4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	b30e79ee45	Run the disk-full restore test again (closes #207) ... TestRestoreReportsDiskFull was skipped pending #163, which is closed. The skip and its "skipped until" wording are removed. Restore is unchanged. With the skip removed the test failed because restore succeeded: its simulated full disk capped only Create, but restore now opens each file with OpenFile, so nothing was capped. It now caps OpenFile, and only for files under the restore target: restore also writes the decrypted metadata database under $TMPDIR through the same filesystem, and capping that would fail the restore before any file reached the target. Judgement call: the test was corrected, not restore; both assertions are unchanged. Model: opus-5-5	2026-10-01 20:24:30 +02:00
clawbot	dd7a610c23	Mark a snapshot complete only after its metadata export succeeds (closes #177) ... finalizeSnapshotMetadata marked the snapshot complete and then exported its metadata. A crash after completion but before/during the export left the local index showing the snapshot complete while the destination had no manifest or database, and PruneDatabase (which drops only NULL completed_at rows) kept it: a silently unrestorable snapshot. Reorder so completion is recorded last. CompleteSnapshot is split into PopulateSnapshotBlobs (before the export) and MarkSnapshotComplete (after it). An interrupted export now leaves the snapshot incomplete, so the next run PruneDatabase drops it and re-backs-up the data; the reverse tiny window leaves a restorable snapshot the index reports honestly as remote-only. Update REPOSTRUCTURE.md guarantee 4 and the ARCHITECTURE.md flow. Add a fault-injection test driving the full create path. Model: opus-4-8	2026-09-22 20:00:41 +02:00
clawbot	38ebfd843a	Trust only uploaded blobs for deduplication (closes #148) ... An interrupted blob upload left the blob's chunks, blob_chunks, and blobs rows committed before the upload was attempted, so a later run deduplicated against data that never reached storage and produced a snapshot that reported success but could not be restored. Fix (issue option b): a chunk counts as known only when a blob holding it has uploaded_ts set, and each run drops un-uploaded blob rows and the chunks they orphan at startup, so the affected data is re-chunked and re-uploaded. A blob recorded with no remote backend is marked uploaded so the invariant holds uniformly. The reproduction is the interrupted-upload test from #72: its t.Skip is removed and it passes against this fix, and this branch's earlier duplicate copy is dropped. The interrupted metadata-export case is split to #177. Model: opus-4-8	2026-09-22 10:29:21 +02:00
clawbot	6b7517a4dc	Add fault-injection tests for interruption and corruption (closes #72) ... Adds internal/storage/faultstore, a storage.Storer wrapper that injects faults through the storage seam without patching production code: an upload that dies mid-stream, a backend reporting success while storing nothing, and reads returning corrupt or truncated bytes. Covers all six scenarios from the issue, each asserting the observable end state (index, destination, and what the user is told), not merely that an error returned. Scenario 1b (retry after an interrupted upload) exposed a real dedup defect and is skipped with a pointer to #148, which also owns the half-exported-state repair. Tests run serially because each calls log.Initialize on the global logger. No production behavior changes. Model: opus-4-8	2026-09-22 09:46:46 +02:00