Artifact [a2398a94e1]

Artifact a2398a94e162c2de3a0668ab023143b9e2356b8f19a4e97e79b1f0b9120a6e33:

• File internal/shun/purge.go — part of check-in [c72c1245b8] at 2026-10-24 02:27:29 on branch main — fix(sync): withhold pending pushed artifacts; judge them when filled (#471)

  Third review of the seedcheck design:

  - Withhold everything recorded, not just refusals. Every serving path (gimme/file, inventory and private igots, both clone paths, the client's file cards) now withholds any rid with a seedcheck row, pending or refused. A seed whose base a local check-in filled was served unjudged before. - Judge promptly. seedcheck.JudgeReadable judges, in one transaction, every pending row that has become readable, of any type: a seed is refused, anything else (files and non-artifacts too) loses its row, so withheld rows do not grow without bound. It runs in the transaction of each path that fills a basis: the dephantomize cascade, the sweep and rebuild (prepareCrosslinkTables), manifest.Checkin and tag.AddTag. Rows are walked in rid order through one cache, so a pending chain is expanded once. A row whose bytes fail their hash stays pending and withheld. - Forget on purge. shun.Purge drops seedcheck rows whose blob is gone (seedcheck.ForgetDeleted), since rids are reused. It is the only place blob rows are deleted. - One existence lookup per transaction. linkArtifact caches whether the table exists in the batch schedule, which is reset on commit and rollback. - Inventories read the withheld set fresh. The per-request cache serves gimme and clone only. Rows a request adds are its own unreadable deltas, which nothing can send, so the store-time and pre-inventory cache resets were unobservable and are gone. - The unsent delete on refusal is removed: only local writes fill unsent, so a pushed artifact is never in it.

  Tests: - The check-in-fills-base case no longer sweeps explicitly. It shows the seed refused in the check-in's transaction and served to neither a clone nor a pulling peer. - A pending seed is not answered on gimme or announced. - A pending plain file is served once its base arrives. - A purged seed's rid, reused by an innocent blob, is not withheld. - A private inventory withholds a privately pushed seed. - A clone does not send a refused seed as a delta source. - Disabling any serving filter fails a test.

  A clone of any store holding a dangling delta stalls at clone sequence 1. That is pre-existing and unrelated to seeds, so the pending-seed test checks pull and gimme instead. (user: [email protected], size: 3480) [annotate] [blame] [check-ins using] [more...]

package shun

import (
	"fmt"

	"github.com/danmestas/go-libfossil/db"
	"github.com/danmestas/go-libfossil/internal/blob"
	"github.com/danmestas/go-libfossil/internal/content"
	libfossil "github.com/danmestas/go-libfossil/internal/fsltype"
	"github.com/danmestas/go-libfossil/internal/seedcheck"
)

// PurgeResult summarizes what Purge deleted.
type PurgeResult struct {
	BlobsDeleted   int
	DeltasExpanded int
	PrivateCleaned int
}

// Purge physically removes all shunned blobs from the repo.
// Follows Fossil's shun_artifacts() algorithm from shun.c.
// Requires *db.DB (not Querier) because it runs in a transaction.
func Purge(d *db.DB) (PurgeResult, error) {
	if d == nil {
		panic("shun.Purge: d must not be nil")
	}
	var result PurgeResult

	err := d.WithTx(func(tx *db.Tx) error {
		// Step 1: Find rids to delete.
		_, err := tx.Exec(`CREATE TEMP TABLE toshun(rid INTEGER PRIMARY KEY)`)
		if err != nil {
			return fmt.Errorf("create toshun: %w", err)
		}

		_, err = tx.Exec(`INSERT INTO toshun SELECT rid FROM blob WHERE uuid IN (SELECT uuid FROM shun)`)
		if err != nil {
			return fmt.Errorf("populate toshun: %w", err)
		}

		// Step 2: Undelta dependents — expand blobs whose delta source is being shunned.
		rows, err := tx.Query(`SELECT rid FROM delta WHERE srcid IN (SELECT rid FROM toshun)`)
		if err != nil {
			return fmt.Errorf("query dependents: %w", err)
		}
		var dependents []libfossil.FslID
		for rows.Next() {
			var rid libfossil.FslID
			if err := rows.Scan(&rid); err != nil {
				rows.Close()
				return fmt.Errorf("scan dependent: %w", err)
			}
			dependents = append(dependents, rid)
		}
		rows.Close()

		// Bare Expand: each dependent of a shunned base is expanded once to be
		// rewritten as whole content. Distinct rids, single pass -- and the
		// deltas are being deleted, so there is no chain left to cache against.
		for _, rid := range dependents {
			expanded, err := content.Expand(tx, rid)
			if err != nil {
				return fmt.Errorf("expand rid %d: %w", rid, err)
			}
			compressed, err := blob.Compress(expanded)
			if err != nil {
				return fmt.Errorf("compress rid %d: %w", rid, err)
			}
			_, err = tx.Exec("UPDATE blob SET content=?, size=? WHERE rid=?",
				compressed, len(expanded), rid)
			if err != nil {
				return fmt.Errorf("update blob rid %d: %w", rid, err)
			}
			_, err = tx.Exec("DELETE FROM delta WHERE rid=?", rid)
			if err != nil {
				return fmt.Errorf("delete delta rid %d: %w", rid, err)
			}
			result.DeltasExpanded++
		}

		// Step 3: Delete shunned blobs.
		_, err = tx.Exec("DELETE FROM delta WHERE rid IN (SELECT rid FROM toshun)")
		if err != nil {
			return fmt.Errorf("delete shunned deltas: %w", err)
		}

		res, err := tx.Exec("DELETE FROM blob WHERE rid IN (SELECT rid FROM toshun)")
		if err != nil {
			return fmt.Errorf("delete shunned blobs: %w", err)
		}
		n, _ := res.RowsAffected()
		result.BlobsDeleted = int(n)

		_, err = tx.Exec("DROP TABLE toshun")
		if err != nil {
			return fmt.Errorf("drop toshun: %w", err)
		}

		// Step 4: Orphan cleanup. A seed verdict on a deleted rid would pass
		// to the next blob stored under it.
		if err := seedcheck.ForgetDeleted(tx); err != nil {
			return err
		}
		res, err = tx.Exec("DELETE FROM private WHERE NOT EXISTS (SELECT 1 FROM blob WHERE rid=private.rid)")
		if err != nil {
			return fmt.Errorf("cleanup private: %w", err)
		}
		n, _ = res.RowsAffected()
		result.PrivateCleaned = int(n)

		return nil
	})

	return result, err
}