deploy/systemd/README.md

@@ -8,6 +8,7 @@ Systemd **user** units for clawstor.
 |---|---|
 | `clawstor-cluster.service` | daemon (gossip + RPC + Prometheus + build cache). Not shipped here — deployed per-node from the fleet playbook. |
 | `clawstor-fuse.service` | Phase 6 read-only FUSE mount at `~/clawstor-mount/`. Depends on `clawstor-cluster.service`. |
+| `clawstor-scrub.service` + `clawstor-scrub.timer` | Weekly (Sun 04:00) BLAKE3 verify every chunk against its manifest. Non-zero exit = integrity failure — surfaced by systemd status. |
 
 ## Install `clawstor-fuse.service`
 
@@ -41,3 +42,18 @@ systemctl --user edit clawstor-fuse.service
 [Service]
 Environment=CLAWSTOR_MOUNT=/mnt/clawstor
 ```
+
+## Install `clawstor-scrub.timer`
+
+```bash
+cp deploy/systemd/clawstor-scrub.service ~/.config/systemd/user/
+cp deploy/systemd/clawstor-scrub.timer  ~/.config/systemd/user/
+systemctl --user daemon-reload
+systemctl --user enable --now clawstor-scrub.timer
+
+# Verify:
+systemctl --user list-timers clawstor-scrub.timer
+# Run once manually to confirm the service works:
+systemctl --user start clawstor-scrub.service
+journalctl --user -u clawstor-scrub.service --since -5min
+```

deploy/systemd/clawstor-scrub.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Clawstor read-only integrity scrub (BLAKE3 verify every chunk)
+Documentation=https://git.redclaw.dev/clawverse/clawstor
+After=clawstor-cluster.service network-online.target
+
+[Service]
+Type=oneshot
+# Retarget via `systemctl --user edit clawstor-scrub.service`.
+ExecStart=%h/clawstor-deploy/claw-store --config %h/clawstor-deploy/config.toml cluster-scrub
+StandardOutput=journal
+StandardError=journal
+# Best-effort: an integrity failure surfaces as an exit code (the
+# CLI bails on chunks_corrupt + chunks_missing > 0). systemd will
+# mark the unit failed; the journal captures the details.
+
+[Install]
+WantedBy=default.target

deploy/systemd/clawstor-scrub.timer

@@ -0,0 +1,14 @@
+[Unit]
+Description=Weekly Clawstor blob-store scrub
+Documentation=https://git.redclaw.dev/clawverse/clawstor
+
+[Timer]
+# Sunday 04:00 local. Off-peak; scrub is IO-bound.
+OnCalendar=Sun *-*-* 04:00:00
+# Fire even if the box was off at the scheduled moment (laptops,
+# nodes that got restarted). Prevents skipped-week silences.
+Persistent=true
+Unit=clawstor-scrub.service
+
+[Install]
+WantedBy=timers.target