[pakkah]

What this PR does / why we need it:

• Retries were not repeatable. The request file was renamed onto the config path and therefore
  consumed: a retry failed to parse, and a re-created identical request sealed the upper layer a second
  time instead of returning success.
• A failure after the seal left no consistent state. The layer stack was switched in memory before
  the config was updated, so a failed update left the running device and the on-disk config describing
  different stacks, with no record from which a restart could recover.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

• the request config is copied to <config>.snapshot and published by rename(), so the caller's file
  is no longer consumed.
• conf is updated to the committed config, so an identical request returns success without touching
  anything.
• the config rename() now runs inside the commit callback, under the write lock and before the
  in-memory switch; a failure discards the prepared stack and both memory and disk stay on the old one.

Recovery covers process crashes only; the snapshot path performs no fsync.

Please check the following list:

• Does the affected code have corresponding tests, e.g. unit test, E2E test?
• Does this change require a documentation update?
• Does this introduce breaking changes that would require an announcement or bumping the major version?
• Do all new files have an appropriate license header?

[Copilot]

🟡 Changes recommended

Unresolved rollback, journal cleanup, and durability failures can discard acknowledged writes or persist an inconsistent layer stack.

7 open issues

• Handle snapshot cleanup failures before reopening the device · New
• Parse the exact configuration bytes published in the journal · New
• Fsync parent directories before publishing new upper files · New
• Block writes until configuration publication is durable · New
• Block writes and snapshots after rollback failure · New
• Retire rollback metadata under lock before resuming writers · New
• Avoid zero-length rollback before capturing the original size · New

What changed in this PR

This PR reworks live snapshots into a recoverable transaction, aiming to make retries idempotent and preserve a consistent layer stack across failures and restarts.

Changes:

• Splits restacking into preparation, config publication, and in-memory switching.
• Adds rollback journals, startup recovery, strict layer validation, and snapshot serialization.
• Adds regression tests and documents failure and recovery semantics.

File	Description
src/​test/​image_service_test.cpp	Adds retry, validation, rollback, sequential snapshot, and recovery tests.
src/​overlaybd/​lsmt/​index.h	Declares index preparation and application APIs.
src/​overlaybd/​lsmt/​index.cpp	Prepares merged indexes without modifying the active backing index.
src/​overlaybd/​lsmt/​file.h	Adds transaction callbacks and file-capacity reservation.
src/​overlaybd/​lsmt/​file.cpp	Implements staged restacking, seal rollback, and fsync error propagation.
src/​image_file.h	Declares recovery helpers and a snapshot mutex.
src/​image_file.cpp	Implements journals, recovery, validation, and idempotent snapshot handling.
docs/​live-snapshot.md	Documents transaction semantics, recovery, and limitations.
docs/​live-snapshot_zh.md	Adds corresponding Chinese documentation.

_{Review effort: Balanced}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[Copilot]

🟡 Changes recommended

Unresolved destination-validation, journal-recovery, and writer-synchronization flaws can overwrite or delete layer data, lose writes, and prevent devices from reopening.

11 open issues

• Use lstat to reject dangling symlink move targets · New
• Reject snapshot journal paths as move destinations · New
• Use atomic no-replace moves and transaction ownership checks · New
• Acquire write mutex before flushing group commits · New
• Gate all writes and discards during snapshot sealing · New
• Retire rollback metadata under lock before resuming writers
• Block writes and snapshots after rollback failure
• Block writes until configuration publication is durable
• Fsync parent directories before publishing new upper files
• Handle snapshot cleanup failures before reopening the device
• Reject stale journals before staging new snapshots · New

2 resolved since last review

• Avoid zero-length rollback before capturing the original size
• Parse the exact configuration bytes published in the journal

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Journal-path collisions can cause recovery to delete layer data, while symlink moves and unescaped newline paths can leave images unreopenable or prevent restoration after a crash.

3 open issues

• Protect configured layer paths from snapshot journal cleanup · New
• Reject symlink sources before moving layers · New
• Prevent newline-based snapshot journal path corruption · New

11 resolved since last review

• Gate all writes and discards during snapshot sealing
• Acquire write mutex before flushing group commits
• Use atomic no-replace moves and transaction ownership checks
• Reject snapshot journal paths as move destinations
• Use lstat to reject dangling symlink move targets
• Retire rollback metadata under lock before resuming writers
• Block writes and snapshots after rollback failure
• Block writes until configuration publication is durable
• Fsync parent directories before publishing new upper files
• Handle snapshot cleanup failures before reopening the device
• Reject stale journals before staging new snapshots

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Journal collision checks miss backing files and path aliases, risking layer-data deletion during startup recovery, while direct use of renameat2() breaks the supported CentOS 7 build.

2 open issues

• Add renameat2 compatibility for glibc 2.17 · New
• Resolve aliases before allowing journal cleanup · New

3 resolved since last review

• Reject symlink sources before moving layers
• Protect configured layer paths from snapshot journal cleanup
• Prevent newline-based snapshot journal path corruption

_{Review effort: Balanced}