Evan JarrettandClaude Opus 5
0071528b8f
Drives "Scan for Orphans" through the admin panel and asserts the wiring the
Go tests structurally cannot: that the progress fragment swaps into
#gc-results and hands off to the preview fragment, that every advertised stat
renders a value, and that each table's row count agrees with the stat above
it. A GC that decides correctly and renders a blank panel still gets someone
to click delete on the wrong thing.
Then it hand-checks the claim itself, which is the part that matters: for
each distinct manifest behind an orphaned record, resolve the owner's PDS and
ask whether that manifest is really gone.
Two instrument bugs were found writing this, both in the script rather than
the product, and both worth keeping as comments:
* The three tables overlap on a Digest column, so classifying by "has
Digest but no RKey" swallowed Missing Records as orphaned blobs and
reported 3 blobs against a stat of 0. Classification is now by exact
header set.
* Asserting the manifest is ABSENT from the PDS is too strong. A manifest
can be alive and name a different hold, which is exactly what happens
when defaultHold is repointed and the image re-pushed. Those records are
legitimately orphaned here. The only state that means GC is staged to
destroy live data is a manifest that exists AND still names this hold.
Against the dev hold: 387 orphaned records over 68 distinct manifests, 25
sampled — 17 gone, 8 alive but now pointing at the production hold, 0 still
naming this hold. Orphaned blobs 0, referenced 15, and the counts agree with
the tables.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Browser-driven batch validation
Checks for the val/* validation stack — the branch-per-batch series used to
sign off the range between the deployed commit and main.
These complement, and do not replace, go test and the in-process integration
harness (internal/testharness, test/integration, make integration-test).
Pick by what needs proving:
| Prove | Use |
|---|---|
| A function's logic, a query's shape, a guard's behaviour | Go unit test |
| A push/pull/delete round trip across appview + hold + S3 | make integration-test |
| A fragment renders into the right target, a job outlives its request, a 500 dressed as an empty state | these scripts |
Running
npm i -D @playwright/test && npx playwright install chromium
node test/e2e/login.mjs # interactive, once per hold rebuild
node test/e2e/batch00-admin-jobs.mjs # then the batch checks
Env overrides: ATCR_HOLD_URL, ATCR_APPVIEW_URL, ATCR_E2E_PROFILE,
ATCR_E2E_SEED.
Things that will cost you an afternoon
Use 127.0.0.1, never localhost. The appview canonicalises to
http://127.0.0.1:5000 and answers localhost with a 307. Any snippet written
against localhost:5000 measures the redirect, not the endpoint.
Admin sessions are in-memory and die on every hold rebuild. They live in
ui.sessions (pkg/hold/admin/admin.go), not the admin_sessions table, which
is vestigial for this path. Air rebuilds the hold whenever tracked source
changes — including a batch checkout — so budget one interactive login per
switch. There is no test-mode bypass; server.test_mode only affects OAuth
redirect URLs.
Never drive the admin panel with curl. Sessions are pinned to User-Agent and
client IP prefix, and a mismatch does not merely reject the request — it calls
deleteSession and logs you out. Drive everything through ctx.request, which
inherits the browser's cookie jar and UA.
Closing every Playwright page disposes ctx.request. It fails with "Request
context disposed". Keep one about:blank page open when the test needs the
browser out of the way.
Crew delete is a <button hx-post>, not a <form>. Scraping for forms
finds nothing, deletes nothing, and cheerfully reports a clean tab while every
seeded member is still live. Assert against page text after a reload, not
against the scrape that just ran.
Crew rows hydrate per-row via hx-trigger="load". The tab needs a real
settle window (~6s here) before anything is scrapeable.
A seeded fixture makes the second run lie. Crew import skips DIDs that already exist, so a re-run finishes instantly and the detachment check silently passes without ever exercising a running job. Purge before re-running.
Preconditions are easy to miss. The tier reconciliation card only renders
for crew on a tier absent from quota config (handleCrewList), so it is invisible
on a healthy hold. Crew add/update do not validate the tier against config,
which is how these tests manufacture the condition without restarting the hold.
Per-batch stack switching
Use val-switch.sh. The appview DB migrates forward only, so older batch
code hits a schema from the future: batch 00 selects tags.id (dropped by
0032) and cannot write manifests.manifest_key (added NOT NULL by 0033/0034,
which kills every backfill insert). The script destroys and re-migrates the
appview volume so the DB matches the branch.
It deliberately does not touch atcrio_atcr-hold, which holds the hold's
did:web signing key and the CAR store — captain, crew, layer, stats and scan
records. Losing it means a new hold identity and every pushed layer gone.
docker-compose.yml is pinned to main throughout. a7c7db6 (batch 01) is
what makes the appview share the hold's netns so did:web:localhost%3A8080
resolves, and every compose-based batch needs it — including batch 00, which
lands before it. The file is dev-only, so pinning it is a fixture decision
rather than a change to what is under validation. Never commit it from a batch
branch; the script unstages it for you, because git checkout main -- <path>
stages what it restores.