fix(mst2): retain leases atomically and persist the retention graph

src/api/router/snapshot_router.rs

@@ -424,7 +424,9 @@ async fn resolve(state: State<MonoApiServiceState>, body: Bytes) -> Result<Respo
         scope_page.page_id,
     )
     .map_err(mst2_error_response)?;
-    let ctx = runtime().insert_context(built.clone(), &commit_oid, &tree_oid, req.lease_seconds);
+    let ctx = runtime()
+        .insert_context(built.clone(), &commit_oid, &tree_oid, req.lease_seconds)
+        .map_err(mst2_error_response)?;
     // Publication identity: with T05 enabled the sequence is the durable
     // per-namespace counter written atomically with the ref CAS; a read
     // failure there is surfaced rather than silently falling back, because

src/callisto/mod.rs

@@ -60,6 +60,10 @@ pub mod mega_webhook_delivery;
 pub mod mega_webhook_event_type;
 pub mod mst2_publication;
 pub mod mst2_publication_outbox;
+pub mod mst2_retention_edge;
+pub mod mst2_retention_gc_op;
+pub mod mst2_retention_node;
+pub mod mst2_retention_root;
 pub mod mst2_verified_object;
 pub mod notification_event_types;
 pub mod oci_blob_ref;

src/callisto/mst2_retention_edge.rs

@@ -0,0 +1,19 @@
+//! MST/2 retention graph edges (spec 10 §6).
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "mst2_retention_edge")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = true)]
+    pub id: i64,
+    pub parent_id: String,
+    pub child_id: String,
+    pub created_at: Option<DateTimeWithTimeZone>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}

src/callisto/mst2_retention_gc_op.rs

@@ -0,0 +1,26 @@
+//! Durable MST/2 GC operation log (spec 10 §6 crash replay).
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "mst2_retention_gc_op")]
+pub struct Model {
+    /// Caller supplied idempotency key. A retry of one physical GC step must
+    /// address the same row, so replay cannot decrement an edge twice.
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub operation_id: String,
+    pub node_id: String,
+    /// `MARK_DELETING` or `REMOVE`.
+    pub operation: String,
+    /// `PENDING`, `APPLIED`, or `FAILED`; workers may replay `PENDING`.
+    pub state: String,
+    pub attempts: i32,
+    pub created_at: DateTimeWithTimeZone,
+    pub completed_at: Option<DateTimeWithTimeZone>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}

src/callisto/mst2_retention_node.rs

@@ -0,0 +1,25 @@
+//! MST/2 retention graph nodes (spec 10 §6).
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "mst2_retention_node")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub node_id: String,
+    pub kind: String,
+    pub state: String,
+    #[sea_orm(column_type = "BigInteger")]
+    pub bytes: i64,
+    /// Number of unique incoming retention edges. Root coverage is kept in
+    /// `mst2_retention_root` and checked in the same transaction.
+    #[sea_orm(column_type = "BigInteger")]
+    pub incoming_refs: i64,
+    pub created_at: Option<DateTimeWithTimeZone>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}

src/callisto/mst2_retention_root.rs

@@ -0,0 +1,20 @@
+//! MST/2 retention roots (spec 10 §5/§6).
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "mst2_retention_root")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = true)]
+    pub id: i64,
+    pub node_id: String,
+    pub root_key: String,
+    pub root_kind: String,
+    pub created_at: Option<DateTimeWithTimeZone>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}

src/callisto/prelude.rs

@@ -20,6 +20,10 @@ pub use super::{
     mega_tag::Entity as MegaTag, mega_tree::Entity as MegaTree,
     mega_webhook::Entity as MegaWebhook, mega_webhook_delivery::Entity as MegaWebhookDelivery,
     mega_webhook_event_type::Entity as MegaWebhookEventType,
+    mst2_retention_edge::Entity as Mst2RetentionEdge,
+    mst2_retention_gc_op::Entity as Mst2RetentionGcOp,
+    mst2_retention_node::Entity as Mst2RetentionNode,
+    mst2_retention_root::Entity as Mst2RetentionRoot,
     notification_event_types::Entity as NotificationEventTypes, oci_blob_ref::Entity as OciBlobRef,
     oci_manifest::Entity as OciManifest, oci_tag::Entity as OciTag,
     oci_upload::Entity as OciUpload, path_check_configs::Entity as PathCheckConfigs,