Pre-beta review: data safety in storage, catalog and backup runs

Storage and repository:
- Listing skipped every name containing ".part-", directories too, so the
  exports of a user like "john.part-time" were invisible to prune on S3,
  SFTP, FTP and SMB and their data was deleted. Only real temporary uploads
  ("<name>.part-<8 hex>") are skipped now.
- prune refuses to run while a recorded per-user export's manifest is
  missing, instead of freeing that export's data.
- forget() and untrash() copy first, switch the catalog, and delete the
  originals last, so a crash can no longer leave the catalog pointing at a
  missing snapshot or database dump.
- Writes are checked against the expected size, so a short upload is an
  error instead of a truncated pack; raw restores check rename() and touch().
- A catalog write refuses to overwrite a generation another process just
  wrote, and the catalog lock lasts 300 s, so opening a large repository
  inside it no longer lets the lease run out.

Backup runs and scheduling:
- A file that keeps changing is read again at most three times; then the
  last read is kept and reported, instead of restarting forever and
  blocking cleanup.
- Unreadable files and folders are recorded, logged, shown by occ
  backup:run, stored in the snapshot and notified to admins, instead of
  being skipped silently.
- After a failed scheduled backup, at most three attempts a day, an hour
  apart, instead of a new run and notification every five minutes.
- The job no longer spins on a run whose lease another process holds, and
  the weekly cleanup catches up after a Sunday spent backing up.
- Notifications for the per-user export retention events.

This commit is contained in:

Dillard Blom

2026-10-06 23:48:40 +02:00

parent f39ca71dab

commit 0f4a238414

16 changed files with 319 additions and 40 deletions

									
										psalm-baseline.xml
									
		-5
	
												View File
												
				@@ -224,14 +224,9 @@

				    <MissingParamType>

				      <code><![CDATA[$fh]]></code>

				    </MissingParamType>

				    <PossiblyNullIterator>

				      <code><![CDATA[$segments]]></code>

				    </PossiblyNullIterator>

				    <PossiblyUndefinedArrayOffset>

				      <code><![CDATA[$mtime]]></code>

				      <code><![CDATA[$state['cur']]]></code>

				      <code><![CDATA[$state['phase']]]></code>

				      <code><![CDATA[$state['segments']]]></code>

				      <code><![CDATA[$state['stats']]]></code>

				    </PossiblyUndefinedArrayOffset>

				  </file>