admin
0f311adaa1
F7 atomic volume dumps, F6 no single-copy (volume-only tier-2 + honest single-drive signal), F5 stale-primary sweep. Part 4 locality fork = A (doc-only). Live-validated on 9201: F7 money-shot byte-identical through mid-write cut, F6/F5 confirmed, restore round-trip byte-identical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017CDMFpFx84pfviCTVuGGhf
61 lines
3.9 KiB
Markdown
61 lines
3.9 KiB
Markdown
# REPORT — v0.118.0: backup integrity (F7 atomic dumps · F6 no-single-copy · F5 stale sweep)
|
|
|
|
**Date:** 2026-07-12 · **Version:** controller v0.118.0 (from v0.117.0) · **MinAgent:** 0.81.0 (UNCHANGED)
|
|
· **Deployed:** guest 9201 (`0.118.0` healthy) · **Source:** `felhom.eu/documentation/audits/CAMPAIGN-3-2026-07-11.md`.
|
|
|
|
## What shipped
|
|
|
|
- **F7 (HIGH) — atomic volume dumps.** `backup.DumpAppVolumes` writes the tar to `<vol>.tar.tmp`,
|
|
fsyncs it, then atomically `os.Rename`s over the restore point ONLY on success (+ best-effort dir
|
|
fsync via `atomicPromoteTar`) — mirroring the DB-dump path (`dbdump.go` DumpOne). Any tar
|
|
error / timeout / dead-NFS EIO removes only the `.tmp`; the last good `.tar` is byte-untouched. The
|
|
`.tar.tmp` is invisible to restore-point/stale scans (ends `.tmp`, not `.tar`); orphan tmps are
|
|
swept. New `tarVolume` seam for the red-proof.
|
|
- **F6 (LOW) — no single-copy.** `RunAllTier2` no longer skips non-HDD apps → volume-only apps get a
|
|
cross-drive tier-2 copy. sys_drive restore-point label is now clear ("Belső SSD (rendszer)"), never
|
|
blank. `SingleCopyWarning` (honest HU banner) shows on a single-drive box with no off-drive target.
|
|
- **F5 (LOW) — stale primary sweep.** `pruneStalePrimaryDirs` (end of each backup cycle) removes an
|
|
orphaned `backups/primary/<app>` dir on an OLD drive after an HDD_PATH move. Guards: deployed +
|
|
different-current-drive only; never the current-drive dir or an undeployed app's dir; strictly under
|
|
a `backups/primary/` prefix.
|
|
- **Part 4 — locality fork: operator chose (A) keep locality, document-only.** No code change; the
|
|
NAS-outage behaviour + tier-2 mitigation are documented plainly.
|
|
|
|
## Tests + red-proofs (all green)
|
|
|
|
- F7: happy atomic promote (no `.tmp` left); **truncation red-proof** — pre-seeded good `.tar`, tar
|
|
fails mid-write → original byte-unchanged, no 0-byte (revert to in-place write → fails); leftover
|
|
`.tar.tmp` swept.
|
|
- F6: volume-only app in the tier-2 run set (revert the skip → fails); single-drive honest signal;
|
|
sys_drive drive-label non-blank.
|
|
- F5: redeployed residue removed; **guard red-proofs** — undeployed app's restore point kept,
|
|
current-drive dir kept.
|
|
- Existing `TestListRestorePoints_DriveLabel/SSD` updated (blank → clear label, the F6 behaviour).
|
|
|
|
## Live validation (demo 9201, real pipeline, sim-NAS rails — exportfs only)
|
|
|
|
- **F7 money-shot:** established good tars (radarr sha `847a97ad…` +4 others), then `exportfs -u` the
|
|
NFS target 4 s into a backup during volume dumps → run `success:false`; **all 5 nas-media volume
|
|
tars BYTE-IDENTICAL** (clean host-side diff), **no 0-byte file, no leftover `.tar.tmp`**; the next
|
|
clean run produced fresh good tars (`success:true`). This is the exact campaign F7 repro, now safe.
|
|
- **F6:** after a tier-2 cycle, volume-only `actualbudget` + `seerr` appear under
|
|
`felhom-usb/backups/secondary/` (previously none); `actualbudget` snapshot `drive_label` =
|
|
"Belső SSD (rendszer)"; single-copy banner correctly absent on the multi-drive demo.
|
|
- **F5:** a seeded stale `nas-media/backups/primary/actualbudget` (actualbudget lives on sys_drive) was
|
|
swept by the next backup; the real sys_drive dir + radarr's nas-media dir were kept.
|
|
- **Restore round-trip:** calibre-web tamper → restore → BYTE-IDENTICAL (53 files), container healthy —
|
|
F7's write change did not affect restore.
|
|
|
|
## NOT live-validated / standing items
|
|
|
|
- Single-drive `SingleCopyWarning` live (the demo has enrolled drives) — unit-tested only.
|
|
- Task C (F8/F4) and Task D (ring/alerting) remain queued.
|
|
- Peti's box (controller 0.113 / agentless-on-proxmox2) reaches 0.118 + agent 0.85 at his next train —
|
|
noted for the roadmap; the agentless-on-proxmox2 cluster gap stands.
|
|
- No publish/floor movement; agent untouched (MinAgent 0.81.0).
|
|
|
|
## Box state at wrap
|
|
|
|
controller 0.118.0 healthy on 9201; all backups consistent (fresh tier-1 + tier-2 incl. volume-only
|
|
apps); NAS re-exported; no stale test residue.
|