fix(blob): gate blob unlink on the delete/update committing (#1364)

[kriszyp]

Fixes #1364.

Summary

removeEntry deleted a record's blob files up front, before (and independent of) the record removal actually committing. The fix defers the blob deletion until the removal's commit promise resolves, so the unlink only happens once the delete is durable.

Purpose

Second of the two orphan-producing paths in the JJill preprod replication incident. When the Cache expiration scan's transaction is force-committed without a given delete — or any removal aborts/version-conflicts — the record survives while its blob files are unlinked. That orphaned reference makes a later copy/replication stream hit sendBlob() ENOENT and stall permanently. (Receiver-side tolerance for a missing blob is #1353; this stops the orphan being created.)

Approach

store.remove() returns a promise that resolves when the write commits (truthy on commit, false on a conditional-version miss) and rejects on abort — the same promise the eviction scan already awaits. So removeEntry now schedules the blob unlink only after that promise resolves committed, and skips it otherwise. Falls back to immediate deletion when remove() is synchronous (already durable).

This can only ever skip an unlink, never lose data; a skipped unlink leaves a reclaimable orphaned file (swept by cleanupOrphans).

Where to look

• resources/RecordEncoder.ts — removeEntry. This is the whole change. It works for both the LMDB and RocksDB eviction paths because the removal is queued into the transaction that evict() later commits, so its promise resolves at that commit — no change to evict() itself.

Notes

• No collision with fix(blob): tolerate source-unavailable blobs in pre-commit so a missing blob can't wedge replication #1353 (receiver-side pre-commit) or fix(table): make TTL eviction path errors non-fatal on both storage engines (#1287) #1361 (Table.ts evict() error-handling) — different layers/functions.
• Earlier iterations of this PR tried a post-delay re-read of the record (getEntry re-check). That was abandoned: it raced the commit (skipping legitimate unlinks under load) and a deferred getEntry could fire on a closed store and segfault. Gating on the commit promise avoids both. History squashed.
• Cross-model review: Codex flagged the re-check's commit race (P2) — which is exactly why this version gates on the commit promise instead. The Gemini (agy) leg hung with no output — no second outside-model coverage from Gemini.
• Patch-release candidate per Cache expiration scan orphans blob files (unlink on fixed deletionDelay timer, decoupled from RocksDB commit) #1364 discussion.

🤖 Generated by Claude (Opus 4.8, 1M context).

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[claude]

Reviewed; no blockers found.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!