🐛 fix(storage): keep current decisions outside audit eviction

[gaborbernat]

prune_history dropped the oldest audit row and, when that row was still current for its subject, deleted the subject index along with it. An evaluation stored its result in one place, the bounded audit log, and pointed the subject index at that row's identifier. Audit rows carry a single global serial, so every repository's evaluations interleave in one log. Traffic in one repository could evict another repository's live decision, after which current_policy_decision returned None for a subject that nothing had re-evaluated and no policy had changed.

Current decisions now hold their own copy of the record in policy_decision_current_id, keyed by evaluation serial, outside the audit bound. Pruning removes an audit row and nothing else. Keying the current table by serial rather than by subject keeps the newest-first ordering that the per-artifact lookup walks, and lets that lookup read the record from the current table instead of joining back into history, which drops one of the two expect calls on that join.

flowchart LR
    Eval[Evaluation] --> Audit[Audit log<br/>bounded, global serial]
    Eval --> Current[Current decisions<br/>full record, unbounded]
    Audit --> Prune[Evict oldest row]
    Prune -. no longer reaches .-> Current
    classDef accent fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
    classDef warn fill:#ffe3a3,stroke:#d29200,color:#3a2c00;
    class Eval,Audit,Current accent;
    class Prune warn;

Loading

Two record sets change shape. policy_decision_current_id holds a decision record where it held a subject, so the PyPI metadata migration rewrites it with the legacy-record conversion it already applies to the audit log. policy_decision_current keeps its subject key and identifier value. A preserved decision still compares against its repository's input generation, so surviving eviction does not mean surviving a policy or catalog change.

Closes #1388

[read-the-docs-community]

Documentation build overview

📚 peryx | 🛠️ Build #34317780 | 📁 Comparing 618f5e6 against latest (5f765fe)

  🔍 Preview build  

No files changed.

[codspeed-hq]

Merging this PR will not alter performance

✅ 29 untouched benchmarks
⏩ 133 skipped benchmarks¹

---

_{Comparing fix/current-decisions-outside-eviction-1388 (618f5e6) with main (51c3b19)}

Footnotes

1. 133 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩