pigeonhole-db 1.1.0

data/vendor/compaction/src/gc.rs

@@ -0,0 +1,802 @@
+//! Compaction's garbage collection: which input entries the output must keep so that no read
+//! at any live snapshot changes.
+//!
+//! Read points are the live snapshots plus "latest" (`u64::MAX`). An entry with seqno `q` is
+//! visible at every read point `>= q`; its *stripe* is the index of the first such point. Two
+//! entries in one stripe are seen by exactly the same snapshots. Per `(column, timestamp)`
+//! group (read whole, since a delete may follow the put it hides) an entry is dropped when:
+//!
+//! - its timestamp has expired (`ts + ttl <= now`): everything it could affect expired too;
+//! - it is a put or operand hidden by a delete at every read point that sees it (the delete's
+//!   stripe is not above its own), or shadowed by a newer put at the same timestamp in its
+//!   stripe;
+//! - it is a delete made redundant by another delete covering at least its scope at every
+//!   read point that sees it;
+//! - at the bottommost level only, and only for timestamps below `min_ts_above` (so nothing
+//!   newer above the inputs can be uncovered or have its versions recounted): a delete
+//!   visible at every read point (nothing below can need it, and everything it hides here is
+//!   dropped by the rule above), or a put or operand outside the newest `max_versions`
+//!   versions at every read point that sees it.
+//!
+//! Consecutive kept operands of one group and stripe are combined into one operand. Operands
+//! are never folded across timestamps, nor onto a base in a standard family (D73; see
+//! `docs/design/questions/compaction.md`).
+//!
+//! A counter family (decision D179) resolves differently: every timestamp is its own version
+//! and a delete hides only entries with a lower seqno in its scope. So an entry is hidden at
+//! every read point that sees it only by a delete in its own stripe with a higher seqno, and
+//! a delete is redundant only next to a wider one in its stripe with a higher seqno. Versions
+//! beyond `max_versions` are never purged there: a later delete of a newer bucket, or its
+//! expiry, would show an older one again, and compaction never changes a counter family's
+//! reads (reads apply the limit; the TTL and deletes reclaim the space). Two
+//! operands are combined only if no other source of the slot can hold an entry with a seqno
+//! between theirs, either one included (`GcPolicy::other_sources`): a delete would hide one
+//! but not the other, and a counter checkpoint (D291), a `Put` at the seqno of the newest
+//! operand it folded, already counts the older one (#1051).
+//!
+//! A counter delete hides only entries with a lower seqno, so besides the `min_ts_above` rule
+//! (useless there: every source holding a counter has timestamp 0) a bottommost delete
+//! visible at every read point is purged when no other source that may hold keys of its row
+//! starts at or below its seqno: nothing outside the inputs is old enough for it to
+//! hide, and what it hides in the inputs is dropped with it. Sources the engine leaves out
+//! of `other_sources` start above the newest input seqno, so they never block it.
+//!
+//! In a counter family a compaction also folds a run of operands into the base below them
+//! when the base is in their stripe and no other source reaches from the base's seqno to the
+//! newest operand's (D298 §4.2, S4): the result is one base at the newest operand's key.
+//! D73's objections are about entries at different timestamps, and a bucket is one.
+
+use std::sync::Arc;
+
+use pigeonhole_format::key::{Kind, SUFFIX_LEN, row_prefix_len, split_suffix};
+use pigeonhole_format::value::{BlobPointer, ValueTag};
+use pigeonhole_format::{BlobFileId, Cursor, Seqno, Timestamp};
+
+use crate::blob::{BlobFetch, blob_pointer};
+use crate::{MergeOperator, OtherSource};
+
+/// No stripe (no delete seen).
+const NONE: usize = usize::MAX;
+
+/// Bytes a blob record occupies in its blob file: the 16-byte record header and the value.
+const BLOB_RECORD_HEADER: i64 = 16;
+
+#[derive(Debug, Clone, Copy)]
+struct GEntry {
+    key_start: usize,
+    val_start: usize,
+    end: usize,
+    kind: Kind,
+    seqno: Seqno,
+    stripe: usize,
+}
+
+/// Records that a dropped entry's blob value is no longer referenced from this output.
+fn account_drop(delta: &mut Vec<(BlobFileId, i64)>, kind: Kind, value: &[u8]) {
+    if kind != Kind::Put {
+        return;
+    }
+    if let [tag, ptr @ ..] = value
+        && *tag == ValueTag::Blob as u8
+        && let Ok(p) = BlobPointer::decode(ptr)
+    {
+        let bytes = BLOB_RECORD_HEADER + i64::from(p.len);
+        match delta.iter_mut().find(|d| d.0 == p.blob_file) {
+            Some(d) => d.1 -= bytes,
+            None => delta.push((p.blob_file, -bytes)),
+        }
+    }
+}
+
+/// Kept entries, appended in key order.
+#[derive(Debug, Default)]
+pub(crate) struct OutBuf {
+    data: Vec<u8>,
+    /// `(key start, value start, end)`, in `data` or (`true`) in the GC's group buffer: a
+    /// kept entry of the group just decided is not copied again, as long as the buffer is
+    /// emptied (or [`own`](Self::own)ed) before the GC's next step.
+    items: Vec<(usize, usize, usize, bool)>,
+}
+
+impl OutBuf {
+    fn push(&mut self, key: &[u8], value: &[u8]) {
+        let k = self.data.len();
+        self.data.extend_from_slice(key);
+        let v = self.data.len();
+        self.data.extend_from_slice(value);
+        self.items.push((k, v, self.data.len(), false));
+    }
+
+    /// An entry of the GC's group buffer, by position.
+    fn push_group(&mut self, key: usize, value: usize, end: usize) {
+        self.items.push((key, value, end, true));
+    }
+
+    pub(crate) fn len(&self) -> usize {
+        self.items.len()
+    }
+
+    /// Entry `i`; `group` is the GC's group buffer ([`Gc::group_data`]).
+    pub(crate) fn get<'a>(&'a self, i: usize, group: &'a [u8]) -> (&'a [u8], &'a [u8]) {
+        let (k, v, e, in_group) = self.items[i];
+        let bytes = if in_group { group } else { &self.data };
+        (&bytes[k..v], &bytes[v..e])
+    }
+
+    /// Copies the entries still in the GC's group buffer into this buffer, before the GC's
+    /// next step reuses it.
+    pub(crate) fn own(&mut self, group: &[u8]) {
+        for item in &mut self.items {
+            let (k, v, e, in_group) = *item;
+            if in_group {
+                let start = self.data.len();
+                self.data.extend_from_slice(&group[k..e]);
+                *item = (start, start + (v - k), start + (e - k), false);
+            }
+        }
+    }
+
+    pub(crate) fn clear(&mut self) {
+        self.data.clear();
+        self.items.clear();
+    }
+}
+
+/// What GC needs to know.
+#[derive(Debug, Clone)]
+pub(crate) struct GcConfig {
+    /// Live snapshots, ascending.
+    pub snapshots: Vec<Seqno>,
+    pub now: Timestamp,
+    pub bottommost: bool,
+    pub min_ts_above: Timestamp,
+    pub ttl_micros: u64,
+    pub max_versions: u32,
+    pub merge: Option<Arc<dyn MergeOperator>>,
+    /// Counter-family semantics (D179).
+    pub counter: bool,
+    /// `GcPolicy::other_sources` (counter families only).
+    pub other_sources: Option<Vec<OtherSource>>,
+    /// `GcPolicy::no_outside_deletes`.
+    pub no_outside_deletes: bool,
+    /// Counter families: fold a run of operands into the base below them (D298 §4.2).
+    /// Compaction does; a flush's combine (#287) folds only operands.
+    pub fold_bases: bool,
+    /// Reads a separated base for that fold (`JobContext::base_blobs`). Without one, a run
+    /// above a separated base is only combined.
+    pub base_blobs: Option<Arc<dyn BlobFetch>>,
+}
+
+/// Streaming GC state over one ordered input.
+#[derive(Debug)]
+pub(crate) struct Gc {
+    /// Read points: snapshots ascending, then `u64::MAX`.
+    points: Vec<Seqno>,
+    now: Timestamp,
+    ttl: u64,
+    bottommost: bool,
+    min_ts_above: Timestamp,
+    max_versions: u32,
+    merge: Option<Arc<dyn MergeOperator>>,
+    counter: bool,
+    other_sources: Option<Vec<OtherSource>>,
+    no_outside_deletes: bool,
+    fold_bases: bool,
+    base_blobs: Option<Arc<dyn BlobFetch>>,
+
+    row: Vec<u8>,
+    /// `(ts, stripe, seqno)` of the row's family markers, newest first.
+    markers: Vec<(Timestamp, usize, Seqno)>,
+    /// Counter families: seqno ranges of the other sources that overlap the row.
+    row_guard: Vec<(Seqno, Seqno)>,
+    /// Counter families: per stripe, the newest seqno of the column's column deletes seen
+    /// so far (all at newer timestamps; 0 = none).
+    col_del_seqno: Vec<Seqno>,
+    /// Counter families, per stripe, scratch for one group: the newest seqno of a delete
+    /// from outside the group covering it, and of the group's deletes seen so far (any
+    /// kind, and column deletes).
+    c_cover: Vec<Seqno>,
+    c_any: Vec<Seqno>,
+    c_col: Vec<Seqno>,
+    col: Vec<u8>,
+    /// Lowest stripe of the column's column deletes seen so far (all at newer timestamps).
+    col_stripe: usize,
+    /// Timestamp of the column's newest group.
+    col_newest: Timestamp,
+    /// Per read point: versions started, and whether an operand run is open.
+    counts: Vec<u32>,
+    run_open: Vec<bool>,
+
+    group_data: Vec<u8>,
+    group: Vec<GEntry>,
+    /// Per read point, scratch: group version index (0 = none) and base position.
+    gidx: Vec<u32>,
+    gbase: Vec<usize>,
+    acc: Vec<u8>,
+    acc_key: Vec<u8>,
+    /// The group entries combined into `acc`, `(key start, value start, end)` in
+    /// `group_data`, newest first: kept apart instead if `acc` doesn't settle.
+    acc_parts: Vec<(usize, usize, usize)>,
+    scratch: Vec<u8>,
+
+    /// Live-byte change per blob file from dropped values.
+    pub(crate) blob_delta: Vec<(BlobFileId, i64)>,
+    /// Entries read and kept (statistics).
+    pub(crate) read: u64,
+    pub(crate) kept: u64,
+    /// Bases folded with the operands above them (D298 §4.2; statistics).
+    pub(crate) folded: u64,
+}
+
+impl Gc {
+    pub(crate) fn new(config: GcConfig) -> Self {
+        let mut points = config.snapshots;
+        points.sort_unstable();
+        points.dedup();
+        if points.last() != Some(&Seqno::MAX) {
+            points.push(Seqno::MAX);
+        }
+        let n = points.len();
+        Self {
+            points,
+            now: config.now,
+            ttl: config.ttl_micros,
+            bottommost: config.bottommost,
+            min_ts_above: config.min_ts_above,
+            max_versions: config.max_versions,
+            merge: config.merge,
+            counter: config.counter,
+            other_sources: config.other_sources,
+            no_outside_deletes: config.no_outside_deletes,
+            fold_bases: config.fold_bases,
+            base_blobs: config.base_blobs,
+            row: Vec::new(),
+            markers: Vec::new(),
+            row_guard: Vec::new(),
+            col_del_seqno: vec![0; n],
+            c_cover: vec![0; n],
+            c_any: vec![0; n],
+            c_col: vec![0; n],
+            col: Vec::new(),
+            col_stripe: NONE,
+            col_newest: 0,
+            counts: vec![0; n],
+            run_open: vec![false; n],
+            group_data: Vec::new(),
+            group: Vec::new(),
+            gidx: vec![0; n],
+            gbase: vec![0; n],
+            acc: Vec::new(),
+            acc_key: Vec::new(),
+            acc_parts: Vec::new(),
+            scratch: Vec::new(),
+            blob_delta: Vec::new(),
+            read: 0,
+            kept: 0,
+            folded: 0,
+        }
+    }
+
+    /// Forgets the current row (at a range boundary).
+    /// The group buffer the kept entries of the last step may point into
+    /// ([`OutBuf::get`]).
+    pub(crate) fn group_data(&self) -> &[u8] {
+        &self.group_data
+    }
+
+    pub(crate) fn reset(&mut self) {
+        self.row.clear();
+        self.markers.clear();
+        self.col.clear();
+    }
+
+    fn stripe(&self, seqno: Seqno) -> usize {
+        self.points.partition_point(|&p| p < seqno)
+    }
+
+    /// Whether a bottommost purge may touch timestamp `ts`.
+    fn purgeable(&self, ts: Timestamp) -> bool {
+        self.bottommost && ts < self.min_ts_above
+    }
+
+    fn expired(&self, ts: Timestamp) -> bool {
+        self.ttl != 0 && ts.saturating_add(self.ttl) <= self.now
+    }
+
+    /// Lowest stripe of the row's markers covering timestamp `ts`.
+    fn marker_stripe(&self, ts: Timestamp) -> usize {
+        self.markers
+            .iter()
+            .filter(|m| m.0 >= ts)
+            .map(|m| m.1)
+            .min()
+            .unwrap_or(NONE)
+    }
+
+    /// Counter families: the seqno ranges of the other sources that may hold keys of the
+    /// row with prefix `row` (everything when the other sources are unknown).
+    fn guard_row(&mut self) {
+        self.row_guard.clear();
+        if !self.counter {
+            return;
+        }
+        let Some(others) = &self.other_sources else {
+            self.row_guard.push((0, Seqno::MAX));
+            return;
+        };
+        let row = self.row.as_slice();
+        for o in others {
+            let overlaps = o.keys.as_ref().is_none_or(|(lo, hi)| {
+                hi.as_slice() >= row && (lo.as_slice() <= row || lo.starts_with(row))
+            });
+            if overlaps {
+                self.row_guard.push(o.seqnos);
+            }
+        }
+    }
+
+    /// Counter families: whether a bottommost delete at `ts` with `seqno`, visible at every
+    /// read point, may be purged: by the timestamp rule, or because no other source that
+    /// may hold keys of the row starts at or below its seqno (#290).
+    fn counter_purgeable(&self, ts: Timestamp, seqno: Seqno) -> bool {
+        self.purgeable(ts) || (self.bottommost && self.row_guard.iter().all(|&(lo, _)| lo > seqno))
+    }
+
+    /// Counter families: whether another source could hold, between two operands at `older`
+    /// and `newer`, an entry that splits them: a delete with a seqno in `(older, newer]`
+    /// (hiding the older only), or a counter checkpoint (D291), a `Put` base at the seqno of
+    /// the newest operand it folded, with a seqno in `[older, newer)` (counting the older
+    /// already). Either way the two must stay apart (#1051).
+    fn guarded(&self, older: Seqno, newer: Seqno) -> bool {
+        splits(&self.row_guard, older, newer)
+    }
+
+    /// Processes the next unit at the cursor (one family marker or one `(column, ts)` group),
+    /// appending kept entries to `out`. Returns false at the end of the input or at `end`.
+    pub(crate) fn step<C: Cursor>(
+        &mut self,
+        cursor: &mut C,
+        end: Option<&[u8]>,
+        out: &mut OutBuf,
+    ) -> Result<bool, C::Error> {
+        if !cursor.valid() || end.is_some_and(|e| cursor.key() >= e) {
+            return Ok(false);
+        }
+        let key = cursor.key();
+        let Ok((body, ts, seqno, kind)) = split_suffix(key) else {
+            // A malformed key cannot be interpreted; keep it as is.
+            out.push(key, cursor.value());
+            cursor.next()?;
+            return Ok(true);
+        };
+        if self.row.is_empty() || !key.starts_with(&self.row) {
+            let n = row_prefix_len(key).unwrap_or(body.len());
+            self.row.clear();
+            self.row.extend_from_slice(&key[..n]);
+            self.markers.clear();
+            self.col.clear();
+            self.guard_row();
+        }
+        self.read += 1;
+        if kind == Kind::FamilyDelete {
+            let stripe = self.stripe(seqno);
+            // Earlier markers are at newer timestamps, or at this one with higher seqnos.
+            let redundant = self
+                .markers
+                .iter()
+                .any(|m| m.1 <= stripe && (!self.counter || (m.1 == stripe && m.2 > seqno)));
+            let purge = stripe == 0
+                && if self.counter {
+                    self.counter_purgeable(ts, seqno)
+                } else {
+                    self.purgeable(ts)
+                };
+            let keep = !self.expired(ts) && !redundant && !purge;
+            self.markers.push((ts, stripe, seqno));
+            if keep {
+                out.push(key, cursor.value());
+                self.kept += 1;
+            }
+            cursor.next()?;
+            return Ok(true);
+        }
+        if body != self.col.as_slice() {
+            self.col.clear();
+            self.col.extend_from_slice(body);
+            self.col_stripe = NONE;
+            self.col_newest = ts;
+            self.counts.fill(0);
+            self.run_open.fill(false);
+            self.col_del_seqno.fill(0);
+        }
+        self.read_group(cursor, ts)?;
+        if self.counter {
+            self.decide_counter(ts, out);
+        } else {
+            self.decide(ts, out);
+        }
+        Ok(true)
+    }
+
+    /// Copies the `(column, ts)` group at the cursor into the group buffer.
+    fn read_group<C: Cursor>(&mut self, cursor: &mut C, ts: Timestamp) -> Result<(), C::Error> {
+        self.group.clear();
+        self.group_data.clear();
+        let col_len = self.col.len();
+        while cursor.valid() {
+            let key = cursor.key();
+            if key.len() != col_len + SUFFIX_LEN || !key.starts_with(&self.col) {
+                break;
+            }
+            let Ok((_, t, seqno, kind)) = split_suffix(key) else {
+                break;
+            };
+            if t != ts {
+                break;
+            }
+            let key_start = self.group_data.len();
+            self.group_data.extend_from_slice(key);
+            let val_start = self.group_data.len();
+            self.group_data.extend_from_slice(cursor.value());
+            self.group.push(GEntry {
+                key_start,
+                val_start,
+                end: self.group_data.len(),
+                kind,
+                seqno,
+                stripe: self.points.partition_point(|&p| p < seqno),
+            });
+            cursor.next()?;
+        }
+        // The first entry was counted by `step`.
+        self.read += self.group.len().saturating_sub(1) as u64;
+        Ok(())
+    }
+
+    fn decide(&mut self, ts: Timestamp, out: &mut OutBuf) {
+        let n_points = self.points.len();
+        if self.expired(ts) {
+            for e in &self.group {
+                account_drop(
+                    &mut self.blob_delta,
+                    e.kind,
+                    &self.group_data[e.val_start..e.end],
+                );
+            }
+            return;
+        }
+        let cover = self.col_stripe.min(self.marker_stripe(ts));
+        let mut cell_min = NONE;
+        let mut coldel_min = NONE;
+        for e in &self.group {
+            match e.kind {
+                Kind::CellDelete => cell_min = cell_min.min(e.stripe),
+                Kind::ColumnDelete => coldel_min = coldel_min.min(e.stripe),
+                _ => {}
+            }
+        }
+        let hide = cover.min(cell_min).min(coldel_min);
+
+        // Upper cell deletes can only hit timestamps >= min_ts_above, so if the whole column
+        // is below it, versions counted here stay versions.
+        // Or, with no delete outside the input, nothing can hide the versions counted here.
+        let versions_gc =
+            self.max_versions > 0 && (self.purgeable(self.col_newest) || self.no_outside_deletes);
+        let purge_deletes = self.purgeable(ts);
+        if versions_gc {
+            for j in 0..n_points {
+                self.gidx[j] = 0;
+                if hide <= j {
+                    continue;
+                }
+                let visible =
+                    |e: &GEntry| matches!(e.kind, Kind::Put | Kind::Merge) && e.stripe <= j;
+                if !self.group.iter().any(visible) {
+                    continue;
+                }
+                let base = self
+                    .group
+                    .iter()
+                    .position(|e| e.kind == Kind::Put && e.stripe <= j);
+                if !self.run_open[j] {
+                    self.counts[j] += 1;
+                }
+                self.gidx[j] = self.counts[j];
+                self.run_open[j] = base.is_none();
+                self.gbase[j] = base.unwrap_or(usize::MAX);
+            }
+        }
+
+        let mut put_min = NONE;
+        let mut earlier_cell = NONE;
+        let mut earlier_coldel = NONE;
+        // A pending combined operand: its stripe.
+        let mut pending: Option<usize> = None;
+        for idx in 0..self.group.len() {
+            let e = self.group[idx];
+            let i = e.stripe;
+            let keep = match e.kind {
+                Kind::Put | Kind::Merge => {
+                    let mut k = hide > i && put_min > i;
+                    if k && versions_gc {
+                        k = (i..n_points).any(|j| {
+                            hide > j
+                                && self.gidx[j] != 0
+                                && self.gidx[j] <= self.max_versions
+                                && idx <= self.gbase[j]
+                        });
+                    }
+                    if e.kind == Kind::Put {
+                        put_min = put_min.min(i);
+                    }
+                    k
+                }
+                Kind::CellDelete => {
+                    let redundant = cover.min(coldel_min).min(earlier_cell) <= i;
+                    earlier_cell = earlier_cell.min(i);
+                    !redundant && !(purge_deletes && i == 0)
+                }
+                Kind::ColumnDelete => {
+                    let redundant = cover.min(earlier_coldel) <= i;
+                    earlier_coldel = earlier_coldel.min(i);
+                    !redundant && !(purge_deletes && i == 0)
+                }
+                // Markers never share a group with cells.
+                Kind::FamilyDelete => true,
+            };
+            let key = e.key_start..e.val_start;
+            let value = e.val_start..e.end;
+            if !keep {
+                account_drop(&mut self.blob_delta, e.kind, &self.group_data[value]);
+                continue;
+            }
+            self.kept += 1;
+            // Combine consecutive kept operands of one stripe (no put between them, or it
+            // would shadow the older one).
+            if e.kind == Kind::Merge
+                && let Some(op) = &self.merge
+            {
+                if pending == Some(i) {
+                    // Merge into a scratch copy: a failed merge may leave its accumulator
+                    // half-written, and the operands are then kept apart unchanged.
+                    self.scratch.clear();
+                    self.scratch.extend_from_slice(&self.acc);
+                    if op
+                        .merge(&mut self.scratch, &self.group_data[value.clone()])
+                        .is_ok()
+                    {
+                        std::mem::swap(&mut self.acc, &mut self.scratch);
+                        self.acc_parts.push((key.start, value.start, value.end));
+                        self.kept -= 1;
+                        continue;
+                    }
+                }
+                if pending.is_some() {
+                    self.push_acc(out);
+                }
+                pending = Some(i);
+                self.acc_parts.clear();
+                self.acc_parts.push((key.start, value.start, value.end));
+                self.acc_key.clear();
+                self.acc_key.extend_from_slice(&self.group_data[key]);
+                self.acc.clear();
+                self.acc.extend_from_slice(&self.group_data[value]);
+                continue;
+            }
+            if pending.take().is_some() {
+                self.push_acc(out);
+            }
+            out.push_group(key.start, value.start, value.end);
+        }
+        if pending.is_some() {
+            self.push_acc(out);
+        }
+        self.col_stripe = self.col_stripe.min(coldel_min);
+    }
+
+    /// [`Gc::decide`] for a counter family (D179): seqno-scoped deletes, one version per
+    /// timestamp, no version purge.
+    fn decide_counter(&mut self, ts: Timestamp, out: &mut OutBuf) {
+        if self.expired(ts) {
+            for e in &self.group {
+                account_drop(
+                    &mut self.blob_delta,
+                    e.kind,
+                    &self.group_data[e.val_start..e.end],
+                );
+            }
+            return;
+        }
+        // Per stripe, the newest seqno of a delete from outside the group covering `ts`:
+        // the column's deletes at newer timestamps and the row's markers at or above `ts`.
+        self.c_cover.copy_from_slice(&self.col_del_seqno);
+        for m in self.markers.iter().filter(|m| m.0 >= ts) {
+            self.c_cover[m.1] = self.c_cover[m.1].max(m.2);
+        }
+        // In-group deletes seen so far (newer seqnos), per stripe: any, and column deletes.
+        self.c_any.fill(0);
+        self.c_col.fill(0);
+        let mut put_min = NONE;
+        // A pending combined operand: its stripe and newest seqno.
+        let mut pending: Option<(usize, Seqno)> = None;
+        for idx in 0..self.group.len() {
+            let e = self.group[idx];
+            let i = e.stripe;
+            let covered = self.c_cover[i].max(self.c_any[i]) > e.seqno;
+            let keep = match e.kind {
+                Kind::Put | Kind::Merge => {
+                    let k = !covered && put_min > i;
+                    if e.kind == Kind::Put {
+                        put_min = put_min.min(i);
+                    }
+                    k
+                }
+                Kind::CellDelete => {
+                    let redundant = covered;
+                    self.c_any[i] = self.c_any[i].max(e.seqno);
+                    !redundant && !(i == 0 && self.counter_purgeable(ts, e.seqno))
+                }
+                Kind::ColumnDelete => {
+                    let redundant = self.c_cover[i].max(self.c_col[i]) > e.seqno;
+                    self.c_any[i] = self.c_any[i].max(e.seqno);
+                    self.c_col[i] = self.c_col[i].max(e.seqno);
+                    self.col_del_seqno[i] = self.col_del_seqno[i].max(e.seqno);
+                    !redundant && !(i == 0 && self.counter_purgeable(ts, e.seqno))
+                }
+                Kind::FamilyDelete => true,
+            };
+            let key = e.key_start..e.val_start;
+            let value = e.val_start..e.end;
+            if !keep {
+                account_drop(&mut self.blob_delta, e.kind, &self.group_data[value]);
+                continue;
+            }
+            self.kept += 1;
+            if e.kind == Kind::Merge
+                && let Some(op) = &self.merge
+            {
+                if let Some((stripe, newest)) = pending
+                    && stripe == i
+                    && !self.guarded(e.seqno, newest)
+                {
+                    self.scratch.clear();
+                    self.scratch.extend_from_slice(&self.acc);
+                    if op
+                        .merge(&mut self.scratch, &self.group_data[value.clone()])
+                        .is_ok()
+                    {
+                        std::mem::swap(&mut self.acc, &mut self.scratch);
+                        self.acc_parts.push((key.start, value.start, value.end));
+                        self.kept -= 1;
+                        continue;
+                    }
+                }
+                if pending.is_some() {
+                    self.push_acc(out);
+                }
+                pending = Some((i, e.seqno));
+                self.acc_parts.clear();
+                self.acc_parts.push((key.start, value.start, value.end));
+                self.acc_key.clear();
+                self.acc_key.extend_from_slice(&self.group_data[key]);
+                self.acc.clear();
+                self.acc.extend_from_slice(&self.group_data[value]);
+                continue;
+            }
+            // D298 §4.2: a base below a run of operands of its own stripe becomes one base,
+            // the fold a read would do, at the newest operand's key. Every read point that
+            // sees any of them sees all of them; the base is kept, so no delete in the
+            // inputs with a seqno above it covers the bucket; and the guard, widened to the
+            // base's seqno, rules one out in another source (S4).
+            if e.kind == Kind::Put
+                && let Some((stripe, newest)) = pending
+                && stripe == i
+                && self.fold_bases
+                && !self.guarded(e.seqno, newest)
+                && self.fold_onto(value.clone())
+            {
+                account_drop(&mut self.blob_delta, Kind::Put, &self.group_data[value]);
+                let n = self.acc_key.len();
+                self.acc_key[n - 1] = Kind::Put as u8;
+                self.push_acc(out);
+                pending = None;
+                self.kept -= 1;
+                self.folded += 1;
+                continue;
+            }
+            if pending.take().is_some() {
+                self.push_acc(out);
+            }
+            out.push_group(key.start, value.start, value.end);
+        }
+        if pending.is_some() {
+            self.push_acc(out);
+        }
+    }
+
+    /// Pushes the accumulator, a combined operand (or a fold's result), settled into one an
+    /// operator stores ([`MergeOperator::settle`]): never a working form (D298). If it
+    /// doesn't settle, the operands it combined are pushed apart, unchanged, as if no
+    /// combine had been tried. A fold's result is settled already ([`Gc::fold_onto`]).
+    fn push_acc(&mut self, out: &mut OutBuf) {
+        if let Some(op) = &self.merge
+            && op.settle(&mut self.acc).is_err()
+        {
+            debug_assert_ne!(
+                self.acc_key.last(),
+                Some(&(Kind::Put as u8)),
+                "a fold onto a base left an unsettled result"
+            );
+            self.kept += self.acc_parts.len() as u64 - 1;
+            for &(k, v, e) in &self.acc_parts {
+                out.push_group(k, v, e);
+            }
+            return;
+        }
+        debug_assert_ne!(
+            self.acc.first(),
+            Some(&pigeonhole_format::value::TRANSIENT_TAG),
+            "a working accumulator reached a compaction's output"
+        );
+        out.push(&self.acc_key, &self.acc);
+    }
+
+    /// Applies the combined operands in `acc` to the base at `value` (read from its blob
+    /// file if separated), leaving the result in `acc`. False, with `acc` unchanged, when
+    /// the base can't be read or the operator fails: the inputs are then kept apart (S4).
+    fn fold_onto(&mut self, value: std::ops::Range<usize>) -> bool {
+        let Some(op) = self.merge.clone() else {
+            return false;
+        };
+        let stored = &self.group_data[value];
+        let fetched;
+        let base: &[u8] = match blob_pointer(stored) {
+            None => stored,
+            Some(ptr) => match self.base_blobs.as_ref().and_then(|b| b.fetch(&ptr)) {
+                Some(v) => {
+                    fetched = v;
+                    &fetched
+                }
+                None => return false,
+            },
+        };
+        self.scratch.clear();
+        self.scratch.extend_from_slice(&self.acc);
+        if op.finish(Some(base), &mut self.scratch).is_err()
+            || op.settle(&mut self.scratch).is_err()
+        {
+            return false;
+        }
+        std::mem::swap(&mut self.acc, &mut self.scratch);
+        true
+    }
+}
+
+/// Whether a source with seqnos in one of `ranges` could split operands at `older` and
+/// `newer` ([`Gc::guarded`]): it reaches into `[older, newer]`.
+fn splits(ranges: &[(Seqno, Seqno)], older: Seqno, newer: Seqno) -> bool {
+    ranges.iter().any(|&(lo, hi)| lo <= newer && hi >= older)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::splits;
+
+    #[test]
+    fn a_source_reaching_either_operand_keeps_them_apart() {
+        // Operands at 5 and 6.
+        assert!(
+            splits(&[(2, 5)], 5, 6),
+            "a checkpoint at 5 already counts the older (#1051)"
+        );
+        assert!(
+            splits(&[(6, 9)], 5, 6),
+            "a delete at 6 hides the older only"
+        );
+        assert!(splits(&[(5, 6)], 5, 6));
+        assert!(splits(&[(0, u64::MAX)], 5, 6), "unknown sources");
+        assert!(!splits(&[(2, 4)], 5, 6), "entirely below both");
+        assert!(!splits(&[(7, 9)], 5, 6), "entirely above both");
+        assert!(!splits(&[], 5, 6));
+    }
+}