Keep unreferenced blobs newer than prune_grace_period (closes #387)

A backup uploads its blobs before the manifest that lists them, and the process lock is per user per machine, so a prune from another host or user sharing the destination deleted a running backup's blobs; that backup still reported success and could not be restored. Prune now deletes an unreferenced blob only once it is older than the new config key prune_grace_period (default 24h), and reports how many it kept (blobs_too_new under --json). The storage listing now carries each object's modification time. remote nuke is unchanged. The README says what the lock covers and that a shared destination relies on the grace period or needs one prefix per host. Model: opus-5-5
2026-10-14 08:04:05 +00:00
parent 2590f49583
commit c6021ea494
17 changed files with 320 additions and 47 deletions
@@ -228,7 +228,8 @@ The restore process doesn't use the local database. Instead:

 1. **Identify Unreferenced Blobs**
   - Query blobs not referenced by any remaining snapshot
-   - Delete from S3 and local database
+   - Delete from S3, once older than `prune_grace_period`, and from the local
+     database

 ### 6. Incomplete Snapshot Cleanup