The second storage tier nobody was writing to

Some infrastructure gaps are loud: something breaks, an alert fires, someone investigates. This one was silent in the most complete way possible. A whole layer of a backup design existed, was correctly built, had a working restore path proven against it, and simply had no job configured to ever put anything into it. Nothing about that state produces an error. The storage server reports healthy. The datastore reports available capacity. The one backup that ever ran, a manual test weeks earlier, succeeded and sat there looking exactly like evidence the system worked, when it was the entire extent of what the system had ever done.

The only reason this near-miss carried no real cost is that a separate, redundant mechanism already covered every guest that mattered, a fact true by coincidence of how those guests had been set up rather than by any design connecting the two layers.

Finding it required a deliberate audit asking what this component’s actual scope, actual schedule and actual proof of a successful restore were, rather than an alert-driven investigation. Nothing about the component’s own behaviour signalled anything missing. A backup system being reachable, healthy, and holding at least one successful entry is not the same claim as a backup system being scheduled to run against the things that matter, and only an audit that asks about schedule and scope explicitly catches the difference.

The stance changed with the job. Before, a guest was backed up if someone had added it to a plan; after, every guest is backed up unless it is explicitly excluded, and the job selects all guests and names the two test ones it leaves out. The difference is where the silence lands. Under the old stance a forgotten guest was silently unprotected; under the new one a guest that should not be backed up shows up in the archive until somebody says so, which is a cost measured in disk rather than in loss. A new guest is covered the day it exists without anyone remembering to add it, and the exclusion list is short enough to read at a glance in the audit. The same default applies to the seed: a backup plan selects everything and excludes by name, never the reverse.