cozystack
diff --git a/‎docs/cli-parity-known-deltas.md‎
Lines changed: 3 additions & 0 deletions b/‎docs/cli-parity-known-deltas.md‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎internal/controller/ensure_tiebreaker_test.go‎
Lines changed: 123 additions & 8 deletions b/‎internal/controller/ensure_tiebreaker_test.go‎
Lines changed: 123 additions & 8 deletions
diff --git a/‎internal/controller/resourcedefinition_controller.go‎
Lines changed: 22 additions & 2 deletions b/‎internal/controller/resourcedefinition_controller.go‎
Lines changed: 22 additions & 2 deletions
@@ -27,6 +27,9 @@ Row IDs match the command-catalogue indexes used by `cli-parity-refresh.sh` (see
 | 54 | `schedule l` | MISSING_FEATURE | 2026-12-31 | Schedules subsystem deferred to follow-up wave. |
 | 55 | `key-value-store list` | WIRE_SHAPE | 2026-09-30 | BS exposes the KVS endpoints but the wire shape lacks `props.LinstorKvs/...` namespace nesting; CSI uses a flat key set so unblocked. |
 | 60 | `vd s <rd> <vn> <smaller>` (shrink) | BEHAVIOR | permanent | BLOCKSTOR_STRICTER: upstream LINSTOR has permitted `vd set-size` downward since 1.8.0 for layer stacks that support it (e.g. STORAGE/ZFS-only); BS rejects ALL shrinks with `FAIL_INVLD_VLM_SIZE` (HTTP 400) unless the operator opts in with `force=true` (body field or `?force=true`). Rationale: every BS RD is DRBD-backed and DRBD cannot shrink past the on-disk metadata position without destroying it, so an unconditional reject is the safe default. The `force=true` escape hatch covers the post-`resize2fs -s` operator. Pinned by `tests/e2e/cli-matrix/vd-shrink-rejected.sh` (L6), `replay/vd-resize-full-lifecycle.yaml` (L7), and `pkg/rest/volume_definitions_test.go::TestVolumeDefinitionsUpdateShrink{Rejected,WithForceAccepted}` + `pkg/rest/bug_383_*` (L1). |
+| 61 | `rd lp` default `on-no-quorum` (auto-quorum seed) | BEHAVIOR | permanent | Corner-case B6. Upstream auto-quorum default pair is `quorum majority` + `on-no-quorum io-error` (UG9 TIP ~4251-4253). BS seeds `on-no-quorum=suspend-io` instead — Bug 297 (P1 data-loss): io-error freezes the minority replica across partition heal and breaks auto-promote; suspend-io blocks I/O until quorum returns, then resumes cleanly. `quorum majority` half MATCHES upstream verbatim; only the `on-no-quorum` value diverges, by design. Pinned by `TestCornerB_DefaultQuorumPairIsDeliberateDelta`. |
+| 62 | `rd sp DrbdOptions/Resource/quorum-minimum-redundancy <bad>` | BEHAVIOR | permanent | Corner-case B8. Upstream VALIDATES generic DRBD option values against the DRBD schema and rejects e.g. `quorum-minimum-redundancy bogus` with FAIL_INVLD_PROP (oracle: `value 'bogus' is not valid … has to match (1-32) or (all\|majority\|off)`, rc=10). BS's property bag is permissive — it accepts and stores any DrbdOptions value verbatim (no per-key value validator); an invalid value is rejected downstream by drbdadm at `.res` render time. Valid values pass through and propagate to the `options{}` block correctly. Pinned by `TestCornerB_QuorumMinimumRedundancyPassthrough`. |
+| 63 | `r d` quorum-property auto-removal INFO + prop strip | BEHAVIOR | permanent | Corner-case B3b. Upstream LINSTOR, on an `r d` that drops a 3-node resource below quorum feasibility, REMOVES `DrbdOptions/Resource/quorum` + `on-no-quorum` from the RD and prints two INFO lines ("…was removed as there are not enough resources for quorum", UG9 ~1380-1401). BS instead STAMPS `DrbdOptions/Resource/quorum=off` (does not remove it) and prints no INFO — Bug 309: the satellite renders an explicit quorum value into the `.res`; an absent prop would fall back to a DRBD built-in that differs from the intended `off`. Resulting DRBD behaviour (`quorum off`) is equivalent; the divergence is the visible prop shape (`off` present vs absent) and the missing INFO envelope. Stamp-off pinned by `TestEnsureTiebreakerOffOnSingleReplica`. |
 
 ## Open (block merge until addressed)
 
 
@@ -565,11 +565,20 @@ func TestEnsureTiebreakerHonoursAutoQuorumDisabled(t *testing.T) {
 	// Operator opted out of auto-quorum and set the per-RD policy
 	// explicitly. `quorum=off` + `on-no-quorum=io-error` is the
 	// "scale-out fast, fail-loud" combo from UG9.
+	//
+	// Corner-case B1/B4: drive the gate with the CANONICAL kebab-case
+	// `DrbdOptions/auto-quorum` key — the exact spelling the upstream
+	// `linstor (rg|rd) set-property … DrbdOptions/auto-quorum disabled`
+	// CLI emits. The earlier revision of this test stamped the
+	// camelCase `DrbdOptions/AutoQuorum`, which the (then-broken) gate
+	// also read — so the test passed while a real cluster's CLI opt-out
+	// was silently ignored. Pinning the kebab key here guards against a
+	// regression back to the dead-key gate.
 	rd := &blockstoriov1alpha1.ResourceDefinition{
 		ObjectMeta: metav1.ObjectMeta{Name: "pvc-manual-quorum"},
 		Spec: blockstoriov1alpha1.ResourceDefinitionSpec{
 			Props: map[string]string{
-				"DrbdOptions/AutoQuorum":            "disabled",
+				"DrbdOptions/auto-quorum":           "disabled",
 				"DrbdOptions/Resource/quorum":       "off",
 				"DrbdOptions/Resource/on-no-quorum": "io-error",
 			},
@@ -613,12 +622,92 @@ func TestEnsureTiebreakerHonoursAutoQuorumDisabled(t *testing.T) {
 
 	// Auto-quorum opt-out marker must survive the round-trip
 	// unchanged — a stamp-and-strip refactor would be a regression.
-	if got := final.Spec.Props["DrbdOptions/AutoQuorum"]; got != "disabled" {
-		t.Errorf("AutoQuorum prop: got %q, want %q (must round-trip verbatim)",
+	if got := final.Spec.Props["DrbdOptions/auto-quorum"]; got != "disabled" {
+		t.Errorf("auto-quorum prop: got %q, want %q (must round-trip verbatim)",
 			got, "disabled")
 	}
 }
 
+// TestEnsureTiebreakerDisabledDoesNotReseedOnNoQuorum is the B5
+// regression that the dev-stand reproduced against the released
+// (camelCase-bug) binary: with `DrbdOptions/auto-quorum=disabled` set
+// via the real CLI (kebab key) and NO on-no-quorum prop, the
+// reconciler must NOT re-seed `on-no-quorum=suspend-io`.
+//
+// Stand evidence (BS v0.1.9, buggy): after
+//
+//	rd set-property R DrbdOptions/auto-quorum disabled
+//	rd set-property R DrbdOptions/Resource/on-no-quorum         (empty=delete)
+//
+// the CLI deleted the key, then the reconciler re-stamped
+// `on-no-quorum=suspend-io` because isAutoQuorumDisabled read the dead
+// camelCase key, returned false, and ran setQuorum's companion seed —
+// so an operator could never actually clear the prop. With the
+// kebab-key fix, isAutoQuorumDisabled returns true, ensureTiebreaker
+// short-circuits before setQuorum, and the prop stays absent.
+func TestEnsureTiebreakerDisabledDoesNotReseedOnNoQuorum(t *testing.T) {
+	t.Parallel()
+
+	scheme := newScheme(t)
+	st := store.NewInMemory()
+	ctx := context.Background()
+
+	// 2 diskful — the shape that, under active auto-quorum, would
+	// drive quorum=majority + the suspend-io companion seed.
+	for _, n := range []string{"n1", "n2"} {
+		if err := st.Nodes().Create(ctx, &apiv1.Node{
+			Name: n, Type: apiv1.NodeTypeSatellite,
+		}); err != nil {
+			t.Fatalf("seed node %s: %v", n, err)
+		}
+
+		if err := st.Resources().Create(ctx, &apiv1.Resource{
+			Name: "pvc-b5", NodeName: n,
+		}); err != nil {
+			t.Fatalf("seed replica %s: %v", n, err)
+		}
+	}
+
+	// Operator disabled auto-quorum (canonical kebab key) and cleared
+	// on-no-quorum (the CLI delete already removed it — Props has no
+	// on-no-quorum entry).
+	rd := &blockstoriov1alpha1.ResourceDefinition{
+		ObjectMeta: metav1.ObjectMeta{Name: "pvc-b5"},
+		Spec: blockstoriov1alpha1.ResourceDefinitionSpec{
+			Props: map[string]string{
+				"DrbdOptions/auto-quorum": "disabled",
+			},
+		},
+	}
+
+	cli := fake.NewClientBuilder().WithScheme(scheme).WithObjects(rd).Build()
+
+	rec := &controllerpkg.ResourceDefinitionReconciler{
+		Client: cli,
+		Scheme: scheme,
+		Store:  st,
+	}
+
+	if err := rec.EnsureTiebreaker(ctx, rd); err != nil {
+		t.Fatalf("EnsureTiebreaker: %v", err)
+	}
+
+	final := &blockstoriov1alpha1.ResourceDefinition{}
+	if err := cli.Get(ctx, types.NamespacedName{Name: "pvc-b5"}, final); err != nil {
+		t.Fatalf("Get RD: %v", err)
+	}
+
+	if got, present := final.Spec.Props["DrbdOptions/Resource/on-no-quorum"]; present {
+		t.Errorf("B5: on-no-quorum re-seeded to %q under auto-quorum=disabled; "+
+			"must stay ABSENT (the deleted prop must not come back)", got)
+	}
+
+	if got, present := final.Spec.Props["DrbdOptions/Resource/quorum"]; present {
+		t.Errorf("B5: quorum re-stamped to %q under auto-quorum=disabled; "+
+			"the reconciler must leave quorum policy to the operator", got)
+	}
+}
+
 // TestIsAutoQuorumDisabled pins the helper across the input shapes
 // the production code can encounter: nil RD, nil Props, missing key,
 // explicit `disabled` (canonical and mixed case), and the two other
@@ -645,7 +734,29 @@ func TestIsAutoQuorumDisabled(t *testing.T) {
 			want: false,
 		},
 		{
-			name: "disabled (canonical)",
+			// Corner-case B1/B4: canonical kebab-case key — the exact
+			// spelling the upstream CLI writes.
+			name: "disabled (canonical kebab key)",
+			rd: &blockstoriov1alpha1.ResourceDefinition{
+				Spec: blockstoriov1alpha1.ResourceDefinitionSpec{
+					Props: map[string]string{"DrbdOptions/auto-quorum": "disabled"},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "Disabled (mixed case from manual paste, kebab key)",
+			rd: &blockstoriov1alpha1.ResourceDefinition{
+				Spec: blockstoriov1alpha1.ResourceDefinitionSpec{
+					Props: map[string]string{"DrbdOptions/auto-quorum": "Disabled"},
+				},
+			},
+			want: true,
+		},
+		{
+			// Forward-compat fallback: a legacy hand-stamped camelCase
+			// value must still opt out.
+			name: "disabled (legacy camelCase key fallback)",
 			rd: &blockstoriov1alpha1.ResourceDefinition{
 				Spec: blockstoriov1alpha1.ResourceDefinitionSpec{
 					Props: map[string]string{"DrbdOptions/AutoQuorum": "disabled"},
@@ -654,10 +765,14 @@ func TestIsAutoQuorumDisabled(t *testing.T) {
 			want: true,
 		},
 		{
-			name: "Disabled (mixed case from manual paste)",
+			// The canonical kebab key wins over a stale legacy value.
+			name: "kebab disabled overrides legacy non-disabled",
 			rd: &blockstoriov1alpha1.ResourceDefinition{
 				Spec: blockstoriov1alpha1.ResourceDefinitionSpec{
-					Props: map[string]string{"DrbdOptions/AutoQuorum": "Disabled"},
+					Props: map[string]string{
+						"DrbdOptions/auto-quorum": "disabled",
+						"DrbdOptions/AutoQuorum":  "io-error",
+					},
 				},
 			},
 			want: true,
@@ -666,7 +781,7 @@ func TestIsAutoQuorumDisabled(t *testing.T) {
 			name: "suspend-io (auto-set instruction, not disable)",
 			rd: &blockstoriov1alpha1.ResourceDefinition{
 				Spec: blockstoriov1alpha1.ResourceDefinitionSpec{
-					Props: map[string]string{"DrbdOptions/AutoQuorum": "suspend-io"},
+					Props: map[string]string{"DrbdOptions/auto-quorum": "suspend-io"},
 				},
 			},
 			want: false,
@@ -675,7 +790,7 @@ func TestIsAutoQuorumDisabled(t *testing.T) {
 			name: "io-error (auto-set instruction, not disable)",
 			rd: &blockstoriov1alpha1.ResourceDefinition{
 				Spec: blockstoriov1alpha1.ResourceDefinitionSpec{
-					Props: map[string]string{"DrbdOptions/AutoQuorum": "io-error"},
+					Props: map[string]string{"DrbdOptions/auto-quorum": "io-error"},
 				},
 			},
 			want: false,
 
@@ -496,9 +496,29 @@ func isAutoQuorumDisabled(rd *blockstoriov1alpha1.ResourceDefinition) bool {
 		return false
 	}
 
-	const propKey = "DrbdOptions/AutoQuorum"
+	// Corner-case B1/B4: the canonical upstream key is the kebab-case
+	// `DrbdOptions/auto-quorum` — that is what the `linstor (rg|rd)
+	// set-property … DrbdOptions/auto-quorum disabled` CLI writes, what
+	// `seedAutoQuorumDefaults` stamps on RD create, and what the
+	// PropsInfo catalogue advertises. The earlier camelCase spelling
+	// (`DrbdOptions/AutoQuorum`) was never written by any production
+	// path, so the gate silently never fired against a real cluster:
+	// auto-quorum=disabled set via the CLI was ignored and the
+	// reconciler kept overwriting the operator's manual quorum policy
+	// on every pass. Read the kebab key first; keep the camelCase
+	// spelling as a forward-compat fallback so any hand-stamped legacy
+	// value still opts out.
+	const (
+		propKey       = "DrbdOptions/auto-quorum"
+		legacyPropKey = "DrbdOptions/AutoQuorum"
+	)
+
+	value, ok := rd.Spec.Props[propKey]
+	if !ok {
+		value = rd.Spec.Props[legacyPropKey]
+	}
 
-	return strings.EqualFold(rd.Spec.Props[propKey], "disabled")
+	return strings.EqualFold(value, "disabled")
 }
 
 // isTiebreakerSuppressed reports whether the operator recently