R-893 option A (operator D20): a failed off-site restore puts the app's live volumes and definition back exactly and starts it; fit check before the stop; the held sentence made true (R-1169)

2026-10-20 09:17:00 +02:00
parent ae2bfb2f7a
commit 93fb251ea9
13 changed files with 752 additions and 55 deletions
@@ -229,6 +229,15 @@ type Manager struct {
 	// volume leg is unit-testable without Docker. Nil → the real restoreDockerVolumesFrom.
 	volumeReplayFrom func(stackName, dumpDir string) (int, error)

+	// R-893 option A seams (offbox_restore_undo.go) — the live-volume copy taken before an off-site restore replaces
+	// the app's volumes, so a failed restore can put them back. Nil → the real docker calls.
+	undoVolumeProbeFn  func(vol string) (bytes int64, exists bool, err error)
+	undoVolumeTarFn    func(vol, dir string) error
+	undoVolumeRemoveFn func(vol string) error
+	// restorePutBackNotify (R-893 option A) is called once when a failed off-site restore was put back and the app
+	// started again. Operator-tier, the same seam shape as restoreHoldNotify.
+	restorePutBackNotify func(stack string, replayErr error)
+
 	// R-403 unit-REHYDRATE seam — the copy that refills the primary unit from the Tier-2 mirror after
 	// a restore, overridable so the "only when hollow" condition and the byte-identical non-effect are
 	// testable without rsync. Nil → the real rsyncMirror. It is a SEPARATE seam from tier2Mirror on