Make snapshot creation transactional (#5)

* Make snapshot creation transactional

Build each snapshot in a private .incomplete-<name> staging directory
instead of mutating the final backup path directly. Any failure while
building the snapshot (hardlink failure, rsync error, or a single
Actions.ERROR entry) is now fatal: the staging directory is discarded
and BackupFailedError is raised, so a failed or interrupted backup can
never silently look like a success.

On success, the completion marker is written and the directory fsync'd
before an atomic os.rename() into the final snapshot name, so a crash
can never leave a partially-populated directory under a real snapshot
name.

Also:
- cleanup_stale_staging_dirs() removes abandoned staging directories
  left by a crashed run before a new backup starts.
- _reserve_snapshot_name() avoids same-second snapshot name collisions.
- cli.py releases the backup lock in finally and returns a nonzero
  exit code when BackupFailedError is raised.

Updates the error-recovery tests that previously asserted failures
were swallowed silently to assert BackupFailedError is raised instead,
matching the new fail-loud contract.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Address Copilot review feedback on transactional snapshots

- Remove unused uuid import.
- _reserve_snapshot_name() also checks for a collision with an existing
  .incomplete-<name> staging directory, not just the final snapshot
  name.
- _fsync_dir() opens with O_DIRECTORY where available.
- Fsync the completion marker file itself, and fsync the parent
  backups_dir after the rename, so the marker and the rename survive a
  crash/power loss.
- Re-raise an already-BackupFailedError unchanged (preserving its
  traceback) instead of wrapping it in a new instance; only
  fs.BackupCreationError gets wrapped.
- Wrap the initial os.mkdir(staging.path) failure in BackupFailedError
  so every failure path uses the documented exception.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

curateipsum/cli.py

@@ -96,23 +96,28 @@ def main():
     if not backup.set_backups_lock(backups_dir_abs, args.force):
         return 1
 
-    # TODO add cleaning up from non-finished backups
-    backup.cleanup_old_backups(backups_dir=backups_dir_abs,
-                               dry_run=args.dry_run)
-    backup.initiate_backup(
-        sources=args.sources,
-        backups_dir=backups_dir_abs,
-        dry_run=args.dry_run,
-        external_rsync=args.external_rsync,
-        external_hardlink=args.external_hardlink,
-    )
-    backup.release_backups_lock(backups_dir_abs)
+    exit_code = 0
+    try:
+        backup.cleanup_old_backups(backups_dir=backups_dir_abs,
+                                   dry_run=args.dry_run)
+        backup.initiate_backup(
+            sources=args.sources,
+            backups_dir=backups_dir_abs,
+            dry_run=args.dry_run,
+            external_rsync=args.external_rsync,
+            external_hardlink=args.external_hardlink,
+        )
+    except backup.BackupFailedError as err:
+        _lg.error("Backup failed: %s", err)
+        exit_code = 1
+    finally:
+        backup.release_backups_lock(backups_dir_abs)
 
     end_time = time.time()
     spent_time = end_time - start_time
     _lg.info("Finished, time spent: %s", str(timedelta(seconds=spent_time)))
 
-    return 0
+    return exit_code
 
 
 if __name__ == "__main__":