Archive delete: truthful results, unlock & confirm-through; UI/serving performance

[Anonymouse6661]

Summary

Archive → Actions → Delete could appear to do nothing — and in one failure mode it lied about working. This PR makes the delete pipeline truthful end-to-end, adds the missing unlock affordance, and fixes the main UI/serving performance hazards found along the way. Everything was reproduced, fixed, and verified against a live Unraid deployment of v2.5.

The delete bug(s)

Investigating a real "delete does nothing" report surfaced three stacking causes:

1. Protected clips were refused silently. Anything dashcam-locked (event_type='ro' — every clip the camera wrote to /Movie/RO/, i.e. all G-sensor/event footage) or user-locked was filtered out of the delete, and the UI toast dropped the protected count: deleting 12 RO clips read "Deleted 0, skipped 0" with no explanation. There was also no way back from Mark read-only — the lock route hardcoded True and no unlock route existed, so a mis-click was permanent short of editing the SQLite DB by hand.
2. A failed file unlink still deleted the index row. With the classic NAS misconfiguration (container PUID/PGID lacking write+execute on the recordings share), os.remove raises PermissionError, the warning is swallowed, and _delete_index_row() runs anyway: the tile disappears, the toast says "Deleted N", no space is freed, and the clip re-appears on the next rescan. The same swallow sat in the retention sweep, where it was worse — bytes_freed was credited for the file's size (read via getsize before the failed unlink), so quota bookkeeping drifted while the disk-pressure loop kept "deleting".
3. Day-card totals went stale — after a successful delete the open day re-rendered but the day header kept the old clip count and GB figure until a manual reload.

What changed

Backend correctness (web/services/retention.py, web/services/queue.py, web/routers/queue.py)

• _delete_clip_files now returns (bytes_freed, ok), where ok reflects whether the primary .mp4 was actually removed; on failure it reports 0 bytes freed. delete_clip keeps the index row when ok is false.
• delete_clips reports {deleted, skipped, protected, protected_names, failed}. Failed clips keep both their index and queue rows. protected_names lets the UI target exactly the refused clips on a follow-up.
• Loop wedge guards: in the disk-pressure pass and make_room_for, clips whose unlink fails leave the candidate pool for that pass — previously the oldest-first query would re-select the same un-unlinkable clip forever.
• New POST /api/queue/unlock (the reverse of /api/queue/lock), and an optional force flag on POST /api/queue/delete for an explicit, confirmed delete of protected clips.
• Day-folder rmdir pruning is batched once per delete batch instead of one failing syscall per clip.

UI (web/static/app.js, web/static/index.html)

• The delete toast now reports all four outcomes (Deleted N, M won't re-download, K read-only/locked kept, J failed — see Logs), and when protected clips were refused the UI asks once — "N of the selected clip(s) are read-only or locked… Delete them anyway?" — and force-deletes exactly those names on confirm.
• Clear read-only joins Mark read-only in the Actions menu.
• loadDays() runs after delete/skip so day-card totals stay correct.
• The CSRF 403 retry now retries once instead of recursing unbounded.

Performance

• Filmstrip hover-scrub dwell + abort (app.js): loading fired on raw mouseenter with no cancellation — sweeping the cursor across a 240-tile day queued one ffmpeg sprite job per tile crossed, saturating the browser's ~6 connections per origin and blocking every other API call behind sprite generation (the UI would go dead for tens of seconds and spin up array disks). Loads now require 350 ms of hover and abort via AbortController on mouseleave.
• Event-loop discipline (web/routers/archive.py): _fetch_clip (a synchronous sqlite connect + os.path.isfile on the recordings mount) was called directly from three async def handlers; on a spun-down array one isfile can take hundreds of ms, and a day view issues ~240 of them. Now wrapped in asyncio.to_thread.
• makedirs memoization (web/services/thumbs.py, web/services/filmstrip.py): the cache-path helpers ran os.makedirs — a NAS metadata round-trip — on every call; now once per process per directory.
• GZipMiddleware (web/app.py): app.js (~200 KB) and day payloads (~80 KB at 240 clips) were served uncompressed on every fetch.
• Sync-time re-render churn (app.js): queue_changed fires on every item transition during a download session; the 300 ms resetting debounce could starve refreshes under a steady stream and, once idle, wipe-and-rebuild every open day per transition (innerHTML wipe, ~240 recreated <img>s, Leaflet teardown, double getBoundingClientRect FLIP passes). It's now a coalescing throttle (widened to 2 s while a sync is active), and renderDayBody keys each render on its payload + render-shaping settings and skips days whose data didn't change.

API compatibility

• POST /api/queue/delete request gains optional force: bool = false; response gains protected_names and failed (additive).
• retention.sweep() summary gains a failed key (additive).
• Internal signatures changed: retention.delete_clip / _delete_clip_files now return tuples; _disk_pressure_pass returns a 4-tuple.

Tests

• Existing delete/lock/retention tests updated for the new response shapes; test doubles that stub _delete_clip_files return the new tuple.
• New tests/test_retention_failed_unlink.py covers: index row kept on failed unlink, sweep reporting failed with 0 bytes credited, and the no-infinite-loop guards for both the disk-pressure pass and make_room_for.
• New tests for force delete, protected_names, and the unlock endpoint.
• 78 tests across the affected files pass; the full suite passes on Linux (a handful of unrelated tests fail on a Windows dev host for platform reasons — POSIX file modes/signals and DirEntry.st_dev — identically on unpatched main).

Verification on a real deployment

Built as a Docker image and deployed on an Unraid server (Intel Arrow Lake iGPU, recordings on a user share): delete round-trips behave honestly, /api/queue/unlock is live, gzip is active on the wire, thumbnails/filmstrips still generate, and QSV hardware encode still passes the runtime probe.

Authorship disclosure

This contribution was researched, written, and tested by an AI — Claude (Anthropic), running as a coding agent — at the direction of, and with every step reviewed and deployed by, the repository user submitting this PR. The audit that motivated it was also AI-performed against 995a965. Happy to adjust anything to fit the project's conventions.

🤖 Generated with Claude Code

[RobXYZ]

These all look great, many thanks for contributing!