Skip to content

feat(worker): customer Postgres backup + restore pipeline (D1) - #18

Merged
mastermanas805 merged 1 commit into
masterfrom
feat/customer-backups-worker-fresh
May 14, 2026
Merged

mastermanas805 merged 1 commit into
masterfrom
feat/customer-backups-worker-fresh

Conversation

@mastermanas805

Copy link
Copy Markdown
Member

3 River workers streaming pg_dump → S3 with tier-based retention. 16 tests pass.

Three River workers:
- customer_backup_scheduler (hourly): per-tier cadence — pro/team hourly, hobby daily
- customer_backup_runner (30s): atomic claim, pg_dump --format=custom | gzip → S3 multipart, retention sweep (hobby 7d / pro 30d / team 90d)
- customer_restore_runner (30s): same shape but reverse

16 new tests, all pass race-clean.

Operator dep: pg_dump binary in worker container (current distroless lacks it).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@mastermanas805
mastermanas805 force-pushed the feat/customer-backups-worker-fresh branch from 2c179e1 to 9d1bf56 Compare May 14, 2026 05:02
@mastermanas805
mastermanas805 merged commit 0518c36 into master May 14, 2026
mastermanas805 added a commit that referenced this pull request Jun 2, 2026
…dup, cursor (#78)

* fix(worker): bug-bash batch 2 — grace close, namespace reaper grace, autopsy dedup, cursor

Four confirmed bugs from the 2026-06-02 platform bug bash:

- #5 (P1) billing_reconciler: a terminal Razorpay status downgraded the team
  but left the active payment_grace_periods row open, so payment_grace_reminder
  emitted dunning emails forever and the terminator later re-acted on an
  already-cancelled subscription. Add TerminateActiveGracePeriod to the
  gracePeriodOpener interface (status→'terminated', terminated_at=now()) and
  call it in the terminal-downgrade branch (fail-open).

- #8 (P1) orphan_sweep PASS 4: the customer-namespace reaper excluded 'pending'
  resources from the live-token set AND had no creation-grace, so a sweep
  during two-phase provisioning could DELETE a live, mid-provision namespace.
  Add 'pending' to fetchLiveResourceTokens and a namespace-age grace check
  (skip if younger than orphanNoDBRowGrace) mirroring PASS 3.

- #15 (P2) deploy_failure_autopsy: emitDeployFailedAudit inserted a new
  deploy.failed audit row (new id) on every reconciler retry, and the forwarder
  dedups by audit_id (not deployment) → duplicate failure emails. Make it
  idempotent: skip the INSERT when a deploy.failed row already exists for the
  deployment (metadata->>'deploy_id'). Fail-open on probe error.

- #18 (P2) billing_reconciler scanChargeUndeliverable: jumping the cursor to
  now() on an empty window skipped rows that became visible a moment later
  (clock skew / late commit). Leave the cursor unchanged on count==0 — the 1h
  look-back re-applies and re-scanning the small indexed window is cheap.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(worker): cover bug-bash batch-2 changed lines (100% patch gate)

- orphan_sweep PASS 4: young-namespace (within grace) + age-lookup-error are
  NOT reaped (#8 grace branches).
- emitDeployFailedAudit: dedup-hit skips the INSERT (#15 idempotency branch).
- dbGracePeriodOpener.TerminateActiveGracePeriod: UPDATE success + error-wrap.
- billing terminal downgrade still succeeds when the grace-close errors (#5
  fail-open warn branch).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant