| … | … | @@ -0,0 +1,163 @@ |
| 1 | // `gc` must rebuild the index ONCE, not once per deleted version. |
| 2 | // |
| 3 | // deleteVersion ends with _rescan(), which calls _writeIndex() (walking every |
| 4 | // artifact in the release root and re-registering each with the overlay) and |
| 5 | // then _deploy.rescan(). gc called deleteVersion in a loop, so collecting N |
| 6 | // versions rebuilt the whole index N times: O(N x M) where it should be |
| 7 | // O(N + M), all synchronous on the daemon's event loop. |
| 8 | // |
| 9 | // Measured in prod 2026-08-29: collecting favela-android on stortron (1117 |
| 10 | // indexed files) pinned ~45% of a core for minutes and starved HTTP -- the |
| 11 | // public forge flapped 000/200 for the whole run, roughly 90s per version, and |
| 12 | // the operator killed it. The bytes being unlinked were ~150 MB; the cost was |
| 13 | // almost entirely the repeated reindex. |
| 14 | // |
| 15 | // ORDERING IS LOAD-BEARING and must survive the batching. The invariant, pinned |
| 16 | // by release-index-serve-order.test.js and release-event-log.test.js, is: |
| 17 | // |
| 18 | // register overlay -> write _index.json -> append event |
| 19 | // |
| 20 | // A mirror reacts to the event within milliseconds. If gc emitted per-version |
| 21 | // events during the loop and reindexed only at the end, a mirror woken by an |
| 22 | // early event would read an index still advertising the deleted version and ask |
| 23 | // for bytes nobody holds -- reintroducing "no holder" (see deleted-releases.js). |
| 24 | // So the batched order must be: delete all bytes -> reindex ONCE -> emit events. |
| 25 | |
| 26 | import test from 'brittle' |
| 27 | import { mkdtempSync, existsSync, readFileSync } from '#node:fs' |
| 28 | import { join } from '#node:path' |
| 29 | import { tmpdir } from '#node:os' |
| 30 | import b4a from 'b4a' |
| 31 | |
| 32 | import { ReleaseManager } from '../lib/release-manager.js' |
| 33 | |
| 34 | const INDEX_FILE = '_index.json' |
| 35 | |
| 36 | function tmpStorage () { |
| 37 | return mkdtempSync(join(tmpdir(), 'pgv3-rel-gc-batch-')) |
| 38 | } |
| 39 | |
| 40 | /** Counts rescans, and records the index state at each event append. */ |
| 41 | function harness (dir) { |
| 42 | const rescans = [] |
| 43 | const events = [] |
| 44 | return { |
| 45 | rescans, |
| 46 | events, |
| 47 | deploy: { |
| 48 | async rescan () { rescans.push(Date.now()) } |
| 49 | }, |
| 50 | eventLog: { |
| 51 | writable: true, |
| 52 | async append (e) { |
| 53 | // Snapshot what the on-disk index advertises AT THIS INSTANT. A mirror |
| 54 | // woken by this event would read exactly this. |
| 55 | let advertised = [] |
| 56 | try { |
| 57 | const idx = JSON.parse(readFileSync(join(dir, INDEX_FILE), 'utf8')) |
| 58 | advertised = [...new Set((idx.files || []).map((f) => f.version))] |
| 59 | } catch {} |
| 60 | events.push({ ...e, advertisedVersions: advertised }) |
| 61 | } |
| 62 | } |
| 63 | } |
| 64 | } |
| 65 | |
| 66 | async function seed (rm, repo, versions) { |
| 67 | for (const v of versions) { |
| 68 | await rm.publish({ |
| 69 | repo, |
| 70 | version: v, |
| 71 | artifacts: [{ path: 'dist/app.bin', data: b4a.from('payload-' + v) }] |
| 72 | }) |
| 73 | } |
| 74 | } |
| 75 | |
| 76 | test('gc rebuilds the index ONCE regardless of how many versions it collects', async (t) => { |
| 77 | const dir = tmpStorage() |
| 78 | const h = harness(dir) |
| 79 | const rm = new ReleaseManager({ releaseDir: dir, deploy: h.deploy, eventLog: h.eventLog }) |
| 80 | |
| 81 | await seed(rm, 'demo', ['v1', 'v2', 'v3', 'v4', 'v5', 'v6', 'v7']) |
| 82 | |
| 83 | // Ignore the rescans that publishing itself performed. |
| 84 | h.rescans.length = 0 |
| 85 | h.events.length = 0 |
| 86 | |
| 87 | const res = await rm.gc({ repo: 'demo', keepN: 2 }) |
| 88 | |
| 89 | t.is(res.deleted.length, 5, 'five stale versions collected') |
| 90 | t.is(h.rescans.length, 1, |
| 91 | 'ONE reindex for the whole sweep, not one per version (was ' + h.rescans.length + ')') |
| 92 | }) |
| 93 | |
| 94 | test('gc still emits one tombstone per collected version', async (t) => { |
| 95 | const dir = tmpStorage() |
| 96 | const h = harness(dir) |
| 97 | const rm = new ReleaseManager({ releaseDir: dir, deploy: h.deploy, eventLog: h.eventLog }) |
| 98 | |
| 99 | await seed(rm, 'demo', ['v1', 'v2', 'v3', 'v4']) |
| 100 | h.rescans.length = 0 |
| 101 | h.events.length = 0 |
| 102 | |
| 103 | await rm.gc({ repo: 'demo', keepN: 1 }) |
| 104 | |
| 105 | t.is(h.events.length, 3, 'a tombstone per deleted version — batching the reindex must not batch these') |
| 106 | const versions = h.events.map((e) => e.version).sort() |
| 107 | t.alike(versions, ['v1', 'v2', 'v3'], 'the three oldest') |
| 108 | t.ok(h.events.every((e) => e.op === 3), 'all OP_DELETED') |
| 109 | }) |
| 110 | |
| 111 | test('every tombstone is emitted AFTER the index stops advertising the dead versions', async (t) => { |
| 112 | // The invariant that makes batching safe: no mirror may be woken while the |
| 113 | // index still names a version whose bytes are gone. |
| 114 | const dir = tmpStorage() |
| 115 | const h = harness(dir) |
| 116 | const rm = new ReleaseManager({ releaseDir: dir, deploy: h.deploy, eventLog: h.eventLog }) |
| 117 | |
| 118 | await seed(rm, 'demo', ['v1', 'v2', 'v3', 'v4']) |
| 119 | h.rescans.length = 0 |
| 120 | h.events.length = 0 |
| 121 | |
| 122 | await rm.gc({ repo: 'demo', keepN: 1 }) |
| 123 | |
| 124 | for (const e of h.events) { |
| 125 | t.absent(e.advertisedVersions.includes(e.version), |
| 126 | 'when ' + e.version + ' was announced deleted, the index no longer advertised it') |
| 127 | } |
| 128 | t.absent(existsSync(join(dir, 'demo', 'versions', 'v1')), 'bytes actually gone') |
| 129 | t.ok(existsSync(join(dir, 'demo', 'versions', 'v4')), 'the kept version survives') |
| 130 | }) |
| 131 | |
| 132 | test('a single deleteVersion still reindexes on its own', async (t) => { |
| 133 | // gc batches; the public single-shot API must not regress. |
| 134 | const dir = tmpStorage() |
| 135 | const h = harness(dir) |
| 136 | const rm = new ReleaseManager({ releaseDir: dir, deploy: h.deploy, eventLog: h.eventLog }) |
| 137 | |
| 138 | await seed(rm, 'demo', ['v1', 'v2']) |
| 139 | h.rescans.length = 0 |
| 140 | h.events.length = 0 |
| 141 | |
| 142 | await rm.deleteVersion('demo', 'v1') |
| 143 | |
| 144 | t.is(h.rescans.length, 1, 'one reindex') |
| 145 | t.is(h.events.length, 1, 'one tombstone') |
| 146 | t.absent(h.events[0].advertisedVersions.includes('v1'), 'index updated before the event') |
| 147 | }) |
| 148 | |
| 149 | test('gc with nothing to collect does no work at all', async (t) => { |
| 150 | const dir = tmpStorage() |
| 151 | const h = harness(dir) |
| 152 | const rm = new ReleaseManager({ releaseDir: dir, deploy: h.deploy, eventLog: h.eventLog }) |
| 153 | |
| 154 | await seed(rm, 'demo', ['v1', 'v2']) |
| 155 | h.rescans.length = 0 |
| 156 | h.events.length = 0 |
| 157 | |
| 158 | const res = await rm.gc({ repo: 'demo', keepN: 5 }) |
| 159 | |
| 160 | t.is(res.deleted.length, 0, 'nothing collected') |
| 161 | t.is(h.rescans.length, 0, 'and no reindex — an empty sweep must be free') |
| 162 | t.is(h.events.length, 0, 'no events') |
| 163 | }) |