Full fleet-script rehearsal

The opt-in rehearsal runs the repository's fleet-capture.sh, format-2 pack verification and fleet-restore.sh across two freshly created local Linux VMs. It uses the real Linux agent, real Postgres, and a real named volume. The scripts are copied without test path rewrites. Public-IP discovery alone is pinned to a documentation address to avoid an external lookup.

HOSTSSH_FLEET_RECOVERY_DRILL=1 \
HOSTSSH_DRILL_VM_IMAGE=/absolute/path/to/cached-colima-vm-image \
HOSTSSH_DRILL_DOCKER_HOST=unix:///absolute/path/to/existing/docker.sock \
node --test scripts/recovery-fleet-drill.test.mjs

Prerequisites: installed Colima, Docker CLI, Node and Go; a local cached aarch64 VM image; an already-present arm64 pgvector/pgvector:pg18 image on the specified local Unix socket. The harness exports that image locally and loads it into its own VMs. It installs no project dependencies and does not pull a container image. A suitable cached VM image must already provide Docker, Bash, tar and standard file utilities.

Each random profile has 2 CPUs, 2 GiB RAM, an 8 GiB data disk and the runtime's separate root disk. Host directory mounts and SSH-agent forwarding are disabled. The active Docker context is unchanged. Cleanup deletes only the newly created profiles and their data disks, plus the private temporary export/artifacts. A killed test process can prevent cleanup; inspect the exact hostssh-fleet-<random>-source/target profiles before removing them.

The source fixture has 100 synthetic PostgreSQL rows with Unicode, NULL and binary data and a named volume with regular files. Capture emits a tar archive into a private host buffer; that buffer becomes restore's stdin in the other VM. Ordered database and file-content fingerprints must match. The source must remain unchanged. A repeated restore must refuse the occupied target and preserve its data. The test skips unless explicitly enabled.

Existing systemd units

A fresh VM already has some of the same systemd units as its source. Restore preserves an existing unit when its readable regular-file contents match the captured unit. This includes preserving an existing symlink whose target has identical contents; it is not replaced by a regular file. Different contents still cause preflight refusal. New unit copies use no-clobber copying and content verification so a path occupied after preflight cannot be overwritten. Other occupied destination guards remain in force.

What passed, and what did not

The 2026-09-05 rehearsal passed with a 61,440-byte artifact and matching database/volume fingerprints. Both temporary VMs were removed. It also emitted the existing global-role SQL warning role "gmadmin" already exists. Data parity passed despite that warning; role and permission parity was not established, and global-role error handling was not changed.

This is a cross-VM script/data rehearsal on one physical Mac. It is not the encrypted peer transfer protocol, remote-host/network recovery, a populated control-plane brain replacement, application/TLS verification within the fleet script, consistent live-database raw-volume capture, or production DNS cutover. Empty/absent optional layers do not prove their restoration.