PoolFS recovery test record

This is a dated record of prototype testing, including formats older than the current v6 format. It describes observed results, not a procedure to reproduce machine-level interruption tests. Use the PoolFS README for current setup and commands, and the v6 integrity guide for the current recovery boundaries.

One Hyper-V guest reset (November 13, 2026)

A fresh v6 pool with 384 MiB and 512 MiB members was writing a 4 KiB probe and flushing a separate acknowledgement log when the guest VM was reset. Windows recorded Kernel-Power event 41 and EventLog event 6008, with no orderly shutdown event in the inspected window. Microsoft describes these events as an unclean restart. The VM checkpoint was not restored before verification.

The last complete acknowledged generation was 378. After remount, the probe contained exactly generation 378, with SHA-256 68380D704CD249774998BB73E562D7D70B49305C86903FA54BF817A7A885F727. The offline scrub reported CLEAN; the checker found 380 common journal records and reported CLEAN without repair. This was one guest reset with the hypervisor and storage host still powered. It does not establish recovery from physical host power loss, volatile device-cache loss, or other interruption timings.

V4 process-exit sweep (November 12, 2026)

An internal harness interrupted v4 member writes and flushes at 54 distinct I/O boundaries, both before and after each call. The full sweep passed in 540.6 seconds. Each successful reopen showed either the old or new target state and retained a previously acknowledged anchor.

These were PoolFS process exits, not host power loss or torn physical sectors. A separate v4 three-member checker trial resumed an interrupted final-tail repair from durable undo sidecars and returned CLEAN; the checker could not reconstruct file-data bytes.

V5 integrity and process exits (November 13, 2026)

V5 tests covered normal reads, unaligned overwrite, truncation and regrowth, reopening, and reversed member-path order. A changed data byte or checksum cell raised Corrupt on read, and the offline scrub identified the affected file and member. The scrub refused mounted member images.

Write and overwrite each underwent 18 interrupted trials at nine I/O boundaries. In each sweep, 13 reopened to the old state and five to the new state; none returned wrong bytes or lost the acknowledged anchor. A 150 MiB cross-member file retained its SHA-256 through forced mount restarts and scrubbed clean. V5 updated its checksum table in place, so a torn containing sector could damage neighboring checksum cells. These tests did not simulate host power loss or controller-cache failure.

V6 checksum and recovery tests (November 13, 2026)

V6 fixtures retained data blocks and checksum pages named by the selected durable checkpoint. After later journal records were discarded, they reopened the checkpoint with its original bytes and scrubbed clean. Near-full fixtures rotated a checkpoint before reusing retained space. V6 also detected changed data blocks and selected checksum pages on read and in offline scrub.

Write and overwrite process-exit sweeps each exercised nine I/O boundaries: 13 trials reopened to the old state and five to the new state. Checkpoint rotation exercised 26 boundaries: 47 old and five new. No trial returned wrong bytes or lost its acknowledged anchor. These were process-exit and partial page-write simulations; they do not establish physical power-loss safety.

A three-member final-tail repair trial stopped after two members had flushed a new journal record. Inspection reported INTERRUPTED_FINAL_COMMIT. A second interruption during repair left undo sidecars and PENDING_REPAIR; retry restored the sidecars, discarded the uncertain final operation, and reopened writable with a clean scrub. Damaged or divergent valid journal records were rejected without creating sidecars. The same retry path passed with mixed-size 384, 512, and 640 MiB members. These results validate that narrow repair path, not reconstruction of damaged data.

For atomic file replacement, a focused sweep interrupted six member write/flush boundaries on either side of the call. Across 12 trials, seven reopened with the old source and destination and five with the new destination; none produced a mixed state. A mounted WinFsp test retained a 152 MiB cross-member file's SHA-256 after remount and finished with a clean scrub and checker. This does not include a new abrupt VM reset during replacement.

Tests still needed

An external power-cut oracle and an on-host probe were documented as internal test plans. The records above do not show a completed physical power-loss trial. Controller-cache behavior, torn sectors, missing-member cases, and wider Windows compatibility need more validation. Keep an independent backup of PoolFS data you care about.