Make document deletion durable before physical file cleanup

tests/document-file-failures.test.mjs

@@ -22,14 +22,20 @@ test('failed document insert removes only the new upload and preserves previous
   assert.equal(store.listDocuments('a').length,1);
 });
 
-test('filesystem deletion error preserves document metadata instead of reporting success',()=>{
+test('filesystem cleanup failure keeps a durable deletion task and denies document access',()=>{
   const destination=join(store.BELGE_DIR,'not-a-file');
   fs.mkdirSync(destination);
   const db=store.openDb(); db.exec('DROP TRIGGER reject_document'); db.close();
   const id=store.addDocument('a',{ad:'test',boyut:1,dosya:'not-a-file'});
-  assert.throws(()=>store.deleteDocument('a',id));
-  assert.ok(store.getDocument('a',id));
   assert.equal(store.deleteDocument('b',id),false);
-  fs.rmdirSync(destination);
+  assert.ok(store.getDocument('a',id));
   assert.equal(store.deleteDocument('a',id),true);
+  assert.equal(store.getDocument('a',id),null);
+  const pending=store.openDb();
+  assert.ok(pending.prepare('SELECT 1 FROM document_file_cleanup WHERE dosya=?').get('not-a-file'));
+  pending.close();
+  fs.rmdirSync(destination);
+  const recovered=store.openDb();
+  assert.equal(recovered.prepare('SELECT COUNT(*) n FROM document_file_cleanup').get().n,0);
+  recovered.close();
 });