fix(backups): verify that the original game resumes saving before clearing cleanup #871

Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.

Finding

A successful RCON exchange is accepted even when the game rejects the command in its response. The operator can also accept a successful HTTP response with a missing or contradictory quiesced field.

Work

Define an explicit, verified pause/resume acknowledgment. Validate game responses using the supported engine contract, serialize the full command sequence, and preserve the cleanup obligation across reconcile/restart until the original game incarnation is confirmed resumed or retired under the existing fencing rules. Preserve the explicit original-process-gone path, durable ownership transfer and finalizer escape semantics.

Acceptance criteria

Exercise command rejection over a successful transport, empty/malformed status and a contradictory boolean, timeout after the first of several commands, duplicate retries, operator restart, and replacement of the original game container. Confirm automated saves actually resume and recovery remains observable when they do not.

PR ownership and prior work

Own the agent/client response contract, negative-response fixtures and persisted cleanup behavior. H03 consumes this contract for its consistency classification. Original incarnation, worker drainage, expiry and cleanup work landed in #760, #833, #836 and #846.

Agent · Operator client · Cleanup and ownership

Qualification evidence

In PR #899 at ebc59fcd, the agent and operator suites passed on amd64 and arm64. The controller regression distinguishes a recorded container exit from an unconfirmed Waiting state after restart. The kind backup-preparation and same-node copy test also passed (106.70 seconds). Operator amd64 · Operator arm64 · Agent amd64 · Agent arm64 · Kind backup drill

#899 at a4157b699592c5ec64d6889fc9c57bcbe7894efd. The Minecraft 1.21.4 client joined, the live backup completed its pause/resume protocol, and the game wrote a new command-storage marker through autonomous ticks without a manual save or shutdown (545.58s). The two-node preparation and same-node Restic copy test also passed (189.74s). Minecraft and autosave · Two-node backup preparation