cold-store-reaper: project-budget enforcement in put-backup never counts backup bytes — cumulative backups can cross the 3 TiB budget unrefused (PR #988)

Finding

PR #988 added project-budget enforcement to put_backup(), but the accounting it enforces against never counts backup bytes — so the cumulative backup stream can cross the 3 TiB project budget without ever being refused, and status's within_budget verdict has the same blind spot.

Evidence (verified on current main `76672b97df023607d8469d462f21420604fe92d5`, via `gh pr diff 988` and the local clone)

pkgs/cold-store-reaper/cold_store.py:

_upload_accounting() (lines ~459–482) defines cold_bytes as verified bundles only:
```
SELECT coalesce(sum(bytes),0) n FROM bundles WHERE state='verified'
```
_check_upload_limits() (lines ~485–507) refuses when cold_bytes + nbytes > project_budget_bytes.
put_backup() (lines ~933–960) calls _check_upload_limits(conn, size, …) before uploading, then records the backup only in the transfer ledger (ledger_add(conn, "upload", size, "backup-upload", name)). Backups are unbundled Drive files (db-backups/<db>/); they never enter the bundles table.

Consequences:

For a put_backup call, the budget side of the check compares bundle bytes + this one backup against the budget. Yesterday's backups contribute 0. A backup stream of any cumulative size passes as long as each individual file fits under budget − bundle_bytes and the rolling-24h hard stop (the only cumulative accounting backups do get, and it forgets after 24h).
This is now the main growth path: backup-d1 and backup-supabase go through put_backup, and PR cold-store: nightly Turso exports via HTTP APIs #993 added a nightly Turso export through the same path. Retention (prune-backups) bounds count by age class, but nothing bounds total backup bytes against the budget the PR claims to enforce.
status_data() reuses the same accounting, so its cold_bytes / within_budget readout also excludes every DB backup sitting in Drive.

PR #988's tests cover a single put_backup against a tiny budget (cold = 0 bundles + one file) and the bundle-path refusals, but no sequence of backups accumulating past the budget.

Deduped 2026-10-26: gh issue list --search 'put-backup project budget' returns only #938 (closed by PR #988 — this is a remainder of that enforcement, not a re-file of the original "never enforced" report) and #939 (retention, unrelated mechanism).

Why it matters

#938 was filed because the limits were "reported but never enforced". After PR #988 the daily hard stop is genuinely enforced for all paths, but the project budget is still effectively unenforced for the backup class — the class that grows every night — while the README ("Upload guardrails (enforced, not just reported)") and status both present it as enforced. A silent Drive blow-out past 3 TiB is the failure the budget exists to prevent.

Acceptance criteria

Triage decides the correct cumulative accounting for backups (e.g. a backups total tracked in the manifest/meta, Drive folder totals, or ledger sums over the retention window — whatever can be kept truthful), and put_backup's budget check uses it so that a sequence of backups whose cumulative total crosses project_budget_bytes is refused.
Regression test: two or more put_backup calls that individually fit but cumulatively cross the budget — the crossing call is refused with a ColdStoreError naming the project budget, and no Drive writes occur for it.
status's budget readout reflects the same accounting the enforcement uses (one implementation, per PR cold-store-reaper: enforce upload hard stop + budget (#938), stop persisting access token (#940), retention verified (#939) #988's own design principle), or explicitly scopes its claim to bundles.
Bundle-path enforcement and the daily hard stop behave exactly as before; existing TestUploadLimits tests still pass.

Source: PR #988 — #988 (commits a6ac921, 78f2707, 0789776); backup-stream growth via PR #993 — #993. Relates to closed #938. Filed by the pr-diff-review job, 2026-10-26.

CODE-182

🤖 Agent note · filed

Agent: pr-diff-review job
Session / ID: pr-diff-review cron run 2026-10-26 18:24 CDT
Found via: filed this run
Task: PR cold-store-reaper: enforce upload hard stop + budget (#938), stop persisting access token (#940), retention verified (#939) #988's put-backup project-budget check uses _upload_accounting cold_bytes = verified bundles only; backups never enter that total (ledger only, rolling 24h), so cumulative nightly backups (D1/Supabase, plus Turso from PR cold-store: nightly Turso exports via HTTP APIs #993) can cross the 3 TiB budget unrefused and status within_budget has the same blind spot. Verified on current main 76672b9 via gh pr diff 988 and the local clone; deduped (cold-store-reaper: 700 GB/day upload hard stop and 3 TiB budget are reported by status but never enforced in upload / put-backup #938 closed is the original enforcement issue — this is its remainder). Enqueued as a triage packet to repo-health-code-pilot.
Expectation: triage decides the truthful cumulative backup accounting; done when a sequence of backups cumulatively crossing the budget is refused, with a regression test, and status matches enforcement.
Links: PR cold-store-reaper: enforce upload hard stop + budget (#938), stop persisting access token (#940), retention verified (#939) #988 · body hidden_files/issue-code-988-backup-budget-accounting-body.md

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), Lane B shift
Session / ID: queue task 1205
Found via: queue claim
Task: Implement the cold-store-reaper: project-budget enforcement in put-backup never counts backup bytes — cumulative backups can cross the 3 TiB budget unrefused (PR #988) #1028 fix decided in triage 1198 — ledger-derived backup bytes (backup-upload − backup-prune, all-time) counted in _upload_accounting's project-budget total for _check_upload_limits and status_data, plus the cumulative-backup regression test.
Expectation: s — done looks like a PR with the accounting change, regression tests passing, and the full cold-store suite green.
Links: issue cold-store-reaper: project-budget enforcement in put-backup never counts backup bytes — cumulative backups can cross the 3 TiB budget unrefused (PR #988) #1028; triage findings comment on this issue

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), Lane B shift
Session / ID: queue task 1205
Found via: queue claim
Task: Fix implemented — PR fix(cold-store-reaper): count backup bytes in project-budget accounting (#1028) #1035 counts ledger-derived backup bytes in the project-budget total for enforcement and status, with cumulative + prune-decrement regression tests.
Expectation: done looks like PR fix(cold-store-reaper): count backup bytes in project-budget accounting (#1028) #1035 CI green and merged (closes this issue); worker is polling CI now, and will park the task if CI outlives the poll window.
Links: PR fix(cold-store-reaper): count backup bytes in project-budget accounting (#1028) #1035 · branch queue/1205-1028-backup-budget @ 9378d58

Merge pull request #1035 from developing-today/queue/1205-1028-backup…

🤖 Agent note · done

Agent: queue worker (repo-worker-code), Lane B shift
Session / ID: queue task 1205
Found via: queue claim
Task: Done — PR fix(cold-store-reaper): count backup bytes in project-budget accounting (#1028) #1035 merged (merge commit 70efcd4); this issue closed by the PR.
Expectation: met — _upload_accounting now counts ledger-derived backup bytes in the project-budget total for both enforcement and status; cumulative-backup and prune-decrement regression tests pass; full cold-store suite 63 tests OK; CI green (treefmt, Nix flake evaluation, run).
Links: PR fix(cold-store-reaper): count backup bytes in project-budget accounting (#1028) #1035 · branch queue/1205-1028-backup-budget @ 9378d58

Navigation Menu

Repository navigation

cold-store-reaper: project-budget enforcement in put-backup never counts backup bytes — cumulative backups can cross the 3 TiB budget unrefused (PR #988) #1028

Finding

Evidence (verified on current main `76672b97df023607d8469d462f21420604fe92d5`, via `gh pr diff 988` and the local clone)

Why it matters

Acceptance criteria

11 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

cold-store-reaper: project-budget enforcement in put-backup never counts backup bytes — cumulative backups can cross the 3 TiB budget unrefused (PR #988) #1028

Description

Finding

Evidence (verified on current main 76672b97df023607d8469d462f21420604fe92d5, via gh pr diff 988 and the local clone)

Why it matters

Acceptance criteria

Activity

developing-today commented on Oct 26, 2026

dezren39 commented on Oct 26, 2026

11 remaining items

dezren39 commented on Oct 27, 2026

dezren39 commented on Oct 27, 2026

dezren39 commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Evidence (verified on current main `76672b97df023607d8469d462f21420604fe92d5`, via `gh pr diff 988` and the local clone)