Two of these were mine, from the previous round.
- mounted_snapshots still swallowed OSError. I said I had fixed it and had not: the
edit never matched, and I did not read it back. With the mount table unreadable the
GC loses its in-use protection entirely and can destroy the snapshots of a backup
that is still uploading (a first upload easily outlives the 1h age floor). It raises
now, and both behaviours are tested.
- The foreign-dataset check added last round had two bugs of its own. It ignored
`mounted`, so a locked/encrypted dataset from a sibling tree turned a working nightly
backup into a permanent failure — it belongs in `skipped`, exactly as an in-tree one
does. And it tested `mp.startswith(path + "/")`, so a foreign dataset mounted EXACTLY
at the backup path slipped through — the very hole the check was added to close, one
character wide, and the worse case of the two because it SHADOWS the base dataset's
own directory.
- _read_sidecar's new raise broke cleanup_all, which is what recover.sh and
uninstall.sh call — i.e. the code that must work when the box is ALREADY stuck. One
unreadable sidecar aborted it before it unmounted anything, leaving the staging tree
mounted, which pins the snapshots, which is the state recover.sh exists to escape. It
now reports and carries on — and does not delete a record it could not read.
- compat could report a FALSE OK: `defined` was collected by walking the whole file, so
any function named `delete` anywhere in it — on an unrelated class, or nested inside
another method — satisfied "this namespace defines delete". The runtime is stricter
(a plugin class on the service's MRO), so the two could disagree in the ok direction.
compat now looks in the class that declares the namespace. Same question on both
sides, which is what pick_snapshot_service's docstring has been claiming all along.
- apply.sh's compat preflight — the guard that refuses to patch a middleware whose
assumptions no longer hold, on every boot, on a live NAS — had no test at all. It
could be turned into a no-op eight different ways with the suite still green. The
SHIPPED heredoc is now extracted and driven directly against fake verdicts.
Also pinned: the Tap/Tap2 prefix collisions (a sweep that treats "Tap2/data@snap" as
part of Tap's tree DESTROYS another pool's snapshot), and the GC's in_use wiring.
355 tests. Verified on TrueNAS 26.0.0-BETA.1: 292-dataset backup, 0 orphans, 0 leaked
mounts, byte-identical restore of a 4-deep child dataset.
flan
086b20ed23