Release version 7.1.1

The entrypoint installs root@localhost without unix_socket auth and sets
its password during init, so the passwordless socket probe only passed
when it landed in the window before SET PASSWORD. Missing that window
timed the e2e MariaDB suites out at random.

The probe now authenticates with the root password it already received
and requires @@skip_networking = 0, so the entrypoint's temporary server
no longer counts as ready. The anonymous-preemption bootstrap logs in
with the root password as well.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,89 @@
 # Changelog
 
+## [7.1.1] - 2026-10-17
+
+Fixed:
+
+- Tests: e2e MariaDB probe ran root passwordless and timed out at random
+- Tests: probe now logs in with the root password, skips the temp server
+- Tests: anonymous-preemption bootstrap now uses the root password too
+
+Upgrade notes:
+
+- 7.1.0 never reached stable: its CI failed, no image was published
+- 7.1.1 is the first published -aHAX build; 7.1.0 upgrade notes apply
+
+## [7.1.0] - 2026-10-17
+
+Fixed:
+
+- Backup: rsync -a stored no xattrs, ACLs or hardlinks; now -aHAX
+- Restore: restore_volume_files had the same gap; now -aHAX too
+- An OpenCloud volume lost its storage metadata through a DR drill
+
+Upgrade notes:
+
+- First backup re-copies every attribute-carrying volume once in full
+- A destination without xattr support now fails the backup run outright
+- exFAT, xattr-less NFS and object-storage FUSE mounts must move first
+
+## [7.0.2] - 2026-09-23
+
+* Backup: failed live pre-copy no longer aborts when a stopped copy follows
+* Backup: stopped --checksum copy replaces pre-copy hit by live writer (rc 23)
+* Backup: failing sole live copy or failing stopped copy still fails the run
+* Tests: e2e live writer shrinking files mid-read reproduces the rsync failure
+
+## [7.0.1] - 2026-08-18
+
+- Restore: *--empty* no longer aborts on a database that carries an extension.
+  The pre-clean picked its candidates by owner, on the stated assumption that
+  extension members are superuser-owned and would therefore never be selected.
+  That holds only when a superuser installed the extension: a role that
+  installs one itself owns its functions, so they were listed for a one-by-one
+  *DROP* that postgres refuses — *cannot drop function
+  vector_in(cstring,oid,integer) because extension vector requires it*. Under
+  *ON_ERROR_STOP* that ends the whole restore, which is how a generation of an
+  application declaring the *vector* extension became unreplayable. Membership
+  now comes from *pg_depend* rather than from ownership; each branch carries
+  its oid and classid so one *NOT EXISTS* covers all seven instead of seven
+  separate predicates, and the schema branch is guarded too because an
+  extension can own a schema. Skipping the members suffices — the dump's
+  *CREATE EXTENSION IF NOT EXISTS* finds the surviving extension either way.
+
+## [7.0.0] - 2026-08-18
+
+Breaking:
+- Backup: *mariadb* and *mysql* join the suffix tokens, so a container named
+  *<app>-mariadb* or *<app>-mysql* now resolves to the instance *<app>* instead
+  of to its own name. A *databases.csv* keyed on the full container name has to
+  move to the application name, or name the container in
+  *--database-containers*. This narrows what 6.0.0 broke rather than widening
+  it: a container named exactly *postgres*, *mariadb*, *mysql*, *db* or
+  *database* resolves again without any declaration, which is the shape a
+  compose file writes as *container_name: postgres* and the most common
+  configuration there is.
+
+Fixed:
+- Backup: a container named exactly after its engine is dumped again. The
+  suffix match needs a hyphen or underscore in front of the token, which a bare
+  name does not carry, so 6.0.0 resolved *container_name: postgres* to nothing
+  and stopped dumping it without saying so. *ENGINE_NAMES* now states the set
+  once and serves both readings — carried as a suffix it makes the rest the
+  instance, being one outright makes the container its own instance.
+- Backup: a central MariaDB under swarm is dumped for the first time. Swarm
+  names its task *mariadb_mariadb.1.<id>*, which matches neither the static
+  *mariadb* passed through *--database-containers* nor any token the suffix
+  match knew, since *_mariadb* is not *_db*. The database was silently absent
+  from every swarm backup this tool has ever written, before 6.0.0 as well.
+- Backup: an application container is no longer recorded as a database.
+  *container_engine* recognises an engine by its client tools, which an
+  application image frequently ships, so refusing its dump alone would have
+  written the volume to the manifest as *database: true, dumped: false* — the
+  exact shape a restore drill reads as a database that was missed. Without an
+  instance there is no database to record, and the volume is a file backup like
+  any other.
+
 ## [6.0.0] - 2026-08-18
 
 Breaking:

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "backup-docker-to-local"
-version = "6.0.0"
+version = "7.1.1"
 description = "Backup Docker volumes to local with rsync and optional DB dumps."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -19,7 +19,7 @@ dependencies = [
 [project.optional-dependencies]
 # Pinned: a ruff minor bump changes which rules fire, and `make test` gates on
 # a clean run, so an unpinned lint would fail the suite on an unrelated day.
-lint = ["ruff==0.16.1"]
+lint = ["ruff==0.16.7"]
 
 [project.scripts]
 baudolo = "baudolo.backup.__main__:main"

src/baudolo/backup/app.py

@@ -23,6 +23,7 @@ from .layout import (
     write_manifest,
 )
 from .policy import requires_stop, volume_is_fully_ignored
+from .shell import BackupError
 from .snapshot import snapshot_source, volume_snapshot
 from .volume import backup_volume, inspect_backing
 
@@ -125,13 +126,23 @@ def main() -> int:
                     copy(authoritative=False)
                 continue
 
-            copy(authoritative=False)
-            if requires_stop(containers, args.images_no_stop_required):
-                stoppable = filter_stoppable(containers)
-                change_containers_status(stoppable, "stop")
-                copy(authoritative=True)
-                if not args.shutdown:
-                    change_containers_status(stoppable, "start")
+            if not requires_stop(containers, args.images_no_stop_required):
+                copy(authoritative=False)
+                continue
+
+            try:
+                copy(authoritative=False)
+            except BackupError as error:
+                print(
+                    f"WARNING: live pre-copy of volume '{volume_name}' failed; "
+                    f"the copy with its containers stopped replaces it.\n{error}",
+                    flush=True,
+                )
+            stoppable = filter_stoppable(containers)
+            change_containers_status(stoppable, "stop")
+            copy(authoritative=True)
+            if not args.shutdown:
+                change_containers_status(stoppable, "start")
 
     write_manifest(version_dir, outcomes)
     stamp_directory(version_dir)

src/baudolo/backup/db.py

@@ -16,13 +16,18 @@ if TYPE_CHECKING:
 
 log = logging.getLogger(__name__)
 
+ENGINE_NAMES = ("database", "postgres", "mariadb", "mysql", "db")
+_SUFFIX_RE = re.compile(rf"(_|-)({'|'.join(ENGINE_NAMES)})")
+
 
 def get_instance(container: str, database_containers: list[str]) -> str | None:
     """The databases.csv instance a container serves, or None for no database.
 
-    A declared container is its own instance. Every other name is normalised by
-    stripping a database suffix token, which maps both `<app>-database` from
-    compose and `<app>_database.1.<task>` from swarm onto the same instance.
+    A declared container is its own instance. Every other name is read against
+    ENGINE_NAMES: carrying one as a suffix makes the rest the instance, which
+    maps `<app>-database` from compose and `<app>_database.1.<task>` from swarm
+    onto the same one; being one outright makes the container its own instance,
+    the shape a compose file writes as `container_name: postgres`.
 
     Args:
         container: the running container's name.
@@ -30,14 +35,16 @@ def get_instance(container: str, database_containers: list[str]) -> str | None:
             declared engines whatever they are called.
 
     Returns:
-        The instance name, or None when the name carries no database token: an
-        application container is not an engine, even when it ships the client
-        tools that would let a dump command start.
+        The instance name, or None when the name neither carries nor is an
+        engine name: an application container is not an engine, even when it
+        ships the client tools that would let a dump command start.
     """
     if container in database_containers:
         return container
-    parts = re.split(r"(_|-)(database|db|postgres)", container)
-    return parts[0] if len(parts) > 1 else None
+    parts = _SUFFIX_RE.split(container)
+    if len(parts) > 1:
+        return parts[0]
+    return container if container in ENGINE_NAMES else None
 
 
 def fallback_pg_dumpall(

src/baudolo/backup/dumps.py

@@ -10,7 +10,7 @@ from pandas.errors import EmptyDataError
 
 from baudolo.databases import COLUMNS, DELIMITER
 
-from .db import backup_database
+from .db import backup_database, get_instance
 from .docker import has_tool, image_id
 
 DUMP_TOOLS: tuple[tuple[str, str], ...] = (
@@ -76,6 +76,8 @@ def backup_mariadb_or_postgres(
     engine = container_engine(container)
     if engine is None:
         return VolumeOutcome(database=False, dumped=False)
+    if get_instance(container, database_containers) is None:
+        return VolumeOutcome(database=False, dumped=False)
     db_type, dump_tool = engine
     dumped = backup_database(
         container=container,

src/baudolo/backup/volume.py

@@ -75,7 +75,7 @@ def backup_volume(
     pathlib.Path(dest).mkdir(parents=True, exist_ok=True)
 
     last = get_last_backup_dir(versions_dir, volume_name, dest)
-    cmd = ["rsync", "-aP", "--no-D", "--delete", "--delete-excluded"]
+    cmd = ["rsync", "-aHAX", "-P", "--no-D", "--delete", "--delete-excluded"]
     if authoritative:
         cmd.append("--checksum")
     if last:

src/baudolo/restore/db/empty_preclean.sql

@@ -3,8 +3,12 @@
 -- would run every DROP in one transaction and exhaust max_locks_per_transaction on
 -- large schemas (e.g. gitlab). Also drops user-owned non-public schemas so a dump
 -- that CREATE SCHEMAs (e.g. discourse's discourse_functions) does not fail on an
--- already-existing schema. Extension members (pg_trgm's set_limit) are
--- superuser-owned; IF EXISTS absorbs the CASCADE fallout.
+-- already-existing schema. Objects belonging to an extension are skipped: postgres
+-- refuses to drop them one by one ("cannot drop function vector_in(...) because
+-- extension vector requires it"), and the dump's CREATE EXTENSION IF NOT EXISTS
+-- finds the surviving extension either way. Owning them is not enough to make them
+-- droppable - an extension a role installed itself is owned by that role, so the
+-- owner filter alone lets pgvector's members through.
 SELECT format('DROP %s IF EXISTS public.%s CASCADE', obj.type, obj.name)
   FROM (
     SELECT format('%I', c.relname) AS name,
@@ -13,7 +17,8 @@ SELECT format('DROP %s IF EXISTS public.%s CASCADE', obj.type, obj.name)
              WHEN 'm' THEN 'MATERIALIZED VIEW'
              WHEN 'f' THEN 'FOREIGN TABLE'
              ELSE 'TABLE'
-           END AS type
+           END AS type,
+           c.oid AS objid, 'pg_class'::regclass AS classid
       FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
      WHERE n.nspname = 'public' AND c.relkind IN ('r', 'p', 'v', 'm', 'f')
        AND pg_get_userbyid(c.relowner) = current_user
@@ -21,17 +26,20 @@ SELECT format('DROP %s IF EXISTS public.%s CASCADE', obj.type, obj.name)
     -- Overloaded functions share a proname; DROP needs the identity
     -- signature or psql aborts with "function name is not unique".
     SELECT format('%I(%s)', p.proname, pg_get_function_identity_arguments(p.oid)) AS name,
-           CASE p.prokind WHEN 'p' THEN 'PROCEDURE' ELSE 'FUNCTION' END AS type
+           CASE p.prokind WHEN 'p' THEN 'PROCEDURE' ELSE 'FUNCTION' END AS type,
+           p.oid AS objid, 'pg_proc'::regclass AS classid
       FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
      WHERE n.nspname = 'public' AND p.prokind IN ('f', 'p', 'w')
        AND pg_get_userbyid(p.proowner) = current_user
     UNION ALL
-    SELECT format('%I', c.relname) AS name, 'SEQUENCE' AS type
+    SELECT format('%I', c.relname) AS name, 'SEQUENCE' AS type,
+           c.oid AS objid, 'pg_class'::regclass AS classid
       FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
      WHERE n.nspname = 'public' AND c.relkind = 'S'
        AND pg_get_userbyid(c.relowner) = current_user
     UNION ALL
-    SELECT format('%I', t.typname) AS name, 'TYPE' AS type
+    SELECT format('%I', t.typname) AS name, 'TYPE' AS type,
+           t.oid AS objid, 'pg_type'::regclass AS classid
       FROM pg_type t JOIN pg_namespace n ON n.oid = t.typnamespace
      WHERE n.nspname = 'public'
        AND pg_get_userbyid(t.typowner) = current_user
@@ -40,25 +48,36 @@ SELECT format('DROP %s IF EXISTS public.%s CASCADE', obj.type, obj.name)
                   SELECT 1 FROM pg_class c2
                    WHERE c2.oid = t.typrelid AND c2.relkind = 'c')))
     UNION ALL
-    SELECT format('%I', col.collname) AS name, 'COLLATION' AS type
+    SELECT format('%I', col.collname) AS name, 'COLLATION' AS type,
+           col.oid AS objid, 'pg_collation'::regclass AS classid
       FROM pg_collation col JOIN pg_namespace n ON n.oid = col.collnamespace
      WHERE n.nspname = 'public'
        AND pg_get_userbyid(col.collowner) = current_user
     UNION ALL
-    SELECT format('%I', ts.cfgname) AS name, 'TEXT SEARCH CONFIGURATION' AS type
+    SELECT format('%I', ts.cfgname) AS name, 'TEXT SEARCH CONFIGURATION' AS type,
+           ts.oid AS objid, 'pg_ts_config'::regclass AS classid
       FROM pg_ts_config ts JOIN pg_namespace n ON n.oid = ts.cfgnamespace
      WHERE n.nspname = 'public'
        AND pg_get_userbyid(ts.cfgowner) = current_user
     UNION ALL
-    SELECT format('%I', d.dictname) AS name, 'TEXT SEARCH DICTIONARY' AS type
+    SELECT format('%I', d.dictname) AS name, 'TEXT SEARCH DICTIONARY' AS type,
+           d.oid AS objid, 'pg_ts_dict'::regclass AS classid
       FROM pg_ts_dict d JOIN pg_namespace n ON n.oid = d.dictnamespace
      WHERE n.nspname = 'public'
        AND pg_get_userbyid(d.dictowner) = current_user
   ) obj
+ WHERE NOT EXISTS (
+         SELECT 1 FROM pg_depend dep
+          WHERE dep.classid = obj.classid AND dep.objid = obj.objid
+            AND dep.deptype = 'e')
 UNION ALL
 SELECT format('DROP SCHEMA IF EXISTS %I CASCADE', n.nspname)
   FROM pg_namespace n
  WHERE NOT starts_with(n.nspname, 'pg_')
    AND n.nspname NOT IN ('public', 'information_schema')
    AND pg_get_userbyid(n.nspowner) = current_user
+   AND NOT EXISTS (
+         SELECT 1 FROM pg_depend dep
+          WHERE dep.classid = 'pg_namespace'::regclass AND dep.objid = n.oid
+            AND dep.deptype = 'e')
 \gexec

src/baudolo/restore/files.py

@@ -59,6 +59,6 @@ def restore_volume_files(volume_name: str, backup_files_dir: str) -> int:
     # rsync reads "dir/" as its contents and "dir" as the directory itself.
     src = f"{Path(backup_files_dir)}{os.sep}"
     dest = f"{Path(mountpoint)}{os.sep}"
-    run(["rsync", "-avv", "--delete", src, dest])
+    run(["rsync", "-aHAX", "-vv", "--delete", src, dest])
     print("File restore complete.")
     return 0

tests/e2e/helpers/fixtures.py

@@ -25,7 +25,7 @@ def backup_run(
     images_no_stop_required: list[str],
     images_no_backup_required: list[str] | None = None,
     only_sql: bool = False,
-) -> None:
+) -> subprocess.CompletedProcess:
     cmd = [
         "baudolo",
         "--compose-dir",
@@ -49,7 +49,7 @@ def backup_run(
         cmd += ["--only-sql"]
 
     try:
-        run(cmd, capture=True, check=True)
+        return run(cmd, capture=True, check=True)
     except subprocess.CalledProcessError as e:
         print(">>> baudolo failed (exit code:", e.returncode, ")")
         if e.stdout:

tests/e2e/helpers/process.py

@@ -96,12 +96,13 @@ def wait_for_mariadb(
     container: str, *, root_password: str, timeout_s: int = 90
 ) -> None:
     """
-    Liveness probe for MariaDB.
+    Readiness probe for MariaDB, as root over the socket.
 
-    IMPORTANT (MariaDB 11):
-    Root TCP auth is often restricted (unix_socket auth), so a TCP ping like
-    `mariadb-admin -uroot -p... -h localhost ping` can fail even though the server is up.
-    We therefore check readiness via a socket-based query.
+    The entrypoint drops root@127.0.0.1, so root is socket-only, and it
+    installs root@localhost without unix_socket auth: a probe without the
+    password only passes in the init window before the password is set.
+    `@@skip_networking` must be 0 so the entrypoint's temporary server,
+    which shuts down right after init, does not count as ready.
     """
     deadline = time.time() + timeout_s
     while time.time() < deadline:
@@ -112,12 +113,15 @@ def wait_for_mariadb(
                 container,
                 "sh",
                 "-lc",
-                'mariadb -uroot --protocol=socket -e "SELECT 1;"',
+                (
+                    f"mariadb -uroot -p{root_password} --protocol=socket "
+                    '-N -e "SELECT @@skip_networking;"'
+                ),
             ],
             capture=True,
             check=False,
         )
-        if p.returncode == 0:
+        if p.returncode == 0 and p.stdout.strip() == "0":
             return
         time.sleep(1)
     raise TimeoutError(

tests/e2e/test_e2e_app_container_ships_client_tools.py

@@ -13,10 +13,11 @@ by its own launcher and ships pg_dumpall, so a dump command starts there and
 writes a file that looks like a backup and holds none of the data.
 """
 
+import json
 import unittest
 from pathlib import Path
 
-from baudolo.generation import DUMP_SUFFIX, FILES_DIR, SQL_DIR
+from baudolo.generation import DUMP_SUFFIX, FILES_DIR, MANIFEST_FILE, SQL_DIR
 
 from .helpers import (
     POSTGRES_DATA_DIR,
@@ -158,6 +159,26 @@ class TestE2EAppContainerShipsClientTools(unittest.TestCase):
         self.assertTrue(marker.is_file(), f"expected a file backup at {marker}")
         self.assertIn(MARKER, marker.read_text(encoding="utf-8"))
 
+    def test_the_manifest_does_not_call_the_application_volume_a_database(self) -> None:
+        manifest = json.loads(
+            (self.volume_dir(self.app_volume).parent / MANIFEST_FILE).read_text(
+                encoding="utf-8"
+            )
+        )
+        entry = manifest["volumes"][self.app_volume]
+        self.assertFalse(entry["database"], entry)
+        self.assertFalse(entry["dumped"], entry)
+
+    def test_the_manifest_records_the_engine_volume_as_dumped(self) -> None:
+        manifest = json.loads(
+            (self.volume_dir(self.engine_volume).parent / MANIFEST_FILE).read_text(
+                encoding="utf-8"
+            )
+        )
+        entry = manifest["volumes"][self.engine_volume]
+        self.assertTrue(entry["database"], entry)
+        self.assertTrue(entry["dumped"], entry)
+
 
 if __name__ == "__main__":
     unittest.main()

tests/e2e/test_e2e_files_live_writer_precopy.py

@@ -0,0 +1,110 @@
+"""A writer that shrinks files mid-read fails the live pre-copy, not the run."""
+
+import unittest
+
+from .helpers import (
+    backup_path,
+    backup_run,
+    cleanup_docker,
+    create_minimal_compose_dir,
+    ensure_empty_dir,
+    latest_version_dir,
+    require_docker,
+    run,
+    unique,
+    wait_for_log,
+    write_databases_csv,
+)
+
+CHURN_FILES = 8
+
+WRITER = f"""
+trap 'exit 0' TERM
+echo hello > /data/hello.txt
+for i in $(seq 1 {CHURN_FILES}); do
+  (while :; do truncate -s 0 /data/churn$i; truncate -s 16M /data/churn$i; done) &
+done
+echo ready
+wait
+"""
+
+
+class TestE2EFilesLiveWriterPreCopy(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        require_docker()
+        cls.prefix = unique("baudolo-e2e-live-writer")
+        cls.backups_dir = f"/tmp/{cls.prefix}/Backups"
+        ensure_empty_dir(cls.backups_dir)
+
+        cls.compose_dir = create_minimal_compose_dir(f"/tmp/{cls.prefix}")
+        cls.repo_name = cls.prefix
+
+        cls.volume = f"{cls.prefix}-vol"
+        cls.writer = f"{cls.prefix}-writer"
+        cls.containers = [cls.writer]
+        cls.volumes = [cls.volume]
+
+        run(["docker", "volume", "create", cls.volume])
+        run(
+            [
+                "docker",
+                "run",
+                "-d",
+                "--name",
+                cls.writer,
+                "-v",
+                f"{cls.volume}:/data",
+                "alpine:3.20",
+                "sh",
+                "-c",
+                WRITER,
+            ]
+        )
+        wait_for_log(cls.writer, "ready")
+
+        cls.databases_csv = f"/tmp/{cls.prefix}/databases.csv"
+        write_databases_csv(cls.databases_csv, [])
+
+        cls.result = backup_run(
+            backups_dir=cls.backups_dir,
+            repo_name=cls.repo_name,
+            compose_dir=cls.compose_dir,
+            databases_csv=cls.databases_csv,
+            database_containers=["dummy-db"],
+            images_no_stop_required=["dummy-image"],
+        )
+
+        cls.hash, cls.version = latest_version_dir(cls.backups_dir, cls.repo_name)
+
+    @classmethod
+    def tearDownClass(cls) -> None:
+        cleanup_docker(containers=cls.containers, volumes=cls.volumes)
+
+    def test_the_live_pre_copy_hit_the_writer(self) -> None:
+        self.assertIn(
+            f"WARNING: live pre-copy of volume '{self.volume}' failed",
+            self.result.stdout,
+            "the writer never shrank a file under rsync, so this run proves nothing",
+        )
+
+    def test_the_stopped_copy_captured_the_volume(self) -> None:
+        files = (
+            backup_path(self.backups_dir, self.repo_name, self.version, self.volume)
+            / "files"
+        )
+        self.assertEqual((files / "hello.txt").read_text().strip(), "hello")
+        self.assertEqual(
+            sorted(p.name for p in files.glob("churn*")),
+            sorted(f"churn{i}" for i in range(1, CHURN_FILES + 1)),
+        )
+
+    def test_the_writer_runs_again_after_the_backup(self) -> None:
+        state = run(
+            ["docker", "inspect", "-f", "{{.State.Running}}", self.writer]
+        ).stdout.strip()
+        self.assertEqual(state, "true")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/e2e/test_e2e_mariadb_anonymous_preemption.py

@@ -100,7 +100,10 @@ class TestE2EMariaDBAnonymousPreemption(unittest.TestCase):
                 cls.db_container,
                 "sh",
                 "-lc",
-                f'mariadb -uroot --protocol=socket -e "{bootstrap_sql}"',
+                (
+                    f"mariadb -uroot -p{cls.root_password} --protocol=socket "
+                    f'-e "{bootstrap_sql}"'
+                ),
             ]
         )
 

tests/e2e/test_e2e_postgres_empty_drop_hard.py

@@ -24,6 +24,7 @@ from .helpers import (
 # is not unique") and english_stem_nostop reproduces taiga's text search
 # dictionary abort (duplicate pg_ts_dict_dictname_index).
 SCENARIO_SQL = (
+    "CREATE EXTENSION pg_trgm;"
     "CREATE SCHEMA discourse_functions;"
     "CREATE TABLE discourse_functions.helper (id int);"
     "INSERT INTO discourse_functions.helper VALUES (1);"
@@ -166,6 +167,13 @@ class TestE2EPostgresEmptyDropHard(unittest.TestCase):
         )
         self.assertEqual(self._scalar("SELECT public.f(41) + public.f();"), "42")
 
+    def test_the_extension_survived_the_preclean(self) -> None:
+        self.assertEqual(
+            self._scalar("SELECT count(*) FROM pg_extension WHERE extname='pg_trgm';"),
+            "1",
+        )
+        self.assertEqual(self._scalar("SELECT similarity('abc','abc')::int;"), "1")
+
     def test_text_search_dictionary_restored_once(self) -> None:
         self.assertEqual(
             self._scalar(

tests/unit/backup/test_app_live_precopy.py

@@ -0,0 +1,70 @@
+"""Contract of app.main's live copy when no snapshot is taken."""
+
+from __future__ import annotations
+
+import unittest
+from unittest import mock
+
+from baudolo.backup import app
+from baudolo.backup.shell import BackupError
+from baudolo.backup.volume import Backing
+
+from . import BASE_ARGV
+
+
+def drive(*, stop: bool, fail_live: bool) -> list[str]:
+    events: list[str] = []
+
+    def record(versions_dir, volume_name, volume_dir, *, authoritative, source):
+        events.append("authoritative" if authoritative else "live")
+        if fail_live and not authoritative:
+            raise BackupError("rsync exit code 23")
+
+    with (
+        mock.patch("sys.argv", BASE_ARGV),
+        mock.patch.object(app, "get_machine_id", return_value="machine"),
+        mock.patch.object(app, "create_version_directory", return_value="/gen"),
+        mock.patch.object(app, "create_volume_directory", return_value="/gen/vol"),
+        mock.patch.object(app, "load_databases_df", return_value=None),
+        mock.patch.object(app, "docker_volume_names", return_value=["vol"]),
+        mock.patch.object(app, "containers_using_volume", return_value=["c"]),
+        mock.patch.object(app, "volume_is_fully_ignored", return_value=False),
+        mock.patch.object(app, "backup_dumps_for_volume", return_value=(False, False)),
+        mock.patch.object(
+            app,
+            "inspect_backing",
+            return_value=Backing("/var/lib/docker/volumes/vol/_data"),
+        ),
+        mock.patch.object(app, "requires_stop", return_value=stop),
+        mock.patch.object(app, "filter_stoppable", return_value=["c"]),
+        mock.patch.object(
+            app,
+            "change_containers_status",
+            side_effect=lambda containers, status: events.append(status),
+        ),
+        mock.patch.object(app, "write_manifest"),
+        mock.patch.object(app, "stamp_directory"),
+        mock.patch.object(app, "handle_docker_compose_services"),
+        mock.patch.object(app, "backup_volume", side_effect=record),
+    ):
+        app.main()
+    return events
+
+
+class TestLivePreCopy(unittest.TestCase):
+    def test_a_failed_pre_copy_is_replaced_by_the_stopped_copy(self) -> None:
+        self.assertEqual(
+            drive(stop=True, fail_live=True),
+            ["live", "stop", "authoritative", "start"],
+        )
+
+    def test_a_failed_live_copy_without_a_stop_aborts_the_run(self) -> None:
+        with self.assertRaises(BackupError):
+            drive(stop=False, fail_live=True)
+
+    def test_a_volume_without_a_stop_is_copied_live_once(self) -> None:
+        self.assertEqual(drive(stop=False, fail_live=False), ["live"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/backup/test_get_instance.py

@@ -24,12 +24,21 @@ class TestDeclaredContainers(unittest.TestCase):
             get_instance("shop-database", ["shop-database"]), "shop-database"
         )
 
-    def test_an_undeclared_central_engine_resolves_to_nothing(self) -> None:
-        """`postgres-central` has no separator before its token, so nothing is
-        stripped - a central engine has to be declared to be found."""
+    def test_a_qualified_central_name_still_has_to_be_declared(self) -> None:
         self.assertIsNone(get_instance("postgres-central", []))
 
 
+class TestContainersNamedAfterTheirEngine(unittest.TestCase):
+    def test_a_bare_engine_name_is_its_own_instance(self) -> None:
+        for name in ("postgres", "mariadb", "mysql", "db", "database"):
+            with self.subTest(container=name):
+                self.assertEqual(get_instance(name, []), name)
+
+    def test_a_swarm_task_of_such_a_container_keeps_the_instance(self) -> None:
+        self.assertEqual(get_instance("postgres_postgres.1.k3f9x2", []), "postgres")
+        self.assertEqual(get_instance("mariadb_mariadb.1.k3f9x2", []), "mariadb")
+
+
 class TestDedicatedEngines(unittest.TestCase):
     def test_compose_names_the_container_with_a_hyphen(self) -> None:
         self.assertEqual(get_instance("discourse-database", []), "discourse")
@@ -49,6 +58,10 @@ class TestDedicatedEngines(unittest.TestCase):
     def test_mariadb_uses_the_same_suffix(self) -> None:
         self.assertEqual(get_instance("matomo-database", []), "matomo")
 
+    def test_an_engine_named_suffix_is_stripped_too(self) -> None:
+        self.assertEqual(get_instance("shop-mariadb", []), "shop")
+        self.assertEqual(get_instance("shop-mysql", []), "shop")
+
 
 class TestApplicationContainers(unittest.TestCase):
     def test_a_bare_application_name_is_not_a_database(self) -> None:

tests/unit/backup/test_volume.py

@@ -46,9 +46,12 @@ class TestBackupVolume(unittest.TestCase):
     def test_it_carries_no_kernel_objects_into_a_generation(self) -> None:
         self.assertIn("--no-D", self.copy())
 
+    def test_it_stores_the_metadata_a_restore_has_to_give_back(self) -> None:
+        self.assertIn("-aHAX", self.copy())
+
     def test_it_keeps_no_twin_of_what_the_second_pass_replaces(self) -> None:
         command = self.copy(authoritative=True)
-        self.assertEqual(command[:2], ["rsync", "-aP"])
+        self.assertEqual(command[:3], ["rsync", "-aHAX", "-P"])
         self.assertNotIn("--backup", command)
 
     def test_it_creates_the_destination(self) -> None: