Intent and job recovery

ONTAP mutations are asynchronous and may outlive a network path, process, or reconcile run. Blindly retrying a timed-out request can duplicate a destination volume or transfer. DonkeyFleet therefore treats intent and job identity as durable state.

Provisioning sequence

If a stored job remains in flight, the run polls and yields. The next run resumes that job rather than issuing the operation again.

Recovery boundary

The intent model and destination comment support crash recovery. However, a full importer that reconstructs every missing database record from destination markers is not currently available. Do not present the recovery schema alone as a complete disaster-recovery feature.

Back up PostgreSQL and Vault according to your platform recovery plan.