M5: upgrade + backup/restore stages green (custom-html); backup-bot-two oneshot

3-stage run green (install/upgrade/backup), clean teardown. backupbot deployed
via reconcile oneshot; PTY (script) for abra backup/restore; -m for secret generate
(no value leak). M5 CLAIMED.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/custom-html/test_backup.py

@@ -0,0 +1,28 @@
+"""custom-html — backup/restore stage (D2): backup, mutate state, restore, assert the restored
+state matches the pre-mutation (backed-up) state."""
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import lifecycle  # noqa: E402
+
+MARKER_PATH = "/usr/share/nginx/html/ci-marker.txt"
+
+
+def test_backup_mutate_restore(deployed):
+    domain = deployed
+
+    # 1) establish original state, then back it up
+    lifecycle.exec_in_app(domain, ["sh", "-c", f"echo original > {MARKER_PATH}"])
+    assert lifecycle.http_body(domain, "/ci-marker.txt").strip() == "original"
+    lifecycle.backup_app(domain)
+
+    # 2) mutate state (diverge from the backup)
+    lifecycle.exec_in_app(domain, ["sh", "-c", f"echo mutated > {MARKER_PATH}"])
+    assert lifecycle.http_body(domain, "/ci-marker.txt").strip() == "mutated"
+
+    # 3) restore -> state returns to the backed-up "original"
+    lifecycle.restore_app(domain)
+    lifecycle.wait_healthy(domain)
+    assert lifecycle.http_body(domain, "/ci-marker.txt").strip() == "original", \
+        "restore did not return the pre-mutation state"

tests/custom-html/test_upgrade.py

@@ -0,0 +1,39 @@
+"""custom-html — upgrade stage (D2): deploy the previous published version, write data, upgrade
+to the current/$REF version, and assert the app stays healthy and data survives."""
+import os
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import lifecycle  # noqa: E402
+
+MARKER_PATH = "/usr/share/nginx/html/ci-marker.txt"
+
+
+@pytest.fixture
+def old_app(recipe, app_domain, request):
+    prev = lifecycle.previous_version(recipe)
+    if not prev:
+        pytest.skip(f"{recipe}: no previous published version to upgrade from")
+    lifecycle.janitor()
+    request.addfinalizer(lambda: lifecycle.teardown_app(app_domain))
+    lifecycle.deploy_app(recipe, app_domain, version=prev)
+    lifecycle.wait_healthy(app_domain)
+    return app_domain, prev
+
+
+def test_upgrade_preserves_data(old_app):
+    domain, prev = old_app
+    # write a data marker into the served volume (nginx serves /usr/share/nginx/html)
+    lifecycle.exec_in_app(domain, ["sh", "-c", f"echo upgrade-survives > {MARKER_PATH}"])
+    assert lifecycle.http_body(domain, "/ci-marker.txt").strip() == "upgrade-survives"
+
+    # upgrade previous -> current/$REF
+    lifecycle.upgrade_app(domain, version=os.environ.get("VERSION") or None)
+    lifecycle.wait_healthy(domain)
+
+    # app healthy and the data written before the upgrade is still there
+    assert lifecycle.http_get(domain, "/") == 200
+    assert lifecycle.http_body(domain, "/ci-marker.txt").strip() == "upgrade-survives", \
+        "data did not survive the upgrade"