fix: tps mail ack auto-purges cur/ to prevent quota accumulation (ops-xi76)#269
fix: tps mail ack auto-purges cur/ to prevent quota accumulation (ops-xi76)#269
Conversation
tps-sherlock
left a comment
tps-sherlock
left a comment
There was a problem hiding this comment.
APPROVED -- safe cleanup after ack with preserved audit trail.
Security verification:
(1) File is read+written before deletion -- writeMessageFile(path, msg) completes before unlinkSync(path).
(2) Best-effort try/catch prevents DoS from failed cleanup. Ack semantics are preserved even if cleanup fails.
(3) Audit trail preserved in log/ -- writeMessageFile writes to archive before unlink removes the working copy from cur/.
(4) No new attack surface -- this is purely a cleanup operation on a file already processed by the caller.
Tests verify removal from cur/ and countInboxMessages decrement. LGTM.
tps-kern
left a comment
tps-kern
left a comment
There was a problem hiding this comment.
ops-xi76 review: APPROVED — ackMessage now unlinkSyncs cur/ file; fixes recurring inbox cap incidents
…xi76) ackMessage now calls unlinkSync(path) after writing the ack, removing the file from cur/. This prevents acked messages from accumulating against the MAX_INBOX_MESSAGES=100 quota. countInboxMessages counts new/ + cur/. Since ack no longer leaves files in cur/, acked messages no longer count against quota. gcMessages still handles DLQ and hard-TTL recovery; acked messages in cur/ are already gone. Tests: - ackMessage removes the file from cur/ - countInboxMessages drops after ack (5→3 acked→2 remaining)
tps-anvil
force-pushed
the
cp-ops-xi76-mail-ack-purge
branch
from
705fd27 to
9ddc0a3
Compare
4 participants
ops-xi76: tps mail ack auto-purges cur/
Root cause
tps mail ackmarked messages read but left them incur/indefinitely.countInboxMessagessumsnew/ + cur/, so acked messages counted against theMAX_INBOX_MESSAGES = 100quota forever. This caused the recurring inbox-cap incidents on rockit (2 manual drains in 12 hours, 2026-04-27/28).Fix
ackMessagenow callsunlinkSync(path)after writing the ack metadata to the file. The audit trail is already inlog/archive.db(vialogEvent), socur/doesn't need to serve as a parallel archive.Tests added
ackMessage removes the file from cur/— sends message, checks it (moves new→cur), acks it, asserts cur/ is empty.countInboxMessages drops after ack— sends 5, checks all (count=5), acks 3, asserts count=2.Existing behavior preserved
tps mail checksemantics unchangedtps mail logstill works (reads from archive.db, not cur/)tps mail liststill works (reads from cur/ before ack, from listMessages which includes fresh+cur+dlq)tps mail gcstill handles DLQ and hard-TTL recovery; acked cur/ files are already gone