fixes and ui improvements

internal/app/files/botfather_avatar_seed.go

@@ -12,36 +12,36 @@ import (
 //go:embed seedassets/botfather_avatar.jpg
 var botFatherAvatarJPG []byte
 
-// SeedBotFatherAvatar idempotently seeds the built-in BotFather account's
-// profile photo from the bundled avatar, mirroring SeedOfficialSystemAvatar:
-// writes it under the fixed domain.BotFatherUserPhotoID so the photo/blob
-// layer and the pure domain.BotFatherUser() struct literal stay in sync
-// across restarts, and registers it as the account's *current* profile photo
-// so users.getFullUser resolves it too. Returns true if it actually wrote a
-// new photo.
+// SeedBotFatherAvatar seeds the built-in BotFather account's profile photo
+// from the bundled avatar, mirroring SeedOfficialSystemAvatar: writes it
+// under the fixed domain.BotFatherUserPhotoID so the photo/blob layer and
+// the pure domain.BotFatherUser() struct literal stay in sync across
+// restarts, and registers it as the account's *current* profile photo so
+// users.getFullUser resolves it too. Deliberately re-upserts the photo row
+// AND its file_blobs bytes on every boot (not just when the photos row is
+// missing) -- storage retention/manual-purge only ever deletes file_blobs
+// bytes, never the photos row itself, so a "skip if the row exists" check
+// used to leave this bot's avatar permanently blank after any purge that
+// swept the Avatar category, even though the row it checked for was still
+// right there. Returns true if it actually (re)wrote the photo.
 func (s *Service) SeedBotFatherAvatar(ctx context.Context) (bool, error) {
 	photoID := domain.BotFatherUserPhotoID
-	wrote := false
-	if _, found, err := s.media.GetPhoto(ctx, photoID); err != nil {
+	sizes, err := s.putPhotoStaticSizes(ctx, photoID, botFatherAvatarJPG, photoSizeSpecsForAvatar(botFatherAvatarJPG))
+	if err != nil {
 		return false, err
-	} else if !found {
-		sizes, err := s.putPhotoStaticSizes(ctx, photoID, botFatherAvatarJPG, photoSizeSpecsForAvatar(botFatherAvatarJPG))
-		if err != nil {
-			return false, err
-		}
-		photo := domain.Photo{
-			ID:            photoID,
-			AccessHash:    domain.BotFatherUserPhotoAccessHash,
-			FileReference: randomFileReference(),
-			Date:          int(time.Now().Unix()),
-			DCID:          s.dc,
-			Sizes:         sizes,
-		}
-		if err := s.media.PutPhoto(ctx, photo); err != nil {
-			return false, err
-		}
-		wrote = true
 	}
+	newPhoto := domain.Photo{
+		ID:            photoID,
+		AccessHash:    domain.BotFatherUserPhotoAccessHash,
+		FileReference: randomFileReference(),
+		Date:          int(time.Now().Unix()),
+		DCID:          s.dc,
+		Sizes:         sizes,
+	}
+	if err := s.media.PutPhoto(ctx, newPhoto); err != nil {
+		return false, err
+	}
+	wrote := true
 	photo, ok, err := s.SetCurrentProfilePhoto(ctx, domain.PeerTypeUser, domain.BotFatherUserID, photoID, int(time.Now().Unix()))
 	if err != nil {
 		return false, err

internal/app/files/chatbot_avatar_seed.go

@@ -12,36 +12,35 @@ import (
 //go:embed seedassets/chatbot_avatar.png
 var chatBotAvatarPNG []byte
 
-// SeedChatBotAvatar idempotently seeds the built-in @ChatBot account's
-// profile photo from the bundled avatar, mirroring SeedBotFatherAvatar:
-// writes it under the fixed domain.ChatBotUserPhotoID so the photo/blob
-// layer and the pure domain.ChatBotUser() struct literal stay in sync
-// across restarts, and registers it as the account's *current* profile photo
-// so users.getFullUser resolves it too. Returns true if it actually wrote a
-// new photo.
+// SeedChatBotAvatar seeds the built-in @ChatBot account's profile photo from
+// the bundled avatar, mirroring SeedOfficialSystemAvatar: writes it under the
+// fixed domain.ChatBotUserPhotoID so the photo/blob layer and the pure
+// domain.ChatBotUser() struct literal stay in sync across restarts, and
+// registers it as the account's *current* profile photo so
+// users.getFullUser resolves it too. Deliberately re-upserts the photo row
+// AND its file_blobs bytes on every boot (not just when the photos row is
+// missing) -- see SeedBotFatherAvatar's doc comment for why a "skip if the
+// row exists" check is wrong here (storage retention/manual-purge only ever
+// deletes file_blobs bytes, never the photos row). Returns true if it
+// actually (re)wrote the photo.
 func (s *Service) SeedChatBotAvatar(ctx context.Context) (bool, error) {
 	photoID := domain.ChatBotUserPhotoID
-	wrote := false
-	if _, found, err := s.media.GetPhoto(ctx, photoID); err != nil {
+	sizes, err := s.putPhotoStaticSizes(ctx, photoID, chatBotAvatarPNG, photoSizeSpecsForAvatar(chatBotAvatarPNG))
+	if err != nil {
 		return false, err
-	} else if !found {
-		sizes, err := s.putPhotoStaticSizes(ctx, photoID, chatBotAvatarPNG, photoSizeSpecsForAvatar(chatBotAvatarPNG))
-		if err != nil {
-			return false, err
-		}
-		photo := domain.Photo{
-			ID:            photoID,
-			AccessHash:    domain.ChatBotUserPhotoAccessHash,
-			FileReference: randomFileReference(),
-			Date:          int(time.Now().Unix()),
-			DCID:          s.dc,
-			Sizes:         sizes,
-		}
-		if err := s.media.PutPhoto(ctx, photo); err != nil {
-			return false, err
-		}
-		wrote = true
 	}
+	newPhoto := domain.Photo{
+		ID:            photoID,
+		AccessHash:    domain.ChatBotUserPhotoAccessHash,
+		FileReference: randomFileReference(),
+		Date:          int(time.Now().Unix()),
+		DCID:          s.dc,
+		Sizes:         sizes,
+	}
+	if err := s.media.PutPhoto(ctx, newPhoto); err != nil {
+		return false, err
+	}
+	wrote := true
 	photo, ok, err := s.SetCurrentProfilePhoto(ctx, domain.PeerTypeUser, domain.ChatBotUserID, photoID, int(time.Now().Unix()))
 	if err != nil {
 		return false, err

internal/app/files/stickers_bot_avatar_seed.go

@@ -12,36 +12,35 @@ import (
 //go:embed seedassets/stickers_avatar.png
 var stickersBotAvatarPNG []byte
 
-// SeedStickersBotAvatar idempotently seeds the built-in @Stickers account's
-// profile photo from the bundled avatar, mirroring SeedBotFatherAvatar:
-// writes it under the fixed domain.StickersBotUserPhotoID so the photo/blob
-// layer and the pure domain.StickersBotUser() struct literal stay in sync
-// across restarts, and registers it as the account's *current* profile photo
-// so users.getFullUser resolves it too. Returns true if it actually wrote a
-// new photo.
+// SeedStickersBotAvatar seeds the built-in @Stickers account's profile photo
+// from the bundled avatar, mirroring SeedOfficialSystemAvatar: writes it
+// under the fixed domain.StickersBotUserPhotoID so the photo/blob layer and
+// the pure domain.StickersBotUser() struct literal stay in sync across
+// restarts, and registers it as the account's *current* profile photo so
+// users.getFullUser resolves it too. Deliberately re-upserts the photo row
+// AND its file_blobs bytes on every boot (not just when the photos row is
+// missing) -- see SeedBotFatherAvatar's doc comment for why a "skip if the
+// row exists" check is wrong here (storage retention/manual-purge only ever
+// deletes file_blobs bytes, never the photos row). Returns true if it
+// actually (re)wrote the photo.
 func (s *Service) SeedStickersBotAvatar(ctx context.Context) (bool, error) {
 	photoID := domain.StickersBotUserPhotoID
-	wrote := false
-	if _, found, err := s.media.GetPhoto(ctx, photoID); err != nil {
+	sizes, err := s.putPhotoStaticSizes(ctx, photoID, stickersBotAvatarPNG, photoSizeSpecsForAvatar(stickersBotAvatarPNG))
+	if err != nil {
 		return false, err
-	} else if !found {
-		sizes, err := s.putPhotoStaticSizes(ctx, photoID, stickersBotAvatarPNG, photoSizeSpecsForAvatar(stickersBotAvatarPNG))
-		if err != nil {
-			return false, err
-		}
-		photo := domain.Photo{
-			ID:            photoID,
-			AccessHash:    domain.StickersBotUserPhotoAccessHash,
-			FileReference: randomFileReference(),
-			Date:          int(time.Now().Unix()),
-			DCID:          s.dc,
-			Sizes:         sizes,
-		}
-		if err := s.media.PutPhoto(ctx, photo); err != nil {
-			return false, err
-		}
-		wrote = true
 	}
+	newPhoto := domain.Photo{
+		ID:            photoID,
+		AccessHash:    domain.StickersBotUserPhotoAccessHash,
+		FileReference: randomFileReference(),
+		Date:          int(time.Now().Unix()),
+		DCID:          s.dc,
+		Sizes:         sizes,
+	}
+	if err := s.media.PutPhoto(ctx, newPhoto); err != nil {
+		return false, err
+	}
+	wrote := true
 	photo, ok, err := s.SetCurrentProfilePhoto(ctx, domain.PeerTypeUser, domain.StickersBotUserID, photoID, int(time.Now().Unix()))
 	if err != nil {
 		return false, err

internal/app/files/verifybot_avatar_seed.go

@@ -12,36 +12,35 @@ import (
 //go:embed seedassets/verifybot_avatar.png
 var verifyBotAvatarPNG []byte
 
-// SeedVerifyBotAvatar idempotently seeds the built-in @verifybot account's
-// profile photo from the bundled avatar, mirroring SeedChatBotAvatar: writes
-// it under the fixed domain.VerifyBotUserPhotoID so the photo/blob layer and
+// SeedVerifyBotAvatar seeds the built-in @verifybot account's profile photo
+// from the bundled avatar, mirroring SeedOfficialSystemAvatar: writes it
+// under the fixed domain.VerifyBotUserPhotoID so the photo/blob layer and
 // the pure domain.VerifyBotUser() struct literal stay in sync across
 // restarts, and registers it as the account's *current* profile photo so
-// users.getFullUser resolves it too. Returns true if it actually wrote a new
-// photo.
+// users.getFullUser resolves it too. Deliberately re-upserts the photo row
+// AND its file_blobs bytes on every boot (not just when the photos row is
+// missing) -- see SeedBotFatherAvatar's doc comment for why a "skip if the
+// row exists" check is wrong here (storage retention/manual-purge only ever
+// deletes file_blobs bytes, never the photos row). Returns true if it
+// actually (re)wrote the photo.
 func (s *Service) SeedVerifyBotAvatar(ctx context.Context) (bool, error) {
 	photoID := domain.VerifyBotUserPhotoID
-	wrote := false
-	if _, found, err := s.media.GetPhoto(ctx, photoID); err != nil {
+	sizes, err := s.putPhotoStaticSizes(ctx, photoID, verifyBotAvatarPNG, photoSizeSpecsForAvatar(verifyBotAvatarPNG))
+	if err != nil {
 		return false, err
-	} else if !found {
-		sizes, err := s.putPhotoStaticSizes(ctx, photoID, verifyBotAvatarPNG, photoSizeSpecsForAvatar(verifyBotAvatarPNG))
-		if err != nil {
-			return false, err
-		}
-		photo := domain.Photo{
-			ID:            photoID,
-			AccessHash:    domain.VerifyBotUserPhotoAccessHash,
-			FileReference: randomFileReference(),
-			Date:          int(time.Now().Unix()),
-			DCID:          s.dc,
-			Sizes:         sizes,
-		}
-		if err := s.media.PutPhoto(ctx, photo); err != nil {
-			return false, err
-		}
-		wrote = true
 	}
+	newPhoto := domain.Photo{
+		ID:            photoID,
+		AccessHash:    domain.VerifyBotUserPhotoAccessHash,
+		FileReference: randomFileReference(),
+		Date:          int(time.Now().Unix()),
+		DCID:          s.dc,
+		Sizes:         sizes,
+	}
+	if err := s.media.PutPhoto(ctx, newPhoto); err != nil {
+		return false, err
+	}
+	wrote := true
 	photo, ok, err := s.SetCurrentProfilePhoto(ctx, domain.PeerTypeUser, domain.VerifyBotUserID, photoID, int(time.Now().Unix()))
 	if err != nil {
 		return false, err

internal/store/postgres/media_refs.go

@@ -349,6 +349,21 @@ func (s *MediaStore) DeleteFileBlobsForDocument(ctx context.Context, id int64) (
 				return fmt.Errorf("delete file blob row: %w", err)
 			}
 		}
+		// gif_catalog and user_sticker_collections entries are pure picker
+		// metadata -- unlike a chat message (which keeps rendering "media
+		// unavailable" off the documents row after its bytes are gone), a
+		// picker entry has no placeholder concept: once the underlying gif's
+		// bytes are purged it's just a dead thumbnail nobody can open, so it
+		// gets removed here too, in the same transaction as the actual blob
+		// purge, instead of drifting out of sync until some separate sweep
+		// happens to notice. No-op (0 rows) for the overwhelming majority of
+		// documents, which are never in either table.
+		if _, err := tx.Exec(ctx, `DELETE FROM gif_catalog WHERE document_id = $1`, id); err != nil {
+			return fmt.Errorf("delete gif catalog entry for purged document: %w", err)
+		}
+		if _, err := tx.Exec(ctx, `DELETE FROM user_sticker_collections WHERE document_id = $1`, id); err != nil {
+			return fmt.Errorf("delete sticker collection entries for purged document: %w", err)
+		}
 		return nil
 	})
 	if err != nil {