* shell: replicate the downloaded volume before deleting its remote object
volume.tier.download downloaded every replica from the remote tier and let
the last one in the master's location list delete the shared object, so a
replica missing from that list kept reading a deleted object.
Download onto one replica, copy it over every other remote-backed replica,
re-read the topology so replicas that show up meanwhile are replaced too,
and only then delete the last remote-backed replica together with the
object before copying the local volume onto it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: test tier download replicates before deleting the remote object
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: copy the downloaded volume onto each replica's own disk type
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: test tier download keeps each replica's disk type
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: name the hdd disk type when copying a downloaded volume
VolumeCopy treats an empty disk type as the source's, so an HDD replica
copied from an SSD source was placed on SSD or failed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: block deletes on the tier download copy source
A readonly-can-delete source took deletes after VolumeCopy read its
index, so the replaced replica lost them and served the files again.
Hard-mark the source readonly while replicas are replaced, then restore
the writable mark or reload the persisted state.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: keep the remote object while replicas are unlisted
Tier download deleted the shared object once the listed replicas were
local, even when the replica placement expected more copies than the
topology listed. Keep it in that case so a rerun can finish later.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: fail tier download when no replica is listed
Also point the final-replica delete error at volume.fix.replication.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: keep the remote object when a server lists the volume twice
A stale twin on another disk of a replaced server still references the
object but is filtered out with its server.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: restore the tier download source when its readonly mark fails
VolumeMarkReadonly blocks local writes and deletes before its second master
notification, so a failed notification returns an error with the source
already frozen. Restore it whenever the status was read.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: report a failed tier download source restore
A restore that leaves the source unmounted or frozen was only printed, so the
command still returned success. Join the restore error into the result.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: wrap the tier download restore error
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
