Preview mode that survives a reboot, and a fallback log that survives one too

Fallback/fallback.sh

@@ -314,6 +314,50 @@ if [[ "$EUID" -ne 0 ]]; then
     exit 1
 fi
 
+
+# ── Persistent dry-run ────────────────────────────────────────────────────────────────────────
+# Conf-driven, not argument-driven, deliberately. array_started.sh launches every entry as a bare
+# `bash script.sh &` with no arguments, so a --dry-run typed at a terminal survives exactly until
+# the next array start — and then the LIVE daemon comes up in its place, silently, which is the
+# one transition nobody would be watching for.
+#
+# Setting it here means the mode is a property of the install rather than of how the process
+# happened to be started: array start, the Fallback tab's button, and a hand-run all agree.
+#
+# OR, never override: --dry-run on the command line still wins over a conf that says false, so an
+# ad-hoc preview against a live install needs no conf edit.
+if [[ "${FALLBACK_DRY_RUN:-false}" == "true" ]]; then
+    DRY_RUN=true
+fi
+
+# ── Persistent log ────────────────────────────────────────────────────────────────────────────
+# array_started.sh launches every entry as a bare `bash script.sh &` with no redirection, so this
+# daemon's output has never been captured anywhere: /var/log/varaverk has a directory for every
+# other script family and none for Fallback. A month of dry-run observation would have persisted
+# nothing at all.
+#
+# /var/log is a 128 MB tmpfs on Unraid — RAM, and cleared on reboot — so the log goes to
+# LOG_ARCHIVE_DIR, which follows DATA_DIR onto real storage.
+#
+# Only when stdout is not a terminal. Run by hand, output still goes to the terminal exactly as
+# before; run by array_started or the Fallback tab's button, it lands in the file. A plain append
+# redirect rather than `tee` through process substitution: no extra child to outlive, and nothing
+# for the shutdown trap to race.
+FALLBACK_LOG="${LOG_ARCHIVE_DIR:-${DATA_DIR:-/tmp}/logs}/fallback.log"
+if [[ ! -t 1 ]]; then
+    mkdir -p "$(dirname "$FALLBACK_LOG")" 2>/dev/null
+    # One rotation, sized rather than line-counted — the whole point of this log is a long run,
+    # and _orch_trim_log()'s 1000-line cap would discard weeks of it. Event-only output (no
+    # --log) is a few lines per incident, so this holds years; --log fills it in about a fortnight
+    # and then keeps the most recent fortnight plus the one before it.
+    _fb_max=$(( ${FALLBACK_LOG_MAX_MB:-5} * 1048576 ))
+    if [[ -f "$FALLBACK_LOG" ]] && (( $(stat -c %s "$FALLBACK_LOG" 2>/dev/null || echo 0) > _fb_max )); then
+        mv -f "$FALLBACK_LOG" "${FALLBACK_LOG}.1" 2>/dev/null
+    fi
+    exec >> "$FALLBACK_LOG" 2>&1
+    echo ""
+    echo "═══ fallback.sh started $(date '+%Y-%m-%d %H:%M:%S') — dry_run=${DRY_RUN} pid=$$ ═══"
+fi
 # FALLBACK_ENABLED gate — exits cleanly when disabled.
 # Fail-closed: anything that isn't exactly "true" disables fallback. Matching only the
 # literal "false" would let a typo ("no", "0", "FALSE") hand this script DDNS authority
@@ -1222,4 +1266,4 @@ while [[ "$FALLBACK_RUNNING" == true ]]; do
     sleep "$FALLBACK_CHECK_INTERVAL" &
     wait $!
 
-done
+done