Enum ManageError 

pub enum ManageError {
    Store(ObjectStoreError),
    BranchNotFound(String),
    Protected(String),
    LockContended {
        branch: String,
        lock: String,
        ttl_seconds: i64,
    },
    PartialDelete {
        branch: String,
        undeleted: Vec<String>,
        attempted: usize,
    },
    InvalidBranch(String),
    Cancelled,
    Io(Error),
    Internal(String),
    StaleSnapshot {
        entity: String,
        reason: StaleReason,
    },
    Packchain(PackchainError),
}

Errors surfaced by the management surface.

Variants

Store(ObjectStoreError)

Underlying object-store call failed.

BranchNotFound(String)

delete-branch / protect / unprotect was invoked against a branch that has no objects under <prefix>/refs/heads/<branch>/.

Protected(String)

delete-branch was invoked against a branch that has a PROTECTED# marker. Mirrors the refusal the helper-protocol delete path emits so both surfaces share one wording.

LockContended

delete-branch could not acquire the per-ref LOCK#.lock because another writer (a concurrent git push / delete / compact) currently holds it. Mirrors the helper-protocol push path’s contention surface so both delete surfaces converge on the same “another operation in progress” wording. Issue #158: without this lock, a concurrent push that lands between the post-prompt re-list and the sweep is silently missed and the ref survives despite an apparent success.

Fields

branch: String

Branch the lock guards.

lock: String

Full lock key on the bucket (<prefix>/<ref>/LOCK#.lock). Operators copy this into a doctor invocation.

ttl_seconds: i64

Lock TTL in seconds at the time of attempted acquisition, rendered into the operator-facing message so a tuned GIT_REMOTE_OBJECT_STORE_LOCK_TTL_SECONDS is visible.

PartialDelete

delete-branch swept the fresh listing but one or more per-key deletes failed with a non-NotFound error. The loop continues past each transient failure so the caller has a complete inventory of which keys survived; this variant carries that inventory verbatim.

Retry on the same branch is naturally idempotent — the re-list at the start of the next delete call will only show the surviving keys, and the same loop will try to delete them. A NotFound mid-sweep is tolerated and counts as success, so the undeleted field is strictly the set of keys whose deletes raised something else (Network, AccessDenied, etc.).

Fields

branch: String

Branch the sweep ran against.

undeleted: Vec<String>

Keys whose per-key delete returned a non-NotFound error. Stored verbatim so a retry-by-key tool can target exactly what survived.

attempted: usize

Total number of keys the fresh listing yielded, for the operator-facing “N of M” framing in the error message.

InvalidBranch(String)

Branch name failed gix-validate’s strict ref-name check; we reject these at the management boundary so a value like foo/../bar cannot land as a literal substring of a stored object key.

Cancelled

User cancelled an interactive prompt via Ctrl+C or EOF. A deliberate “no” on a confirmation prompt is not an error — callers (ManageBranch::delete, fix_multiple_bundles) print “Aborted” and return Ok(()).

Io(Error)

I/O error from dialoguer or other non-store sources.

Internal(String)

A defensive invariant inside the management code was violated — for example a snapshot map lookup that the caller had previously proven to exist, or a prompter returning an out-of-range index. These should not happen in practice; surfacing them as a typed error keeps the helper from aborting the process.

StaleSnapshot

doctor’s top-of-run snapshot disagreed with a fresh re-check taken immediately before a mutating write — the on-bucket state changed under us between the snapshot LIST and the write. The canonical case (issue #138) is fix_head racing against a concurrent git push :<branch> or manage delete-branch: the operator picks a HEAD candidate from the snapshot, but by the time the prompt returns the chosen branch has been deleted. Writing HEAD anyway would reproduce the invalid-HEAD condition the doctor was trying to fix.

Carries the entity whose presence was re-verified (e.g. "refs/heads/main") and a StaleReason describing exactly what the re-check observed, so the operator-facing message names the branch and tells them to re-run the doctor.

Fields

entity: String

The ref-path or other entity whose presence was re-verified.

reason: StaleReason

What the re-check actually saw under that entity’s prefix.

Packchain(PackchainError)

Packchain engine surface error. Surfaced by the doctor’s engine-aware audit path. Carries the typed source so the main-level downcast can recognise transport failures and emit the categorical fatal: line.

Trait Implementations

impl Debug for ManageError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for ManageError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for ManageError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<Error> for ManageError

fn from(source: Error) -> Self

Converts to this type from the input type.

impl From<Error> for ManageError

fn from(err: Error) -> Self

Converts to this type from the input type.

impl From<ObjectStoreError> for ManageError

fn from(source: ObjectStoreError) -> Self

Converts to this type from the input type.

impl From<PackchainError> for ManageError

fn from(source: PackchainError) -> Self

Converts to this type from the input type.