admin
1257014c2b
An event type the hub does not allowlist makes POST /event return 400 and the
event vanishes (R-97a). The controller cannot emit backup_target_absent until
this is live, so the hub half ships first.
E-2 Phase 0 established that an absent backup target has NO prompt signal today.
The controller's drive-gate path stops apps and logs a WARN but emits nothing:
NotifyStorageDisconnected is defined and never called anywhere (verified against
the gitignored-cmd/ trap with a positive control). A drive that is ONLY a backup
target has no apps to stop, so it is entirely silent. The sole signal is the
tier's own failure at its next due cycle -- up to ~24h on the daily local tier,
which is the R-100 shape: a real fault visible only after a deadline elapses.
Added to BOTH registers, because each half fails differently:
allowedEventTypes -- without it the event is lost at the door;
customerMessages -- without it the event IS delivered but in the controller's
raw operator English, and nothing looks broken.
backup_target_absent is deliberately NOT folded into storage_disconnected: that
says "a drive went away and some apps may have stopped"; this says "the thing
that makes your backup survive a disk failure is gone".
Hungarian copy names the consequence, not just the fact. backup_target_restored
is the paired recovery at info severity -- severityNotifies NOT widened.
Three tests pin the pair and the copy's substance. All red-proofed with the
mutation VERIFIED to have landed first: the initial attempt silently no-op'd
(gofmt had realigned the map) and the test "passed" -- a false proof that would
have been reported as evidence.
Green gate: build + vet + test rc=0, run separately from this commit.
26 lines
1.2 KiB
Go
26 lines
1.2 KiB
Go
package api
|
|
|
|
import "testing"
|
|
|
|
// E-2 — the absent-backup-target signal needs BOTH registers, not one.
|
|
//
|
|
// Phase 0 of E-2 established that an absent backup target has no prompt signal today: the drive-gate
|
|
// path stops apps and logs, but emits nothing, and the tier's own failure only lands at its next due
|
|
// cycle (up to ~24 h on the daily local tier). `backup_target_absent` is that missing signal.
|
|
//
|
|
// A new event type is a PAIR, and each half fails differently:
|
|
// - missing from allowedEventTypes → POST /event returns 400 and the event VANISHES (R-97a);
|
|
// - missing from customerMessages → it is delivered, but the customer gets the controller's raw
|
|
// English operator string instead of Hungarian.
|
|
//
|
|
// The second failure is the quiet one — delivery "works", so nothing looks broken. Both are pinned
|
|
// here, in the same test, because fixing one and not the other is the realistic mistake.
|
|
func TestBackupTargetEventTypesAreAllowlisted(t *testing.T) {
|
|
for _, et := range []string{"backup_target_absent", "backup_target_restored"} {
|
|
if !allowedEventTypes[et] {
|
|
t.Fatalf("%s must be in allowedEventTypes, or POST /event 400s and the absent backup "+
|
|
"target goes silent until the tier misses its deadline", et)
|
|
}
|
|
}
|
|
}
|