fix(uninstall): purge 前预检 felis 角色在其他库的依赖，DROP ROLE 不再半途失败

deploy/uninstall.sh

@@ -340,6 +340,39 @@ remove_hba_block() { # file
   rm -f "$tmp"
 }
 
+# check_database_purge runs before anything is removed: DROP ROLE refuses a role that
+# still owns a database or holds anything in one besides felis (a felis_pgint left by
+# `felis db pgint`, a grant made by hand), and by then the units and k3s are already gone.
+# It lists what holds the role instead, so the purge either runs to the end or not at all.
+check_database_purge() {
+  [ "$PURGE" = 1 ] || return 0
+  systemctl is-active --quiet postgresql 2>/dev/null || return 0
+  local sql held err
+  read -r -d '' sql <<SQL || true
+WITH r AS (SELECT oid FROM pg_roles WHERE rolname = '${DB_USER}'),
+     f AS (SELECT oid FROM pg_database WHERE datname = '${DB_NAME}')
+SELECT DISTINCT CASE
+    WHEN s.classid = 'pg_database'::regclass THEN 'database ' || (SELECT datname FROM pg_database WHERE oid = s.objid)
+    WHEN s.classid = 'pg_tablespace'::regclass THEN 'tablespace ' || (SELECT spcname FROM pg_tablespace WHERE oid = s.objid)
+    ELSE 'objects in database ' || (SELECT datname FROM pg_database WHERE oid = s.dbid)
+  END || CASE s.deptype WHEN 'o' THEN ' (owned)' ELSE ' (privileges)' END
+FROM pg_shdepend s
+WHERE s.refclassid = 'pg_authid'::regclass AND s.refobjid = (SELECT oid FROM r)
+  AND s.dbid IS DISTINCT FROM (SELECT oid FROM f)
+  AND NOT (s.classid = 'pg_database'::regclass AND s.objid IS NOT DISTINCT FROM (SELECT oid FROM f))
+ORDER BY 1;
+SQL
+  err="$(mktemp)"
+  if ! held="$(as_postgres psql -v ON_ERROR_STOP=1 -tAq 2>"$err" <<<"$sql")"; then
+    held="$(cat "$err")"
+    rm -f "$err"
+    die "could not ask PostgreSQL what the ${DB_USER} role still holds, so nothing was removed: ${held}"
+  fi
+  rm -f "$err"
+  [ -n "$held" ] || return 0
+  die "the ${DB_USER} role still holds $(printf '%s' "$held" | paste -sd ';' - | sed 's/;/; /g'), so DROP ROLE would fail halfway through the purge; nothing was removed. Hand them to postgres first (sudo -u postgres psql -c 'ALTER DATABASE <name> OWNER TO postgres', or REASSIGN OWNED BY ${DB_USER} TO postgres; DROP OWNED BY ${DB_USER}; inside that database), or rerun without --purge"
+}
+
 purge_database() {
   [ "$PURGE" = 1 ] || return 0
   if ! systemctl is-active --quiet postgresql 2>/dev/null; then
@@ -395,6 +428,7 @@ main() {
   [ -e "$STATE_DIR" ] || [ -e "$HOST_BIN" ] || [ -e "$OPT_DIR" ] \
     || die "no Felis install here (${STATE_DIR}, ${HOST_BIN} and ${OPT_DIR} are all absent)"
   decide_k3s
+  check_database_purge
   print_plan
   confirm
   final_backup

deploy/uninstall_test.sh

@@ -89,7 +89,17 @@ run_uninstall() {
       shift 3
       case "$*" in
         *"SHOW hba_file"*) echo "$ROOT/h/hba.conf" ;;
-        *) echo "PSQL $* $(cat)" >> "$calls" ;;
+        *)
+          sql="$(cat)"
+          case "$sql" in
+            # What the felis role still holds: PG_HELD, one line each; PG_CHECK=fail for a
+            # server that refuses the query.
+            *pg_shdepend*)
+              echo "PSQL-CHECK" >> "$calls"
+              [ "${PG_CHECK:-}" = fail ] && { echo "psql: error: connection refused" >&2; return 2; }
+              [ -z "${PG_HELD:-}" ] || printf "%s\n" "$PG_HELD" ;;
+            *) echo "PSQL $* $sql" >> "$calls" ;;
+          esac ;;
       esac
     }
     docker() { echo "DOCKER $*" >> "$calls"; }
@@ -161,6 +171,7 @@ fresh_host
 out="$(run_uninstall "default felis minecraft" --purge --yes)"
 calls="$(cat "$root/calls")"
 refute "purge takes no bundle" "db backup" "$calls"
+expect "purge asks what the role holds first" "PSQL-CHECK" "$calls"
 expect "purge drops the database" "DROP DATABASE IF EXISTS felis;" "$calls"
 expect "purge drops the role" "DROP ROLE IF EXISTS felis;" "$calls"
 expect "purge puts listen_addresses back" "ALTER SYSTEM RESET listen_addresses;" "$calls"
@@ -179,6 +190,35 @@ case "$hba" in
 esac
 expect "purge cleans Docker's build cache" "DOCKER builder prune -af" "$calls"
 
+# --- a purge DROP ROLE would refuse -------------------------------------------------------
+# The VM drill: `felis db pgint` had left felis_pgint owned by felis, the purge removed the
+# units and k3s, then stopped at DROP ROLE with half the host gone.
+untouched() { # label
+  [ -d "$root/h/opt" ] && [ -f "$root/h/units/felis-velocity.service" ] && [ -d "$root/h/etc" ] \
+    && ! grep -q "k3s-uninstall.sh\|DROP DATABASE\|SYSTEMCTL disable" "$root/calls" \
+    && echo "PASS $1" \
+    || { echo "FAIL $1: $(cat "$root/calls")"; fails=$((fails + 1)); }
+}
+fresh_host
+out="$(PG_HELD="database felis_pgint (owned)
+objects in database shop (privileges)" run_uninstall "default felis minecraft" --purge --yes)"
+expect "a purge the role cannot survive is refused" "the felis role still holds database felis_pgint (owned); objects in database shop (privileges)" "$out"
+expect "with the way to hand the database over" "ALTER DATABASE <name> OWNER TO postgres" "$out"
+untouched "nothing is removed when DROP ROLE would fail"
+fresh_host
+out="$(PG_HELD="database felis_pgint (owned)" CONFIRM_TTY="$root/no-tty/x" run_uninstall "default felis minecraft" --purge)"
+expect "the check comes before the plan and the prompt" "the felis role still holds database felis_pgint" "$out"
+refute "so nobody confirms a purge that cannot finish" "this will remove" "$out"
+fresh_host
+out="$(PG_CHECK=fail run_uninstall "default felis minecraft" --purge --yes)"
+expect "a server that cannot be asked stops the purge" "could not ask PostgreSQL what the felis role still holds, so nothing was removed: psql: error: connection refused" "$out"
+untouched "nothing is removed when the check cannot run"
+fresh_host
+PG_HELD="database felis_pgint (owned)" run_uninstall "default felis minecraft" --yes >/dev/null
+calls="$(cat "$root/calls")"
+refute "keep-data drops no role, so it asks nothing" "PSQL-CHECK" "$calls"
+expect "and goes on" "RUN k3s-uninstall.sh" "$calls"
+
 # --- the pieces read before they are removed ---------------------------------------------
 fresh_host
 lib() { STATE_DIR="$root/h/etc" OPT_DIR="$root/h/opt" UNIT_DIR="$root/h/units" FELIS_UNINSTALL_SOURCED=1 \

docs/operations.md

@@ -189,7 +189,7 @@ the cluster holds nothing but Felis's namespaces; when it runs anything else onl
 | | keep data (default) | `--purge` |
 |---|---|---|
 | Final database bundle | taken first (`felis db backup -label manual`); a failure stops the uninstall before anything is removed. `--no-backup` skips it | none |
-| `felis` database and role | kept | dropped; `listen_addresses` and `pg_hba.conf` go back to how they were |
+| `felis` database and role | kept | dropped; `listen_addresses` and `pg_hba.conf` go back to how they were. Checked before anything is removed: a role that still owns another database (a `felis_pgint` left by `felis db pgint`) or holds grants elsewhere stops the purge up front with the list and the `ALTER DATABASE … OWNER TO postgres` to run |
 | `/etc/felis` (secrets, `felis.toml`, `offsite.env`, tunnel config) | kept; `bootstrap.done` and the per-run records go | deleted, with the tunnel's credentials file |
 | `/var/lib/felis` (database bundles) | kept | deleted |
 | Worlds, archives, registry, uploads | moved to `/var/lib/felis/retained/k3s-storage-<stamp>/` (with `--keep-k3s`: their volumes switch to `Retain` and stay in place) | deleted |