Name each database target's archive for its webhook and target (closes #376)

Each database target now writes its own archive file, archive-WEBHOOKNAME-TARGETNAME-TARGETID.db, named by delivery.ArchiveFileName, in place of one archive per webhook keyed on its UUID. Renaming a webhook or a target renames its archive files (with any -wal and -shm) before the new name is saved, never over an existing file, and moves every one back if a rename or the save fails. The webhook edit, the target edit and target creation share one lock so no two interleave. Deleting a webhook or target leaves its files on disk. Nothing looks for the old archive-WEBHOOKID.db files. The README gives the naming and the recovery steps.

Model: opus-5-5

internal/delivery/target_database_archive.go

@@ -4,8 +4,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io/fs"
 	"log/slog"
 	"os"
+	"path/filepath"
 	"sync"
 	"time"
 
@@ -41,7 +43,7 @@ const (
 
 var (
 	// errArchiveMissingWebhookID is returned when an event to
-	// archive has no webhook id to key its archive file on.
+	// archive has no webhook id to record in its archive row.
 	errArchiveMissingWebhookID = errors.New(
 		"cannot archive event without a webhook id",
 	)
@@ -61,13 +63,19 @@ var (
 	)
 
 	// errArchiveWriterEvicted is returned when a writer that has
-	// been evicted (its webhook was deleted, or its last database
-	// target was removed) is used again. An evicted writer is no
-	// longer in the registry, so reopening its file would leak a
-	// handle nothing owns.
+	// been evicted (its target or its webhook was deleted) is used
+	// again. An evicted writer is no longer in the registry, so
+	// reopening its file would leak a handle nothing owns.
 	errArchiveWriterEvicted = errors.New(
 		"archive writer has been evicted",
 	)
+
+	// ErrArchiveNameTaken is returned when an archive cannot be
+	// renamed because a file already has the new name. That file may
+	// be an archive with rows of its own, so it is never replaced.
+	ErrArchiveNameTaken = errors.New(
+		"a file already has the archive's new name",
+	)
 )
 
 // databaseTargetConfig is the optional per-target JSON config
@@ -80,7 +88,7 @@ type databaseTargetConfig struct {
 }
 
 // archivedEvent is one fully captured webhook event stored in a
-// per-webhook archive database for long-term retention. It is a
+// database target's archive for long-term retention. It is a
 // self-contained copy — independent of the per-webhook event
 // database, which may prune events under its own retention.
 type archivedEvent struct {
@@ -170,8 +178,8 @@ func ValidateArchiveExpiry(expiry string) error {
 	return nil
 }
 
-// archiveWriter owns one per-webhook archive SQLite file. It
-// serialises writes, and after each write closes and reopens
+// archiveWriter owns one database target's archive SQLite file.
+// It serialises writes, and after each write closes and reopens
 // the file (debounced to at most once per debounce window) so
 // an operator can move the file away for offline archiving. The
 // next write recreates a moved or removed file, because the
@@ -187,16 +195,21 @@ type archiveWriter struct {
 	reopens    int
 
 	// evicted marks a writer that has been removed from the
-	// per-webhook registry. Its handle is closed and it must
-	// never open the file again: nothing holds it any more, so a
-	// reopen would leak the handle for the process lifetime.
+	// registry. Its handle is closed and it must never open the
+	// file again: nothing holds it any more, so a reopen would
+	// leak the handle for the process lifetime.
 	evicted bool
 
+	// webhookID is the webhook the archive's target belongs to,
+	// so deleting the webhook can find its writers. It is set
+	// when the writer is created and never changes.
+	webhookID string
+
 	// sweepOwned marks a registry entry that the idle sweep
-	// created because no writer was cached for the webhook. The
+	// created because no writer was cached for the target. The
 	// sweep removes such an entry again when it is done, so a
 	// sweep can never leave — or resurrect — a registry entry
-	// for a webhook that has been deleted. A delivery that adopts
+	// for a target that has been deleted. A delivery that adopts
 	// the writer clears the flag, handing the entry to the
 	// registry proper.
 	//
@@ -385,11 +398,78 @@ func (w *archiveWriter) sweepExpired(expiry time.Duration) error {
 	return nil
 }
 
+// rename gives the archive file a new name in the same directory,
+// and the writer uses the file under that name from now on. The
+// handle is closed first, which folds the -wal into the .db; any
+// -wal or -shm still beside the file (left by a crash) is moved with
+// it, because SQLite finds them by name. A missing file is not an
+// error: the operator may have moved it away, and the next write
+// creates it under the new name.
+//
+// If a file already has the new name, nothing is moved and the
+// error is ErrArchiveNameTaken. If one file fails to move, those
+// already moved are moved back before the error is returned, so the
+// archive is never split across two names.
+func (w *archiveWriter) rename(name string) error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	if w.evicted {
+		return fmt.Errorf(
+			"%w: %s", errArchiveWriterEvicted, w.path,
+		)
+	}
+
+	path := filepath.Join(filepath.Dir(w.path), name)
+	if path == w.path {
+		return nil
+	}
+
+	suffixes := []string{"", "-wal", "-shm"}
+
+	for _, suffix := range suffixes {
+		if fileExists(path + suffix) {
+			return fmt.Errorf(
+				"%w: %s", ErrArchiveNameTaken, name+suffix,
+			)
+		}
+	}
+
+	w.close()
+
+	for i, suffix := range suffixes {
+		err := os.Rename(w.path+suffix, path+suffix)
+		if err == nil || errors.Is(err, fs.ErrNotExist) {
+			continue
+		}
+
+		for _, moved := range suffixes[:i] {
+			backErr := os.Rename(path+moved, w.path+moved)
+			if backErr != nil && !errors.Is(backErr, fs.ErrNotExist) {
+				w.log.Error(
+					"failed to move archive file back",
+					"from", path+moved,
+					"to", w.path+moved,
+					"error", backErr,
+				)
+			}
+		}
+
+		return fmt.Errorf(
+			"renaming archive %s to %s: %w", w.path+suffix, path+suffix, err,
+		)
+	}
+
+	w.path = path
+
+	return nil
+}
+
 // evict closes the writer's handle and marks it unusable. It is
-// called when the writer leaves the registry, either because the
-// webhook was deleted or because its last database target was
-// removed. The archive FILE is deliberately left on disk: it is
-// long-term storage an operator may still want.
+// called when the writer leaves the registry, because its target
+// or its webhook was deleted, or at shutdown. The archive FILE is
+// deliberately left on disk: it is long-term storage an operator
+// may still want.
 func (w *archiveWriter) evict() {
 	w.mu.Lock()
 	defer w.mu.Unlock()