fix(backups): distinguish flushed saves from verified write freezes #870

Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.

Finding

The official ARK: Survival Ascended template requests SaveWorld at both boundaries. A subsequent write during a Restic traversal can therefore leave a mixed-generation backup that is reported as Quiesced. The official Project Zomboid module also uses the same save command on both sides of the copy.

Work

Represent flush-only, verified write freeze and stopped/drained distinctly in the module and Backup status. Treat unqualified legacy hooks conservatively. Keep the old snapshot readable. Provide a safe stopped-copy route for ARK and make the ARK: Survival Ascended and Project Zomboid modules advertise only guarantees they can establish.

Acceptance criteria

Back up while a known world and player marker change. Restore the copy, join, verify markers and complete another save. Cover freeze timeout, raw/flush-only status, restricted multi-volume coverage and SQLite integrity where applicable. Qualify each engine that claims a live freeze.

PR ownership and prior work

Consume the H04 acknowledgment and identity checks. The platform PR owns consistency semantics and fixtures. The companion GameplanePanel/module PR owns the two affected engine declarations and their module releases. An immediately safe metadata-only downgrade can ship first. Build on the consistency status of #767 and stopped/multivolume backup in #861. The existing ARK query fixture cannot demonstrate a successful player join.

ARK commands · Palworld behavior · Minecraft commands · Consistency calculation · Project Zomboid save hooks

Recovery qualification on a0891c6b9fa749a900ca1d7d925e576a6046e022

Minecraft Java 1.21.4 accepted the real client before capture and after Restic restored the save. The world marker and player score changed from their captured values during the acknowledged freeze, and changed again after the copy. The restored server returned the original world marker and score 17, accepted score 18 and acknowledged another flushed save. A post-resume marker reached disk through native autosave. The live test completed in 532.71 seconds. Minecraft capture, restore and rejoin

Two independent stopped Restic snapshots each restored a SQLite database with PRAGMA integrity_check returning ok and the expected player score of 17 (190.68 seconds). The multi-volume recovery test passed its suspended, idle, missing-claim and changed-path cases (556.46 seconds). ARM64 operator recovery tests