Evict archive writers on deletion and sweep idle archives (closes #89)

The per-webhook archiveWriter registry in the database delivery target
was never evicted, so a deleted webhook's writer -- and any archive
file handle open within its debounce window -- lingered for the process
lifetime. Separately, expiry pruning ran only when an archive was
(re)opened, and reopens only happen on writes, so an archive belonging
to a webhook that stopped receiving events kept its expired rows
forever.

Eviction: a new one-method delivery.WebhookEvictor interface (kept
separate from Notifier: archiving lifecycle is not notification) is
implemented by the Engine and injected into the handlers. Deleting a
webhook, or deleting its last database target, drops the writer from
the registry and closes its handle under the writer's own mutex, so
eviction can never race an in-flight write. An evicted writer refuses
further writes rather than reopening a file nothing holds. The archive
file is deliberately left on disk: it is long-term storage an operator
may want to keep or move away, and destroying it as a side effect of
deleting a webhook would be unrecoverable.

Idle sweep: a new ArchiveSweeper, modelled on the event RetentionReaper
(fx lifecycle hooks, cancellable context, WaitGroup, ticker loop),
prunes archives whose database target declares a positive expiry. It
reuses the existing RETENTION_SWEEP_INTERVAL rather than adding a
config key. It never creates an archive -- a missing file is skipped,
and the reopen uses SQLite mode=rw so the file cannot be conjured even
if it disappears mid-sweep -- routes the prune through the per-webhook
writer so its mutex orders the sweep against concurrent writes, and
leaves the archive closed so the move-the-file-away workflow keeps
working. A failure for one webhook is logged and the sweep continues.
Archives with no expiry or the expiry "never" are untouched.

README.md

@@ -307,29 +307,13 @@ event routing.
 | `user_id`        | UUID    | Foreign key → User |
 | `name`           | string  | Human-readable name |
 | `description`    | string  | Optional description |
-| `retention_days` | integer | Days to retain events (default: 30; 0 means retain forever) |
+| `retention_days` | integer | Days to retain events (default: 30) |
 
 **Relations:** Belongs to User. Has many Entrypoints. Has many Targets.
 
 The `retention_days` field controls how long event data is kept in the
 webhook's dedicated database before automatic cleanup.
 
-Setting `retention_days` to `0` means "retain events forever". Because
-the column carries a default of 30, a literal zero cannot survive an
-insert, so a zero is rewritten on save to a sentinel of `365 * 1000`
-days (`database.RetentionForeverDays`). The retention reaper recognises
-that sentinel and skips the webhook entirely, and the web UI displays
-such a webhook's retention as "forever" rather than as a day count.
-
-A *finite* retention is capped at `database.MaxFiniteRetentionDays`
-(106751 days, about 292 years), and a larger one is rejected with a
-400. The cap is not arbitrary: the reaper computes its cutoff as a
-`time.Duration`, an int64 nanosecond count, and a longer period
-overflows it. An overflowed cutoff lands in the future, where it
-matches every row, so the sweep would delete every event the webhook
-has instead of none. The reaper also clamps the value it is given, so a
-row written by an older version cannot trigger that either.
-
 #### Entrypoint
 
 A receiver URL where external services POST webhook events. Each
@@ -525,7 +509,7 @@ This separation provides:
   DB; the event database file is hard-deleted (permanently removed).
 - **Per-webhook retention** — the `retention_days` field on each webhook
   controls automatic cleanup of old events in that webhook's database
-  only, or disables cleanup entirely when set to `0` (retain forever).
+  only.
 - **Performance** — each webhook's database has its own WAL, its own
   page cache, and its own lock, so concurrent event ingestion across
   webhooks won't contend.
@@ -547,6 +531,30 @@ older than the expiry are pruned each time the archive is (re)opened. An
 archive write failure is never silent success: the delivery records a
 failed attempt with the error and is marked failed.
 
+Because reopens only happen on writes, an archive belonging to a webhook
+that has stopped receiving events would never be pruned. A background
+**archive sweeper** closes that gap: on the same interval as the event
+retention reaper (`RETENTION_SWEEP_INTERVAL`) it prunes every archive
+whose database target declares a positive expiry, whether or not the
+webhook is still receiving traffic. The sweep never creates an archive —
+a webhook whose archive file does not yet exist is skipped, not
+initialised — it takes the same per-webhook lock the write path uses, so
+it can never interleave with a write, and it leaves the archive closed
+afterwards so the move-the-file-away workflow keeps working. Archives
+with no expiry, or the expiry `never`, are not touched by the sweep at
+all.
+
+Deleting a webhook releases its archive: the delivery engine's cached
+archive writer is dropped and its file handle closed, so nothing lingers
+after the webhook is gone. The archive **file itself is deliberately
+left on disk**. Unlike the event database — per-webhook working storage
+that is hard-deleted with the webhook — an archive is long-term storage
+an operator may still want to keep or move away for offline retention,
+and destroying it as a side effect of deleting a webhook would be
+unrecoverable. Removing `archive-{webhookID}.db` is the operator's call.
+Deleting a webhook's last `database` target releases the writer the same
+way, and for the same reason leaves the file alone.
+
 The **Slack target type** sends webhook events as formatted messages to
 any Slack-compatible incoming webhook URL (works with Slack, Mattermost,
 and other compatible services). Each message includes event metadata

TODO.md

@@ -28,17 +28,11 @@ databases currently grow without bound.
 
 # Completed Steps
 
-- 2026-08-09 Make retain-forever reachable from the normal create and
-  edit flows (#79): a `RetentionForeverDays = 365 * 1000` sentinel, a
-  `Webhook.BeforeSave` hook rewriting any non-positive `retention_days`
-  to it ahead of GORM's own column defaulting, a reaper that skips such
-  webhooks outright, form validation that honours `0` and rejects
-  garbage with a 400, and a retention UI that says "forever". Also
-  closes the overflow the same code path exposed: a finite
-  `retention_days` above `MaxFiniteRetentionDays` (106751, derived from
-  what an int64 `time.Duration` can hold) wrapped the reaper's cutoff
-  into the future and deleted every event, so it is now rejected at the
-  form and clamped in the reaper
+- 2026-08-09 Archive writer lifecycle (#89): deleting a webhook (or its
+  last `database` target) evicts the cached archive writer and closes
+  its handle while deliberately leaving `archive-{webhookID}.db` on
+  disk, and a new `ArchiveSweeper` prunes idle archives on the existing
+  `RETENTION_SWEEP_INTERVAL` without ever creating an archive file
 - 2026-08-07 Update golangci-lint to v2.12.2 (Docker image digest in
   `Dockerfile`, release-archive sha256 pins in `script/bootstrap`),
   adopt the canonical `.golangci.yml` (v2 `linters.settings` layout so

cmd/webhooker/main.go

@@ -40,9 +40,15 @@ func main() {
 			handlers.New,
 			middleware.New,
 			delivery.New,
+			delivery.NewArchiveSweeper,
 			// Wire *delivery.Engine as delivery.Notifier so the
 			// webhook handler can notify the engine of new deliveries.
 			func(e *delivery.Engine) delivery.Notifier { return e },
+			// Wire *delivery.Engine as delivery.WebhookEvictor so
+			// deleting a webhook releases its archive writer.
+			func(e *delivery.Engine) delivery.WebhookEvictor {
+				return e
+			},
 			server.New,
 		),
 		fx.Invoke(
@@ -50,6 +56,7 @@ func main() {
 				*server.Server,
 				*delivery.Engine,
 				*database.RetentionReaper,
+				*delivery.ArchiveSweeper,
 			) {
 			},
 		),

internal/database/database_test.go

@@ -18,11 +18,6 @@ const (
 	testVersion = "test"
 	// testContentType is the event content type used in tests.
 	testContentType = "application/json"
-	// testWebhookName is the Webhook.Name used in tests.
-	testWebhookName = "test-webhook"
-	// testForeverLabel is Webhook.RetentionLabel for a retain-forever
-	// webhook.
-	testForeverLabel = "forever"
 )
 
 func setupTestDB(

internal/database/model_webhook.go

@@ -1,59 +1,6 @@
 package database
 
-import (
-	"math"
-	"strconv"
-	"time"
-
-	"gorm.io/gorm"
-)
-
-const (
-	// DefaultRetentionDays is the event retention period applied to a
-	// webhook created without an explicit retention value. It is the
-	// single source of truth for that policy and must stay in sync
-	// with the `gorm:"default:30"` column default on
-	// Webhook.RetentionDays below; a struct tag cannot reference a
-	// constant, so a test asserts the two agree.
-	DefaultRetentionDays = 30
-
-	// RetentionForeverDays is the sentinel RetentionDays value meaning
-	// "retain events forever". Users express that intent as 0, which
-	// Webhook.BeforeSave rewrites to this value: the column default
-	// substitutes DefaultRetentionDays for a zero value at insert
-	// time, so a zero can never survive a round trip to the database.
-	// Nothing outside this file may hardcode the number.
-	RetentionForeverDays = 365 * 1000
-
-	// MaxFiniteRetentionDays is the largest finite retention period the
-	// reaper's cutoff arithmetic can represent, and therefore the
-	// largest one a caller may request. It is derived from that
-	// arithmetic rather than picked: retentionCutoff computes
-	// retentionDays * hoursPerDay * time.Hour, and a time.Duration is
-	// an int64 nanosecond count, so math.MaxInt64 nanoseconds divided
-	// by an hour and then by a day is the exact ceiling — 106751 days,
-	// a little over 292 years.
-	//
-	// One day more overflows int64, wraps the product negative, and
-	// turns the cutoff into a timestamp in the far future that matches
-	// every row in the webhook's database. That is why this bound is
-	// enforced on input and why retentionCutoff saturates underneath
-	// it. Note that RetentionForeverDays deliberately sits above this
-	// ceiling: such webhooks are skipped before any cutoff is
-	// computed, and never reach the arithmetic at all.
-	MaxFiniteRetentionDays = int(
-		math.MaxInt64 / int64(time.Hour) / hoursPerDay,
-	)
-)
-
 // Webhook represents a webhook processing unit that groups entrypoints and targets
-//
-// Every method below takes a pointer receiver. BeforeSave has to,
-// because it mutates the record and GORM only invokes hooks declared
-// that way; the display helpers follow suit so the receiver kinds do
-// not mix. Handlers therefore put a *Webhook into template data:
-// html/template cannot call a pointer method on a value held in a map,
-// because a map element is not addressable.
 type Webhook struct {
 	BaseModel
 
@@ -61,9 +8,7 @@ type Webhook struct {
 	Name        string `gorm:"not null"           json:"name"`
 	Description string `json:"description"`
 
-	// RetentionDays is the number of days to retain events. A value of
-	// RetentionForeverDays means retain forever. The column default
-	// must equal DefaultRetentionDays.
+	// RetentionDays is the number of days to retain events.
 	RetentionDays int `gorm:"default:30" json:"retentionDays"`
 
 	// Relations
@@ -71,55 +16,3 @@ type Webhook struct {
 	Entrypoints []Entrypoint `json:"entrypoints,omitempty"`
 	Targets     []Target     `json:"targets,omitempty"`
 }
-
-// BeforeSave normalises RetentionDays on every insert and update. A
-// non-positive value is the user's way of asking for "retain forever",
-// which is stored as the RetentionForeverDays sentinel.
-//
-// This has to happen in a hook rather than at the call sites. GORM
-// substitutes the column default (DefaultRetentionDays) for a zero
-// value while building the insert statement, which runs after
-// BeforeSave; rewriting any later than this loses that race and the
-// row lands at 30 days. Living on the model also means a future call
-// site — a REST API, a fixture, a migration — cannot bypass it.
-func (w *Webhook) BeforeSave(_ *gorm.DB) error {
-	if w.RetentionDays <= 0 {
-		w.RetentionDays = RetentionForeverDays
-	}
-
-	return nil
-}
-
-// retainsForever reports whether a stored RetentionDays value means
-// "keep events indefinitely". It is the single definition of that
-// question, shared by Webhook.RetainsForever and by the reaper's
-// cutoff computation so the two cannot disagree about which webhooks
-// are exempt from reaping.
-//
-// It accepts the RetentionForeverDays sentinel written by BeforeSave
-// and, defensively, the non-positive values that rows written before
-// the sentinel existed may still carry.
-func retainsForever(retentionDays int) bool {
-	return retentionDays <= 0 ||
-		retentionDays >= RetentionForeverDays
-}
-
-// RetainsForever reports whether this webhook's events are kept
-// indefinitely.
-func (w *Webhook) RetainsForever() bool {
-	return retainsForever(w.RetentionDays)
-}
-
-// RetentionLabel returns the webhook's retention policy as display
-// text, so that no template has to know about the sentinel value.
-func (w *Webhook) RetentionLabel() string {
-	if w.RetainsForever() {
-		return "forever"
-	}
-
-	if w.RetentionDays == 1 {
-		return "1 day"
-	}
-
-	return strconv.Itoa(w.RetentionDays) + " days"
-}

internal/database/model_webhook_test.go

@@ -1,222 +0,0 @@
-package database_test
-
-import (
-	"context"
-	"reflect"
-	"strconv"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gorm.io/gorm"
-	"gorm.io/gorm/clause"
-	"sneak.berlin/go/webhooker/internal/database"
-)
-
-// startedTestDB returns a started main database for model-level tests.
-func startedTestDB(t *testing.T) *gorm.DB {
-	t.Helper()
-
-	db, lc := setupTestDB(t)
-
-	ctx := context.Background()
-	require.NoError(t, lc.Start(ctx))
-	t.Cleanup(func() { require.NoError(t, lc.Stop(ctx)) })
-
-	return db.DB()
-}
-
-// storedRetention reads the retention_days column straight out of the
-// row, so the assertion is about what was persisted rather than about
-// whatever the in-memory struct happens to hold.
-func storedRetention(t *testing.T, db *gorm.DB, id string) int {
-	t.Helper()
-
-	var got int
-
-	require.NoError(
-		t,
-		db.Model(&database.Webhook{}).
-			Where("id = ?", id).
-			Pluck("retention_days", &got).Error,
-	)
-
-	return got
-}
-
-// newWebhookWithRetention creates a webhook through the ordinary Create
-// path, so the BeforeSave hook and the GORM column default both apply
-// exactly as they do in production.
-func newWebhookWithRetention(
-	t *testing.T,
-	db *gorm.DB,
-	wh *database.Webhook,
-) string {
-	t.Helper()
-
-	wh.UserID = uuid.New().String()
-	wh.Name = testWebhookName
-
-	require.NoError(
-		t,
-		db.Omit(clause.Associations).Create(wh).Error,
-	)
-
-	return wh.ID
-}
-
-func TestWebhookBeforeSave_ZeroBecomesForeverSentinel(t *testing.T) {
-	t.Parallel()
-
-	db := startedTestDB(t)
-
-	wh := &database.Webhook{RetentionDays: 0}
-	id := newWebhookWithRetention(t, db, wh)
-
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetention(t, db, id),
-		"a zero retention must be stored as the sentinel, "+
-			"not replaced by the column default",
-	)
-}
-
-func TestWebhookBeforeSave_NegativeBecomesForeverSentinel(t *testing.T) {
-	t.Parallel()
-
-	db := startedTestDB(t)
-
-	wh := &database.Webhook{RetentionDays: -5}
-	id := newWebhookWithRetention(t, db, wh)
-
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetention(t, db, id),
-	)
-}
-
-func TestWebhookBeforeSave_PositiveIsPreserved(t *testing.T) {
-	t.Parallel()
-
-	db := startedTestDB(t)
-
-	wh := &database.Webhook{RetentionDays: 7}
-	id := newWebhookWithRetention(t, db, wh)
-
-	assert.Equal(t, 7, storedRetention(t, db, id))
-}
-
-// TestWebhookBeforeSave_UpdateToZeroBecomesSentinel proves the hook
-// fires on update as well as insert, via the same Save call the edit
-// handler makes.
-func TestWebhookBeforeSave_UpdateToZeroBecomesSentinel(t *testing.T) {
-	t.Parallel()
-
-	db := startedTestDB(t)
-
-	wh := &database.Webhook{RetentionDays: 30}
-	id := newWebhookWithRetention(t, db, wh)
-	require.Equal(t, 30, storedRetention(t, db, id))
-
-	wh.RetentionDays = 0
-	require.NoError(t, db.Omit(clause.Associations).Save(wh).Error)
-
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetention(t, db, id),
-	)
-}
-
-// TestWebhookRetentionColumnDefaultMatchesConstant guards the one place
-// the default lives twice: a struct tag cannot reference a constant, so
-// this asserts the tag and DefaultRetentionDays agree.
-func TestWebhookRetentionColumnDefaultMatchesConstant(t *testing.T) {
-	t.Parallel()
-
-	field, ok := reflect.TypeFor[database.Webhook]().
-		FieldByName("RetentionDays")
-	require.True(t, ok, "Webhook.RetentionDays must exist")
-
-	assert.Equal(
-		t,
-		"default:"+strconv.Itoa(database.DefaultRetentionDays),
-		field.Tag.Get("gorm"),
-	)
-}
-
-// TestMaxFiniteRetentionDaysIsTheOverflowCeiling asserts that the
-// constant is exactly where the cutoff arithmetic stops working, which
-// is what makes it a derived bound rather than a round number someone
-// liked. One day more wraps the int64 nanosecond count negative, and a
-// negative span is precisely what turned a cutoff into a future
-// timestamp that matched — and deleted — every row.
-//
-// The multiplications are done through variables on purpose: as
-// constant expressions the overflowing one would not compile.
-func TestMaxFiniteRetentionDaysIsTheOverflowCeiling(t *testing.T) {
-	t.Parallel()
-
-	const hoursPerDay = 24
-
-	atCeiling := database.MaxFiniteRetentionDays
-	overCeiling := database.MaxFiniteRetentionDays + 1
-
-	assert.Positive(
-		t,
-		time.Duration(atCeiling*hoursPerDay)*time.Hour,
-		"the ceiling itself must still be representable",
-	)
-	assert.Negative(
-		t,
-		time.Duration(overCeiling*hoursPerDay)*time.Hour,
-		"one day past the ceiling must overflow",
-	)
-
-	assert.Less(
-		t,
-		database.MaxFiniteRetentionDays,
-		database.RetentionForeverDays,
-		"the sentinel sits above the ceiling and is only safe "+
-			"because retain-forever webhooks skip the arithmetic",
-	)
-}
-
-func TestWebhookRetainsForeverAndLabel(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name    string
-		days    int
-		forever bool
-		label   string
-	}{
-		{
-			"sentinel",
-			database.RetentionForeverDays, true, testForeverLabel,
-		},
-		{
-			"above sentinel",
-			database.RetentionForeverDays + 1, true, testForeverLabel,
-		},
-		{"legacy zero", 0, true, testForeverLabel},
-		{"legacy negative", -1, true, testForeverLabel},
-		{"default", database.DefaultRetentionDays, false, "30 days"},
-		{"one day", 1, false, "1 day"},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			wh := database.Webhook{RetentionDays: tc.days}
-
-			assert.Equal(t, tc.forever, wh.RetainsForever())
-			assert.Equal(t, tc.label, wh.RetentionLabel())
-		})
-	}
-}

internal/database/retention.go

@@ -114,8 +114,7 @@ func (r *RetentionReaper) run(ctx context.Context) {
 }
 
 // sweep lists every webhook from the main database and reaps expired
-// rows from each per-webhook database that has a finite retention
-// policy. Webhooks set to retain forever are skipped entirely.
+// rows from each per-webhook database whose RetentionDays is positive.
 func (r *RetentionReaper) sweep(ctx context.Context) {
 	var webhooks []Webhook
 
@@ -140,13 +139,8 @@ func (r *RetentionReaper) sweep(ctx context.Context) {
 
 		wh := webhooks[i]
 
-		// Skip retain-forever webhooks before building any query.
-		// RetainsForever covers both the RetentionForeverDays
-		// sentinel and the non-positive values that predate it: the
-		// sentinel is a positive number, so without this the reaper
-		// would compute a cutoff a thousand years in the past and
-		// issue a DELETE matching nothing on every single sweep.
-		if wh.RetainsForever() {
+		// RetentionDays of zero or less means retain forever.
+		if wh.RetentionDays <= 0 {
 			continue
 		}
 
@@ -177,10 +171,9 @@ func (r *RetentionReaper) reapWebhook(
 		return
 	}
 
-	cutoff, ok := retentionCutoff(time.Now(), retentionDays)
-	if !ok {
-		return
-	}
+	cutoff := time.Now().Add(
+		-time.Duration(retentionDays*hoursPerDay) * time.Hour,
+	)
 
 	deleted, err := reapExpired(db, cutoff)
 	if err != nil {
@@ -203,37 +196,6 @@ func (r *RetentionReaper) reapWebhook(
 	}
 }
 
-// retentionCutoff returns the timestamp before which a webhook's
-// events have expired, and whether any cutoff applies at all. It
-// reports false for a retain-forever policy, so no DELETE is issued.
-//
-// The day count is clamped to MaxFiniteRetentionDays first. This is
-// defense in depth rather than decoration: a time.Duration is an int64
-// nanosecond count, so an unclamped multiplication overflows above
-// that ceiling and wraps the span negative. Subtracting a negative
-// span moves the cutoff into the far future, where it matches every
-// row in the database: the sweep then deletes every event, delivery,
-// and delivery result, including ones created seconds ago. Rejecting
-// out-of-range input at the form is the primary guard; saturating here
-// means an old row, a migration, or a future call site cannot turn a
-// too-large retention into total data loss.
-func retentionCutoff(
-	now time.Time,
-	retentionDays int,
-) (time.Time, bool) {
-	if retainsForever(retentionDays) {
-		return time.Time{}, false
-	}
-
-	if retentionDays > MaxFiniteRetentionDays {
-		retentionDays = MaxFiniteRetentionDays
-	}
-
-	return now.Add(
-		-time.Duration(retentionDays*hoursPerDay) * time.Hour,
-	), true
-}
-
 // reapExpired hard-deletes, in foreign-key-safe order, the delivery
 // results, deliveries, and events associated with events older than
 // cutoff. Deletes are unscoped so rows are physically removed rather

internal/database/retention_test.go

@@ -77,7 +77,7 @@ func createWebhook(
 
 	wh := &database.Webhook{
 		UserID:        uuid.New().String(),
-		Name:          testWebhookName,
+		Name:          "test-webhook",
 		RetentionDays: retentionDays,
 	}
 	require.NoError(
@@ -85,11 +85,10 @@ func createWebhook(
 		db.Omit(clause.Associations).Create(wh).Error,
 	)
 
-	// Webhook.BeforeSave rewrites a non-positive RetentionDays to the
-	// retain-forever sentinel, and the column's GORM default would
-	// otherwise substitute 30. Force the requested value with a
-	// column-level update so tests can plant legacy rows that predate
-	// the sentinel and still carry a literal 0 or negative value.
+	// The RetentionDays column carries a GORM default of 30, so a
+	// zero (or negative) value passed to Create is replaced by that
+	// default. Force the requested value explicitly so the
+	// retain-forever (<= 0) path can be exercised.
 	require.NoError(
 		t,
 		db.Model(wh).
@@ -99,30 +98,6 @@ func createWebhook(
 	return wh.ID
 }
 
-// createWebhookNormally inserts a webhook through the ordinary Create
-// path, with no column-level forcing, so Webhook.BeforeSave applies
-// exactly as it does in production. Passing 0 therefore yields a row
-// holding the RetentionForeverDays sentinel.
-func createWebhookNormally(
-	t *testing.T,
-	db *gorm.DB,
-	retentionDays int,
-) string {
-	t.Helper()
-
-	wh := &database.Webhook{
-		UserID:        uuid.New().String(),
-		Name:          testWebhookName,
-		RetentionDays: retentionDays,
-	}
-	require.NoError(
-		t,
-		db.Omit(clause.Associations).Create(wh).Error,
-	)
-
-	return wh.ID
-}
-
 // eventChain is the set of row IDs seeded for a single event.
 type eventChain struct {
 	eventID    string
@@ -281,111 +256,12 @@ func TestRetentionReaper_ReapsExpiredKeepsRecent(t *testing.T) {
 	assertChainPresent(t, db, recent)
 }
 
-// TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep covers the
-// end-to-end retain-forever path: a webhook created the normal way with
-// a requested retention of 0 lands on the RetentionForeverDays
-// sentinel, and the reaper leaves its ancient events alone while still
-// reaping a finite-retention webhook in the very same sweep.
-func TestRetentionReaper_SkipsSentinelReapsFiniteInSameSweep(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupRetentionTest(t)
-
-	foreverID := createWebhookNormally(t, env.mainDB.DB(), 0)
-
-	var stored database.Webhook
-
-	require.NoError(
-		t,
-		env.mainDB.DB().Where("id = ?", foreverID).
-			First(&stored).Error,
-	)
-	require.Equal(
-		t,
-		database.RetentionForeverDays,
-		stored.RetentionDays,
-		"a requested retention of 0 must persist as the sentinel",
-	)
-
-	finiteID := createWebhookNormally(t, env.mainDB.DB(), 30)
-
-	foreverDB, err := env.mgr.GetDB(foreverID)
-	require.NoError(t, err)
-
-	finiteDB, err := env.mgr.GetDB(finiteID)
-	require.NoError(t, err)
-
-	ancient := time.Now().Add(-365 * 24 * time.Hour)
-	kept := seedEventChain(t, foreverDB, foreverID, ancient)
-	doomed := seedEventChain(t, finiteDB, finiteID, ancient)
-
-	env.reaper.ExportSweep(context.Background())
-
-	assertChainPresent(t, foreverDB, kept)
-	assertChainGone(t, finiteDB, doomed)
-}
-
-// TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents pins the
-// overflow that made a large finite retention destroy everything.
-//
-// The cutoff is a time.Duration, an int64 nanosecond count. A day
-// count above MaxFiniteRetentionDays multiplied out unclamped wraps
-// negative, so subtracting it moves the cutoff into the far future,
-// where "created_at < cutoff" matches every row: an event created a
-// moment ago, and its delivery and delivery result, were all deleted
-// on the first sweep. 200000 is inside that band and below the
-// retain-forever sentinel, so it is treated as a finite policy and
-// really does reach the arithmetic.
-//
-// The row is planted at the column level because such a value can no
-// longer be submitted through the form; the point of the test is that
-// a row from an older version, or a future call site, still cannot
-// trigger the wipe.
-func TestRetentionReaper_HugeFiniteRetentionRetainsRecentEvents(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupRetentionTest(t)
-
-	const overflowingRetentionDays = 200000
-
-	require.Greater(
-		t,
-		overflowingRetentionDays,
-		database.MaxFiniteRetentionDays,
-		"the test value must exceed what the cutoff can represent",
-	)
-	require.Less(
-		t,
-		overflowingRetentionDays,
-		database.RetentionForeverDays,
-		"the test value must not be rescued by the forever skip",
-	)
-
-	webhookID := createWebhook(
-		t, env.mainDB.DB(), overflowingRetentionDays,
-	)
-
-	db, err := env.mgr.GetDB(webhookID)
-	require.NoError(t, err)
-
-	fresh := seedEventChain(t, db, webhookID, time.Now())
-
-	env.reaper.ExportSweep(context.Background())
-
-	assertChainPresent(t, db, fresh)
-}
-
 func TestRetentionReaper_RetainsForeverWhenNonPositive(t *testing.T) {
 	t.Parallel()
 
 	env := setupRetentionTest(t)
 
-	// A legacy row written before the sentinel existed still carries a
-	// literal 0; the <= 0 guard must keep honouring it.
+	// RetentionDays of zero means retain forever.
 	webhookID := createWebhook(t, env.mainDB.DB(), 0)
 
 	db, err := env.mgr.GetDB(webhookID)

internal/delivery/archive_sweeper.go

@@ -0,0 +1,189 @@
+package delivery
+
+import (
+	"context"
+	"log/slog"
+	"sync"
+	"time"
+
+	"go.uber.org/fx"
+	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/logger"
+)
+
+// ArchiveSweeperParams holds the fx dependencies for the
+// ArchiveSweeper.
+type ArchiveSweeperParams struct {
+	fx.In
+
+	Config   *config.Config
+	Database *database.Database
+	Engine   *Engine
+	Logger   *logger.Logger
+}
+
+// ArchiveSweeper periodically prunes expired rows from
+// per-webhook archive databases whose database target carries a
+// positive expiry.
+//
+// Without it, pruning happens only when an archive is
+// (re)opened, and archives are only ever reopened by writes: an
+// archive belonging to a webhook that has stopped receiving
+// events would keep its expired rows forever. The sweep closes
+// that gap without changing anything for archives whose expiry
+// is unset or "never".
+//
+// It reuses Config.RetentionSweepInterval rather than
+// introducing a second interval: this is a retention sweep with
+// the same semantics as the event retention reaper.
+type ArchiveSweeper struct {
+	db       *database.Database
+	eng      *Engine
+	log      *slog.Logger
+	interval time.Duration
+	cancel   context.CancelFunc
+	wg       sync.WaitGroup
+}
+
+// NewArchiveSweeper creates the archive sweeper and registers
+// its fx lifecycle hooks. The background sweep loop starts on
+// OnStart and stops cleanly on OnStop via context cancellation.
+func NewArchiveSweeper(
+	lc fx.Lifecycle,
+	params ArchiveSweeperParams,
+) *ArchiveSweeper {
+	s := &ArchiveSweeper{
+		db:       params.Database,
+		eng:      params.Engine,
+		log:      params.Logger.Get(),
+		interval: params.Config.RetentionSweepInterval,
+	}
+
+	lc.Append(fx.Hook{
+		OnStart: func(ctx context.Context) error {
+			s.start(ctx)
+
+			return nil
+		},
+		OnStop: func(_ context.Context) error {
+			s.stop()
+
+			return nil
+		},
+	})
+
+	return s
+}
+
+func (s *ArchiveSweeper) start(ctx context.Context) {
+	ctx, cancel := context.WithCancel(ctx)
+	s.cancel = cancel
+
+	s.wg.Add(1)
+
+	go s.run(ctx)
+
+	s.log.Info(
+		"archive sweeper started",
+		"interval", s.interval.String(),
+	)
+}
+
+func (s *ArchiveSweeper) stop() {
+	s.log.Info("archive sweeper stopping")
+
+	if s.cancel != nil {
+		s.cancel()
+	}
+
+	s.wg.Wait()
+	s.log.Info("archive sweeper stopped")
+}
+
+func (s *ArchiveSweeper) run(ctx context.Context) {
+	defer s.wg.Done()
+
+	ticker := time.NewTicker(s.interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			s.sweep(ctx)
+		}
+	}
+}
+
+// sweep prunes every archive whose database target declares a
+// positive expiry. Targets belonging to a deleted webhook are
+// soft-deleted along with it, so GORM's default scope already
+// excludes them.
+//
+// A failure for one webhook is logged and the sweep continues,
+// matching how the write path already treats a prune error as
+// non-fatal.
+func (s *ArchiveSweeper) sweep(ctx context.Context) {
+	var targets []database.Target
+
+	err := s.db.DB().
+		Model(&database.Target{}).
+		Where("type = ?", database.TargetTypeDatabase).
+		Find(&targets).Error
+	if err != nil {
+		s.log.Error(
+			"archive sweep: failed to list database targets",
+			"error", err,
+		)
+
+		return
+	}
+
+	for i := range targets {
+		select {
+		case <-ctx.Done():
+			return
+		default:
+		}
+
+		s.sweepTarget(&targets[i])
+	}
+}
+
+// sweepTarget prunes the archive of a single database target.
+// A missing, empty, or "never" expiry parses as a zero duration
+// and is skipped entirely, so those archives keep exactly the
+// behaviour they had before the sweep existed.
+func (s *ArchiveSweeper) sweepTarget(target *database.Target) {
+	expiry, err := parseArchiveExpiry(target.Config)
+	if err != nil {
+		s.log.Error(
+			"archive sweep: invalid database target config",
+			"webhook_id", target.WebhookID,
+			"target_id", target.ID,
+			"error", err,
+		)
+
+		return
+	}
+
+	if expiry <= 0 {
+		return
+	}
+
+	if s.eng == nil || s.eng.dbTarget == nil {
+		return
+	}
+
+	err = s.eng.dbTarget.sweepWebhook(target.WebhookID, expiry)
+	if err != nil {
+		s.log.Error(
+			"archive sweep: failed to prune archive",
+			"webhook_id", target.WebhookID,
+			"target_id", target.ID,
+			"error", err,
+		)
+	}
+}

internal/delivery/archive_sweeper_test.go

@@ -0,0 +1,425 @@
+package delivery_test
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"net/http"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	_ "modernc.org/sqlite" // Pure Go SQLite driver.
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
+)
+
+const (
+	// sweepRowOld and sweepRowNew are the event ids
+	// seedArchiveRows assigns to the first and second seeded
+	// rows.
+	sweepRowOld = "ev-0"
+	sweepRowNew = "ev-1"
+
+	// sweepConcurrentWrites is how many deliveries the
+	// concurrent write-plus-sweep test races against the sweep.
+	sweepConcurrentWrites = 20
+)
+
+// sweeperEnv bundles the pieces an archive sweep test drives:
+// a main configuration database holding webhooks and targets, a
+// delivery engine owning the archive writer registry, and the
+// data directory the archive files live in.
+type sweeperEnv struct {
+	sweeper *delivery.ArchiveSweeper
+	eng     *delivery.Engine
+	mainDB  *database.Database
+	dataDir string
+}
+
+func setupSweeperTest(t *testing.T) *sweeperEnv {
+	t.Helper()
+
+	dataDir := t.TempDir()
+	log := archiveTestLogger()
+
+	sqlDB, err := sql.Open(
+		"sqlite",
+		fmt.Sprintf(
+			"file:%s?mode=rwc",
+			filepath.Join(dataDir, "main.db"),
+		),
+	)
+	require.NoError(t, err)
+
+	t.Cleanup(func() { _ = sqlDB.Close() })
+
+	gdb, err := gorm.Open(
+		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
+	)
+	require.NoError(t, err)
+
+	mainDB := database.NewTestDatabase(gdb)
+	require.NoError(t, mainDB.Migrate())
+
+	eng := delivery.NewTestEngineWithDB(
+		mainDB,
+		database.NewTestWebhookDBManager(dataDir),
+		log,
+		&http.Client{Timeout: 5 * time.Second},
+		1,
+	)
+
+	return &sweeperEnv{
+		sweeper: delivery.NewTestArchiveSweeper(
+			mainDB, eng, log,
+		),
+		eng:     eng,
+		mainDB:  mainDB,
+		dataDir: dataDir,
+	}
+}
+
+// archivePath returns where the engine keeps a webhook's
+// archive file.
+func (env *sweeperEnv) archivePath(webhookID string) string {
+	return filepath.Join(
+		env.dataDir, fmt.Sprintf("archive-%s.db", webhookID),
+	)
+}
+
+// seedDatabaseTarget creates a webhook with one database target
+// carrying the given target config JSON, and returns the
+// webhook id.
+func (env *sweeperEnv) seedDatabaseTarget(
+	t *testing.T, configJSON string,
+) string {
+	t.Helper()
+
+	wh := &database.Webhook{
+		UserID: uuid.New().String(),
+		Name:   "sweep-test",
+	}
+	require.NoError(
+		t,
+		env.mainDB.DB().
+			Omit(clause.Associations).
+			Create(wh).Error,
+	)
+
+	tgt := &database.Target{
+		WebhookID: wh.ID,
+		Name:      "archive",
+		Type:      database.TargetTypeDatabase,
+		Active:    true,
+		Config:    configJSON,
+	}
+	require.NoError(
+		t,
+		env.mainDB.DB().
+			Omit(clause.Associations).
+			Create(tgt).Error,
+	)
+
+	return wh.ID
+}
+
+// seedArchiveRows creates the archive file for a webhook and
+// inserts one row per supplied archived-at timestamp, returning
+// the archive path. The handle is closed before returning, so
+// the archive is idle exactly as it would be with no traffic.
+func (env *sweeperEnv) seedArchiveRows(
+	t *testing.T, webhookID string, archivedAt ...time.Time,
+) string {
+	t.Helper()
+
+	path := env.archivePath(webhookID)
+
+	sqlDB, err := sql.Open(
+		"sqlite", fmt.Sprintf("file:%s?mode=rwc", path),
+	)
+	require.NoError(t, err)
+
+	gdb, err := gorm.Open(
+		sqlite.Dialector{Conn: sqlDB}, &gorm.Config{},
+	)
+	require.NoError(t, err)
+
+	require.NoError(
+		t, gdb.AutoMigrate(&delivery.ExportArchivedEvent{}),
+	)
+
+	for i, at := range archivedAt {
+		row := delivery.ExportArchivedEvent{
+			EventID:    fmt.Sprintf("ev-%d", i),
+			WebhookID:  webhookID,
+			Method:     http.MethodPost,
+			Body:       `{"seeded":true}`,
+			ArchivedAt: at,
+		}
+		require.NoError(t, gdb.Create(&row).Error)
+	}
+
+	require.NoError(t, sqlDB.Close())
+
+	return path
+}
+
+// archivedEventIDs returns the event ids currently stored in an
+// archive file, read through a separate read-only handle.
+func archivedEventIDs(
+	t *testing.T, path string,
+) []string {
+	t.Helper()
+
+	var rows []delivery.ExportArchivedEvent
+
+	rdb := openArchiveDBForRead(t, path)
+	require.NoError(t, rdb.Order("event_id").Find(&rows).Error)
+
+	ids := make([]string, 0, len(rows))
+	for i := range rows {
+		ids = append(ids, rows[i].EventID)
+	}
+
+	return ids
+}
+
+// TestArchiveSweep_PrunesIdleArchive is the core regression
+// test for this issue: an archive that receives no further
+// writes must still lose its expired rows. Before the sweeper
+// existed, pruning only ever ran on a write-triggered reopen,
+// so an idle archive kept expired rows forever.
+func TestArchiveSweep_PrunesIdleArchive(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+
+	now := time.Now()
+	path := env.seedArchiveRows(
+		t, webhookID,
+		now.Add(-48*time.Hour),
+		now.Add(-time.Minute),
+	)
+
+	require.Equal(
+		t, []string{sweepRowOld, sweepRowNew},
+		archivedEventIDs(t, path),
+	)
+
+	env.sweeper.ExportSweep(context.Background())
+
+	assert.Equal(
+		t, []string{sweepRowNew}, archivedEventIDs(t, path),
+		"the sweep should prune rows older than the expiry "+
+			"from an idle archive and keep the rest",
+	)
+}
+
+// TestArchiveSweep_LeavesArchiveClosed proves the sweep does
+// not hold the archive open afterwards, so an operator can
+// still move the file away for offline retention.
+func TestArchiveSweep_LeavesArchiveClosed(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	env.seedArchiveRows(
+		t, webhookID, time.Now().Add(-48*time.Hour),
+	)
+
+	env.sweeper.ExportSweep(context.Background())
+
+	assert.False(
+		t, env.eng.ExportArchiveHandleOpen(webhookID),
+		"an idle archive must end the sweep closed",
+	)
+}
+
+// TestArchiveSweep_NeverExpiryUntouched proves the sweep is a
+// no-op for the default retention policy, so archives with no
+// expiry (or the literal "never") behave exactly as before.
+func TestArchiveSweep_NeverExpiryUntouched(t *testing.T) {
+	t.Parallel()
+
+	for _, configJSON := range []string{
+		`{"expiry":"never"}`,
+		`{"expiry":""}`,
+		"",
+	} {
+		env := setupSweeperTest(t)
+
+		webhookID := env.seedDatabaseTarget(t, configJSON)
+		path := env.seedArchiveRows(
+			t, webhookID,
+			time.Now().Add(-10000*time.Hour),
+		)
+
+		env.sweeper.ExportSweep(context.Background())
+
+		assert.Equal(
+			t, []string{sweepRowOld}, archivedEventIDs(t, path),
+			"config %q must keep rows forever", configJSON,
+		)
+	}
+}
+
+// TestArchiveSweep_DoesNotCreateArchiveFile proves the sweep
+// never conjures an archive: a webhook with a database target
+// that has never received an event must still have no archive
+// file (nor SQLite sidecar) after a sweep.
+func TestArchiveSweep_DoesNotCreateArchiveFile(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	path := env.archivePath(webhookID)
+
+	require.NoFileExists(t, path)
+
+	env.sweeper.ExportSweep(context.Background())
+
+	for _, suffix := range []string{"", "-wal", "-shm"} {
+		assert.NoFileExists(
+			t, path+suffix,
+			"the sweep must not create an archive file",
+		)
+	}
+}
+
+// TestArchiveSweep_DoesNotCreateAfterWriterExists covers the
+// same guarantee once a writer is cached in the registry but
+// the file itself is still absent (for instance because the
+// operator moved the archive away).
+func TestArchiveSweep_DoesNotCreateAfterWriterExists(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+
+	path, err := env.eng.ExportEnsureArchiveWriter(webhookID)
+	require.NoError(t, err)
+	require.NoFileExists(t, path)
+
+	env.sweeper.ExportSweep(context.Background())
+
+	assert.NoFileExists(t, path)
+}
+
+// TestArchiveSweep_SkipsDeletedWebhookTargets proves that the
+// sweep ignores targets soft-deleted along with their webhook,
+// so a deleted webhook's archive is never reopened.
+func TestArchiveSweep_SkipsDeletedWebhookTargets(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	path := env.seedArchiveRows(
+		t, webhookID, time.Now().Add(-48*time.Hour),
+	)
+
+	require.NoError(
+		t,
+		env.mainDB.DB().
+			Where("webhook_id = ?", webhookID).
+			Delete(&database.Target{}).Error,
+	)
+
+	env.sweeper.ExportSweep(context.Background())
+
+	assert.Equal(
+		t, []string{sweepRowOld}, archivedEventIDs(t, path),
+		"a deleted target's archive must be left alone",
+	)
+}
+
+// TestArchiveSweep_ConcurrentWrites proves the sweep serialises
+// against writes through the per-webhook writer mutex. Run
+// under -race, an unsynchronised sweep would be caught here.
+func TestArchiveSweep_ConcurrentWrites(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+
+	webhookDB := testWebhookDB(t)
+
+	// The deliveries are seeded up front, on the test's own
+	// goroutine: the seed helpers assert, and testify assertions
+	// must not run off the test goroutine.
+	deliveries := make(
+		[]*database.Delivery, 0, sweepConcurrentWrites,
+	)
+
+	for range sweepConcurrentWrites {
+		event := seedEvent(t, webhookDB, `{"n":1}`)
+		event.WebhookID = webhookID
+
+		deliveries = append(
+			deliveries,
+			seedDatabaseTargetDelivery(
+				t, webhookDB, event, `{"expiry":"1h"}`,
+			),
+		)
+	}
+
+	var wg sync.WaitGroup
+
+	wg.Add(2)
+
+	go func() {
+		defer wg.Done()
+
+		for _, d := range deliveries {
+			env.eng.ExportDeliverDatabase(webhookDB, d)
+		}
+	}()
+
+	go func() {
+		defer wg.Done()
+
+		for range sweepConcurrentWrites {
+			env.sweeper.ExportSweep(context.Background())
+		}
+	}()
+
+	wg.Wait()
+
+	assert.FileExists(t, env.archivePath(webhookID))
+}
+
+// TestArchiveSweeper_StopsCleanly proves the background loop
+// exits on OnStop rather than leaking a goroutine.
+func TestArchiveSweeper_StopsCleanly(t *testing.T) {
+	t.Parallel()
+
+	env := setupSweeperTest(t)
+
+	webhookID := env.seedDatabaseTarget(t, `{"expiry":"1h"}`)
+	env.seedArchiveRows(
+		t, webhookID, time.Now().Add(-48*time.Hour),
+	)
+
+	env.sweeper.ExportSetInterval(time.Millisecond)
+	env.sweeper.ExportStart(context.Background())
+
+	// stop blocks on the loop's WaitGroup, so returning at all
+	// proves the loop observed the cancellation and exited.
+	env.sweeper.ExportStop()
+}

internal/delivery/engine.go

@@ -94,6 +94,23 @@ type Notifier interface {
 	Notify(tasks []Task)
 }
 
+// WebhookEvictor releases the delivery engine's per-webhook
+// state for a webhook that no longer needs it — currently the
+// cached archive writer of the database target, whose open
+// file handle would otherwise outlive the webhook.
+//
+// It is deliberately separate from Notifier and deliberately
+// one method wide: archiving lifecycle is not notification, and
+// a single-method interface keeps the handlers package free of
+// any dependency on the engine's internals while staying
+// trivially fakeable in tests.
+//
+// EvictWebhook never deletes an archive file. It is idempotent
+// and is a no-op for a webhook with no engine state.
+type WebhookEvictor interface {
+	EvictWebhook(webhookID string)
+}
+
 // EngineParams are the fx dependencies for the delivery
 // engine.
 type EngineParams struct {
@@ -127,6 +144,10 @@ type Engine struct {
 	// httpTarget is retained so tests can reach the HTTP
 	// target's shared client and circuit breakers.
 	httpTarget *httpTarget
+
+	// dbTarget is retained so the engine can reach the archive
+	// writer registry for webhook eviction and the idle sweep.
+	dbTarget *databaseTarget
 }
 
 // New creates and registers the delivery engine with the
@@ -182,6 +203,19 @@ func (e *Engine) Notify(tasks []Task) {
 	}
 }
 
+// EvictWebhook implements WebhookEvictor. It releases the
+// engine's per-webhook archiving state: the database target's
+// cached archive writer is dropped from the registry and its
+// file handle closed. The archive file itself is left on disk
+// — it is long-term storage the operator owns.
+func (e *Engine) EvictWebhook(webhookID string) {
+	if e.dbTarget == nil {
+		return
+	}
+
+	e.dbTarget.evict(webhookID)
+}
+
 // ScheduleRetry schedules a task to be re-enqueued onto the
 // retry channel after delay. It implements the Scheduler
 // interface the targets use to own their durable retries.

internal/delivery/export_test.go

@@ -328,6 +328,90 @@ func (e *ExportArchiveWriter) DB() *gorm.DB {
 	return e.w.db
 }
 
+// ExportHasArchiveWriter reports whether the database target
+// currently caches an archive writer for a webhook.
+func (e *Engine) ExportHasArchiveWriter(
+	webhookID string,
+) bool {
+	e.dbTarget.mu.Lock()
+	defer e.dbTarget.mu.Unlock()
+
+	_, ok := e.dbTarget.writers[webhookID]
+
+	return ok
+}
+
+// ExportArchiveHandleOpen reports whether the cached archive
+// writer for a webhook holds an open database handle. It
+// returns false when no writer is cached.
+func (e *Engine) ExportArchiveHandleOpen(
+	webhookID string,
+) bool {
+	e.dbTarget.mu.Lock()
+	w, ok := e.dbTarget.writers[webhookID]
+	e.dbTarget.mu.Unlock()
+
+	if !ok {
+		return false
+	}
+
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	return w.db != nil
+}
+
+// ExportEnsureArchiveWriter creates (if needed) and returns the
+// archive file path of the cached writer for a webhook, so a
+// test can prime the registry the way a delivery would.
+func (e *Engine) ExportEnsureArchiveWriter(
+	webhookID string,
+) (string, error) {
+	w, err := e.dbTarget.writerFor(webhookID)
+	if err != nil {
+		return "", err
+	}
+
+	return w.path, nil
+}
+
+// NewTestArchiveSweeper builds an ArchiveSweeper backed by the
+// given main database and engine, without the fx lifecycle.
+// Intended for tests.
+func NewTestArchiveSweeper(
+	db *database.Database,
+	eng *Engine,
+	log *slog.Logger,
+) *ArchiveSweeper {
+	return &ArchiveSweeper{
+		db:       db,
+		eng:      eng,
+		log:      log,
+		interval: time.Hour,
+	}
+}
+
+// ExportSweep runs a single archive sweep synchronously for
+// tests.
+func (s *ArchiveSweeper) ExportSweep(ctx context.Context) {
+	s.sweep(ctx)
+}
+
+// ExportStart starts the sweeper's background loop for tests.
+func (s *ArchiveSweeper) ExportStart(ctx context.Context) {
+	s.start(ctx)
+}
+
+// ExportStop stops the sweeper's background loop for tests.
+func (s *ArchiveSweeper) ExportStop() {
+	s.stop()
+}
+
+// ExportSetInterval overrides the sweep interval for tests.
+func (s *ArchiveSweeper) ExportSetInterval(d time.Duration) {
+	s.interval = d
+}
+
 // ExportParseArchiveExpiry exposes parseArchiveExpiry.
 func ExportParseArchiveExpiry(
 	configJSON string,

internal/delivery/target.go

@@ -90,12 +90,15 @@ func (e *Engine) initTargets(client *http.Client) {
 		client:   client,
 	}
 
+	dbT := &databaseTarget{eng: e}
+
 	e.httpTarget = httpT
+	e.dbTarget = dbT
 
 	e.targets = map[database.TargetType]Target{
 		database.TargetTypeHTTP:     httpT,
 		database.TargetTypeSlack:    slackT,
-		database.TargetTypeDatabase: &databaseTarget{eng: e},
+		database.TargetTypeDatabase: dbT,
 		database.TargetTypeLog:      &logTarget{eng: e},
 	}
 }

internal/delivery/target_database.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"path/filepath"
 	"sync"
+	"time"
 
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
@@ -111,15 +112,11 @@ func (t *databaseTarget) archive(d *database.Delivery) error {
 func (t *databaseTarget) writerFor(
 	webhookID string,
 ) (*archiveWriter, error) {
-	if t.eng.dbManager == nil {
-		return nil, errArchiveNoDataDir
+	path, err := t.archivePath(webhookID)
+	if err != nil {
+		return nil, err
 	}
 
-	dir := filepath.Dir(t.eng.dbManager.DBPath(webhookID))
-	path := filepath.Join(
-		dir, fmt.Sprintf("archive-%s.db", webhookID),
-	)
-
 	t.mu.Lock()
 	defer t.mu.Unlock()
 
@@ -135,3 +132,86 @@ func (t *databaseTarget) writerFor(
 
 	return w, nil
 }
+
+// archivePath returns the archive file path for a webhook: it
+// lives beside the per-webhook event database in the data
+// directory. It does not touch the filesystem.
+func (t *databaseTarget) archivePath(
+	webhookID string,
+) (string, error) {
+	if t.eng.dbManager == nil {
+		return "", errArchiveNoDataDir
+	}
+
+	dir := filepath.Dir(t.eng.dbManager.DBPath(webhookID))
+
+	return filepath.Join(
+		dir, fmt.Sprintf("archive-%s.db", webhookID),
+	), nil
+}
+
+// evict drops a webhook's archive writer from the registry and
+// closes its handle, so a deleted webhook does not leave a
+// writer (and an open archive handle within its debounce
+// window) alive for the process lifetime.
+//
+// The map entry is removed under the registry lock, which is
+// then released before the handle is closed under the writer's
+// own lock: that ordering keeps the registry available to other
+// webhooks while an in-flight write on this one drains, and
+// closing under the writer's lock means eviction can never race
+// a write.
+//
+// Eviction is idempotent and silent for a webhook with no
+// writer, which is the common case: a webhook with no database
+// target never creates one. It never deletes the archive file.
+func (t *databaseTarget) evict(webhookID string) {
+	t.mu.Lock()
+
+	w, ok := t.writers[webhookID]
+	if ok {
+		delete(t.writers, webhookID)
+	}
+
+	t.mu.Unlock()
+
+	if !ok {
+		return
+	}
+
+	w.evict()
+
+	t.eng.log.Info(
+		"evicted archive writer",
+		"webhook_id", webhookID,
+		"path", w.path,
+	)
+}
+
+// sweepWebhook prunes one webhook's archive of rows older than
+// expiry, without requiring a write. It returns nil (nothing to
+// do) when the archive file does not exist, so a sweep never
+// creates an archive for a webhook that has a database target
+// but has never received an event.
+func (t *databaseTarget) sweepWebhook(
+	webhookID string, expiry time.Duration,
+) error {
+	path, err := t.archivePath(webhookID)
+	if err != nil {
+		return err
+	}
+
+	// Check before taking a writer at all: a webhook whose
+	// archive has never been created gets no writer, no handle,
+	// and no file.
+	if !fileExists(path) {
+		return nil
+	}
+
+	w, err := t.writerFor(webhookID)
+	if err != nil {
+		return err
+	}
+
+	return w.sweepExpired(expiry)
+}

internal/delivery/target_database_archive.go

@@ -24,6 +24,20 @@ const archiveExpiryNever = "never"
 // offline archiving, but never more than once per this window.
 const archiveReopenDebounce = time.Second
 
+const (
+	// archiveModeCreate is the SQLite URI mode used by the write
+	// path: open the archive file, creating it if missing, so a
+	// first write (or a write after the operator moved the file
+	// away) recreates it.
+	archiveModeCreate = "rwc"
+
+	// archiveModeExisting is the SQLite URI mode used by the idle
+	// sweep: open read-write but never create. A sweep must never
+	// conjure an empty archive file for a webhook that has a
+	// database target but has never received an event.
+	archiveModeExisting = "rw"
+)
+
 var (
 	// errArchiveMissingWebhookID is returned when an event to
 	// archive has no webhook id to key its archive file on.
@@ -44,6 +58,15 @@ var (
 	errArchiveExpiryNotPositive = errors.New(
 		"expiry must be a positive duration or \"never\"",
 	)
+
+	// errArchiveWriterEvicted is returned when a writer that has
+	// been evicted (its webhook was deleted, or its last database
+	// target was removed) is used again. An evicted writer is no
+	// longer in the registry, so reopening its file would leak a
+	// handle nothing owns.
+	errArchiveWriterEvicted = errors.New(
+		"archive writer has been evicted",
+	)
 )
 
 // databaseTargetConfig is the optional per-target JSON config
@@ -161,6 +184,12 @@ type archiveWriter struct {
 	db         *gorm.DB
 	lastReopen time.Time
 	reopens    int
+
+	// evicted marks a writer that has been removed from the
+	// per-webhook registry. Its handle is closed and it must
+	// never open the file again: nothing holds it any more, so a
+	// reopen would leak the handle for the process lifetime.
+	evicted bool
 }
 
 // newArchiveWriter builds an archiveWriter for a file path with
@@ -185,6 +214,12 @@ func (w *archiveWriter) write(
 	w.mu.Lock()
 	defer w.mu.Unlock()
 
+	if w.evicted {
+		return fmt.Errorf(
+			"%w: %s", errArchiveWriterEvicted, w.path,
+		)
+	}
+
 	if w.db == nil || !fileExists(w.path) {
 		err := w.reopen(expiry)
 		if err != nil {
@@ -212,7 +247,19 @@ func (w *archiveWriter) write(
 // its schema, records the reopen time, and prunes expired rows
 // when expiry is positive.
 func (w *archiveWriter) open(expiry time.Duration) error {
-	dbURL := fmt.Sprintf("file:%s?mode=rwc", w.path)
+	return w.openMode(archiveModeCreate, expiry)
+}
+
+// openMode opens the archive file with the given SQLite URI
+// mode, migrates its schema, records the reopen time, and
+// prunes expired rows when expiry is positive. The write path
+// passes archiveModeCreate so a missing file is recreated; the
+// idle sweep passes archiveModeExisting so a missing file is an
+// error rather than a newly conjured empty archive.
+func (w *archiveWriter) openMode(
+	mode string, expiry time.Duration,
+) error {
+	dbURL := fmt.Sprintf("file:%s?mode=%s", w.path, mode)
 
 	sqlDB, err := sql.Open("sqlite", dbURL)
 	if err != nil {
@@ -275,6 +322,63 @@ func (w *archiveWriter) close() {
 	w.db = nil
 }
 
+// sweepExpired prunes an archive that may have gone idle, with
+// no write to trigger the usual on-reopen prune. It takes the
+// writer's own mutex for the whole operation, so a sweep is
+// ordered against concurrent writes rather than reaching around
+// them to the file.
+//
+// It never creates the archive file: a missing file is skipped,
+// and the reopen uses archiveModeExisting so SQLite itself
+// refuses to create one if the file disappears between the
+// check and the open.
+//
+// The archive is left CLOSED afterwards. An idle archive holding
+// no handle is what keeps the operator's move-the-file-away
+// workflow working; the next write reopens (and recreates) the
+// file as it always has.
+func (w *archiveWriter) sweepExpired(expiry time.Duration) error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	if w.evicted {
+		return fmt.Errorf(
+			"%w: %s", errArchiveWriterEvicted, w.path,
+		)
+	}
+
+	if !fileExists(w.path) {
+		return nil
+	}
+
+	// Drop any live handle first so the prune runs against a
+	// freshly opened file, matching the write path's semantics.
+	w.close()
+
+	err := w.openMode(archiveModeExisting, expiry)
+	if err != nil {
+		return err
+	}
+
+	w.close()
+
+	return nil
+}
+
+// evict closes the writer's handle and marks it unusable. It is
+// called when the writer leaves the registry, either because the
+// webhook was deleted or because its last database target was
+// removed. The archive FILE is deliberately left on disk: it is
+// long-term storage an operator may still want.
+func (w *archiveWriter) evict() {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	w.evicted = true
+
+	w.close()
+}
+
 // prune deletes archived rows older than expiry, measured from
 // each row's archived time. It runs on every (re)open, and
 // because the file is reopened after writes this keeps the

internal/delivery/target_database_evict_test.go

@@ -0,0 +1,130 @@
+package delivery_test
+
+import (
+	"fmt"
+	"net/http"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/delivery"
+)
+
+// evictTestEngine builds an engine backed by a temporary data
+// directory and returns it along with that directory.
+func evictTestEngine(t *testing.T) (*delivery.Engine, string) {
+	t.Helper()
+
+	dataDir := t.TempDir()
+
+	eng := delivery.NewTestEngineWithDB(
+		nil,
+		database.NewTestWebhookDBManager(dataDir),
+		archiveTestLogger(),
+		&http.Client{Timeout: 5 * time.Second},
+		1,
+	)
+
+	return eng, dataDir
+}
+
+// TestEvictWebhook_ClosesAndRemovesWriter proves that evicting
+// a webhook drops its archive writer from the registry and
+// closes the open archive handle, rather than leaving both
+// alive for the process lifetime.
+func TestEvictWebhook_ClosesAndRemovesWriter(t *testing.T) {
+	t.Parallel()
+
+	eng, dataDir := evictTestEngine(t)
+
+	webhookDB := testWebhookDB(t)
+	event := seedEvent(t, webhookDB, `{"archived":true}`)
+	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
+
+	eng.ExportDeliverDatabase(webhookDB, d)
+
+	webhookID := event.WebhookID
+
+	require.True(
+		t, eng.ExportHasArchiveWriter(webhookID),
+		"a delivery should have cached an archive writer",
+	)
+	require.True(
+		t, eng.ExportArchiveHandleOpen(webhookID),
+		"the writer should hold an open handle after a write",
+	)
+
+	eng.EvictWebhook(webhookID)
+
+	assert.False(
+		t, eng.ExportHasArchiveWriter(webhookID),
+		"eviction should remove the registry entry",
+	)
+	assert.False(
+		t, eng.ExportArchiveHandleOpen(webhookID),
+		"eviction should close the archive handle",
+	)
+
+	archivePath := filepath.Join(
+		dataDir, fmt.Sprintf("archive-%s.db", webhookID),
+	)
+	assert.FileExists(
+		t, archivePath,
+		"eviction must not delete the archive file",
+	)
+}
+
+// TestEvictWebhook_UnknownWebhookIsNoOp proves eviction is safe
+// for the common case of a webhook that never had a database
+// target, and that repeating it does not panic.
+func TestEvictWebhook_UnknownWebhookIsNoOp(t *testing.T) {
+	t.Parallel()
+
+	eng, _ := evictTestEngine(t)
+
+	assert.NotPanics(t, func() {
+		eng.EvictWebhook("no-such-webhook")
+		eng.EvictWebhook("no-such-webhook")
+	})
+
+	assert.False(
+		t, eng.ExportHasArchiveWriter("no-such-webhook"),
+		"eviction must not create a writer",
+	)
+}
+
+// TestEvictWebhook_EvictedWriterDoesNotReopen proves an evicted
+// writer refuses further writes instead of silently reopening
+// the archive file: nothing holds it any more, so a reopened
+// handle would leak.
+func TestEvictWebhook_EvictedWriterDoesNotReopen(t *testing.T) {
+	t.Parallel()
+
+	eng, _ := evictTestEngine(t)
+
+	webhookDB := testWebhookDB(t)
+	event := seedEvent(t, webhookDB, `{"archived":true}`)
+	d := seedDatabaseTargetDelivery(t, webhookDB, event, "")
+
+	eng.ExportDeliverDatabase(webhookDB, d)
+	require.True(
+		t, eng.ExportHasArchiveWriter(event.WebhookID),
+	)
+
+	eng.EvictWebhook(event.WebhookID)
+
+	// A fresh delivery for the same webhook gets a brand new
+	// writer from the registry, so archiving keeps working.
+	second := seedDatabaseTargetDelivery(
+		t, webhookDB, event, "",
+	)
+	eng.ExportDeliverDatabase(webhookDB, second)
+
+	assert.True(
+		t, eng.ExportHasArchiveWriter(event.WebhookID),
+		"a later delivery should recreate the writer",
+	)
+}

internal/handlers/handlers.go

@@ -26,6 +26,8 @@ const (
 	maxBodyShift = 20
 	// recentEventLimit is the number of recent events to show.
 	recentEventLimit = 20
+	// defaultRetentionDays is the default event retention period.
+	defaultRetentionDays = 30
 	// paginationPerPage is the number of items per page.
 	paginationPerPage = 25
 
@@ -49,6 +51,7 @@ type HandlersParams struct {
 	Healthcheck  *healthcheck.Healthcheck
 	Session      *session.Session
 	Notifier     delivery.Notifier
+	Evictor      delivery.WebhookEvictor
 }
 
 // Handlers provides HTTP handler methods for all application
@@ -61,6 +64,7 @@ type Handlers struct {
 	dbMgr     *database.WebhookDBManager
 	session   *session.Session
 	notifier  delivery.Notifier
+	evictor   delivery.WebhookEvictor
 	templates map[string]*template.Template
 }
 
@@ -95,6 +99,7 @@ func New(
 	s.dbMgr = params.WebhookDBMgr
 	s.session = params.Session
 	s.notifier = params.Notifier
+	s.evictor = params.Evictor
 
 	// Parse all page templates once at startup
 	s.templates = map[string]*template.Template{

internal/handlers/handlers_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"sync"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -24,6 +25,32 @@ type noopNotifier struct{}
 
 func (n *noopNotifier) Notify([]delivery.Task) {}
 
+// recordingEvictor is a delivery.WebhookEvictor that records
+// the webhook ids it was asked to evict, so a test can prove
+// that a deletion path reached the delivery engine.
+type recordingEvictor struct {
+	mu      sync.Mutex
+	evicted []string
+}
+
+func (r *recordingEvictor) EvictWebhook(webhookID string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	r.evicted = append(r.evicted, webhookID)
+}
+
+// Evicted returns a copy of the recorded webhook ids.
+func (r *recordingEvictor) Evicted() []string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	out := make([]string, len(r.evicted))
+	copy(out, r.evicted)
+
+	return out
+}
+
 func newTestApp(
 	t *testing.T,
 	targets ...any,
@@ -47,6 +74,12 @@ func newTestApp(
 			func() delivery.Notifier {
 				return &noopNotifier{}
 			},
+			func() *recordingEvictor {
+				return &recordingEvictor{}
+			},
+			func(r *recordingEvictor) delivery.WebhookEvictor {
+				return r
+			},
 			handlers.New,
 		),
 		fx.Populate(targets...),

internal/handlers/source_delete_test.go

@@ -0,0 +1,305 @@
+package handlers_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/go-chi/chi"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm/clause"
+	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/handlers"
+	"sneak.berlin/go/webhooker/internal/session"
+)
+
+const (
+	deleteTestUserID   = "test-user-id"
+	deleteTestUsername = "testuser"
+
+	// paramSourceID and paramTargetID are the chi URL parameter
+	// names the deletion handlers read.
+	paramSourceID = "sourceID"
+	paramTargetID = "targetID"
+)
+
+// seedWebhook inserts a webhook owned by the test user and
+// returns it.
+func seedWebhook(
+	t *testing.T,
+	db *database.Database,
+) *database.Webhook {
+	t.Helper()
+
+	wh := &database.Webhook{
+		UserID: deleteTestUserID,
+		Name:   "delete-me",
+	}
+
+	require.NoError(
+		t,
+		db.DB().Omit(clause.Associations).Create(wh).Error,
+	)
+
+	return wh
+}
+
+// seedTarget inserts a target of the given type for a webhook
+// and returns it.
+func seedTarget(
+	t *testing.T,
+	db *database.Database,
+	webhookID string,
+	targetType database.TargetType,
+) *database.Target {
+	t.Helper()
+
+	tgt := &database.Target{
+		WebhookID: webhookID,
+		Name:      "t-" + string(targetType),
+		Type:      targetType,
+		Active:    true,
+	}
+
+	require.NoError(
+		t,
+		db.DB().Omit(clause.Associations).Create(tgt).Error,
+	)
+
+	return tgt
+}
+
+// archivePathFor returns the archive database path the
+// delivery engine would use for a webhook: beside the webhook's
+// event database in the data directory.
+func archivePathFor(
+	t *testing.T,
+	mgr *database.WebhookDBManager,
+	webhookID string,
+) string {
+	t.Helper()
+
+	return filepath.Join(
+		filepath.Dir(mgr.DBPath(webhookID)),
+		"archive-"+webhookID+".db",
+	)
+}
+
+// writeArchivePlaceholder creates a stand-in archive file so a
+// test can assert the file survives webhook deletion.
+func writeArchivePlaceholder(path string) error {
+	return os.WriteFile(path, []byte("archive"), 0o600)
+}
+
+// postRequest builds an authenticated POST request carrying the
+// given chi URL parameters.
+func postRequest(
+	path string,
+	cookies []*http.Cookie,
+	params map[string]string,
+) *http.Request {
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodPost, path, nil,
+	)
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	rctx := chi.NewRouteContext()
+	for k, v := range params {
+		rctx.URLParams.Add(k, v)
+	}
+
+	return req.WithContext(
+		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
+	)
+}
+
+// TestHandleSourceDelete_EvictsArchiveWriter proves that
+// deleting a webhook reaches the delivery engine and releases
+// the webhook's archive writer, exercised through the real
+// deletion handler rather than by calling the evictor directly.
+func TestHandleSourceDelete_EvictsArchiveWriter(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+		db   *database.Database
+		ev   *recordingEvictor
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &ev)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+	seedTarget(t, db, wh.ID, database.TargetTypeDatabase)
+
+	cookies := authenticatedCookies(
+		t, sess, deleteTestUserID, deleteTestUsername,
+	)
+
+	req := postRequest(
+		"/source/"+wh.ID+"/delete",
+		cookies,
+		map[string]string{paramSourceID: wh.ID},
+	)
+	w := httptest.NewRecorder()
+
+	h.HandleSourceDelete().ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Equal(
+		t, []string{wh.ID}, ev.Evicted(),
+		"deleting a webhook should evict its archive writer",
+	)
+}
+
+// TestHandleSourceDelete_KeepsArchiveFile proves that deleting
+// a webhook does not remove its archive database file: the
+// archive is long-term storage the operator owns.
+func TestHandleSourceDelete_KeepsArchiveFile(t *testing.T) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+		db   *database.Database
+		mgr  *database.WebhookDBManager
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &mgr)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+
+	// Place an archive file where the delivery engine would.
+	archivePath := archivePathFor(t, mgr, wh.ID)
+	require.NoError(
+		t,
+		writeArchivePlaceholder(archivePath),
+	)
+
+	cookies := authenticatedCookies(
+		t, sess, deleteTestUserID, deleteTestUsername,
+	)
+
+	req := postRequest(
+		"/source/"+wh.ID+"/delete",
+		cookies,
+		map[string]string{paramSourceID: wh.ID},
+	)
+	w := httptest.NewRecorder()
+
+	h.HandleSourceDelete().ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.FileExists(
+		t, archivePath,
+		"webhook deletion must not destroy the archive file",
+	)
+}
+
+// TestHandleTargetDelete_EvictsWhenLastDatabaseTargetGone
+// proves that removing the last database target releases the
+// archive writer.
+func TestHandleTargetDelete_EvictsWhenLastDatabaseTargetGone(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+		db   *database.Database
+		ev   *recordingEvictor
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &ev)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+	tgt := seedTarget(
+		t, db, wh.ID, database.TargetTypeDatabase,
+	)
+
+	cookies := authenticatedCookies(
+		t, sess, deleteTestUserID, deleteTestUsername,
+	)
+
+	req := postRequest(
+		"/source/"+wh.ID+"/targets/"+tgt.ID+"/delete",
+		cookies,
+		map[string]string{
+			paramSourceID: wh.ID,
+			paramTargetID: tgt.ID,
+		},
+	)
+	w := httptest.NewRecorder()
+
+	h.HandleTargetDelete().ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Equal(
+		t, []string{wh.ID}, ev.Evicted(),
+		"removing the last database target should evict",
+	)
+}
+
+// TestHandleTargetDelete_KeepsWriterWhileDatabaseTargetRemains
+// proves that deleting an unrelated target, or one of several
+// database targets, leaves a still-needed archive writer alone.
+func TestHandleTargetDelete_KeepsWriterWhileDatabaseTargetRemains(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	var (
+		h    *handlers.Handlers
+		sess *session.Session
+		db   *database.Database
+		ev   *recordingEvictor
+	)
+
+	app := newTestApp(t, &h, &sess, &db, &ev)
+	app.RequireStart()
+
+	t.Cleanup(app.RequireStop)
+
+	wh := seedWebhook(t, db)
+	seedTarget(t, db, wh.ID, database.TargetTypeDatabase)
+	other := seedTarget(t, db, wh.ID, database.TargetTypeLog)
+
+	cookies := authenticatedCookies(
+		t, sess, deleteTestUserID, deleteTestUsername,
+	)
+
+	req := postRequest(
+		"/source/"+wh.ID+"/targets/"+other.ID+"/delete",
+		cookies,
+		map[string]string{
+			paramSourceID: wh.ID,
+			paramTargetID: other.ID,
+		},
+	)
+	w := httptest.NewRecorder()
+
+	h.HandleTargetDelete().ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Empty(
+		t, ev.Evicted(),
+		"a surviving database target must keep its writer",
+	)
+}

internal/handlers/source_management.go

@@ -25,73 +25,6 @@ type WebhookListItem struct {
 // errMissingURL signals that a required URL was not provided.
 var errMissingURL = errors.New("missing URL")
 
-// errInvalidRetention signals a retention_days form value that is not
-// a non-negative whole number.
-var errInvalidRetention = errors.New("invalid retention days")
-
-// errRetentionTooLarge signals a retention_days form value that is a
-// whole number but larger than the reaper's cutoff arithmetic can
-// represent. It is distinguished from errInvalidRetention so the form
-// can tell the user the actual ceiling instead of implying their input
-// was not a number.
-var errRetentionTooLarge = errors.New("retention days out of range")
-
-// retentionErrorMessage returns the message the create and edit forms
-// show the user for a rejected retention_days value. Any error other
-// than errRetentionTooLarge falls back to the generic wording, so an
-// unrecognised parse failure still produces a sensible 400 rather than
-// an empty alert.
-func retentionErrorMessage(err error) string {
-	if errors.Is(err, errRetentionTooLarge) {
-		return "Retention must be at most " +
-			strconv.Itoa(database.MaxFiniteRetentionDays) +
-			" days, or 0 to retain events forever."
-	}
-
-	return "Retention must be a whole number of days, or 0 to " +
-		"retain events forever."
-}
-
-// parseRetentionDays interprets a retention_days form value.
-//
-// An empty value yields fallback, which lets the create path apply the
-// default and the edit path leave the stored value unchanged. A value
-// of 0 is returned as 0 and is rewritten to the retain-forever
-// sentinel by database.Webhook's BeforeSave hook. Anything unparseable
-// or negative is an error rather than a silently substituted default.
-//
-// The upper bound is not cosmetic. The reaper computes its cutoff as a
-// time.Duration, an int64 nanosecond count, so a day count above
-// database.MaxFiniteRetentionDays overflows, puts the cutoff in the
-// future, and deletes every event the webhook has. A finite value
-// above that ceiling is therefore a 400.
-//
-// A value at or above the retain-forever sentinel is not out of range:
-// it is what the edit form pre-fills for a retain-forever webhook, so
-// submitting the form back unchanged has to keep meaning "forever"
-// rather than being rejected.
-func parseRetentionDays(raw string, fallback int) (int, error) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return fallback, nil
-	}
-
-	v, err := strconv.Atoi(raw)
-	if err != nil || v < 0 {
-		return 0, errInvalidRetention
-	}
-
-	if v >= database.RetentionForeverDays {
-		return database.RetentionForeverDays, nil
-	}
-
-	if v > database.MaxFiniteRetentionDays {
-		return 0, errRetentionTooLarge
-	}
-
-	return v, nil
-}
-
 // EventWithDeliveries holds an event and its deliveries.
 type EventWithDeliveries struct {
 	database.Event
@@ -173,30 +106,11 @@ func (h *Handlers) buildWebhookListItems(
 // HandleSourceCreate shows the form to create a new webhook.
 func (h *Handlers) HandleSourceCreate() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		h.renderTemplate(
-			w, r, "sources_new.html",
-			newSourceFormData("", "", ""),
-		)
+		data := map[string]any{
+			tmplKeyError: "",
 		}
-}
 
-// newSourceFormData builds the template data for the webhook creation
-// form.
-//
-// It carries the retention default so the pre-filled value comes from
-// database.DefaultRetentionDays rather than being a third hardcoded
-// copy of the same policy, and it carries the submitted name and
-// description so that re-rendering the form after a validation failure
-// gives the user their input back instead of a blank form. The edit
-// form already behaves that way; create now matches it.
-func newSourceFormData(
-	errMsg, name, description string,
-) map[string]any {
-	return map[string]any{
-		tmplKeyError:           errMsg,
-		"Name":                 name,
-		"Description":          description,
-		"DefaultRetentionDays": database.DefaultRetentionDays,
+		h.renderTemplate(w, r, "sources_new.html", data)
 	}
 }
 
@@ -231,31 +145,23 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 		retentionStr := r.FormValue("retention_days")
 
 		if name == "" {
+			data := map[string]any{
+				tmplKeyError: "Name is required",
+			}
+
 			w.WriteHeader(http.StatusBadRequest)
-			h.renderTemplate(
-				w, r, "sources_new.html",
-				newSourceFormData(
-					"Name is required", name, description,
-				),
-			)
+			h.renderTemplate(w, r, "sources_new.html", data)
 
 			return
 		}
 
-		retentionDays, retErr := parseRetentionDays(
-			retentionStr, database.DefaultRetentionDays,
-		)
-		if retErr != nil {
-			w.WriteHeader(http.StatusBadRequest)
-			h.renderTemplate(
-				w, r, "sources_new.html",
-				newSourceFormData(
-					retentionErrorMessage(retErr),
-					name, description,
-				),
-			)
+		retentionDays := defaultRetentionDays
 
-			return
+		if retentionStr != "" {
+			v, convErr := strconv.Atoi(retentionStr)
+			if convErr == nil && v > 0 {
+				retentionDays = v
+			}
 		}
 
 		h.createWebhookWithEntrypoint(
@@ -409,10 +315,8 @@ func (h *Handlers) renderSourceDetail(
 		scheme = fwdProto
 	}
 
-	// The template calls Webhook methods, which take pointer
-	// receivers; html/template cannot address a value stored in a map.
 	data := map[string]any{
-		tmplKeyWebhook: &webhook,
+		tmplKeyWebhook: webhook,
 		"Entrypoints":  entrypoints,
 		"Targets":      targets,
 		"Events":       events,
@@ -448,7 +352,7 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			tmplKeyWebhook: &webhook,
+			tmplKeyWebhook: webhook,
 			tmplKeyError:   "",
 		}
 
@@ -512,7 +416,7 @@ func (h *Handlers) applyWebhookEdit(
 	name := r.FormValue("name")
 	if name == "" {
 		data := map[string]any{
-			tmplKeyWebhook: webhook,
+			tmplKeyWebhook: *webhook,
 			tmplKeyError:   "Name is required",
 		}
 
@@ -524,25 +428,7 @@ func (h *Handlers) applyWebhookEdit(
 
 	webhook.Name = name
 	webhook.Description = r.FormValue("description")
-
-	// An empty field falls back to the stored value, so submitting the
-	// form without touching retention leaves the policy alone.
-	retentionDays, retErr := parseRetentionDays(
-		r.FormValue("retention_days"), webhook.RetentionDays,
-	)
-	if retErr != nil {
-		data := map[string]any{
-			tmplKeyWebhook: webhook,
-			tmplKeyError:   retentionErrorMessage(retErr),
-		}
-
-		w.WriteHeader(http.StatusBadRequest)
-		h.renderTemplate(w, r, "source_edit.html", data)
-
-		return
-	}
-
-	webhook.RetentionDays = retentionDays
+	h.parseRetention(r, webhook)
 
 	err := h.db.DB().Save(webhook).Error
 	if err != nil {
@@ -556,6 +442,23 @@ func (h *Handlers) applyWebhookEdit(
 	)
 }
 
+// parseRetention parses and applies retention_days from the
+// form.
+func (h *Handlers) parseRetention(
+	r *http.Request,
+	webhook *database.Webhook,
+) {
+	retStr := r.FormValue("retention_days")
+	if retStr == "" {
+		return
+	}
+
+	v, err := strconv.Atoi(retStr)
+	if err == nil && v > 0 {
+		webhook.RetentionDays = v
+	}
+}
+
 // HandleSourceDelete handles webhook deletion.
 func (h *Handlers) HandleSourceDelete() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -630,6 +533,13 @@ func (h *Handlers) deleteWebhookResources(
 		return
 	}
 
+	// Release the delivery engine's per-webhook archiving state
+	// so a deleted webhook's archive writer (and any handle open
+	// within its debounce window) does not linger for the
+	// process lifetime. The archive file itself is deliberately
+	// left on disk; see evictArchiveWriter.
+	h.evictArchiveWriter(webhook.ID)
+
 	err = h.dbMgr.DeleteDB(webhook.ID)
 	if err != nil {
 		h.log.Error(
@@ -648,6 +558,64 @@ func (h *Handlers) deleteWebhookResources(
 	http.Redirect(w, r, "/sources", http.StatusSeeOther)
 }
 
+// evictArchiveWriter asks the delivery engine to drop its
+// cached archive writer for a webhook, closing the archive file
+// handle.
+//
+// The archive database file is NOT deleted. Unlike the event
+// database — which is per-webhook working storage and is
+// hard-deleted with the webhook — an archive is explicitly
+// long-term storage that an operator may want to keep or move
+// away for offline retention. Destroying it as a side effect of
+// deleting a webhook would be a surprising and unrecoverable
+// data loss, so the file is left for the operator to handle.
+func (h *Handlers) evictArchiveWriter(webhookID string) {
+	if h.evictor == nil {
+		return
+	}
+
+	h.evictor.EvictWebhook(webhookID)
+}
+
+// evictArchiveWriterIfUnused releases a webhook's archive
+// writer once the webhook has no database target left to feed
+// it.
+//
+// It is called after any child resource of a webhook is
+// deleted, and is correct without knowing which kind was: it
+// evicts only when no database target remains, so deleting one
+// of several database targets — or deleting an unrelated
+// target type — leaves a still-needed writer alone. When no
+// database target ever existed there is no writer and eviction
+// is a no-op. Soft-deleted targets are excluded by GORM's
+// default scope, so the row just deleted is not counted.
+func (h *Handlers) evictArchiveWriterIfUnused(webhookID string) {
+	var remaining int64
+
+	err := h.db.DB().
+		Model(&database.Target{}).
+		Where(
+			"webhook_id = ? AND type = ?",
+			webhookID, database.TargetTypeDatabase,
+		).
+		Count(&remaining).Error
+	if err != nil {
+		h.log.Error(
+			"failed to count remaining database targets",
+			"webhook_id", webhookID,
+			"error", err,
+		)
+
+		return
+	}
+
+	if remaining > 0 {
+		return
+	}
+
+	h.evictArchiveWriter(webhookID)
+}
+
 // HandleSourceLogs shows the request/response logs for a
 // webhook.
 func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
@@ -687,7 +655,7 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			tmplKeyWebhook: &webhook,
+			tmplKeyWebhook: webhook,
 			"Events":       evts,
 			"Page":         page,
 			"TotalPages":   totalPages,
@@ -1121,23 +1089,31 @@ func (h *Handlers) HandleEntrypointDelete() http.HandlerFunc {
 	return h.deleteChildResource(
 		"entrypointID", &database.Entrypoint{},
 		"failed to delete entrypoint",
+		nil,
 	)
 }
 
-// HandleTargetDelete handles deleting a target.
+// HandleTargetDelete handles deleting a target. Deleting the
+// last database target of a webhook leaves its archive writer
+// with nothing to write, so the writer is evicted and its
+// handle closed; the archive file is left on disk.
 func (h *Handlers) HandleTargetDelete() http.HandlerFunc {
 	return h.deleteChildResource(
 		"targetID", &database.Target{},
 		"failed to delete target",
+		h.evictArchiveWriterIfUnused,
 	)
 }
 
 // deleteChildResource returns a handler that deletes a child
-// resource (entrypoint or target) belonging to a webhook.
+// resource (entrypoint or target) belonging to a webhook. The
+// optional afterDelete hook runs with the webhook's id once the
+// delete has succeeded, before the redirect.
 func (h *Handlers) deleteChildResource(
 	idParam string,
 	model any,
 	errMsg string,
+	afterDelete func(webhookID string),
 ) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID, ok := h.getUserID(r)
@@ -1177,6 +1153,10 @@ func (h *Handlers) deleteChildResource(
 			return
 		}
 
+		if afterDelete != nil {
+			afterDelete(webhook.ID)
+		}
+
 		http.Redirect(
 			w, r,
 			"/source/"+webhook.ID,

internal/handlers/source_management_test.go

@@ -1,581 +0,0 @@
-package handlers_test
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strconv"
-	"strings"
-	"testing"
-
-	"github.com/go-chi/chi"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gorm.io/gorm/clause"
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/handlers"
-	"sneak.berlin/go/webhooker/internal/session"
-)
-
-const (
-	// sourceTestUserID is the session user id used by the webhook
-	// management tests.
-	sourceTestUserID = "source-test-user"
-	// sourceIDParam is the chi URL parameter naming a webhook.
-	sourceIDParam = "sourceID"
-)
-
-// formRequest builds an urlencoded POST to path carrying the given
-// cookies, plus any chi URL parameters the handler reads.
-func formRequest(
-	path string,
-	cookies []*http.Cookie,
-	form url.Values,
-	urlParams map[string]string,
-) *http.Request {
-	req := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodPost,
-		path,
-		strings.NewReader(form.Encode()),
-	)
-	req.Header.Set(
-		"Content-Type", "application/x-www-form-urlencoded",
-	)
-
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-
-	rctx := chi.NewRouteContext()
-	for k, v := range urlParams {
-		rctx.URLParams.Add(k, v)
-	}
-
-	return req.WithContext(
-		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
-	)
-}
-
-// getRequest builds a GET to path carrying the given cookies, plus any
-// chi URL parameters the handler reads.
-func getRequest(
-	t *testing.T,
-	path string,
-	cookies []*http.Cookie,
-	urlParams map[string]string,
-) *http.Request {
-	t.Helper()
-
-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodGet, path, nil,
-	)
-
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-
-	rctx := chi.NewRouteContext()
-	for k, v := range urlParams {
-		rctx.URLParams.Add(k, v)
-	}
-
-	return req.WithContext(
-		context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
-	)
-}
-
-// submitCreate posts the webhook creation form with the given
-// retention_days value (omitted entirely when retention is nil) and
-// returns the recorder.
-func submitCreate(
-	t *testing.T,
-	h *handlers.Handlers,
-	cookies []*http.Cookie,
-	name string,
-	retention *string,
-) *httptest.ResponseRecorder {
-	t.Helper()
-
-	form := url.Values{}
-	form.Set("name", name)
-
-	if retention != nil {
-		form.Set("retention_days", *retention)
-	}
-
-	req := formRequest("/sources/new", cookies, form, nil)
-	w := httptest.NewRecorder()
-
-	h.HandleSourceCreateSubmit().ServeHTTP(w, req)
-
-	return w
-}
-
-// onlyWebhook loads the single webhook belonging to the test user.
-func onlyWebhook(
-	t *testing.T,
-	db *database.Database,
-) database.Webhook {
-	t.Helper()
-
-	var webhooks []database.Webhook
-
-	require.NoError(
-		t,
-		db.DB().Where("user_id = ?", sourceTestUserID).
-			Find(&webhooks).Error,
-	)
-	require.Len(t, webhooks, 1)
-
-	return webhooks[0]
-}
-
-// seedWebhook inserts a webhook owned by the test user with an exact
-// stored retention value, bypassing Webhook.BeforeSave via a
-// column-level update so that legacy rows can be planted too.
-func seedWebhook(
-	t *testing.T,
-	db *database.Database,
-	retentionDays int,
-) database.Webhook {
-	t.Helper()
-
-	wh := &database.Webhook{
-		UserID:        sourceTestUserID,
-		Name:          "seeded",
-		RetentionDays: retentionDays,
-	}
-	require.NoError(
-		t,
-		db.DB().Omit(clause.Associations).Create(wh).Error,
-	)
-	require.NoError(
-		t,
-		db.DB().Model(wh).
-			Update("retention_days", retentionDays).Error,
-	)
-
-	wh.RetentionDays = retentionDays
-
-	return *wh
-}
-
-// storedRetentionDays reads the retention_days column for a webhook.
-func storedRetentionDays(
-	t *testing.T,
-	db *database.Database,
-	id string,
-) int {
-	t.Helper()
-
-	var got int
-
-	require.NoError(
-		t,
-		db.DB().Model(&database.Webhook{}).
-			Where("id = ?", id).
-			Pluck("retention_days", &got).Error,
-	)
-
-	return got
-}
-
-// sourceTestEnv bundles the handler, session, and database a webhook
-// management test drives.
-type sourceTestEnv struct {
-	handlers *handlers.Handlers
-	db       *database.Database
-	cookies  []*http.Cookie
-}
-
-func setupSourceTest(t *testing.T) *sourceTestEnv {
-	t.Helper()
-
-	var h *handlers.Handlers
-
-	var sess *session.Session
-
-	var db *database.Database
-
-	app := newTestApp(t, &h, &sess, &db)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	return &sourceTestEnv{
-		handlers: h,
-		db:       db,
-		cookies: authenticatedCookies(
-			t, sess, sourceTestUserID, "sourceuser",
-		),
-	}
-}
-
-// TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever is the core
-// regression test for the bug: the create form's 0 must reach the
-// database as the retain-forever sentinel rather than being replaced by
-// the column's default of 30.
-func TestHandleSourceCreateSubmit_ZeroRetentionPersistsForever(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	zero := "0"
-
-	w := submitCreate(t, env.handlers, env.cookies, "forever", &zero)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-
-	wh := onlyWebhook(t, env.db)
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
-	assert.True(t, wh.RetainsForever())
-}
-
-func TestHandleSourceCreateSubmit_OmittedRetentionUsesDefault(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	w := submitCreate(t, env.handlers, env.cookies, "defaulted", nil)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-
-	wh := onlyWebhook(t, env.db)
-	assert.Equal(
-		t,
-		database.DefaultRetentionDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
-}
-
-// TestHandleSourceCreate_PrefillsDefaultFromConstant keeps the create
-// form's pre-filled retention from becoming a third hardcoded copy of
-// the 30-day policy.
-func TestHandleSourceCreate_PrefillsDefaultFromConstant(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	w := httptest.NewRecorder()
-	env.handlers.HandleSourceCreate().ServeHTTP(
-		w, getRequest(t, "/sources/new", env.cookies, nil),
-	)
-
-	require.Equal(t, http.StatusOK, w.Code)
-
-	body := w.Body.String()
-
-	assert.Contains(
-		t, body,
-		`value="`+strconv.Itoa(database.DefaultRetentionDays)+`"`,
-	)
-	assert.NotContains(
-		t, body, `max="365"`,
-		"a max below the sentinel would block retain-forever",
-	)
-	assert.Contains(t, body, `min="0"`)
-}
-
-func TestHandleSourceCreateSubmit_InvalidRetentionIsRejected(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	for _, raw := range []string{"abc", "-1", "3.5"} {
-		t.Run(raw, func(t *testing.T) {
-			t.Parallel()
-
-			env := setupSourceTest(t)
-
-			w := submitCreate(
-				t, env.handlers, env.cookies, "bad", &raw,
-			)
-
-			assert.Equal(t, http.StatusBadRequest, w.Code)
-			assert.Contains(
-				t, w.Body.String(), "Retention must be",
-			)
-
-			var count int64
-
-			require.NoError(
-				t,
-				env.db.DB().Model(&database.Webhook{}).
-					Where("user_id = ?", sourceTestUserID).
-					Count(&count).Error,
-			)
-			assert.Zero(
-				t, count,
-				"no webhook may be created from a rejected form",
-			)
-		})
-	}
-}
-
-// TestHandleSourceCreateSubmit_OverflowingRetentionIsRejected covers
-// the data-loss path directly: a finite retention above the largest one
-// the reaper's cutoff arithmetic can represent must never reach the
-// database, because the sweep would compute a future cutoff and delete
-// every event the webhook has.
-func TestHandleSourceCreateSubmit_OverflowingRetentionIsRejected(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	tooBig := strconv.Itoa(database.MaxFiniteRetentionDays + 1)
-
-	env := setupSourceTest(t)
-
-	w := submitCreate(t, env.handlers, env.cookies, "huge", &tooBig)
-
-	assert.Equal(t, http.StatusBadRequest, w.Code)
-	assert.Contains(
-		t, w.Body.String(),
-		strconv.Itoa(database.MaxFiniteRetentionDays),
-		"the form tells the user the actual ceiling",
-	)
-
-	var count int64
-
-	require.NoError(
-		t,
-		env.db.DB().Model(&database.Webhook{}).
-			Where("user_id = ?", sourceTestUserID).
-			Count(&count).Error,
-	)
-	assert.Zero(
-		t, count,
-		"no webhook may be created from a rejected form",
-	)
-}
-
-// TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever guards the
-// boundary between "too large to represent" and "retain forever": the
-// sentinel is above MaxFiniteRetentionDays, but it is the value the
-// edit form pre-fills, so it must be accepted rather than rejected as
-// out of range.
-func TestHandleSourceCreateSubmit_SentinelIsAcceptedAsForever(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	sentinel := strconv.Itoa(database.RetentionForeverDays)
-
-	w := submitCreate(t, env.handlers, env.cookies, "forever", &sentinel)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-
-	wh := onlyWebhook(t, env.db)
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
-}
-
-// TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput checks that a
-// validation failure hands the user's typing back, matching what the
-// edit form already does. Losing a long description to a mistyped
-// retention value is the kind of thing that makes people give up on a
-// form.
-func TestHandleSourceCreateSubmit_RejectedFormKeepsUserInput(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-
-	const (
-		name        = "kept-name"
-		description = "a description worth not losing"
-	)
-
-	form := url.Values{}
-	form.Set("name", name)
-	form.Set("description", description)
-	form.Set("retention_days", "nonsense")
-
-	req := formRequest("/sources/new", env.cookies, form, nil)
-	w := httptest.NewRecorder()
-
-	env.handlers.HandleSourceCreateSubmit().ServeHTTP(w, req)
-
-	require.Equal(t, http.StatusBadRequest, w.Code)
-
-	body := w.Body.String()
-
-	assert.Contains(t, body, `value="`+name+`"`)
-	assert.Contains(t, body, description)
-}
-
-// submitEdit posts the webhook edit form for the given webhook.
-func submitEdit(
-	t *testing.T,
-	env *sourceTestEnv,
-	wh database.Webhook,
-	retention string,
-) *httptest.ResponseRecorder {
-	t.Helper()
-
-	form := url.Values{}
-	form.Set("name", wh.Name)
-	form.Set("description", wh.Description)
-	form.Set("retention_days", retention)
-
-	req := formRequest(
-		"/source/"+wh.ID+"/edit",
-		env.cookies,
-		form,
-		map[string]string{sourceIDParam: wh.ID},
-	)
-	w := httptest.NewRecorder()
-
-	env.handlers.HandleSourceEditSubmit().ServeHTTP(w, req)
-
-	return w
-}
-
-func TestHandleSourceEditSubmit_ZeroRetentionPersistsForever(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	wh := seedWebhook(t, env.db, database.DefaultRetentionDays)
-
-	w := submitEdit(t, env, wh, "0")
-	require.Equal(t, http.StatusSeeOther, w.Code)
-
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
-}
-
-func TestHandleSourceEditSubmit_InvalidRetentionIsRejected(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	wh := seedWebhook(t, env.db, database.DefaultRetentionDays)
-
-	w := submitEdit(t, env, wh, "not-a-number")
-
-	assert.Equal(t, http.StatusBadRequest, w.Code)
-	assert.Contains(t, w.Body.String(), "Retention must be")
-	assert.Equal(
-		t,
-		database.DefaultRetentionDays,
-		storedRetentionDays(t, env.db, wh.ID),
-		"a rejected form must not change the stored retention",
-	)
-}
-
-func TestHandleSourceEditSubmit_EmptyRetentionLeavesValueUnchanged(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	wh := seedWebhook(t, env.db, 7)
-
-	w := submitEdit(t, env, wh, "")
-	require.Equal(t, http.StatusSeeOther, w.Code)
-
-	assert.Equal(t, 7, storedRetentionDays(t, env.db, wh.ID))
-}
-
-// TestSourceEditForm_ForeverWebhookRoundTrips walks the exact path that
-// the removed max="365" cap used to break: render the edit form for a
-// retain-forever webhook, confirm the pre-filled sentinel is not capped
-// by browser validation, then submit that pre-filled value straight
-// back and confirm the retention policy survives untouched.
-func TestSourceEditForm_ForeverWebhookRoundTrips(t *testing.T) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	wh := seedWebhook(t, env.db, database.RetentionForeverDays)
-
-	req := getRequest(
-		t, "/source/"+wh.ID+"/edit", env.cookies,
-		map[string]string{sourceIDParam: wh.ID},
-	)
-	w := httptest.NewRecorder()
-	env.handlers.HandleSourceEdit().ServeHTTP(w, req)
-
-	require.Equal(t, http.StatusOK, w.Code)
-
-	sentinel := strconv.Itoa(database.RetentionForeverDays)
-	body := w.Body.String()
-
-	assert.Contains(
-		t, body, `value="`+sentinel+`"`,
-		"the edit form pre-fills the stored retention",
-	)
-	assert.NotContains(
-		t, body, `max="365"`,
-		"a max below the sentinel would block saving any edit",
-	)
-	// "Currently forever." is the rendered RetentionLabel, not the
-	// static hint below the input, which says "Enter 0 to retain events
-	// forever." A bare Contains of "forever" would pass for any
-	// webhook and would assert nothing about this one.
-	assert.Contains(
-		t, body, "Currently forever.",
-		"the form reports this webhook's policy as forever",
-	)
-
-	// Submit the pre-filled value back, exactly as a browser would.
-	post := submitEdit(t, env, wh, sentinel)
-	require.Equal(t, http.StatusSeeOther, post.Code)
-
-	assert.Equal(
-		t,
-		database.RetentionForeverDays,
-		storedRetentionDays(t, env.db, wh.ID),
-	)
-}
-
-// TestSourceListAndDetail_ShowForeverNotTheSentinelNumber checks that
-// the retain-forever value is never rendered to the user as a raw day
-// count on either read-only view.
-func TestSourceListAndDetail_ShowForeverNotTheSentinelNumber(
-	t *testing.T,
-) {
-	t.Parallel()
-
-	env := setupSourceTest(t)
-	wh := seedWebhook(t, env.db, database.RetentionForeverDays)
-	sentinel := strconv.Itoa(database.RetentionForeverDays)
-
-	listW := httptest.NewRecorder()
-	env.handlers.HandleSourceList().ServeHTTP(
-		listW, getRequest(t, "/sources", env.cookies, nil),
-	)
-
-	require.Equal(t, http.StatusOK, listW.Code)
-	assert.Contains(t, listW.Body.String(), "Retention: forever")
-	assert.NotContains(t, listW.Body.String(), sentinel)
-
-	detailW := httptest.NewRecorder()
-	env.handlers.HandleSourceDetail().ServeHTTP(
-		detailW,
-		getRequest(
-			t, "/source/"+wh.ID, env.cookies,
-			map[string]string{sourceIDParam: wh.ID},
-		),
-	)
-
-	require.Equal(t, http.StatusOK, detailW.Code)
-	assert.Contains(t, detailW.Body.String(), "Retention: forever")
-	assert.NotContains(t, detailW.Body.String(), sentinel)
-}

templates/source_detail.html

@@ -181,7 +181,7 @@
 
     <!-- Info -->
     <div class="mt-4 text-sm text-gray-400">
-        <p>Retention: {{.Webhook.RetentionLabel}} &middot; Created: {{.Webhook.CreatedAt.Format "2006-01-02 15:04:05 UTC"}}</p>
+        <p>Retention: {{.Webhook.RetentionDays}} days &middot; Created: {{.Webhook.CreatedAt.Format "2006-01-02 15:04:05 UTC"}}</p>
     </div>
 </div>
 {{end}}

templates/source_edit.html

@@ -28,8 +28,7 @@
 
             <div class="form-group">
                 <label for="retention_days" class="label">Retention (days)</label>
-                <input type="number" id="retention_days" name="retention_days" value="{{.Webhook.RetentionDays}}" min="0" class="input">
-                <p class="text-xs text-gray-500 mt-1">Currently {{.Webhook.RetentionLabel}}. Enter 0 to retain events forever.</p>
+                <input type="number" id="retention_days" name="retention_days" value="{{.Webhook.RetentionDays}}" min="1" max="365" class="input">
             </div>
 
             <div class="flex gap-3">

templates/sources_list.html

@@ -25,7 +25,7 @@
                     <p class="text-sm text-gray-500 mt-1">{{.Description}}</p>
                     {{end}}
                 </div>
-                <span class="badge-info">Retention: {{.RetentionLabel}}</span>
+                <span class="badge-info">{{.RetentionDays}}d retention</span>
             </div>
             <div class="flex gap-6 mt-4 text-sm text-gray-500">
                 <span>{{.EntrypointCount}} entrypoint{{if ne .EntrypointCount 1}}s{{end}}</span>

templates/sources_new.html

@@ -18,18 +18,18 @@
             <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
             <div class="form-group">
                 <label for="name" class="label">Name</label>
-                <input type="text" id="name" name="name" value="{{.Name}}" required autofocus placeholder="My Webhook" class="input">
+                <input type="text" id="name" name="name" required autofocus placeholder="My Webhook" class="input">
             </div>
 
             <div class="form-group">
                 <label for="description" class="label">Description</label>
-                <textarea id="description" name="description" rows="3" placeholder="Optional description" class="input">{{.Description}}</textarea>
+                <textarea id="description" name="description" rows="3" placeholder="Optional description" class="input"></textarea>
             </div>
 
             <div class="form-group">
                 <label for="retention_days" class="label">Retention (days)</label>
-                <input type="number" id="retention_days" name="retention_days" value="{{.DefaultRetentionDays}}" min="0" class="input">
-                <p class="text-xs text-gray-500 mt-1">How long to keep event data. Enter 0 to retain events forever.</p>
+                <input type="number" id="retention_days" name="retention_days" value="30" min="1" max="365" class="input">
+                <p class="text-xs text-gray-500 mt-1">How long to keep event data.</p>
             </div>
 
             <div class="flex gap-3">