Entries stay fresh in a long-lived handle: re-read after the pack listing's 30 s 771661aa50f4

- **A repository kept in a bucket finds signatures and seals without a LIST each (#116).** Every lookup of an object's signatures, seals, receipts, approvals or certificate listed a prefix in the bucket, and most of these lookups found nothing. Writers now also add each such entry to a journal (`pack-entries`, updated by compare-and-swap), and `oxy gc` folds them all into one list. Once a store has been folded, a reader reads the lists and the journal when it opens it, and again after 30 seconds (as long as the pack listing is kept), and looks everything up from them. Another writer's entry is seen within 30 seconds, as its pack would be, even by a handle a server keeps open. The first `oxy gc` also copies the one-list keys of much older stores (`sigs/`, `seals/`, `certs/`, …) into the current layout and marks them folded, so readers stop requesting them; until now nearly every lookup made one of these requests and found nothing. On the test store, 40 lookups went from 85 requests (40 LISTs) to 7 (one journal read and no LIST). Older readers are unaffected, because every entry still has its own key. Entries written by oxy 0.4.6 or older after the fold are missed until the next `oxy gc`, so upgrade every client that writes to the bucket first, then run `oxy gc` once. A server's `/health` counts journal reads as `read_journal`. A repository's own directory works as before.

/// How long a handle answers lookups from the entries it read before it

/// reads the pack listing and the journal again (spec §13.7): the

/// interval a cloud client keeps the pack listing for, so another

/// writer's entry is seen as soon as its pack would be.

pub const ENTRIES_FRESH: std::time::Duration = std::time::Duration::from_secs(30);

    /// When `entries` was read; past [`ENTRIES_FRESH`] it is read again.

    entries_read: std::cell::Cell<Option<std::time::Instant>>,

    /// Entry lists already read, by key: written once, so never read

    /// twice; those no longer live are let go.

    lists_read: RefCell<std::collections::HashMap<String, Arc<Vec<String>>>>,

            entries_read: std::cell::Cell::new(None),

            lists_read: RefCell::new(Default::default()),

        // Read over the interval ago: list the packs again (a cloud

        // client keeps that listing as long), loading what changed, and

        // read the journal again, so another writer's entry is seen as

        // its pack would be.

        if self

            .entries_read

            .get()

            .is_some_and(|t| t.elapsed() >= ENTRIES_FRESH)

        {

            *self.entries.borrow_mut() = None;

            self.reload_if_changed()?;

            if !self.folded.get() {

                return Ok(None);

            }

        }

            self.lists_read

                .borrow_mut()

                .retain(|k, _| lists.contains(k));

                let known = self.lists_read.borrow().get(key).cloned();

                let keys = match known {

                    Some(keys) => keys,

                    None => match get_optional(self.backend.as_ref(), key)? {

                        Some(bytes) => {

                            let keys = Arc::new(decode_entry_list(key, &bytes)?);

                            self.lists_read

                                .borrow_mut()

                                .insert(key.clone(), keys.clone());

                            keys

                        }

                        None if attempt == 0 => {

                            self.reload_packs()?;

                            continue 'attempt;

                        }

                        None => return Ok(None),

                    },

                };

                set.extend(keys.iter().cloned());

            self.entries_read.set(Some(std::time::Instant::now()));

    }

    /// A handle that has read the entries finds another process's new

    /// signature once the pack listing's interval has passed, with no

    /// refresh, at the cost of one pack listing and one journal read.

    #[test]

    fn a_long_lived_handle_sees_new_entries_within_the_interval() {

        let f = Fixture::new();

        let w = f.open();

        let r1 = w.put(ObjectType::Chunk, b"one").unwrap();

        let s1 = sign(&w, &r1, 1);

        assert!(fold(&w));

        let a = f.open();

        assert_eq!(a.signatures(&r1).unwrap(), vec![s1]);

        let b = f.open();

        let r2 = b.put(ObjectType::Chunk, b"two").unwrap();

        let s2 = sign(&b, &r2, 2);

        b.index_approval(&r2, &ObjectRef([3; 32])).unwrap();

        // Within the interval: answered from what was read.

        assert!(a.signatures(&r2).unwrap().is_empty());

        // The interval passes, as the pack listing's does.

        let t = a.entries_read.get().unwrap();

        a.entries_read.set(t.checked_sub(ENTRIES_FRESH));

        f.backend.reset();

        assert_eq!(a.signatures(&r2).unwrap(), vec![s2]);

        assert_eq!(a.approvals_for(&r2).unwrap(), vec![ObjectRef([3; 32])]);

        assert_eq!(f.backend.n("read_journal"), 1, "{}", f.backend.summary());

        assert_eq!(f.backend.n("list_packs"), 1, "{}", f.backend.summary());

        assert_eq!(f.backend.n("list"), 0, "{}", f.backend.summary());

        assert_eq!(

            f.backend.n("get"),

            1,

            "the signature; the list already read is not read again: {}",

            f.backend.summary()

        );

- **Reading.** A store is **folded** when its live lists (listed and not retired) include a complete one. On its first lookup, a handle on a folded store reads every live list and the journal, folded lines included, and answers every lookup from that set. It adds what it writes itself, and it never lists the per-object prefixes or reads the older lists. A signature's bytes are still read from its own key, which a cache may keep, since that key is written once. A handle reads them again when it loads its packs again (§13.4) or is refreshed, and on the first lookup more than 30 seconds after it last read them. At that point it lists its packs again, reads only the lists that are new, and reads the journal. 30 seconds is as long as a cloud client keeps the pack listing, so another writer's entry is seen within that interval, as another writer's pack is, even by a handle a server keeps open across requests. On a store that is not folded (no collection has folded it since writers kept a journal, or another implementation's collection retired its lists), a lookup lists the per-object prefix as before.

  and lists of them (`pack-<id>.entries`). These are read when the

  repository is opened and again every 30 seconds (spec §13.7). After

  every client that writes to the bucket runs this version of oxy, run

  `oxy gc` once. From then on, looking up a signature or a seal sends no

  LIST request, and another client's new signature is seen within 30

  seconds. A client still on oxy 0.4.6 or older writes signatures that

  the others miss until the next `oxy gc`, so upgrade every client

  first.