forked from heavy-duty/box
4c595eb945
Both reviewers landed on the same line independently, and they are right. cmd_new's hook-failure path offered `box restore $name pristine` unconditionally, but three mints reach that line with no pristine mark, all by this stack's own design: a `dir` pool (skipped, no CoW), BOX_SNAPSHOT_PRISTINE=0, and a create incus refused (warned, mint continued). On a `dir` host that is EVERY hook failure — so the operator standing at the one moment the message exists for copy-pastes a restore that errors. It could not simply be read off the return status. The never-fatal contract means snapshot_mark returns 0 on all four paths on purpose — taken, skipped, knob-disabled, refused — so `if snapshot_mark ...` cannot distinguish a mark that exists from one that does not, and making it distinguish would put the mint's success at the mercy of a checkpoint, which is what that contract exists to prevent. So the fact is recorded rather than inferred: `marks` accumulates the labels snapshot_mark actually created, and `mark_taken <label>` answers the only question a rollback offer may ask. Per-label, so one mark never answers for another. This is the same refusal the message one line earlier already makes when it declines to invent a `bootstrapped` it never watched — a promise the disk cannot deliver is the failure mode #130 was built to refuse. It just was not applied to the restore offer sitting under it. Pinned per path rather than once, because the three no-mark paths fail differently and a single case would let the other two regress silently: five drives over snapshot_mark + mark_taken (created / dir-skip / knob / refused / no bleed between labels) and a static check that the call site is gated. Verified by mutation — dropping the recording, and un-gating the offer, each fail the suite rather than passing quietly. |
||
|---|---|---|
| .. | ||
| box | ||