fix: 12 operator-inconvenience bugs + 1.0.11 release prep#28
Merged
Conversation
False alarms / silent wrong-target:
- repo scrub now scrubs manifest-aware so ENCRYPTED chunks decrypt +
verify — it previously built a decryptor-less CAS and reported 100%
corruption (exit 9) on every encrypted repo, paging on each run.
- The global -c/--config flag is now honored (reads + write-back) via
PG_HARDSTORAGE_CONFIG_FILE; it was advertised everywhere but read
nowhere, so the tool always used the XDG/FHS default.
- lint validates the resolved config with the real loader instead of
always returning {"status":"valid"}.
Dry-run / advisory honesty:
- recovery windows caps latest_restore_lsn at the first WAL archive
hole (records the gap) instead of advertising a range across it.
- restore --preview surfaces the wal_archive_hole finding instead of
reporting "Pre-flight: ✓ ready" for a target the real restore halts
before.
- capacity confidence now requires a real observation window (>=1 day
medium, >=1 week high); a sub-day window can no longer be labelled
"medium" and carries a caveat.
- rotate renders legally-held backups [held], not [del ].
Error class / stubs / muscle memory:
- recovery readiness prints throughput as a byte-rate, not a duration.
- backup --incremental-from against PG<17 is backup.incremental_
unsupported (usage, exit 2) with a hint, not the generic internal.
- repo init accepts --repo (matching sibling repo verbs) or positional.
- explain <cmd> returns the command's real summary/usage/description.
- glossary <term> returns the definition (unknown -> notfound.term).
Also: extended the renderer integer-fidelity fix into a shared
jsonshape helper (yaml/csv/tap/junit/pdf/template).
Release prep: CHANGELOG 1.0.11 and doc version examples bumped. All
fixes carry regression tests; CLI reference regenerated (repo init).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Twelve operator-inconvenience bugs found by systematically exercising the CLI surface, each fixed with a regression test, plus the 1.0.11 release prep.
Highest impact
repo scrubfalse corruption on encrypted repos (the default afterinit): reported 100% chunk corruption and exit 9, paging on every scheduled run. Now scrubs manifest-aware (the same per-manifest CASrepair scrubuses) — E2E verified 342/342 encrypted chunks decrypt + verify.-c/--configsilently ignored: advertised on every command, always read the XDG/FHS default.deployment edit -c staging.yamlmutated the wrong file. Now honored for reads and write-back.lintalways returnedvalid: rubber-stamped garbage YAML/unknown keys/missing files. Now runs the real loader + validation.Dry-run honesty
recovery windowsno longer advertises a PITR range across a WAL archive hole (caps at the hole).restore --previewsurfaces thewal_archive_holefinding instead of "✓ ready" for an unreachable target.capacity reportconfidence now requires a real observation window (a seconds-long window can't be "medium").rotaterenders legally-held backups[held], not[del ].Error class / stubs / muscle memory
recovery readinessthroughput as a byte-rate (160.0 MiB/s), not46603h22m40s.--incremental-fromon PG<17 →backup.incremental_unsupported(exit 2) with a hint, notinternal.repo init --repo <url>accepted (matches sibling verbs).explain <cmd>returns real help;glossary <term>returns the definition.Bonus: the YAML/CSV integer-fidelity fix was extended to a shared
jsonshapehelper covering tap/junit/pdf/template.Verification
Full unit suite green across the tree;
go vetclean; docs/CLI reference regenerated. Every fix has a regression test (repo scrubencrypted E2E, config-flag load, lint invalid,TestWindows_CapsAtArchiveHole,TestPreview_SurfacesWALArchiveHole, capacity window guard, rotate held-label, throughput, incremental class, repo-init flag, explain/glossary).After merge: tag
v1.0.11→ packages publish; Homebrew cask pushed manually (tap token still invalid); containers remain unpublished pending org GHCR enablement.