deleteWebhookResources issued three deletes without checking any of
them. A failing delete sets .Error on the returned session but leaves
the transaction usable, so the handler committed whatever succeeded,
redirected to /sources as though deletion had worked, and then
hard-deleted the per-webhook event database anyway. A webhook could
end up with its entrypoints or targets still in the main database and
its entire event history permanently gone, reported as a success.
The transaction moves into commitWebhookDeletion, which checks each
statement and rolls back on any failure, matching commitWebhook in the
same file. deleteWebhookResources reports the failure with
h.serverError and leaves the event database alone.
The configuration commit deliberately precedes DeleteDB: no
transaction spans SQLite and the filesystem, and a failure after the
commit leaves an unreferenced event database file, which the operator
can remove, rather than destroying history for a webhook that still
exists. That failure is reported with h.serverError too instead of a
success redirect.
check / check (push) Superseded by a newer commit; never tested
Per-webhook archive writers are now evicted when the webhook or its last
database target is deleted, and a background sweeper prunes expired rows from
idle archives that no longer receive writes. Archive files themselves are never
deleted.
