repair and scan --prune delete the beforeHash blobs of active patches, so a later offline rollback fails and tells the user to run repair #893

[agent] Filed by the scheduled architecture audit routine (CLI and core). Register: register comment.

Kind: bug. Source: new finding (C50). Same bug class as #559, which #600 fixed for remove only.

Problem

There are two artifact-retention policies in cleanup_blobs.rs#L30-L64,`` and they disagree about the same blobs:

• ArtifactReferences::after_removal keeps the beforeHash blobs of every patch still in the manifest. Its doc says "a crawler miss must not destroy the only local restore data". rollback (rollback.rs#L1598) and remove (remove.rs#L940) use it. The contract says this "preserves offline rollback of other active patches".
• ArtifactReferences::for_apply keeps only the afterHash blobs. repair (repair.rs#L630) and scan --prune (scan/gc.rs#L159) use it. It deletes the originals of patches that are still active.

get stores those originals: write_all_patch_blobs writes before_blob_content to .socket/blobs/<beforeHash>. The first repair (alias gc) then deletes them again.

The offline rollback error also points to the wrong fix. It says Run "socket-patch repair" to download missing blobs (rollback.rs#L2462-L2483).`` But repair downloads only `get_missing_blobs`, which checks afterHash blobs only (`blob_fetcher.rs#L78-L90`). So running `repair` can never restore the blob that its own GC deleted.

The old rationale is left behind as dead public API: cleanup_unused_blobs ("beforeHash blobs are considered unused because they are downloaded on-demand during rollback"), cleanup_unused_archives and format_cleanup_result (cleanup_blobs.rs#L175-L232).`` They have no caller in any crate except their own unit tests.

Proof (debug build on 9c43dfc, run twice, identical results). Setup: an npm project with one active patch, node_modules/t/index.js in its patched state, and both blobs present in .socket/blobs, the same layout get leaves.

• Control, with no repair: rollback --offline --json exits 0, status: success, and the file is restored.
• repair --offline --json exits 0, and .socket/blobs keeps only the afterHash blob. Then rollback --offline --json exits 1, status: partial_failure: Cannot roll back: package/index.js - Before blob not found: 9b81… and --offline prevents fetching. Run "socket-patch repair" to download missing blobs. The file stays patched.

scan --prune reaches the same for_apply call. That path is verified by reading only, because scan refuses --offline.

Symptoms

None filed. #559 was the same data loss reached through remove.

Impact: an air-gapped or offline rollback of a patch that is still active fails after any repair/gc or scan --prune/--sync. The remedy it prints is wrong. Online, rollback falls back to downloading the blob, which works only while the patch service still serves it.

Proposed change

• Give ArtifactReferences one retention policy for an unchanged manifest: keep the afterHash and beforeHash blobs, and the diff archive, of every manifest patch. In practice, for_apply becomes after_removal(m, m, []) or a named ArtifactReferences::active(m). repair and scan --prune call it, and for_apply is deleted.
• Delete cleanup_unused_blobs, cleanup_unused_archives, format_cleanup_result and their tests. ArtifactReferences::sweep already covers them.
• Rewrite the offline rollback remedy as "re-run without --offline to download the original blobs". repair can't fetch them.

Size and scope

cleanup_blobs.rs, repair.rs, scan/gc.rs, rollback.rs (messages), and the contract's repair / scan --prune text. About 30 production lines changed and about 90 dead lines deleted. Out of scope: teaching repair to download beforeHash blobs.

Acceptance criteria

• A regression test: after repair --offline on a project with an active patch and both blobs, rollback --offline exits 0 and restores the file.
• The same check for scan --mode agent --prune against a mock API: the active patch's beforeHash blob survives.
• repair still removes beforeHash blobs that only manifest-absent patches reference.
• The dead cleanup_unused_* / format_cleanup_result are gone, and cargo test -p socket-patch-core manifest::cleanup_blobs and the repair, remove, rollback and scan-GC suites stay green.
• The offline rollback message no longer names repair.
• CLI_CONTRACT.md describes one retention policy for repair and scan --prune.

Dependencies

None. This touches the same files as #791 (--download-mode in repair) only in separate blocks.

Backlog review — 2026-10-08

Priority: P3 → P2. Deleting original blobs of active patches breaks offline rollback. Keep the data-retention fix; it is more consequential than P3 cleanup.