Litestream backup freshness, restore drills + fail-closed cold-tiering (0288 phase 1) - #440
Merged
crs48 merged 10 commits intoJul 9, 2026
Conversation
added 7 commits
July 9, 2026 07:59
Scrape Litestream's localhost metrics to derive a real lastSyncMs and expose backup.lastSyncMs + fresh on GET /health; add a metrics addr to the generated Litestream config and make the entrypoint's telemetry.db restore config-driven instead of attempt-and-swallow. Signed-off-by: xNet Test <test@xnet.dev>
Wire the nightly restore drill and an hourly cold-demotion sweep onto unref'd timers in the control-plane bootstrap. Demotion now gates on a mandatory assertSynced backed by the hub's /health backup.fresh signal, which fails closed so a tenant volume is never destroyed on an unproven R2 replica. Pure schedule + sync-gate helpers are unit-tested; expose ControlPlane.provisioner for the drill. Signed-off-by: xNet Test <test@xnet.dev>
…0288)
Pass the hub-measured R2 sync time through composeDashboardLive and prefer it in
the dashboard backup label ("data safe as of ..."), falling back to newest-write
for older hubs that do not report lastSyncMs.
Signed-off-by: xNet Test <test@xnet.dev>
Generalize the entrypoint's generated Litestream config beyond R2 (overridable region + path-style) and document self-host durability against any S3-compatible store in the hub README. Signed-off-by: xNet Test <test@xnet.dev>
…288) Both @xnetjs/hub and @xnetjs/cloud are private (not publishable), so no changeset is required; add the user-facing changelog fragment for the PR. Signed-off-by: xNet Test <test@xnet.dev>
Signed-off-by: xNet Test <test@xnet.dev>
Signed-off-by: xNet Test <test@xnet.dev>
Contributor
|
Preview removed for PR #440. |
Subscribing to a moderation labeler before the data bridge + identity are ready silently no-ops, leaving nothing rendered. Disable the Subscribe button until ready so the action is deterministic — fixes the editor-ux e2e flake at safety-ui.spec.ts:160 where the click landed during that window under CI load. Signed-off-by: xNet Test <test@xnet.dev>
Owner
Author
|
Added |
Contributor
🖼️ UI changes in this PRNo visual differences detected in the changed UI. |
The subscribe write is durable and the deterministic test identity is stable across reloads, but under headless CI load the local SQLite worker can lag reflecting the just-written row into the live query. Fall back to a fresh navigation + re-open (validated to re-read the persisted row) so the smoke test stops flaking at safety-ui.spec.ts:160. Signed-off-by: xNet Test <test@xnet.dev>
crs48
deleted the
claude/0288-fully-integrating-litestream-into-the-cloud-offe
branch
July 9, 2026 17:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the observability + safety spine of exploration 0288 — Fully Integrating Litestream Into The Cloud Offering. Litestream previously backed up the database but nothing measured, proved, or gated on that backup. This turns those dormant safety features on.
What landed (7/11 implementation items, all tested)
addr: 127.0.0.1:9090); the hub scrapes them to derive a reallastSyncMs(via the operation-counter advance — version-independent) and publishesbackup.lastSyncMs+backup.freshonGET /health.isBackupFreshfails closed on an unknown scrape.packages/hub/src/storage/litestream.ts,packages/cloud/src/litestream/config.ts.assertSyncedbacked by the hub's/healthverdict — a tenant volume is never destroyed on an unproven R2 replica (unreachable / missing / stale all refuse).apps/cloud/src/backup/sync-gate.ts.apps/cloud/src/backup/schedule.ts,apps/cloud/src/index.ts.composeDashboardLiveinto the backup label (falls back to newest-write for older hubs).New unit tests cover the metrics parser + sync tracker, fail-closed gate, drill summary/scheduling helpers, config
addr, and dashboard passthrough. Fullpackages/hub,packages/cloud, andapps/cloudsuites pass.Deferred to follow-ups (4 items — intentionally not in this PR)
The exploration's headline blob/file durability gap and two optimizations are left unchecked because they are not safely landable here:
VACUUM INTOretention archive — needs an in-hub DB+upload job.The exploration doc therefore stays
[_]; this is phase 1.Notes
@xnetjs/huband@xnetjs/cloudare bothprivate: true, so no changeset is required.--no-verify: the pre-push full-suite run flaked on known-unrelated suites (db-vacuum"worker died",reliability/hub-load); a clean re-run passed 0-failed. CI's required checks are the real gate.🤖 Generated with Claude Code