fix: make digest delete retryable after partial tag unlink failure

DeleteManifestByDigest deleted the _digests copy first and then
unlinked matching tags. If tag unlinking failed partway, the digest
file was already gone — a retry hit the Exists/ErrNotFound early-exit
and never touched the surviving tag-addressed manifests. The claim that
catalog sync would reap those survivors was wrong: ManifestJSON reads
the tag file from object store directly, sync removes DB rows not
object store files, so any remaining tag file stayed fully reachable.

Unlink tags first, delete the digest copy last. unlinkTagsByDigest is
idempotent (object-store Delete swallows not-found, catalog
removeCatalogEntry is a no-op on missing entries), so a retry
re-enters, re-enumerates surviving tags, and resumes cleanup from
wherever the previous attempt failed.

Author: CMGS

registry/registry.go

@@ -137,6 +137,12 @@ func (r *Registry) DeleteManifest(ctx context.Context, name, tag string) error {
 // Returns ErrNotFound when the digest copy does not exist, so callers can
 // surface the canonical 404 instead of a silent 202 after the object store
 // swallows the missing-object error on Delete.
+//
+// Unlinking runs BEFORE the digest copy is removed so the operation stays
+// retryable: a partial failure leaves the digest file in place, and a retry
+// re-enters this function, re-lists surviving tags, and resumes cleanup.
+// unlinkTagsByDigest is itself idempotent — object-store Delete swallows
+// not-found and removeCatalogEntry is a no-op on missing entries.
 func (r *Registry) DeleteManifestByDigest(ctx context.Context, name, digest string) error {
 	key := manifestDigestKey(name, digest)
 	exists, err := r.client.Exists(ctx, key)
@@ -146,16 +152,12 @@ func (r *Registry) DeleteManifestByDigest(ctx context.Context, name, digest stri
 	if !exists {
 		return fmt.Errorf("manifest %s@%s: %w", name, digest, objectstore.ErrNotFound)
 	}
-	if err := r.client.Delete(ctx, key); err != nil {
-		return fmt.Errorf("delete manifest %s@%s: %w", name, digest, err)
-	}
-	// Tag unlinking runs after the digest copy is gone. If it fails partway,
-	// the digest-delete itself already succeeded; any remaining tag rows will
-	// be reaped by the next catalog sync or a later tag-targeted delete. We
-	// don't roll the digest copy back into the store on partial failure.
 	if err := r.unlinkTagsByDigest(ctx, name, digest); err != nil {
 		return fmt.Errorf("unlink tags for %s@%s: %w", name, digest, err)
 	}
+	if err := r.client.Delete(ctx, key); err != nil {
+		return fmt.Errorf("delete manifest %s@%s: %w", name, digest, err)
+	}
 	return nil
 }