fix+test: check hash ref count on copy-on-write (a duplicated beeing updated)

src/application/ports/blob_lifecycle.rs

@@ -0,0 +1,21 @@
+use std::future::Future;
+use std::pin::Pin;
+
+/// Observer notified by [`DedupService`] when a blob's ref_count reaches zero
+/// and it is permanently removed from storage.
+///
+/// Implement this trait on any service that needs to react to blob deletion
+/// (e.g. thumbnail cleanup, CDN invalidation, audit logging).  Register with
+/// [`DedupService::add_blob_hook`] during DI wiring.
+///
+/// The boxed-future return keeps the trait dyn-compatible so multiple
+/// implementations can be stored as `Vec<Arc<dyn BlobDeletionHook>>`.
+pub trait BlobDeletionHook: Send + Sync {
+    /// Called after the blob file has been removed from disk.
+    /// `blob_hash` is the BLAKE3 hex string identifying the blob.
+    /// Must be best-effort — must not propagate errors.
+    fn on_blob_deleted<'a>(
+        &'a self,
+        blob_hash: &'a str,
+    ) -> Pin<Box<dyn Future<Output = ()> + Send + 'a>>;
+}

src/application/services/trash_service.rs

@@ -61,6 +61,7 @@ pub struct TrashService {
 }
 
 impl TrashService {
+    #[allow(clippy::too_many_arguments)]
     pub fn new(
         trash_repository: Arc<TrashDbRepository>,
         file_read_port: Arc<FileBlobReadRepository>,

src/common/di.rs

@@ -456,7 +456,6 @@ impl AppServiceFactory {
             Some(core.file_content_cache.clone()),
         ));
 
-
         // Initialize cleanup service (bulk-deletes expired items in 2 SQL queries)
         let cleanup_service = TrashCleanupService::new(
             trash_repo.clone(),

src/infrastructure/repositories/pg/file_blob_write_repository.rs

@@ -606,15 +606,14 @@ impl FileWritePort for FileBlobWriteRepository {
     async fn delete_file_permanently(&self, file_id: &str) -> Result<(), DomainError> {
         // Read blob_hash before deletion so we can clean up disk after the
         // PG trigger has decremented the ref_count.
-        let blob_hash: Option<String> = sqlx::query_scalar(
-            "SELECT blob_hash FROM storage.files WHERE id = $1::uuid",
-        )
-        .bind(file_id)
-        .fetch_optional(self.pool.as_ref())
-        .await
-        .map_err(|e| {
-            DomainError::internal_error("FileBlobWrite", format!("fetch blob_hash: {e}"))
-        })?;
+        let blob_hash: Option<String> =
+            sqlx::query_scalar("SELECT blob_hash FROM storage.files WHERE id = $1::uuid")
+                .bind(file_id)
+                .fetch_optional(self.pool.as_ref())
+                .await
+                .map_err(|e| {
+                    DomainError::internal_error("FileBlobWrite", format!("fetch blob_hash: {e}"))
+                })?;
 
         // DELETE fires trg_files_decrement_blob_ref → storage.blobs.ref_count--
         self.delete_file(file_id).await?;

src/infrastructure/services/dedup_service.rs

@@ -44,8 +44,8 @@ use std::sync::Arc;
 use tokio::fs;
 use tokio::io::{AsyncReadExt, AsyncSeekExt};
 
-use crate::application::ports::blob_storage_ports::BlobStorageBackend;
 use crate::application::ports::blob_lifecycle::BlobDeletionHook;
+use crate::application::ports::blob_storage_ports::BlobStorageBackend;
 use crate::application::ports::dedup_ports::{
     BlobMetadataDto, DedupPort, DedupResultDto, DedupStatsDto,
 };

src/infrastructure/services/thumbnail_service.rs

@@ -25,8 +25,8 @@ use tokio::time::timeout;
 use crate::application::ports::thumbnail_ports::{
     ThumbnailPort, ThumbnailSize as PortThumbnailSize, ThumbnailStatsDto,
 };
-use crate::infrastructure::services::dedup_service::DedupService;
 use crate::domain::errors::{DomainError, ErrorKind};
+use crate::infrastructure::services::dedup_service::DedupService;
 
 /// Thumbnail sizes supported by the system
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]

src/interfaces/api/handlers/dedup_handler.rs

@@ -502,7 +502,6 @@ impl DedupHandler {
             .unwrap()
             .into_response()
     }
-
 }
 
 // ── Route handlers (free functions) ──────────────────────────────────────────