Merge pull request 'feat(doctor): the one host prerequisite the Asset Bridge added (Phase 9a)' (#25) from feat/asset-bridge-p9 into edge

Reviewed-on: #25

.gitea/workflows/release.yml

@@ -165,6 +165,39 @@ jobs:
             fi
           fi
 
+          # ── Orphan sweep ────────────────────────────────────────────────
+          #
+          # The check above is VERSION-SCOPED: it only ever asks about the one
+          # version this run computed. That is enough to recover an orphan on
+          # the very next run, and useless afterwards — once any releasable
+          # commit lands, the next run computes a NEW version, never looks at
+          # the old tag again, and the orphan becomes permanent and silent.
+          #
+          # servuo-plugins v0.1.0 is the proof, and the proof is pointed: the
+          # commit that ADDED the recovery above was itself typed
+          # `fix(release): ... recover the orphaned v0.1.0 tag`, so it bumped to
+          # v0.1.1 — and the run that introduced the recovery stepped straight
+          # past the tag it was written to rescue. That tag is still orphaned.
+          #
+          # So every v* tag is checked, and anything missing a release is
+          # WARNED about. Deliberately not recovered: publishing an old version
+          # would mean building today's tree and shipping it under a tag whose
+          # tree it is not, which is worse than the inconsistency it fixes.
+          # A human decides whether to recover or drop it.
+          #
+          # Never fails the run. A sweep that can break a good release is a
+          # sweep someone will delete.
+          ORPHANS=""
+          for T in $(git tag -l 'v*' --sort=-v:refname); do
+            T_HTTP="$(curl -s -o /dev/null -w '%{http_code}' \
+              -H "Authorization: token $(printf '%s' "${REGISTRY_TOKEN:-}" | tr -d '\r\n')" \
+              "https://${GITEA_HOST}/api/v1/repos/${REPO}/releases/tags/${T}" || echo 000)"
+            [ "$T_HTTP" = "404" ] && ORPHANS="${ORPHANS} ${T}"
+          done
+          if [ -n "${ORPHANS}" ]; then
+            echo "::warning::Tags with no release:${ORPHANS} — a run failed after tagging. Publish or delete them; this job will not do either."
+          fi
+
           # Changelog range. A recovery run has nothing after the tag, so
           # summarize what the tag itself contains rather than emitting an empty
           # list: the range that produced it, i.e. previous-tag..this-tag.
@@ -395,17 +428,74 @@ jobs:
           # corrupt the Authorization header.
           CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')"
 
-          REL_ID="$(curl -sSf -X POST "${API}/releases" \
-            -H "Authorization: token ${CI_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$(jq -n --arg tag "$TAG" --arg body "$BODY" \
-                   '{tag_name:$tag, name:$tag, body:$body, draft:false, prerelease:false}')" \
-            | jq -r '.id')"
+          PAYLOAD="$(jq -n --arg tag "$TAG" --arg body "$BODY" \
+                       '{tag_name:$tag, name:$tag, body:$body, draft:false, prerelease:false}')"
+
+          # This POST is the step that orphaned tag v0.1.1 (run 75): it landed one
+          # second after the tag push and Gitea answered 500, having not finished
+          # processing the pushed tag. Re-running the workflow published the same
+          # four assets untouched, so the failure was a race, not a bad request.
+          #
+          # Two things went wrong there, and both are fixed here.
+          #
+          # 1. `curl -sSf` prints NO response body on an error status, so all the
+          #    log carried was "curl: (22) ... error: 500" and the cause had to be
+          #    inferred from timestamps. Capture the body and print it.
+          # 2. Nothing retried, so a transient 5xx became a permanent orphan tag.
+          #    The plan step CAN recover one, but only on a run that reaches it --
+          #    and a later push with no releasable commits stands down before it
+          #    gets there, so in practice the tag sits until a human notices.
+          #
+          # 4xx is deliberately NOT retried: a bad token or a malformed body does
+          # not improve by being sent again, and retrying only turns a clear
+          # failure into a slow one.
+          REL_ID=""
+          for attempt in 1 2 3 4 5; do
+            HTTP="$(curl -s -o /tmp/rel.json -w '%{http_code}' -X POST "${API}/releases" \
+              -H "Authorization: token ${CI_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "${PAYLOAD}" || echo 000)"
+
+            if [ "$HTTP" = "201" ] || [ "$HTTP" = "200" ]; then
+              REL_ID="$(jq -r '.id' /tmp/rel.json)"
+              break
+            fi
+
+            echo "::warning::POST /releases attempt ${attempt} returned HTTP ${HTTP}"
+            echo "--- response body ---"
+            cat /tmp/rel.json || true
+            echo
+            echo "---------------------"
+
+            case "$HTTP" in
+              4*) echo "::error::HTTP ${HTTP} is a client error - not retrying."; exit 1 ;;
+            esac
+
+            if [ "$attempt" = 5 ]; then
+              echo "::error::POST /releases still failing after 5 attempts. Tag ${TAG} is pushed but has no release."
+              echo "::error::Re-run this workflow - the plan step detects the orphan tag and republishes it."
+              exit 1
+            fi
+            sleep $(( attempt * 5 ))
+          done
+
+          if [ -z "$REL_ID" ] || [ "$REL_ID" = "null" ]; then
+            echo "::error::Release created but no id came back; refusing to upload assets blind."
+            exit 1
+          fi
           echo "Created release ${TAG} (id=${REL_ID})"
 
           for f in "${BIN}-linux-x86_64" "${BIN}-linux-aarch64" "${BIN}-windows-x86_64.exe" SHA256SUMS; do
-            curl -sSf -X POST "${API}/releases/${REL_ID}/assets?name=${f}" \
+            # Same treatment. An upload that fails quietly leaves a release whose
+            # SHA256SUMS does not cover every binary it advertises, which is worse
+            # than no release at all -- that file IS the trust anchor.
+            HTTP="$(curl -s -o /tmp/asset.json -w '%{http_code}' -X POST "${API}/releases/${REL_ID}/assets?name=${f}" \
               -H "Authorization: token ${CI_TOKEN}" \
-              -F "attachment=@dist/${f}" >/dev/null
+              -F "attachment=@dist/${f}" || echo 000)"
+            if [ "$HTTP" != "201" ] && [ "$HTTP" != "200" ]; then
+              echo "::error::uploading ${f} returned HTTP ${HTTP}"
+              cat /tmp/asset.json || true
+              exit 1
+            fi
             echo "  uploaded ${f}"
           done

src/doctor.rs

@@ -158,6 +158,10 @@ pub fn run(cli: &Cli) -> Result<i32> {
     // ── The bundle ───────────────────────────────────────────────────────────
     rows.push(bundle_row(&record));
 
+    // ── The host ─────────────────────────────────────────────────────────────
+    // Linux only, and absent entirely elsewhere (see `imaging_row`).
+    rows.extend(imaging_row());
+
     // ── Backups ──────────────────────────────────────────────────────────────
     rows.push(backup_row(&layout));
 
@@ -755,6 +759,71 @@ fn bundle_row(record: &InstallRecord) -> Row {
     Row::warn("Bundle", detail).note("run `update` to move both halves to one checked combination")
 }
 
+/// `libgdiplus` on a Linux shard host — the one host prerequisite the Asset Bridge added
+/// (docs/link/v8.md §4.4, docs/link/SHARD_PREREQS.md).
+///
+/// ServUO targets `net48`, so on Linux it runs under Mono, and Mono's `System.Drawing` is a thin
+/// layer over this library — which sits in the **decode** path, not merely the encode: without it
+/// the shard cannot read a single sprite out of the operator's UO client. Windows hosts ship
+/// `System.Drawing` with .NET Framework and need nothing, which is why this row exists only on
+/// Linux rather than reporting "not applicable" on three quarters of the hosts that run it.
+///
+/// **A `⚠`, never a `✗`.** Everything else on this plane works without it: the cliloc table and
+/// the shard's own spawn files have no pixels in them, and a bridge that serves names and an atlas
+/// but no artwork is a working bridge with one feature missing. It is also not the last word — the
+/// shard reports `NO_IMAGING` on the asset plane itself, from inside the process that would do the
+/// decoding. This row exists to move that discovery from "the bestiary is empty, weeks later" to
+/// "the host is missing a package, now".
+#[cfg(target_os = "linux")]
+fn imaging_row() -> Option<Row> {
+    Some(imaging_verdict(imaging_present()))
+}
+
+/// Is the library on this host? Two answers, in the order that is most likely to be right.
+#[cfg(target_os = "linux")]
+fn imaging_present() -> bool {
+    // `ldconfig -p` is the loader's own cache, which is the same question Mono asks at runtime —
+    // strictly better than probing paths, because a distro that puts the file somewhere unusual has
+    // told the loader about it and would otherwise read here as missing.
+    let cached = crate::util::run("ldconfig", &["-p"])
+        .ok()
+        .map(|o| String::from_utf8_lossy(&o.stdout).contains("libgdiplus.so"))
+        .unwrap_or(false);
+
+    // The fallback is for a host with no `ldconfig` on PATH (a slim container, mostly), where a
+    // present library would otherwise be reported absent.
+    cached
+        || [
+            "/usr/lib/libgdiplus.so",
+            "/usr/lib64/libgdiplus.so",
+            "/usr/lib/x86_64-linux-gnu/libgdiplus.so",
+            "/usr/lib/aarch64-linux-gnu/libgdiplus.so",
+            "/usr/local/lib/libgdiplus.so",
+        ]
+        .iter()
+        .any(|p| Path::new(p).exists())
+}
+
+/// The operator-visible half, split out so the wording and the mark are testable on a host that
+/// has the library and on one that does not — which the detection itself is not.
+#[cfg(target_os = "linux")]
+fn imaging_verdict(found: bool) -> Row {
+    if found {
+        return Row::ok("Imaging (libgdiplus)", "present");
+    }
+    Row::warn("Imaging (libgdiplus)", "not found on this host")
+        .note("this shard cannot decode artwork out of its UO client — creature portraits and")
+        .note("item pictures will be absent; names and the spawn atlas are unaffected")
+        .note("install it: apt-get install libgdiplus  /  dnf install libgdiplus")
+        .note("see docs/link/SHARD_PREREQS.md — Windows hosts need nothing")
+}
+
+/// Windows and macOS hosts do not need it, so there is no row to print.
+#[cfg(not(target_os = "linux"))]
+fn imaging_row() -> Option<Row> {
+    None
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -913,4 +982,39 @@ mod tests {
         assert_eq!(row.mark, Mark::Ok);
         assert!(row.detail.contains("operator-owned"), "{}", row.detail);
     }
+
+    // ── The host row (Linux only; see `imaging_row`) ─────────────────────────
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn a_missing_libgdiplus_warns_and_names_the_package() {
+        let row = imaging_verdict(false);
+        // A ⚠, never a ✗: the cliloc table and the spawn atlas have no pixels in them, so a host
+        // without this library still runs a useful bridge. `doctor`'s exit code must not turn red
+        // over one absent feature.
+        assert_eq!(row.mark, Mark::Warn);
+        let notes = row.notes.join(" ");
+        assert!(notes.contains("apt-get install libgdiplus"), "{notes}");
+        assert!(notes.contains("SHARD_PREREQS.md"), "{notes}");
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn a_present_libgdiplus_is_one_quiet_ok_line() {
+        let row = imaging_verdict(true);
+        assert_eq!(row.mark, Mark::Ok);
+        assert!(
+            row.notes.is_empty(),
+            "a satisfied prerequisite needs no advice"
+        );
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn detection_answers_rather_than_panicking_on_a_host_with_no_ldconfig() {
+        // The value depends on the host and is not asserted — what is asserted is that a missing
+        // `ldconfig` degrades to the path probe instead of taking `doctor` down, which is the rule
+        // every row in this module follows.
+        let _ = imaging_present();
+    }
 }