R-1252 (P2): a rejected or absent backup block never deletes second-drive copies — reconcile only on a valid classification; a rejected block is said on the app's status and once a day to the operator (backup_run_failures); kept copies stay kept (H2); Remove drops the kept records it deleted (H9). Commit only.

controller/internal/backup/r1252_rejected_block_keeps_copies_test.go

@@ -0,0 +1,189 @@
+package backup
+
+// R-1252 (review round 2, HUNT-2 H1, H2, H9): a rejected backup block never deletes second-drive copies.
+//
+// The first test is the review's 9202 reproduction (audits/review-round-2-2026-10-24/proofs/H2-bad-backup-block/) as a
+// unit test: an app with its household files in a userdata leg; two good runs keep the copy (the control); one bogus
+// path in the block rejects it → the legacy legs → before the fix „Tier 2 reconcile: removed stale dest dir
+// userdata/media". RED-PROOF (2026-10-24, on the parent of this commit): TestR1252_ARejectedBlockKeepsEveryCopy failed
+// on „the household's file copy was deleted"; TestR1252_AKeptCopyStaysWhenItsLegLeaves on „the kept copy was
+// reconciled away"; TestR1252_RemoveDropsTheKeptRecordsItDeleted on „the record outlived its copy".
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// rejectingProvider is the v2 fixture provider that can also say a block was rejected (the stack adapter's
+// BackupBlockRejected in production).
+type rejectingProvider struct {
+	*t2v2Provider
+	rejected map[string]string
+}
+
+func (p *rejectingProvider) BackupBlockRejected(n string) string { return p.rejected[n] }
+
+func mUD(rel string) ClassifiedBind {
+	b := oUD(rel)
+	b.ReadOnly = false
+	b.Class = ClassMandatory
+	return b
+}
+
+func TestR1252_ARejectedBlockKeepsEveryCopy(t *testing.T) {
+	m, src, target, prov := newTier2V2(t, "audiobookshelf")
+	rp := &rejectingProvider{t2v2Provider: prov, rejected: map[string]string{}}
+	m.stackProvider = rp
+	var sent []string
+	m.SetTier2SettingsUnreadableNotify(func(app, why string) { sent = append(sent, app+": "+why) })
+	prov.has["audiobookshelf"] = true
+	prov.binds["audiobookshelf"] = []ClassifiedBind{mHDD("appdata/audiobookshelf/config"), mUD("media/audiobooks")}
+	prov.mounts["audiobookshelf"] = []string{filepath.Join(src, "appdata", "audiobookshelf", "config")}
+	mustWrite(t, filepath.Join(src, "appdata", "audiobookshelf", "config", "db.sqlite"), "DB")
+	mustWrite(t, filepath.Join(src, "userdata", "media", "audiobooks", "r1252-marker.mp3"), "the household's book")
+	destBase := filepath.Join(target, "backups", "secondary", "audiobookshelf")
+	copyOfBook := filepath.Join(destBase, "userdata", "media", "audiobooks", "r1252-marker.mp3")
+
+	for run := 1; run <= 2; run++ { // the positive control: an unchanged block keeps the copy
+		if err := m.RunTier2("audiobookshelf"); err != nil {
+			t.Fatal(err)
+		}
+		if !exists(copyOfBook) {
+			t.Fatalf("control run %d: the household's file was not copied", run)
+		}
+	}
+	// one bogus path: LoadMetadata rejects the WHOLE block → no classification, the legacy legs
+	prov.has["audiobookshelf"] = false
+	rp.rejected["audiobookshelf"] = `userdata path "media/nope" matches no compose bind`
+	if err := m.RunTier2("audiobookshelf"); err != nil {
+		t.Fatal(err)
+	}
+	if !exists(copyOfBook) {
+		t.Fatal("the household's file copy was deleted by the night copy after a rejected block (R-1252)")
+	}
+	if cd := m.settings.GetCrossDriveConfig("audiobookshelf"); cd == nil || !strings.Contains(cd.LastWarning, "nem olvashat") {
+		t.Fatalf("the app's status must say the settings are unreadable and the copies kept: %+v", cd)
+	}
+	if len(sent) != 1 || !strings.Contains(sent[0], "media/nope") {
+		t.Fatalf("the operator must be told once, with the reason: %v", sent)
+	}
+	if err := m.RunTier2("audiobookshelf"); err != nil {
+		t.Fatal(err)
+	}
+	if len(sent) != 1 {
+		t.Fatalf("a second run the same day must not tell the operator again: %v", sent)
+	}
+	m.tier2Unreadable.now = func() time.Time { return time.Now().Add(25 * time.Hour) }
+	if err := m.RunTier2("audiobookshelf"); err != nil {
+		t.Fatal(err)
+	}
+	if len(sent) != 2 {
+		t.Fatalf("the next day tells the operator again: %v", sent)
+	}
+}
+
+// An app with no block at all (absent) — the legacy legs — reconciles nothing either, and says nothing.
+func TestR1252_AnAbsentBlockReconcilesNothing(t *testing.T) {
+	m, src, target, prov := newTier2V2(t, "legacyapp")
+	prov.has["legacyapp"] = false
+	prov.mounts["legacyapp"] = []string{filepath.Join(src, "appdata", "legacyapp", "x")}
+	mustWrite(t, filepath.Join(src, "appdata", "legacyapp", "a.txt"), "A")
+	destBase := filepath.Join(target, "backups", "secondary", "legacyapp")
+	stray := filepath.Join(destBase, "userdata", "photos", "p.jpg")
+	mustWrite(t, stray, "a copy from an earlier, classified night")
+	if err := m.RunTier2("legacyapp"); err != nil {
+		t.Fatal(err)
+	}
+	if !exists(stray) {
+		t.Fatal("an app without a valid classification must not reconcile away a copy")
+	}
+	if cd := m.settings.GetCrossDriveConfig("legacyapp"); cd != nil && strings.Contains(cd.LastWarning, "nem olvashat") {
+		t.Fatalf("an absent block is not unreadable settings: %q", cd.LastWarning)
+	}
+}
+
+// The control the other way: a VALID classification still reconciles a leg that was re-classed excluded.
+func TestR1252_AValidClassificationStillReconciles(t *testing.T) {
+	m, src, target, prov := newTier2V2(t, "app")
+	prov.has["app"] = true
+	prov.binds["app"] = []ClassifiedBind{mHDD("appdata/app/keep"), mHDD("appdata/app/drop")}
+	mustWrite(t, filepath.Join(src, "appdata", "app", "keep", "k"), "K")
+	mustWrite(t, filepath.Join(src, "appdata", "app", "drop", "d"), "D")
+	if err := m.RunTier2("app"); err != nil {
+		t.Fatal(err)
+	}
+	dropped := filepath.Join(target, "backups", "secondary", "app", "hdd", "appdata", "app", "drop")
+	if !exists(dropped) {
+		t.Fatal("precondition: run 1 copied both legs")
+	}
+	prov.binds["app"] = []ClassifiedBind{mHDD("appdata/app/keep"), xHDD("appdata/app/drop")}
+	if err := m.RunTier2("app"); err != nil {
+		t.Fatal(err)
+	}
+	if exists(dropped) {
+		t.Fatal("a leg re-classed excluded under a VALID block must still be reconciled away (§8.2)")
+	}
+}
+
+// HUNT-2 H2: a copy D25 keeps (its folder went missing) stays kept when its leg later leaves the declared set.
+func TestR1252_AKeptCopyStaysWhenItsLegLeaves(t *testing.T) {
+	m, src, target, prov := newTier2V2(t, "app")
+	prov.has["app"] = true
+	prov.binds["app"] = []ClassifiedBind{mHDD("appdata/app/photos"), mHDD("appdata/app/docs")}
+	mustWrite(t, filepath.Join(src, "appdata", "app", "photos", "family.jpg"), "PHOTO")
+	mustWrite(t, filepath.Join(src, "appdata", "app", "docs", "contract.pdf"), "PDF")
+	if err := m.RunTier2("app"); err != nil {
+		t.Fatal(err)
+	}
+	photo := filepath.Join(target, "backups", "secondary", "app", "hdd", "appdata", "app", "photos", "family.jpg")
+	if err := os.RemoveAll(filepath.Join(src, "appdata", "app", "photos")); err != nil {
+		t.Fatal(err)
+	}
+	if err := m.RunTier2("app"); err != nil { // the folder is missing → kept + recorded (D25)
+		t.Fatal(err)
+	}
+	if len(m.KeptCopies()) != 1 {
+		t.Fatalf("precondition: the photos copy is kept, got %+v", m.KeptCopies())
+	}
+	prov.binds["app"] = []ClassifiedBind{mHDD("appdata/app/docs")} // the photos leg leaves the declared set
+	if err := m.RunTier2("app"); err != nil {
+		t.Fatal(err)
+	}
+	if !exists(photo) {
+		t.Fatal("the kept copy was reconciled away while its record stays (HUNT-2 H2)")
+	}
+	if len(m.KeptCopies()) != 1 {
+		t.Fatalf("the kept record must stay: %+v", m.KeptCopies())
+	}
+}
+
+// HUNT-2 H9: Remove with „remove backups" deletes the mirror — and the kept-copy records inside it go with it.
+func TestR1252_RemoveDropsTheKeptRecordsItDeleted(t *testing.T) {
+	m, src, target, prov := newTier2V2(t, "app")
+	prov.has["app"] = true
+	prov.binds["app"] = []ClassifiedBind{mHDD("appdata/app/photos")}
+	mustWrite(t, filepath.Join(src, "appdata", "app", "photos", "family.jpg"), "PHOTO")
+	if err := m.RunTier2("app"); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.RemoveAll(filepath.Join(src, "appdata", "app", "photos")); err != nil {
+		t.Fatal(err)
+	}
+	if err := m.RunTier2("app"); err != nil {
+		t.Fatal(err)
+	}
+	if len(m.KeptCopies()) != 1 {
+		t.Fatalf("precondition: one kept copy, got %+v", m.KeptCopies())
+	}
+	mirror := filepath.Join(target, "backups", "secondary", "app")
+	removed := m.RemoveTier2Mirrors("app", []string{mirror})
+	if len(removed) != 1 || exists(mirror) {
+		t.Fatalf("precondition: the mirror is deleted, got %v", removed)
+	}
+	if len(m.KeptCopies()) != 0 {
+		t.Fatalf("the record outlived its copy: %+v", m.KeptCopies())
+	}
+}