fix: tiered CopyObject converges under its pre-forward version; converge retries once

[ovaistariq]

Fixes the three findings the bots raised on release PR #227:

• CopyObject out-deleted racing PUTs in tiered mode (greptile P1): it was the last mode-blind mutating handler still using the unconditional convergeInvalidation. A small PUT acked while the copy was in flight — the local tier's only copy — lost its metadata behind the copy's 200 and read as an authoritative 404. It now claims the key (cancelling/excluding re-tiers) and captures a pre-forward token, converging via convergeTieredDelete — the same rule the forwarded DELETE paths use. Regression test fails against the old code, passes with the fix.
• Tiered converge didn't retry transient errors (greptile P1): a converge that never lands leaves deleted metadata authoritative until TTL (a marker makes HEAD report the deleted object present). It now retries once, keeping the version guard — the discipline convergeInvalidation already applied.
• Unreachable src.err branch in the engine PUT error path (cursor, low): removed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L5DLvDTo9dhD38YQXhHpU9

---

Note

Medium Risk
Changes tiered cache/metadata convergence for CopyObject and DELETE converge retries—incorrect version guards could cause stale metadata or data loss in race scenarios, but behavior is aligned with existing DELETE paths and heavily tested.

Overview
Tiered CopyObject now matches forwarded DELETE convergence: it claims the destination key (cancelling re-tiers), records the pre-forward metadata version, and after a successful upstream copy calls convergeTieredDelete instead of unconditional cache invalidation and warming. That stops a racing small PUT on the destination from being wiped when its local-tier copy is the only copy.

convergeTieredDelete retries DeleteMetaIfVersion once on failure, still using the same version token (aligned with convergeInvalidation).

localstore PutObject error handling drops a duplicate unreachable src.err branch.

Regression tests cover copy-vs-racing-PUT and single-retry converge behavior.

^{Reviewed by Cursor Bugbot for commit 30d5b8f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the previously requested retry coverage is now present and no new actionable issue was identified.

Summary

This PR makes tiered CopyObject converge destination metadata under its pre-forward version and retries transient tiered convergence failures once.

• Claims the destination during tiered copies and uses version-guarded convergence to preserve racing writes.
• Retries DeleteMetaIfVersion once with the same version token.
• Adds regression coverage for racing PUT preservation, successful retry, stable version guards, and persistent failure.
• Removes an unreachable error branch from the local-store PUT path.

_{Reviews (2) · Last reviewed commit: "test: tiered converge retry — same versi..."}

[ovaistariq]

@greptile review — added the converge-retry regression test (same version across the retry, exactly two attempts on persistent failure).

[tigrisdata-argocd-bot]

🎉 This PR is included in version 1.22.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀