# The other half of the restore drill. carlos-restore-verify.service proves
# every database named in /etc/litestream.yml; that config deliberately OMITS
# hibernating instances, because the activator's embedded litestream owns
# their replication under its lease and a second replicator on the same WAL
# would corrupt the replica. The consequence, until this unit existed, was
# that the fleet's largest set of app databases was the one set nobody ever
# drilled — the first thing to learn whether a hibernating tenant's replica
# restores clean was a real user's wake.
#
# This restores each of those replicas into a private tmp, integrity-checks
# it, and publishes a per-host verdict to the deployment bucket
# (control/restore-verify.json) so the result is readable WITHOUT a session on
# this box. A damaged replica leaves the unit 'failed'; a replica the pass
# could not reach is recorded 'unverified' and does not fail the run.
#
# Inert until /etc/carlos/host.env carries CARLOS_HIBERNATE_BUCKET — a box
# with no hibernating instances prints that and exits 0.
[Unit]
Description=carlos hibernate-verify (restore-drill the activator-owned replicas)
After=network-online.target carlos-edge.service
Wants=network-online.target

[Service]
Type=oneshot
# Same host-wide config the edge reads: CARLOS_HIBERNATE_* names the replica
# set, CARLOS_DEPLOYMENT_BUCKET/_DIR is where the verdict is published.
# Deliberately NOT /data/litestream.env — those credentials belong to the
# box-wide replication bucket, and borrowing them here would sign for the
# wrong store.
EnvironmentFile=-/etc/carlos/host.env
ExecStart=/opt/carlos/carlos ops hibernate-verify
# Disk, not the PrivateTmp tmpfs — see carlos-restore-verify.service's note
# for the measurements. This drill is where it mattered most: the flagship's
# largest hibernating tenant is 412M and the first live run peaked at 485.6M
# against a 512M ceiling. On tmpfs that gap was ~30M of tenant growth away
# from an OOM kill on the very databases the drill is there to vouch for; on
# disk the same overrun only slows it down.
CacheDirectory=carlos-verify
Environment=TMPDIR=%C/carlos-verify
User=carlos
Group=carlos
CapabilityBoundingSet=
NoNewPrivileges=yes
ProtectSystem=strict
# The registry is opened (read-only in effect, but SQLite wants the file and
# its directory writable to attach WAL) — the same grant carlos-edge.service
# holds, for a unit running as the user that already owns /data.
ReadWritePaths=/data
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_INET AF_INET6
MemoryDenyWriteExecute=yes
# One-at-a-time by construction — lease.VerifyReplica deletes each throwaway
# copy in a defer — so this needs to clear the largest single tenant, not the
# fleet. Same ceiling and the same WATCH note as the sibling unit.
MemoryMax=512M