context, vmid int, onSnapshot func())
 	// R-685 (v0.134.0): will the new archive FIT on a local target? Asked before anything runs, so a
 	// target that cannot hold it is a named SKIP with the numbers, not a nightly "No space left on
 	// device" that only the vzdump log explains (demo-hp, every night from 2026-09-23 — R-684).
+	if r.beforeBackup != nil {
+		r.beforeBackup(ctx, r.target, vmid)
+	}
 	if ok, why := r.spaceFits(ctx, vmid); !ok {
 		rec.Error = BackupSkipNoSpacePrefix + why
 		rec.DurationSeconds = time.Since(start).Seconds()