20260716 增加verification-only缓存正确性复核

src/blob_store.rs

@@ -77,6 +77,7 @@ pub struct ExternalRawStoreDb {
 pub struct ExternalRepoBytesDb {
     path: PathBuf,
     db: Arc<DB>,
+    read_only: bool,
 }
 
 impl ExternalRawStoreDb {
@@ -189,6 +190,7 @@ impl ExternalRepoBytesDb {
         Ok(Self {
             path,
             db: Arc::new(db),
+            read_only: false,
         })
     }
 
@@ -201,6 +203,7 @@ impl ExternalRepoBytesDb {
         Ok(Self {
             path,
             db: Arc::new(db),
+            read_only: true,
         })
     }
 
@@ -208,6 +211,12 @@ impl ExternalRepoBytesDb {
         if blobs.is_empty() {
             return Ok(());
         }
+        if self.read_only {
+            return Err(StorageError::RocksDb(format!(
+                "repo-bytes DB is read-only: {}",
+                self.path.display()
+            )));
+        }
         let mut batch = WriteBatch::default();
         for (sha256_hex, bytes) in blobs {
             validate_blob_sha256_hex(sha256_hex)?;
@@ -221,6 +230,42 @@ impl ExternalRepoBytesDb {
         Ok(())
     }
 
+    pub(crate) fn is_read_only(&self) -> bool {
+        self.read_only
+    }
+
+    pub(crate) fn require_existing_blob_bytes_batch(
+        &self,
+        blobs: &[(String, Vec<u8>)],
+    ) -> StorageResult<()> {
+        if blobs.is_empty() {
+            return Ok(());
+        }
+        let hashes = blobs
+            .iter()
+            .map(|(sha256_hex, _)| sha256_hex.clone())
+            .collect::<Vec<_>>();
+        let existing = self.get_blob_bytes_batch(&hashes)?;
+        for ((sha256_hex, expected_bytes), actual_bytes) in blobs.iter().zip(existing) {
+            match actual_bytes {
+                Some(actual_bytes) if actual_bytes == *expected_bytes => {}
+                Some(_) => {
+                    return Err(StorageError::InvalidData {
+                        entity: "read_only_repo_bytes",
+                        detail: format!("existing bytes differ for SHA-256 {sha256_hex}"),
+                    });
+                }
+                None => {
+                    return Err(StorageError::InvalidData {
+                        entity: "read_only_repo_bytes",
+                        detail: format!("blob is missing for SHA-256 {sha256_hex}"),
+                    });
+                }
+            }
+        }
+        Ok(())
+    }
+
     pub fn get_blob_bytes(&self, sha256_hex: &str) -> StorageResult<Option<Vec<u8>>> {
         validate_blob_sha256_hex(sha256_hex)?;
         let key = repo_bytes_key(sha256_hex);