feat(submit): 模组上传改为分片续传并显示进度，经 Cloudflare 边缘也能传满 1GiB

internal/submit/blobstore.go

@@ -58,16 +58,21 @@ const DefaultUploadsMinFree = 0.10
 // CheckRoom refuses an upload of up to need bytes that could push Base's
 // filesystem below its free floor.
 func (s *LocalContextStore) CheckRoom(need int64) error {
+	return checkRoom(s.Base, need, s.MinFree)
+}
+
+// checkRoom refuses need more bytes under dir when they could push its filesystem
+// below the minFree share (DefaultUploadsMinFree when 0), wrapping ErrUploadsFull.
+func checkRoom(dir string, need int64, minFree float64) error {
 	var st syscall.Statfs_t
-	if err := syscall.Statfs(s.Base, &st); err != nil {
-		return fmt.Errorf("submit: measure the uploads store %s: %w", s.Base, err)
+	if err := syscall.Statfs(dir, &st); err != nil {
+		return fmt.Errorf("submit: measure the uploads store %s: %w", dir, err)
 	}
 	bsize := uint64(st.Bsize) // uint32 on darwin
 	total, avail := uint64(st.Blocks)*bsize, uint64(st.Bavail)*bsize
 	if total == 0 {
 		return nil
 	}
-	minFree := s.MinFree
 	if minFree <= 0 {
 		minFree = DefaultUploadsMinFree
 	}

internal/submit/parts.go

@@ -0,0 +1,238 @@
+package submit
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+// DefaultPartMaxBytes caps one part of a chunked upload. A single request body is
+// bounded by whatever proxy fronts the API — the Cloudflare edge refuses bodies
+// over 100 MB on the Free and Pro plans — so a large modpack arrives as a run of
+// parts. 32 MiB stays well under that limit and keeps a retried part cheap.
+const DefaultPartMaxBytes = 32 << 20
+
+// StalePartRetention is how long a staged upload may sit untouched before the
+// reaper deletes it: long enough to resume after a lost connection or a laptop
+// lid, short enough that abandoned parts do not hold the uploads volume.
+const StalePartRetention = 24 * time.Hour
+
+// partSuffix names a staged upload on disk: {Dir}/{id}.part.
+const partSuffix = ".part"
+
+// ErrUploadBusy reports that another request is writing (or completing) the same
+// staged upload. Parts go in order, one at a time; the API answers 409 and the
+// client asks where the upload stands before it sends again.
+var ErrUploadBusy = errors.New("submit: another request is writing this upload")
+
+// ErrPartTooLarge reports a part longer than the part cap. The API answers 413.
+var ErrPartTooLarge = errors.New("submit: an upload part exceeds the part size limit")
+
+// OffsetMismatchError reports a part that does not start where the staged upload
+// ends. Received is where it does end, so the client resumes from there.
+type OffsetMismatchError struct {
+	Received int64
+}
+
+func (e *OffsetMismatchError) Error() string {
+	return fmt.Sprintf("submit: the upload holds %d bytes; send the part that starts there", e.Received)
+}
+
+// PartStore stages a chunked upload until Manager.CompleteUpload hands the
+// assembled bytes to Blobs. Parts are appended in order to {Dir}/{id}.part, and
+// the file's length is the resume point: a client that lost its connection asks
+// for it and carries on from there. The store serializes the requests for one id
+// in process, which is enough for the single felis-api replica (its Deployment is
+// Recreate, never two pods at once).
+type PartStore struct {
+	// Dir holds the staged uploads. cmd/felis puts it on the uploads volume, so a
+	// staged upload survives an API restart and the room check sees the same disk.
+	Dir string
+	// MinFree is the share of Dir's filesystem a part must leave free; 0 uses
+	// DefaultUploadsMinFree.
+	MinFree float64
+
+	mu   sync.Mutex
+	busy map[string]bool
+}
+
+// hold claims id for one request; the returned func releases it. A second claim
+// while the first is held fails with ErrUploadBusy.
+func (s *PartStore) hold(id string) (func(), error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.busy[id] {
+		return nil, ErrUploadBusy
+	}
+	if s.busy == nil {
+		s.busy = map[string]bool{}
+	}
+	s.busy[id] = true
+	return func() {
+		s.mu.Lock()
+		delete(s.busy, id)
+		s.mu.Unlock()
+	}, nil
+}
+
+func (s *PartStore) path(id string) (string, error) {
+	if !idRE.MatchString(id) {
+		return "", fmt.Errorf("submit: invalid submission id %q", id)
+	}
+	return filepath.Join(s.Dir, id+partSuffix), nil
+}
+
+// CheckRoom refuses a part of up to need bytes that could push Dir's filesystem
+// below its free floor.
+func (s *PartStore) CheckRoom(need int64) error {
+	if err := os.MkdirAll(s.Dir, 0o750); err != nil {
+		return fmt.Errorf("submit: mkdir upload parts dir: %w", err)
+	}
+	return checkRoom(s.Dir, need, s.MinFree)
+}
+
+// Size reports how many bytes are staged for id; nothing staged is (0, false, nil).
+func (s *PartStore) Size(id string) (int64, bool, error) {
+	p, err := s.path(id)
+	if err != nil {
+		return 0, false, err
+	}
+	fi, err := os.Stat(p)
+	switch {
+	case err == nil:
+		return fi.Size(), true, nil
+	case os.IsNotExist(err):
+		return 0, false, nil
+	default:
+		return 0, false, fmt.Errorf("submit: stat staged upload: %w", err)
+	}
+}
+
+// Append writes r to id's staged upload at offset and returns the new length.
+// Offset 0 starts the upload over; any other offset must equal the staged length,
+// or the call fails with *OffsetMismatchError naming it. A part that fails to
+// arrive whole is cut back off, so the staged bytes are always a prefix of what
+// the client sent.
+func (s *PartStore) Append(id string, offset int64, r io.Reader) (int64, error) {
+	p, err := s.path(id)
+	if err != nil {
+		return 0, err
+	}
+	release, err := s.hold(id)
+	if err != nil {
+		return 0, err
+	}
+	defer release()
+	if err := os.MkdirAll(s.Dir, 0o750); err != nil {
+		return 0, fmt.Errorf("submit: mkdir upload parts dir: %w", err)
+	}
+	var f *os.File
+	if offset == 0 {
+		f, err = os.OpenFile(p, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o640)
+	} else {
+		f, err = os.OpenFile(p, os.O_WRONLY, 0)
+		if os.IsNotExist(err) {
+			return 0, &OffsetMismatchError{Received: 0}
+		}
+	}
+	if err != nil {
+		return 0, fmt.Errorf("submit: open staged upload: %w", err)
+	}
+	fi, err := f.Stat()
+	if err != nil {
+		f.Close()
+		return 0, fmt.Errorf("submit: stat staged upload: %w", err)
+	}
+	if fi.Size() != offset {
+		f.Close()
+		return 0, &OffsetMismatchError{Received: fi.Size()}
+	}
+	if _, err := f.Seek(offset, io.SeekStart); err != nil {
+		f.Close()
+		return 0, fmt.Errorf("submit: seek staged upload: %w", err)
+	}
+	n, err := io.Copy(f, r)
+	if err == nil {
+		err = f.Sync()
+	}
+	if err != nil {
+		f.Truncate(offset)
+		f.Close()
+		return 0, fmt.Errorf("submit: write upload part: %w", err)
+	}
+	if err := f.Close(); err != nil {
+		return 0, fmt.Errorf("submit: close staged upload: %w", err)
+	}
+	return offset + n, nil
+}
+
+// open returns id's staged upload for reading, or an ErrInvalid error when
+// nothing is staged. The caller must already hold id.
+func (s *PartStore) open(id string) (*os.File, error) {
+	p, err := s.path(id)
+	if err != nil {
+		return nil, err
+	}
+	f, err := os.Open(p)
+	if os.IsNotExist(err) {
+		return nil, invalidf("no upload in progress for this submission; send its parts first")
+	}
+	if err != nil {
+		return nil, fmt.Errorf("submit: open staged upload: %w", err)
+	}
+	return f, nil
+}
+
+// Delete removes id's staged upload. Nothing staged is success.
+func (s *PartStore) Delete(id string) error {
+	p, err := s.path(id)
+	if err != nil {
+		return err
+	}
+	if err := os.Remove(p); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("submit: remove staged upload: %w", err)
+	}
+	return nil
+}
+
+// Reap deletes every staged upload last written before cutoff, skipping one a
+// request holds right now. It returns how many it deleted and carries on past
+// one it cannot delete, reporting the first such error.
+func (s *PartStore) Reap(cutoff time.Time) (int, error) {
+	entries, err := os.ReadDir(s.Dir)
+	if os.IsNotExist(err) {
+		return 0, nil
+	}
+	if err != nil {
+		return 0, fmt.Errorf("submit: list staged uploads: %w", err)
+	}
+	var reaped int
+	var firstErr error
+	for _, e := range entries {
+		id, ok := strings.CutSuffix(e.Name(), partSuffix)
+		if !ok || e.IsDir() || !idRE.MatchString(id) {
+			continue
+		}
+		fi, err := e.Info()
+		if err != nil || !fi.ModTime().Before(cutoff) {
+			continue
+		}
+		release, err := s.hold(id)
+		if err != nil {
+			continue
+		}
+		err = s.Delete(id)
+		release()
+		if err == nil {
+			reaped++
+		} else if firstErr == nil {
+			firstErr = err
+		}
+	}
+	return reaped, firstErr
+}

internal/submit/parts_test.go

@@ -0,0 +1,338 @@
+package submit
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// newChunkedManager wires a Manager with an in-memory Blobs, a PartStore on a
+// temp dir and 4-byte parts, and files one pending submission for user-1.
+func newChunkedManager(t *testing.T) (*Manager, *fakeStore, *fakeBlobs, string) {
+	t.Helper()
+	m, st, _ := newManager()
+	fb := newFakeBlobs()
+	m.Blobs = fb
+	// A near-zero floor keeps the room check off this machine's own disk usage.
+	m.Parts = &PartStore{Dir: t.TempDir(), MinFree: 1e-9}
+	m.PartMaxBytes = 4
+	sub, err := m.Create(context.Background(), CreateRequest{DisplayName: "Pack", SubmittedBy: "user-1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return m, st, fb, sub.ID
+}
+
+func sendPart(t *testing.T, m *Manager, id string, offset int64, part string) int64 {
+	t.Helper()
+	p, err := m.UploadPart(context.Background(), id, "user-1", offset, strings.NewReader(part))
+	if err != nil {
+		t.Fatalf("UploadPart(offset %d, %q): %v", offset, part, err)
+	}
+	return p.Received
+}
+
+func staged(t *testing.T, m *Manager, id string) int64 {
+	t.Helper()
+	p, err := m.UploadStatus(context.Background(), id, "user-1")
+	if err != nil {
+		t.Fatalf("UploadStatus: %v", err)
+	}
+	return p.Received
+}
+
+func TestChunkedUploadAssemblesAndStores(t *testing.T) {
+	m, _, fb, id := newChunkedManager(t)
+	ctx := context.Background()
+
+	p, err := m.UploadStatus(ctx, id, "user-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p != (UploadProgress{Received: 0, PartMaxBytes: 4, MaxContextBytes: 1 << 30}) {
+		t.Fatalf("status before any part = %+v", p)
+	}
+	for _, step := range []struct {
+		offset int64
+		part   string
+		want   int64
+	}{
+		{0, "\x1f\x8b\x08\x00", 4},
+		{4, "abcd", 8},
+		{8, "efgh", 12},
+		{12, "ij", 14},
+	} {
+		if got := sendPart(t, m, id, step.offset, step.part); got != step.want {
+			t.Fatalf("after the part at %d: received %d, want %d", step.offset, got, step.want)
+		}
+	}
+	if _, ok := fb.stored[id]; ok {
+		t.Fatal("parts reached the blob store before the upload completed")
+	}
+
+	sub, err := m.CompleteUpload(ctx, id, "user-1")
+	if err != nil {
+		t.Fatalf("CompleteUpload: %v", err)
+	}
+	if got := string(fb.stored[id]); got != "\x1f\x8b\x08\x00abcdefghij" {
+		t.Fatalf("stored %q, want the parts in order", got)
+	}
+	if sub.ContextSHA256 != "df86a051af3d8615de097952ac01bc094781053bcda61aaac848edb98068209d" {
+		t.Fatalf("recorded digest %s", sub.ContextSHA256)
+	}
+	if got := staged(t, m, id); got != 0 {
+		t.Fatalf("staged bytes after completion = %d, want the staged copy gone", got)
+	}
+}
+
+func TestChunkedUploadResumesWhereTheStagedBytesEnd(t *testing.T) {
+	m, _, _, id := newChunkedManager(t)
+	ctx := context.Background()
+
+	var mismatch *OffsetMismatchError
+	_, err := m.UploadPart(ctx, id, "user-1", 4, strings.NewReader("abcd"))
+	if !errors.As(err, &mismatch) || mismatch.Received != 0 {
+		t.Fatalf("a part past an empty upload = %v, want an offset mismatch at 0", err)
+	}
+	sendPart(t, m, id, 0, "\x1f\x8b\x08\x00")
+	_, err = m.UploadPart(ctx, id, "user-1", 8, strings.NewReader("efgh"))
+	if !errors.As(err, &mismatch) || mismatch.Received != 4 {
+		t.Fatalf("a part that skips ahead = %v, want an offset mismatch at 4", err)
+	}
+	if got := sendPart(t, m, id, 4, "abcd"); got != 8 {
+		t.Fatalf("the part at the staged length: received %d, want 8", got)
+	}
+	// Offset 0 starts over.
+	if got := sendPart(t, m, id, 0, "\x1f\x8b"); got != 2 {
+		t.Fatalf("restart at 0: received %d, want 2", got)
+	}
+}
+
+type failingReader struct {
+	data string
+	done bool
+}
+
+func (f *failingReader) Read(p []byte) (int, error) {
+	if f.done {
+		return 0, errors.New("connection reset")
+	}
+	f.done = true
+	return copy(p, f.data), nil
+}
+
+func TestChunkedUploadCutsBackAPartThatBrokeOff(t *testing.T) {
+	m, _, _, id := newChunkedManager(t)
+	sendPart(t, m, id, 0, "\x1f\x8b\x08\x00")
+
+	_, err := m.UploadPart(context.Background(), id, "user-1", 4, &failingReader{data: "ab"})
+	if err == nil {
+		t.Fatal("a part that broke off was accepted")
+	}
+	if got := staged(t, m, id); got != 4 {
+		t.Fatalf("staged after a broken part = %d, want 4 (the half part cut back off)", got)
+	}
+}
+
+func TestChunkedUploadFirstPartMustBeGzip(t *testing.T) {
+	m, _, _, id := newChunkedManager(t)
+	_, err := m.UploadPart(context.Background(), id, "user-1", 0, strings.NewReader("PK\x03\x04"))
+	if !errors.Is(err, ErrInvalid) {
+		t.Fatalf("a zip first part = %v, want ErrInvalid", err)
+	}
+	if got := staged(t, m, id); got != 0 {
+		t.Fatalf("staged after a refused first part = %d, want 0", got)
+	}
+}
+
+func TestChunkedUploadPartCap(t *testing.T) {
+	m, _, _, id := newChunkedManager(t)
+	sendPart(t, m, id, 0, "\x1f\x8b\x08\x00")
+
+	_, err := m.UploadPart(context.Background(), id, "user-1", 4, strings.NewReader("abcde"))
+	if !errors.Is(err, ErrPartTooLarge) {
+		t.Fatalf("a 5-byte part over a 4-byte cap = %v, want ErrPartTooLarge", err)
+	}
+	if got := staged(t, m, id); got != 4 {
+		t.Fatalf("staged after an oversize part = %d, want 4", got)
+	}
+}
+
+// The staged total meets the same cap as a whole context, with the same error.
+func TestChunkedUploadTotalCappedLikeAWholeContext(t *testing.T) {
+	m, _, _, id := newChunkedManager(t)
+	m.MaxContextBytes = 10
+	sendPart(t, m, id, 0, "\x1f\x8b\x08\x00")
+	sendPart(t, m, id, 4, "abcd")
+
+	_, err := m.UploadPart(context.Background(), id, "user-1", 8, strings.NewReader("efg"))
+	if !errors.Is(err, ErrInvalid) || errors.Is(err, ErrPartTooLarge) {
+		t.Fatalf("a part past the context cap = %v, want the context-too-large ErrInvalid", err)
+	}
+	if got := sendPart(t, m, id, 8, "ef"); got != 10 {
+		t.Fatalf("a part ending exactly at the cap: received %d, want 10", got)
+	}
+}
+
+// Staged bytes count against the storage budget, so parts parked on several
+// pending submissions cannot hold more than stored contexts could.
+func TestChunkedUploadStagedBytesCountAgainstTheBudget(t *testing.T) {
+	m, _, fb, a := newChunkedManager(t)
+	ctx := context.Background()
+	m.MaxStoredBytesPerUser = 10
+	m.PartMaxBytes = 16
+	sendPart(t, m, a, 0, "\x1f\x8b\x08\x00abcd")
+
+	b, err := m.Create(ctx, CreateRequest{DisplayName: "B", SubmittedBy: "user-1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.UploadContext(ctx, b.ID, "user-1", strings.NewReader("\x1f\x8b\x08")); !errors.Is(err, ErrQuotaExceeded) {
+		t.Fatalf("3 bytes beside 8 staged under a 10-byte budget = %v, want ErrQuotaExceeded", err)
+	}
+	if _, err := m.UploadContext(ctx, b.ID, "user-1", strings.NewReader("\x1f\x8b")); err != nil {
+		t.Fatalf("2 bytes beside 8 staged = %v, want accepted", err)
+	}
+	// And the other way round: B's stored 2 bytes bound what A may still stage.
+	if _, err := m.UploadPart(ctx, a, "user-1", 8, strings.NewReader("e")); !errors.Is(err, ErrQuotaExceeded) {
+		t.Fatalf("staging past the budget = %v, want ErrQuotaExceeded", err)
+	}
+	if _, ok := fb.stored[a]; ok {
+		t.Fatal("staging stored a blob")
+	}
+}
+
+func TestChunkedUploadOwnerAndStatus(t *testing.T) {
+	m, st, _, id := newChunkedManager(t)
+	ctx := context.Background()
+	sendPart(t, m, id, 0, "\x1f\x8b\x08\x00")
+
+	if _, err := m.UploadStatus(ctx, id, "user-2"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("another user's status = %v, want ErrNotFound", err)
+	}
+	if _, err := m.UploadPart(ctx, id, "user-2", 4, strings.NewReader("abcd")); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("another user's part = %v, want ErrNotFound", err)
+	}
+	if _, err := m.CompleteUpload(ctx, id, "user-2"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("another user's completion = %v, want ErrNotFound", err)
+	}
+	st.subs[id].Status = StatusRejected
+	if _, err := m.UploadPart(ctx, id, "user-1", 4, strings.NewReader("abcd")); !errors.Is(err, ErrAlreadyReviewed) {
+		t.Fatalf("a part for a reviewed submission = %v, want ErrAlreadyReviewed", err)
+	}
+	if _, err := m.CompleteUpload(ctx, id, "user-1"); !errors.Is(err, ErrAlreadyReviewed) {
+		t.Fatalf("completing a reviewed submission = %v, want ErrAlreadyReviewed", err)
+	}
+}
+
+func TestChunkedUploadWithoutPartStoreIsUnavailable(t *testing.T) {
+	m, _, _, id := newChunkedManager(t)
+	m.Parts = nil
+	if _, err := m.UploadStatus(context.Background(), id, "user-1"); !errors.Is(err, ErrUploadsUnavailable) {
+		t.Fatalf("status without a part store = %v, want ErrUploadsUnavailable", err)
+	}
+	if _, err := m.UploadPart(context.Background(), id, "user-1", 0, strings.NewReader("\x1f\x8b")); !errors.Is(err, ErrUploadsUnavailable) {
+		t.Fatalf("part without a part store = %v, want ErrUploadsUnavailable", err)
+	}
+}
+
+func TestCompleteUploadWithNothingStagedIsInvalid(t *testing.T) {
+	m, _, fb, id := newChunkedManager(t)
+	if _, err := m.CompleteUpload(context.Background(), id, "user-1"); !errors.Is(err, ErrInvalid) {
+		t.Fatalf("completing an empty upload = %v, want ErrInvalid", err)
+	}
+	if len(fb.stored) != 0 {
+		t.Fatal("an empty completion stored a blob")
+	}
+}
+
+func TestCompleteUploadFailureKeepsTheStagedBytes(t *testing.T) {
+	m, _, fb, id := newChunkedManager(t)
+	sendPart(t, m, id, 0, "\x1f\x8b\x08\x00")
+	sendPart(t, m, id, 4, "ab")
+	fb.putErr = errors.New("object store unreachable")
+
+	if _, err := m.CompleteUpload(context.Background(), id, "user-1"); err == nil {
+		t.Fatal("completion succeeded with the blob store down")
+	}
+	if got := staged(t, m, id); got != 6 {
+		t.Fatalf("staged after a failed completion = %d, want 6 kept for the retry", got)
+	}
+	fb.putErr = nil
+	if _, err := m.CompleteUpload(context.Background(), id, "user-1"); err != nil {
+		t.Fatalf("retried completion: %v", err)
+	}
+	if got := string(fb.stored[id]); got != "\x1f\x8b\x08\x00ab" {
+		t.Fatalf("stored %q after the retry", got)
+	}
+}
+
+func TestChunkedUploadOneRequestAtATime(t *testing.T) {
+	m, _, _, id := newChunkedManager(t)
+	sendPart(t, m, id, 0, "\x1f\x8b\x08\x00")
+	release, err := m.Parts.hold(id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.UploadPart(context.Background(), id, "user-1", 4, strings.NewReader("ab")); !errors.Is(err, ErrUploadBusy) {
+		t.Fatalf("a part while another is writing = %v, want ErrUploadBusy", err)
+	}
+	if _, err := m.CompleteUpload(context.Background(), id, "user-1"); !errors.Is(err, ErrUploadBusy) {
+		t.Fatalf("completing while a part is writing = %v, want ErrUploadBusy", err)
+	}
+	release()
+	if got := sendPart(t, m, id, 4, "ab"); got != 6 {
+		t.Fatalf("the part after release: received %d, want 6", got)
+	}
+}
+
+func TestWithdrawDeletesTheStagedUpload(t *testing.T) {
+	m, _, _, id := newChunkedManager(t)
+	sendPart(t, m, id, 0, "\x1f\x8b\x08\x00")
+	if _, err := m.Withdraw(context.Background(), id, "user-1"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(m.Parts.Dir, id+".part")); !os.IsNotExist(err) {
+		t.Fatalf("staged upload after withdraw: stat err = %v, want it gone", err)
+	}
+}
+
+func TestReapStaleParts(t *testing.T) {
+	m, _, _, oldID := newChunkedManager(t)
+	ctx := context.Background()
+	fresh, err := m.Create(ctx, CreateRequest{DisplayName: "Fresh", SubmittedBy: "user-1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sendPart(t, m, oldID, 0, "\x1f\x8b\x08\x00")
+	sendPart(t, m, fresh.ID, 0, "\x1f\x8b\x08\x00")
+	if err := os.Chtimes(filepath.Join(m.Parts.Dir, oldID+".part"), testNow.Add(-25*time.Hour), testNow.Add(-25*time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(filepath.Join(m.Parts.Dir, fresh.ID+".part"), testNow.Add(-23*time.Hour), testNow.Add(-23*time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+	// A stray file that is not a staged upload is left alone.
+	if err := os.WriteFile(filepath.Join(m.Parts.Dir, "notes"), []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	os.Chtimes(filepath.Join(m.Parts.Dir, "notes"), testNow.Add(-48*time.Hour), testNow.Add(-48*time.Hour))
+
+	n, err := m.ReapStaleParts(StalePartRetention)
+	if err != nil || n != 1 {
+		t.Fatalf("ReapStaleParts = %d, %v; want 1", n, err)
+	}
+	if got := staged(t, m, oldID); got != 0 {
+		t.Fatalf("the 25-hour-old upload still holds %d bytes", got)
+	}
+	if got := staged(t, m, fresh.ID); got != 4 {
+		t.Fatalf("the 23-hour-old upload holds %d bytes, want 4 kept", got)
+	}
+	if _, err := os.Stat(filepath.Join(m.Parts.Dir, "notes")); err != nil {
+		t.Fatalf("the reaper touched a file that is not a staged upload: %v", err)
+	}
+}

internal/submit/submit.go

@@ -64,6 +64,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log"
 	"regexp"
 	"strings"
 	"time"
@@ -379,6 +380,13 @@ type Manager struct {
 	// MaxStoredBytesTotal overrides the budget for every user's stored contexts
 	// together; 0 uses defaultMaxStoredBytesTotal.
 	MaxStoredBytesTotal int64
+	// Parts stages chunked uploads (UploadPart, CompleteUpload). Nil leaves only
+	// the single-request UploadContext, and the chunked calls return
+	// ErrUploadsUnavailable.
+	Parts *PartStore
+	// PartMaxBytes overrides the cap on one chunked-upload part; 0 uses
+	// DefaultPartMaxBytes.
+	PartMaxBytes int64
 
 	Now   func() time.Time
 	IDGen func() string
@@ -394,6 +402,13 @@ func (m *Manager) maxContextBytes() int64 {
 	return defaultMaxContextBytes
 }
 
+func (m *Manager) partMaxBytes() int64 {
+	if m.PartMaxBytes > 0 {
+		return m.PartMaxBytes
+	}
+	return DefaultPartMaxBytes
+}
+
 func (m *Manager) maxPendingPerUser() int {
 	if m.MaxPendingPerUser > 0 {
 		return m.MaxPendingPerUser
@@ -575,18 +590,10 @@ func (m *Manager) UploadContext(ctx context.Context, id, submittedBy string, r i
 	if m.Blobs == nil {
 		return nil, ErrUploadsUnavailable
 	}
-
-	sub, err := m.Store.GetSubmission(ctx, id)
+	sub, err := m.ownPending(ctx, id, submittedBy)
 	if err != nil {
 		return nil, err
 	}
-	if sub.SubmittedBy != submittedBy {
-		// Not the owner: invisible, so the endpoint cannot confirm the id exists.
-		return nil, ErrNotFound
-	}
-	if sub.Status != StatusPendingReview {
-		return nil, ErrAlreadyReviewed
-	}
 
 	// Sniff the gzip magic before touching the store so a wrong-format upload fails
 	// fast, without persisting anything or reading the whole body.
@@ -595,34 +602,10 @@ func (m *Manager) UploadContext(ctx context.Context, id, submittedBy string, r i
 		return nil, invalidf("build context must be a gzip-compressed tarball (.tar.gz)")
 	}
 
-	// Per-user storage budget: sum the bytes this user's OTHER submissions
-	// already hold (excluding this id, whose blob a re-upload supersedes) and cap
-	// the write at whatever remains. cappedReader trips on the first byte past
-	// the limit, so the store never persists a blob that would exceed the budget
-	// (it removes its temp file on the copy error) and the failure surfaces as a
-	// 403, not a 500. The read-then-write pair is not atomic in this package: a
-	// burst that reaches two api replicas (or any direct caller of the Manager)
-	// can overshoot by up to one blob per interleaved upload — each write still
-	// bounded by the single-blob cap — while the API's per-user upload
-	// reservation collapses the single-replica case.
-	used, total, err := m.storedBytes(ctx, submittedBy, id)
+	limit, over, err := m.uploadLimit(ctx, submittedBy, id)
 	if err != nil {
 		return nil, err
 	}
-	remaining, budgetErr := m.maxStoredBytesPerUser()-used, errStorageQuota
-	if left := m.maxStoredBytesTotal() - total; left < remaining {
-		remaining, budgetErr = left, fmt.Errorf("%w: every user's uploads together reached the %d-byte limit", ErrUploadsFull, m.maxStoredBytesTotal())
-	}
-	if remaining <= 0 {
-		return nil, budgetErr
-	}
-	limit, over := m.maxContextBytes(), errContextTooLarge
-	if remaining < limit {
-		// The budget binds before the single-blob cap: an upload tripping here is
-		// refused as a spent allowance (or a full store), never as a malformed
-		// request.
-		limit, over = remaining, budgetErr
-	}
 	// The upload's size is unknown until it ends, so the room check assumes the
 	// most it may write.
 	if rc, ok := m.Blobs.(RoomChecker); ok {
@@ -648,12 +631,174 @@ func (m *Manager) UploadContext(ctx context.Context, id, submittedBy string, r i
 	return sub, nil
 }
 
+// ownPending loads id for an upload by submittedBy: another user's submission is
+// ErrNotFound (the endpoint cannot confirm the id exists), a reviewed one
+// ErrAlreadyReviewed.
+func (m *Manager) ownPending(ctx context.Context, id, submittedBy string) (*Submission, error) {
+	sub, err := m.Store.GetSubmission(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	if sub.SubmittedBy != submittedBy {
+		return nil, ErrNotFound
+	}
+	if sub.Status != StatusPendingReview {
+		return nil, ErrAlreadyReviewed
+	}
+	return sub, nil
+}
+
+// uploadLimit is how many bytes id's context may hold, and the error an upload
+// past it fails with. Per-user storage budget: sum the bytes this user's OTHER
+// submissions already hold (excluding this id, whose blob a re-upload
+// supersedes) and cap the write at whatever remains. cappedReader trips on the
+// first byte past the limit, so the store never persists a blob that would
+// exceed the budget (it removes its temp file on the copy error) and the failure
+// surfaces as a 403, not a 500. The read-then-write pair is not atomic in this
+// package: a burst that reaches two api replicas (or any direct caller of the
+// Manager) can overshoot by up to one blob per interleaved upload — each write
+// still bounded by the single-blob cap — while the API's per-user upload
+// reservation collapses the single-replica case.
+func (m *Manager) uploadLimit(ctx context.Context, submittedBy, id string) (int64, error, error) {
+	used, total, err := m.storedBytes(ctx, submittedBy, id)
+	if err != nil {
+		return 0, nil, err
+	}
+	remaining, budgetErr := m.maxStoredBytesPerUser()-used, errStorageQuota
+	if left := m.maxStoredBytesTotal() - total; left < remaining {
+		remaining, budgetErr = left, fmt.Errorf("%w: every user's uploads together reached the %d-byte limit", ErrUploadsFull, m.maxStoredBytesTotal())
+	}
+	if remaining <= 0 {
+		return 0, nil, budgetErr
+	}
+	limit, over := m.maxContextBytes(), errContextTooLarge
+	if remaining < limit {
+		// The budget binds before the single-blob cap: an upload tripping here is
+		// refused as a spent allowance (or a full store), never as a malformed
+		// request.
+		limit, over = remaining, budgetErr
+	}
+	return limit, over, nil
+}
+
+// UploadProgress is where a chunked upload stands: Received bytes are staged,
+// the next part starts there and carries at most PartMaxBytes, and the whole
+// context may reach MaxContextBytes.
+type UploadProgress struct {
+	Received        int64 `json:"received"`
+	PartMaxBytes    int64 `json:"part_max_bytes"`
+	MaxContextBytes int64 `json:"max_context_bytes"`
+}
+
+func (m *Manager) chunked(ctx context.Context, id, submittedBy string) error {
+	if strings.TrimSpace(submittedBy) == "" {
+		return invalidf("submitter identity is required")
+	}
+	if m.Blobs == nil || m.Parts == nil {
+		return ErrUploadsUnavailable
+	}
+	_, err := m.ownPending(ctx, id, submittedBy)
+	return err
+}
+
+// UploadStatus reports how far the caller's chunked upload of id has come, so a
+// client that lost its connection resumes where the staged bytes end. Nothing
+// staged reads as Received 0.
+func (m *Manager) UploadStatus(ctx context.Context, id, submittedBy string) (UploadProgress, error) {
+	if err := m.chunked(ctx, id, submittedBy); err != nil {
+		return UploadProgress{}, err
+	}
+	n, _, err := m.Parts.Size(id)
+	if err != nil {
+		return UploadProgress{}, err
+	}
+	return UploadProgress{Received: n, PartMaxBytes: m.partMaxBytes(), MaxContextBytes: m.maxContextBytes()}, nil
+}
+
+// UploadPart appends one part of the caller's chunked upload of id, starting at
+// offset: 0 starts over, anything else must equal what is staged
+// (*OffsetMismatchError otherwise). The first part must open with the gzip
+// magic. A part is capped at PartMaxBytes (ErrPartTooLarge), and the staged
+// total at the same limit UploadContext applies to a whole context, with the
+// same errors, so a chunked upload cannot stage more than a single request could
+// store. Nothing reaches Blobs until CompleteUpload.
+func (m *Manager) UploadPart(ctx context.Context, id, submittedBy string, offset int64, r io.Reader) (UploadProgress, error) {
+	if err := m.chunked(ctx, id, submittedBy); err != nil {
+		return UploadProgress{}, err
+	}
+	if offset < 0 {
+		return UploadProgress{}, invalidf("offset must not be negative")
+	}
+	br := bufio.NewReader(r)
+	if offset == 0 {
+		if magic, err := br.Peek(2); err != nil || magic[0] != 0x1f || magic[1] != 0x8b {
+			return UploadProgress{}, invalidf("build context must be a gzip-compressed tarball (.tar.gz)")
+		}
+	}
+	limit, over, err := m.uploadLimit(ctx, submittedBy, id)
+	if err != nil {
+		return UploadProgress{}, err
+	}
+	left, partOver := m.partMaxBytes(), error(ErrPartTooLarge)
+	if room := limit - offset; room <= left {
+		left, partOver = max(room, 0), over
+	}
+	if err := m.Parts.CheckRoom(left); err != nil {
+		return UploadProgress{}, err
+	}
+	n, err := m.Parts.Append(id, offset, &cappedReader{r: br, left: left, over: partOver})
+	if err != nil {
+		return UploadProgress{}, err
+	}
+	return UploadProgress{Received: n, PartMaxBytes: m.partMaxBytes(), MaxContextBytes: m.maxContextBytes()}, nil
+}
+
+// CompleteUpload stores the caller's staged upload of id as its build context,
+// through UploadContext, so it meets every check a single-request upload does
+// (format, size, budget, room) and records the digest the same way. The staged
+// bytes are deleted once stored; after a failure they stay, for a retry or a
+// fresh start at offset 0, until the reaper takes them.
+func (m *Manager) CompleteUpload(ctx context.Context, id, submittedBy string) (*Submission, error) {
+	if err := m.chunked(ctx, id, submittedBy); err != nil {
+		return nil, err
+	}
+	release, err := m.Parts.hold(id)
+	if err != nil {
+		return nil, err
+	}
+	defer release()
+	f, err := m.Parts.open(id)
+	if err != nil {
+		return nil, err
+	}
+	sub, err := m.UploadContext(ctx, id, submittedBy, f)
+	f.Close()
+	if err != nil {
+		return nil, err
+	}
+	if err := m.Parts.Delete(id); err != nil {
+		// Stored and recorded; the leftover copy only waits for the reaper.
+		log.Printf("submit: %v", err)
+	}
+	return sub, nil
+}
+
+// ReapStaleParts deletes every staged upload untouched for longer than olderThan.
+func (m *Manager) ReapStaleParts(olderThan time.Duration) (int, error) {
+	if m.Parts == nil {
+		return 0, nil
+	}
+	return m.Parts.Reap(m.now().Add(-olderThan))
+}
+
 // storedBytes sums the stored-blob sizes of submittedBy's submissions (user) and
 // of everyone's (total), excluding excludeID — the submission a pending re-upload
 // is about to replace, whose bytes must not be counted twice. Sizes are read from
 // the blob store itself, the same source of truth uploads/approval consult, so
 // the sums cannot drift from what is actually occupying the volume (including
-// blobs uploaded before any budget existed).
+// blobs uploaded before any budget existed). A staged chunked upload counts as
+// well, so parts spread over several pending submissions cannot hold more than
+// the budget allows.
 func (m *Manager) storedBytes(ctx context.Context, submittedBy, excludeID string) (user, total int64, err error) {
 	subs, err := m.Store.ListSubmissions(ctx)
 	if err != nil {
@@ -663,12 +808,16 @@ func (m *Manager) storedBytes(ctx context.Context, submittedBy, excludeID string
 		if s.ID == excludeID {
 			continue
 		}
-		n, ok, err := m.Blobs.Size(ctx, s.ID)
+		n, _, err := m.Blobs.Size(ctx, s.ID)
 		if err != nil {
 			return 0, 0, err
 		}
-		if !ok {
-			continue
+		if m.Parts != nil {
+			staged, _, err := m.Parts.Size(s.ID)
+			if err != nil {
+				return 0, 0, err
+			}
+			n += staged
 		}
 		total += n
 		if s.SubmittedBy == submittedBy {
@@ -976,6 +1125,11 @@ func (m *Manager) Delete(ctx context.Context, id string) (*Submission, error) {
 // exactly what is left behind. A deployment with no upload transport (Blobs nil)
 // has no blobs to reap.
 func (m *Manager) deleteBlob(ctx context.Context, id string) error {
+	if m.Parts != nil {
+		if err := m.Parts.Delete(id); err != nil {
+			return fmt.Errorf("submit: submission removed, but its unfinished upload could not be deleted: %w", err)
+		}
+	}
 	if m.Blobs == nil {
 		return nil
 	}