fix(store): give each db its own blob dir so GC cannot delete a neighbour's content

[getappz]

Closes agentflare item #385 (follow-up from #339 / PR #348).

The bug

~/.agentflare/store.db and ~/.agentflare/flare-docs.db live in the same directory, and blob_disk_path derived the blob directory from the db file's parent — so both resolved to the same ~/.agentflare/blobs/ while keeping separate store_blobs ref-count tables. Neither store can see the other's references.

Two conditions cause content loss:

1. the same bytes stored in both (content-addressed by blake3, so identical bytes collide by design), and
2. one store's ref_count hitting zero while the other's does not.

Condition 2 is what PR #348 changed: blob deletion used to happen only on explicit deletes, but Store::gc now runs on every flare-docs fetch and reclaims blobs routinely. Failure is silent — the row in the other store survives and blob_get returns None, no error anywhere.

The fix

Deliberately not the "one-line namespace the blobs dir" fix noted on #339 — rows store hashes, not paths, so changing the derivation alone orphans every blob already on disk.

• write to <root>/blobs-<db file stem>/<xx>/<hash>
• read the namespaced path first, fall back to the legacy shared <root>/blobs/
• delete only ever unlinks from the namespaced directory

Worst case this leaks a legacy file nothing references any more; it can never remove content another store still depends on. No flag day, no migration that can half-complete. open_memory still uses store_blob_chunks and is unaffected.

Tests

Three added in blobs.rs:

• two stores in one directory holding the same bytes, one reclaims → the other still reads back. Verified this fails on the old derivation (assertion left == right failed: the neighbouring store still references these bytes) and passes with the fix.
• a blob seeded in the legacy shared dir still reads back.
• blob_unref never unlinks from the legacy shared dir.

Verification

cargo fmt --all --check, cargo clippy -p agentflare-store -p flare-docs --all-targets --all-features -- -D warnings, and cargo test --workspace all clean.

Workspace-wide clippy also reports 9 pre-existing items_after_statements errors in agentflare-agent-registry; confirmed present on master with these changes stashed, so unrelated to this PR.

Not included

A one-off sweep to reclaim legacy blobs that neither store's store_blobs table references any more. Worth a follow-up item if the leak turns out to matter.

Summary by CodeRabbit

• Bug Fixes

  • Blob files are now isolated per store, preventing one store from deleting blobs still needed by another.
  • Existing blobs in the legacy shared storage location remain readable.
  • Legacy shared blobs are protected from unintended cleanup.

• Tests

  • Added coverage for shared-directory stores, blob reclamation, and legacy blob compatibility.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 435032b7-eb2d-4a43-bb21-241b08611074

📥 Commits

Reviewing files that changed from the base of the PR and between f5b2275 and cee18ee.

📒 Files selected for processing (3)

• crates/agentflare-store/src/blobs.rs
• crates/agentflare-store/src/lib.rs
• crates/flare-docs/src/store.rs

---

📝 Walkthrough

Walkthrough

Blob disk storage is now namespaced per store, with legacy shared-directory fallback reads. Reclamation only removes files from the owning store directory, and tests cover gzip storage, cross-store references, legacy blobs, and updated path expectations.

Changes

Blob storage isolation

Layer / File(s)	Summary
Store blob directory initialization crates/agentflare-store/src/lib.rs	Store tracks a per-database blob_dir; memory stores initialize it with :memory:.
Namespaced blob IO and reclamation crates/agentflare-store/src/blobs.rs	Blob writes and reads use the namespaced directory, reads fall back to <root>/blobs, and reclamation deletes only from the store-specific directory.
Blob path and compatibility validation crates/agentflare-store/src/blobs.rs, crates/flare-docs/src/store.rs	Tests and reconciliation expectations use namespaced paths and cover gzip storage, cross-store reclamation, and legacy shared-directory blobs.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• getappz/agentflare#244: Earlier blob persistence and garbage-collection implementation in blobs.rs.
• getappz/agentflare#337: Adds the reconciliation flow whose blob-directory expectations are updated here.
• getappz/agentflare#343: Adds document-delete refcount behavior that triggers the reclamation paths changed here.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: per-database blob directories to prevent GC from deleting another store’s blobs.
Description check	✅ Passed	The description covers the bug, fix, tests, verification, and reviewer notes, though it does not follow the exact template headings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/385-blob-namespace

---

_{Comment @coderabbitai help to get the list of available commands.}