Protect production during archival
Source-scoped UTC windows, external lag/load telemetry, adaptive delays and optional gateway validation gates.
Configure once per source
Protection policies apply to manual export/resume, scheduled work, deletion and shadow reads. Limits are checked before connection where possible and at safe batch boundaries. In-flight work can finish. Required missing/stale/future telemetry fails closed. Scheduled protection holds retry without consuming the normal failure budget. Manual paused archives require resume.
coldctl protection set SOURCE --config protection.json
coldctl protection sample SOURCE --file health.json
coldctl protection status SOURCEExample policy
UTC minutes 1320–360 mean 22:00–06:00 daily, start inclusive/end exclusive. Reaching a threshold blocks admission. Delays increase with the highest metric-to-limit ratio. Samples are supplied by your trusted monitoring collector; native replica discovery and database polling are not implemented. Use maximum lag across every replica requiring protection and do not refresh timestamps on stale measurements.
{
"window_start_utc_minute": 1320,
"window_end_utc_minute": 360,
"max_replica_lag_ms": 2000,
"max_cpu_percent": 80,
"sample_max_age_seconds": 30,
"min_batch_delay_ms": 100,
"max_batch_delay_ms": 2000
}Publish real measurements
Use the UUID shown by protection status and actual measurement time in Unix milliseconds. Missing metrics are null, not zero. The timestamp below is illustrative and must be replaced. Samples must be newer than the last sample. Operator-supplied metrics cannot prove replica coverage.
{
"source_id": "SOURCE_UUID",
"observed_at_unix_ms": 1792000000000,
"replica_lag_ms": 250,
"cpu_percent": 30,
"lock_waiters": 0
}Require retrieval evidence before deletion
Set require_gateway_shadow=true and shadow_max_age_seconds (1–86400) to require a recent full gateway pass bound to the manifest. Source-only, partial, failed, empty or expired reports do not qualify. Explicit deletion authorization still applies. Configure automatic_shadow by archive policy name to let the scheduler refresh the gateway and run full validation before deletion; otherwise the manual gate remains. Back up protection.sqlite and shadow.sqlite with state.db while workers are stopped; protect filesystem ACLs.