[LIghtJUNction]

Motivation

• Purge previously inserted permanent purge_tombstones rows with caller-controlled reasons without any retention or quota accounting, allowing delegated users to cause unbounded SQLite growth and potentially exhaust disk.

Description

• Add a PURGE_TOMBSTONE_LIMIT = 10_000 constant and an index on (purged_at, post_id) to support deterministic retention and efficient pruning in src/msgd/store.py.
• Prune legacy tombstones at store initialization by calling a new _prune_purge_tombstones() helper so upgrades reclaim existing excess rows.
• Call _prune_purge_tombstones() after every purge_post insertion so repeated purge cycles cannot grow the table beyond the configured bound.
• Implement _prune_purge_tombstones() to delete all but the newest LIMIT rows using a single SQL DELETE ... WHERE post_id NOT IN (SELECT post_id ... LIMIT ?) statement.
• Add a regression test test_purge_tombstones_have_bounded_retention in tests/test_msgd.py that patches the limit to 2, exercises repeated purge cycles, and asserts only the newest tombstones remain.

Testing

• Ran the focused tests: uv run python -m unittest tests.test_msgd.ServerCase.test_purge_tombstones_have_bounded_retention tests.test_msgd.ServerCase.test_purge_can_irreversibly_remove_an_archived_post -v and both passed.
• Ran lint: uv run ruff check src/msgd/store.py tests/test_msgd.py with no reported errors.
• Ran the full test suite: uv run python -m unittest discover -s tests -v which completed successfully (147 tests passed, 1 skipped).
• Verified repository cleanliness with git diff --check and local diffs after changes (no check failures reported).

---

Codex Task

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-28T11:49:57.627596Z	d45b9be	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

已被 #143 取代，关闭。旧补丁打在已删除的 src/msgd 上；现行 src/msg 的对应容量上限在分支 fix/capacity-recovery-20260928（head e77b53b），该分支已包含合并后的 #142。