fix(auth): recover interrupted projection retention

tools/tht/internal/authprojection/projection_linux_test.go

@@ -555,6 +555,52 @@ func TestRetentionKeepsCurrentAndTwoPredecessors(t *testing.T) {
 	}
 }
 
+func TestBeginCompletesSafeRetentionAfterReadyPublicationInterruptedBeforeCleanup(t *testing.T) {
+	spec := testSpec(t)
+	var snapshots []Snapshot
+	for index := 0; index < 3; index++ {
+		snapshot := testSnapshot(t, fmt.Sprintf("interrupted-%d", index))
+		commitSnapshot(t, spec, snapshot)
+		snapshots = append(snapshots, snapshot)
+	}
+	fourth := testSnapshot(t, "interrupted-3")
+	transaction, err := Begin(spec, nil, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	restore := setTestHooksForTest(testHooks{beforeRetention: func() error { return errors.New("sentinel") }})
+	if _, err := transaction.Commit(fourth); !errors.Is(err, ErrIntegrity) || strings.Contains(fmt.Sprint(err), "sentinel") {
+		t.Fatalf("interrupted Commit error = %v", err)
+	}
+	restore()
+	if err := transaction.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Inspect(spec); !errors.Is(err, ErrIntegrity) {
+		t.Fatalf("Inspect after interrupted retention error = %v", err)
+	}
+
+	fifth := testSnapshot(t, "interrupted-4")
+	recovery, err := Begin(spec, &fourth, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer recovery.Close()
+	status, err := recovery.Commit(fifth)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if status.Snapshot.Generation != fifth.Generation {
+		t.Fatalf("generation = %s", status.Snapshot.Generation)
+	}
+	if _, err := Inspect(spec); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Lstat(filepath.Join(spec.RuntimeRoot, "generations", snapshots[0].Generation)); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("surplus generation remains: %v", err)
+	}
+}
+
 func TestConcurrentTransactionsNeverPublishMixedGeneration(t *testing.T) {
 	spec := testSpec(t)
 	first := testSnapshot(t, "one")