fix: make durable data mean one thing, and the backup gate satisfiable

[vishr]

Two throwaway hosts of field testing found the migration backup gate unusable, and that three places were each guessing at the same undefined meaning. A second opinion reframed it usefully: this is not a new default, it is a published default the loader made unreachable — which makes the fix conservative rather than lenient.

What an absent persistence block means

The contract publishes persistence.mode defaulting to durable. The block is optional, and the default was only applied when the block already existed:

if w.Persistence != nil && w.Persistence.Mode == "" { w.Persistence.Mode = "durable" }

So the default was unreachable exactly when it mattered. ob doctor, the migration-backup requirement and the protection gate each read absence as "not durable" — and 15 of 16 real projects declare volumes while none declares persistence.

• A workload with a managed named volume now holds durable data whether it says so or not, materialised so ob canonical shows mode: durable # default rather than hiding the inference.
• A bind mount is deliberately not durable — onebox neither created the host path nor can tell config from data by looking at it. Counting them would demand backup evidence for every ./config mount, and a warning that fires on everything is one nobody reads. ob doctor mentions them instead.
• Inference does not fire stateful_replicas. That refusal still needs an authored block, because the contract promises a constraint is not tightened against a project that already loads. ob doctor reports the hazard instead. The rule is now also expressed in the published schema, so an editor underlines it.

ob doctor on gitea, before and after:

[PASS] protections: nothing on this host holds durable data
[WARN] db/backup: holds durable data and Onebox takes no backups… Declare
       persistence: {mode: durable} to state this, or mode: ephemeral if the
       volume is not state

The gate could not be satisfied at all

reflect.DeepEqual treats an empty slice and a nil slice as different. A policy requiring no key material leaves the requirement nil while a receipt with none carries a zero-length slice — so with the default configuration every receipt ob backup-evidence create produced was refused. Verified on a host: declaring one key made the identical flow pass.

The requirement also counted only workloads, so the standard shape — replicated stateless app plus managed database — could not satisfy it at all: the gate wanted a durable workload, stateful_replicas refuses a durable workload with replicas, and services counted for nothing. Managed services are now resources.

migration_backup_maximum_age gets a 24h default; enabling one boolean previously made it mandatory and its absence produced an untyped complaint about an empty duration.

The manifest is no longer authored blind

It is the only artifact a person must write, and the docs named its schema version without ever giving its shape — three refusals, one field at a time, even with source access.

ob backup-evidence template --plan ob-plan.json > backup-facts.json

Generated from the same types, so it cannot drift. The guide now carries the field table too.

A regression of my own

The naming PR moved ob abort --force to --break-migration-gate and didn't follow it into free-text errors. Four messages were wrong, two in HALT-AND-PAGE guidance — read when a migration has already run and the release is stuck. The remedy test now resolves the flag against the command, not just the command; verified by reverting a string and watching it fail.

just ci green; Docker e2e green at 202s.

🤖 Generated with Claude Code