Make prune decide retention from filenames, not file content

Same anti-pattern as the last commit (ac7cf22), one function over:
history::prune read and fully deserialized EVERY run's JSON just to
sort by run.timestamp - a value save_run already writes straight into
the filename ({ts}.json / {ts}-{suffix}.json). prune is the one
command whose entire job is dealing with a lot of accumulated history,
so this was the worst-affected function of the three fixed this week -
a deployment that's been running monitor nightly for months, with
runs full of embedded screenshots, paid for parsing all of that on
every single prune.

Fix: reuse the timestamp_from_filename helper added in ac7cf22 for
all_known_forms. prune now never opens or reads a run file's content
at all, only its name - retention is pure filename bookkeeping.

Verified the same way as the last two rounds: added a test that
corrupts every run file's content and confirms prune still counts and
removes the right ones (it never needed to read them), then verified
that test actually catches the regression by temporarily reverting to
the old "parse every file, sort by parsed timestamp" implementation -
it failed on the corrupted content exactly as predicted - then
restored the fix.

cargo fmt/clippy -D warnings clean, full suite green (157 tests).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: voidstackloop

CHANGELOG.md

@@ -24,6 +24,15 @@ project doesn't have a release yet, so everything below is grouped under
 
 ### Performance
 
+- **`prune` no longer opens or parses any run file.** Same anti-pattern
+  as `all_known_forms` below, in the one command whose entire job is
+  handling a *lot* of accumulated history: `history::prune` read and
+  fully deserialized every run's JSON just to sort by `run.timestamp`,
+  which `save_run` already writes into the filename. Retention
+  decisions are now made from filenames alone — `prune` never touches a
+  run's content at all, so a deployment that's been running `monitor`
+  nightly for months prunes exactly as fast as one just getting
+  started.
 - **`all_known_forms` no longer parses every historical run to find the
   newest one.** `history::all_known_forms` — behind `formwatch report`,
   `serve`'s `/metrics`/`/api/forms`, and `baseline --write` — picked each

README.md

@@ -525,6 +525,11 @@ newest runs. Defaults can live in config (`keep_last:` / `keep_days:`) or
 `*.json` run files and leaves anything else in the history directory
 alone. Run it from the same cron/Action that runs `monitor`.
 
+Retention decisions come entirely from filenames (each run's timestamp
+is already encoded there) — `prune` never opens or parses a run's
+content, so it stays cheap no matter how much history has accumulated
+or how much screenshot data those runs carry.
+
 ## Container
 
 A multi-stage `Dockerfile` builds a small Debian image with Chromium and

src/history.rs

@@ -346,6 +346,13 @@ pub struct PruneReport {
 /// Deletes history runs per `retain`, per form. `now` is passed in so the
 /// `Days` policy is testable; `dry_run` computes the outcome without
 /// touching disk. Other files in a form directory are left alone.
+///
+/// Retention is decided from filename timestamps alone (see
+/// [`timestamp_from_filename`]) — a run file is never opened or parsed,
+/// so pruning a long-lived history stays cheap regardless of how many
+/// runs (or how much embedded screenshot data) it holds. A `.json` file
+/// whose name doesn't carry a recognizable timestamp is left alone,
+/// consistent with "other files in a form directory are left alone."
 pub fn prune(base: &Path, retain: Retain, dry_run: bool, now: i64) -> Result<PruneReport> {
     let mut report = PruneReport::default();
     if !base.exists() {
@@ -364,9 +371,10 @@ pub fn prune(base: &Path, retain: Retain, dry_run: bool, now: i64) -> Result<Pru
             if path.extension().and_then(|e| e.to_str()) != Some("json") {
                 continue;
             }
-            let run: RunResult = serde_json::from_str(&fs::read_to_string(&path)?)
-                .with_context(|| format!("parsing {}", path.display()))?;
-            runs.push((run.timestamp, path));
+            let Some(ts) = timestamp_from_filename(&path) else {
+                continue;
+            };
+            runs.push((ts, path));
         }
         // Oldest first; filename breaks ties so same-second runs (with a
         // `-N` suffix) stay a stable, total order.
@@ -738,6 +746,33 @@ mod tests {
         let _ = fs::remove_dir_all(&dir);
     }
 
+    #[test]
+    fn prune_does_not_need_to_parse_any_run_file() {
+        // Retention decisions come from filename timestamps alone, never
+        // by parsing run content — proven by corrupting every file:
+        // prune must still count and remove the right ones.
+        let dir = std::env::temp_dir().join("formwatch-test-prune-corrupt");
+        let _ = fs::remove_dir_all(&dir);
+        let url = "https://city.gov/a";
+        for ts in 1..=4 {
+            save_run(&dir, &run_at(url, ts)).expect("save");
+        }
+        for ts in 1..=4 {
+            fs::write(
+                dir_for(&dir, url).join(format!("{ts}.json")),
+                "{not valid json",
+            )
+            .expect("corrupt");
+        }
+
+        let report = prune(&dir, Retain::Last(2), false, 0)
+            .expect("prune should never need to parse run content");
+        assert_eq!(report.removed, 2);
+        assert_eq!(report.kept, 2);
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
     fn run_status(timestamp: i64, status: Status) -> RunResult {
         RunResult {
             schema_version: SCHEMA_VERSION,