44 lines
2.5 KiB
Markdown
44 lines
2.5 KiB
Markdown
# REPORT — slice 8B.2 (controller half): resume at `snapshotted` (v0.38.0) (2026-06-10)
|
|
|
|
> Overwrite-latest report. Cumulative history: [CHANGELOG.md](CHANGELOG.md). Implements the
|
|
> controller half of `TASK — Slice 8B.2`. Pairs with `felhom-agent` v0.13.0. No hub change.
|
|
|
|
## Outcome
|
|
|
|
The quiesce loop (8B) kept the app stopped for the **whole backup**. In snapshot mode the app only
|
|
needs to be stopped until the **storage snapshot** is taken; after that vzdump reads from the
|
|
snapshot. The controller now resumes its app at the agent's **`snapshotted`** phase instead of
|
|
`done` — app downtime drops from *whole-backup* to *until-snapshot*, with no loss of app-consistency.
|
|
**Measured live: ~3s vs ~23s (~87% cut)**, restore still clean.
|
|
|
|
## What landed (`internal/quiesce`)
|
|
|
|
- The status-poll loop **resumes (`StartStack` + clears the marker) at `snapshotted`**, then **keeps
|
|
polling to `done`/`failed`** — so a new backup isn't started until this one truly finishes and a
|
|
post-snapshot failure is still observed (the backup isn't "successful" until `done`; the early
|
|
resume does not mark it done).
|
|
- **Fallback:** if `snapshotted` never arrives (stop/downgraded storage), it resumes at `done`
|
|
exactly as 8B. The agent only emits `snapshotted` when the actual mode is snapshot.
|
|
- **Crash-safety unchanged:** marker written before stop; guaranteed unquiesce (deferred); startup
|
|
`Recover()`. A failure *after* `snapshotted` is harmless — the app is already up.
|
|
|
|
## Tests
|
|
|
|
`go build ./...` + `go test ./...` green. quiesce: resume at `snapshotted` (RESUME event before
|
|
`done`, marker cleared, then tracked to `done`); stop-mode fallback (resume at `done`, no
|
|
`snapshotted`); fail-after-`snapshotted` (single resume, app stays up); the 8B crash-safety tests
|
|
stay green.
|
|
|
|
## Live validation (demo-felhom)
|
|
|
|
A provisioned controller v0.38.0 with a postgres stack, short quiesce poll: timeline —
|
|
`quiescing [pgtest]` 12:58:45 → `snapshotted — resuming app early` 12:58:48 → `backup done` 12:59:08.
|
|
**App downtime ≈ 3s** (vs ≈ 23s to `done`). The snapshot backup restored to a scratch guest came up
|
|
**clean** (`database system was shut down at 12:58:45`, no WAL replay) — the early resume preserved
|
|
app-consistency. The controller kept tracking to `done` after resuming (no overlapping backup).
|
|
|
|
## Deferred / dependency
|
|
|
|
Snapshot-capable storage (lvm-thin/ZFS) required for the win; stop/downgraded storage falls back to
|
|
resume-at-`done` (8B). No consistency-contract or crash-safety change. No secrets committed.
|