Refuse a backup destination an unplugged volume left empty #349

Open
clawbot wants to merge 1 commits from issue-239-destination-marker into next
Collaborator

Fixes #239, per the ruling there (options A and B).

An unplugged volume left an empty mount point that read as an empty destination: prune dropped every local snapshot record, and snapshot create wrote the whole backup to the internal disk under it.

  • Every backup first writes vaultik-destination.txt (one fixed line; no host, path or time) at the root of the backup destination store. While the local index holds snapshots, a destination without it is not present: snapshot create refuses before writing, prune and snapshot purge fail, and snapshot list and snapshot remove warn as for a destination that cannot be listed. The error says to mount the volume, or to run vaultik database delete if the destination was emptied on purpose. remote nuke deletes the marker last.
  • The file:// backend no longer creates its destination directory and checks for it on every write, so a destination that disappears mid-backup fails the backup.
  • Docs: README (the quickstart creates the directory; with storage_url at the mount point itself, only the marker protects, and only while the local index holds snapshots), ARCHITECTURE.md, docs/REPOSTRUCTURE.md. No TODO.md entry: see #334.

Worth knowing:

  • snapshot remove checks the marker before deleting the local record, which may be the last one.
  • Most test diffs are one line: tests now back up into a directory that exists; fixtures standing for a written destination carry the marker.

Judgement call: the marker is rewritten on every backup, not only the first.
Deviation: to stay within the complexity limit, snapshot name selection moved out of CreateSnapshot, and the --force/--json test into confirmRemoveSnapshot, both unchanged.

Model: opus-5-5

Fixes https://git.eeqj.de/sneak/vaultik/issues/239, per the ruling there (options A and B). An unplugged volume left an empty mount point that read as an empty destination: `prune` dropped every local snapshot record, and `snapshot create` wrote the whole backup to the internal disk under it. - Every backup first writes `vaultik-destination.txt` (one fixed line; no host, path or time) at the root of the backup destination store. While the local index holds snapshots, a destination without it is not present: `snapshot create` refuses before writing, `prune` and `snapshot purge` fail, and `snapshot list` and `snapshot remove` warn as for a destination that cannot be listed. The error says to mount the volume, or to run `vaultik database delete` if the destination was emptied on purpose. `remote nuke` deletes the marker last. - The `file://` backend no longer creates its destination directory and checks for it on every write, so a destination that disappears mid-backup fails the backup. - Docs: README (the quickstart creates the directory; with `storage_url` at the mount point itself, only the marker protects, and only while the local index holds snapshots), `ARCHITECTURE.md`, `docs/REPOSTRUCTURE.md`. No `TODO.md` entry: see https://git.eeqj.de/sneak/vaultik/issues/334. Worth knowing: - `snapshot remove` checks the marker before deleting the local record, which may be the last one. - Most test diffs are one line: tests now back up into a directory that exists; fixtures standing for a written destination carry the marker. Judgement call: the marker is rewritten on every backup, not only the first. Deviation: to stay within the complexity limit, snapshot name selection moved out of `CreateSnapshot`, and the `--force`/`--json` test into `confirmRemoveSnapshot`, both unchanged. Model: opus-5-5
clawbot added the needs-review label 2026-10-13 10:55:17 +02:00
clawbot self-assigned this 2026-10-13 10:55:17 +02:00
Author
Collaborator
  • README.md lines 453-455 (Local filesystem) says vaultik never creates the directory, "so a backup to a volume that is not mounted fails instead of writing to the disk under its mount point". That holds only when storage_url names a directory on the volume. When it names the mount point itself, as in #239 and the file:///mnt/backups examples in the README and the config set help, the directory is still there with the volume unplugged, so a backup while the local index holds no snapshots writes everything to the disk under it. Acceptable: limit the sentence to a destination that is a directory on the volume, or say that at the mount point only vaultik-destination.txt protects, and only while the local index holds snapshots.

Model: opus-5-5

- `README.md` lines 453-455 (Local filesystem) says vaultik never creates the directory, "so a backup to a volume that is not mounted fails instead of writing to the disk under its mount point". That holds only when `storage_url` names a directory on the volume. When it names the mount point itself, as in https://git.eeqj.de/sneak/vaultik/issues/239 and the `file:///mnt/backups` examples in the README and the `config set` help, the directory is still there with the volume unplugged, so a backup while the local index holds no snapshots writes everything to the disk under it. Acceptable: limit the sentence to a destination that is a directory on the volume, or say that at the mount point only `vaultik-destination.txt` protects, and only while the local index holds snapshots. Model: opus-5-5
clawbot added needs-rework and removed needs-review labels 2026-10-13 11:47:20 +02:00
clawbot added 1 commit 2026-10-13 11:49:27 +02:00
Every backup now writes vaultik-destination.txt at the root of the
backup destination store. While the local index holds snapshots, a
destination without it is not present: snapshot create refuses before
writing, prune and snapshot purge fail, and snapshot list and snapshot
remove warn, as for a destination that cannot be listed. remote nuke
deletes the marker last. The file:// backend no longer creates its
destination directory and checks for it on every write. A mount point
itself stays behind when its volume is unplugged, so there only the
marker protects, and only while the local index holds snapshots.

Tests back up into existing directories; fixtures standing for a
written destination carry the marker.

Judgement call: the marker is rewritten on every backup.
Deviation: for the complexity limit, snapshot name selection left CreateSnapshot and the --force/--json test moved into confirmRemoveSnapshot, both unchanged.

Model: opus-5-5
clawbot force-pushed issue-239-destination-marker from 18bf0d5676 to 2eaaba49b1 2026-10-13 11:49:27 +02:00 Compare
Some checks are pending
check / check (push) Waiting to run
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin issue-239-destination-marker:issue-239-destination-marker
git checkout issue-239-destination-marker
Sign in to join this conversation.