## Summary Implement the S20-A lifecycle purger: the tombstone-discovery scans, the per-format reap logic, the repository walk and finalizer, the River purge job and re-queue sweep, the purger's observability, and the destructive repository `DELETE` that feeds them. Closed beta ships on 2026-09-07 and cannot ship without a reaper. Two entry points already write tombstones or will: npm's version and package unpublish write `soft_deleted_at` today with nothing to collect it, and [#464](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/464)'s repository cascade cannot work for npm or Maven at all until a purger exists, because the artifact foreign keys block the finalizer forever. - Spec: [S20-A](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/S20-a-lifecycle-closed-beta.md) - Plan: `docs/plans/2026-08-11-s20a-lifecycle-closed-beta.md` (merged in 40c31b16) ## Scope Nineteen numbered steps across twenty MRs, since Step 17 splits into 17a and 17b. Every step MR links this issue, so this issue is the whole progress view. 1. `repositories` and `npm_packages` tombstone-discovery indexes 1. `LifecycleConfig` proto and loader 1. Repository-read tombstone filters 1. Repository tombstone write and the parent-gate row lock 1. Purge seam, eligibility predicate, namespace page, and the repository scan 1. Version-level tombstone scans 1. `npm_packages` and `container_images` tombstone scans 1. npm hosted reap, and the unpublish attachment fix 1. Maven hosted reap 1. npm remote reap 1. Maven remote reap 1. Container remote reap 1. Container hosted reap 1. Repository walk, finalizer, and the fault-suite CI job 1. `internal/lifecycle` purge worker, chunk driver, and CI enrollment 1. Sweep periodic worker and composition-root registration 1. 17a — unleased purger signals 1. 17b — leased tombstone-count gauge 1. Destructive repository `DELETE` 1. S22 emit call sites at the purger ## Out of scope - **The hosted-container marker schema and its per-statement gates.** [#313](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/313) (S17 Phase 4) Steps 5, 6 and 7 own `container_images.soft_deleted_at`, the per-statement `soft_deleted_at IS NULL` predicates, and the partial re-declaration of `unique_container_images_ns_id_cr_id_name`. The order is load-bearing: once that unique index is partial, `upsertContainerImageInsert`'s bare conflict target can no longer infer it as the arbiter and every image push fails with `42P10`, so the predicates must ship before the swap. - **`container_remote_blobs`, `container_remote_tags`, and `container_remote_manifest_relationships`.** Not in the tree. When [S16](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/288) lands them they are reaped by extending Step 12's file — a follow-on MR against the same reaper. - **A bound on the purge-lag inflation window** beyond the sweep-interval ceiling. A tombstoned repository keeps every artifact in `components_count` and `size_bytes` until the reap removes them, and nothing in the design bounds how long an arbitrarily large repository takes to drain. The realized wait ships as a purge-time histogram instead of a bound. ## External gates - **S22's emit-API step** — `accounting.Emitter`, `accounting.NewEmitter`, `EmitRepoCounters`, `EmitNamespaceCounters` — must merge before Step 19 opens. `internal/accounting` does not exist yet. Steps 1 through 18 do not reference the emit API and do not wait on it, so if S22 slips the purger ships without the emit calls and Step 19 lands whenever S22's step does. Tracked in [#515](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/515). - **S22's leased-collector step** must merge before Step 17b opens, because 17b registers the tombstone-count gauge through `internal/accounting` and reuses that lease rather than writing a second one. There is no schedule fallback, and the risk is real: closed beta may launch with the purger running and no fleet-wide tombstone count, which is the spec's stuck-purge control. Splitting 17a out is what keeps the purge-outcome counter and the two histograms off this gate, so a purger shipping without the gauge is still observable rather than silent. - **Two migration MRs race into one window.** Step 1 here and S17 Phase 4's Step 5 both add migrations under `goose.WithAllowOutofOrder(false)`, so whichever opens second picks its sequence number against `main` after the first has merged. ## Follow-ups identified while planning - **The `/v2/` mount criterion is wrong in the spec** and needs a spec-amendment MR. It requires the mount route to answer `404 NAME_UNKNOWN` for a tombstoned source image. `findBlobInRepositoryExists` is the mount's *source* lookup and its `found=false` is already the `202 source_missing` fallback, so implementing the criterion literally would break OCI mount conformance and reinstate the existence oracle the `202` exists to prevent. The amendment splits the criterion by which side is tombstoned — path-named routes answering `404`, the mount source `202`, the mount destination `201`. No step waits on it. - **`container_remote_images` has no discovery index and no scan level**, so nothing reaches a tombstoned image under a live remote repository. No writer sets that column today, which is why no state is stranded *yet* — the spec is explicit that the absence of a writer is not a property the purger may rely on, so this is not a reason the gap is acceptable. Closing it is one more index of the shape this spec already builds two of, and it belongs with whichever spec lands the first writer. - **`maven_packages` has the same gap and its writer is imminent.** [#313](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/313)'s Step 14 lands `SoftDeleteMavenPackage` inside closed beta as a marker `UPDATE` on the named row only, so a marked package's `maven_versions` children stay live, the version-level scan has nothing to walk up from, and the repository walk never starts under a live repository. `index_maven_packages_on_ns_id_soft_deleted_at` arrives with no scan consumer in either plan. Closing it is one scan level; the amendment belongs with whichever spec owns the per-level bound table. - **The purger's fault tests need their own CI job.** `test:storage-failpoints` cannot host them: it runs with no services and no build tag, its `changes:` rule is one `internal/storage/**/*` glob a purger change never triggers, and its package list is hardcoded in four places in the job plus three more in `.mise.toml`. Step 14 builds a separate job with Postgres services and the integration tag. - **`internal/lifecycle` must be enrolled in `test:integration` by hand.** That job builds its package set from a hardcoded `go list` argument list and gates on a hardcoded `changes:` anchor; a package in neither compiles, reports green, and runs nothing. Step 15 adds it to both lists in the same MR as the package's first `*_integration_test.go` file.