feat: enforce tiered storage reservations

internal/server/store/recovery.go

@@ -9,7 +9,10 @@ import (
 	"path/filepath"
 )
 
-var ErrIntegrityCheck = errors.New("SQLite integrity check failed")
+var (
+	ErrIntegrityCheck       = errors.New("SQLite integrity check failed")
+	ErrQuotaCounterMismatch = errors.New("quota counter mismatch")
+)
 
 type RecoveryReport struct {
 	SegmentsChecked    uint64
@@ -119,12 +122,36 @@ FROM output_segments ORDER BY issue_uuid, ordinal`)
 			return report, err
 		}
 	}
+	if err := checkQuotaCounters(ctx, database); err != nil {
+		return report, err
+	}
 	if _, err := database.ExecContext(ctx, `UPDATE output_segments SET sealed = 1 WHERE sealed = 0`); err != nil {
 		return report, err
 	}
 	return report, nil
 }
 
+func checkQuotaCounters(ctx context.Context, database *sql.DB) error {
+	var mismatchedClients int
+	if err := database.QueryRowContext(ctx, `SELECT count(*) FROM clients WHERE charged_bytes !=
+COALESCE((SELECT sum(commands.charged_bytes) FROM commands WHERE commands.client_id = clients.client_id), 0)`).Scan(&mismatchedClients); err != nil {
+		return err
+	}
+	var storedServer, computedServer uint64
+	if err := database.QueryRowContext(ctx, `SELECT command_charged_bytes,
+COALESCE((SELECT sum(charged_bytes) FROM commands), 0) FROM storage_counters WHERE singleton = 1`).Scan(&storedServer, &computedServer); err != nil {
+		return err
+	}
+	var invalidCommands int
+	if err := database.QueryRowContext(ctx, `SELECT count(*) FROM commands WHERE output_charged_bytes > charged_bytes OR charge_version != ?`, ChargeFormulaVersion).Scan(&invalidCommands); err != nil {
+		return err
+	}
+	if mismatchedClients != 0 || storedServer != computedServer || invalidCommands != 0 {
+		return ErrQuotaCounterMismatch
+	}
+	return nil
+}
+
 func (store *Store) quickCheckDatabase(ctx context.Context, database *sql.DB) error {
 	rows, err := database.QueryContext(ctx, `PRAGMA quick_check(100)`)
 	if err != nil {