32cd2100d9dd11140705c848850e86c4f79191c4
max
  Tue Sep 1 07:02:04 2026 -0700
Reusable "view snapshot" sessions for durable, minimal Share-a-link links

"Share a link" could only share the whole cart: it saved a session holding
every track, setting and position, which bloated the central db and leaked
the sharer's unrelated tracks to whoever opened the link.  Anonymous share
sessions (under the reserved user "l") were also never reaped, so they
accumulated forever, and their 8-char names were generated client-side with
no uniqueness check, so two shares could collide and silently overwrite.

Adds a lightweight "snapshot session" facility (lib/snapshotSession.c): a
snapshot stores only the handful of cart variables a feature declares (a
registered snapshotType, e.g. "blat" -> {db, blatLastBigBed}), moves only
those variables' trash files into durable sessionData storage, and is saved
under a "__"-prefixed name.  The "__" marks it machine-made: hidden from the
My Sessions list by default and eligible for reaping.  For the anonymous "l"
owner the durable files fan out over two extra hash levels so one directory
never fills with millions of entries.

Every anonymous link now shares one server-side name generator
(snapshotNewName): a unique (db-checked), crypto-strong, "__"-prefixed token,
so tokens never collide.  The hgSession doSaveSessionJson endpoint gained
hgS_snapshotType (save a minimal snapshot rather than the whole cart) and
hgS_doAnonName (reserve a unique anonymous name without saving, so the
top-right dialog can preview the exact link before it is created).

Wired three callers to the facility:
- hgc htcBlatAlign "Share a link": a minimal "blat" snapshot instead of a
full-cart anonymous session.
- hgBlat results "Share a link": creates a "blat" snapshot on click and
reveals its ?u=&s= reopen link (rebuilt from the durable bigPsl by the
existing doShareReopen), replacing the trash-only reveal.
- top-right "Share a link": anonymous links use the reserved server name;
logged-in named shares are unchanged.

snapshotReaper (hg/utils) garbage-collects abandoned anonymous snapshots: it
deletes user "l" "__" rows whose lastUse is older than the TTL (hg.conf
snapshot.ttlDays, default ~4 years) and removes their durable files.  lastUse
is bumped on every open by the existing session load, so a link stays alive
as long as it is used.  Meant to run from the trash-cleaner cron.

Also folds in the recent Share-dialog work in these files: the auto share
name is a short "_" prefix instead of "share_", the dialog previews the link
and creates it only when the button is clicked (no orphan session just from
opening the dialog), an optional name field with an overwrite warning, and
the anonymous save path forces the reap-eligible "__" name.

refs #38197

diff --git src/hg/hgSession/hgSession.h src/hg/hgSession/hgSession.h
index a747b22f115..691f0b354b1 100644
--- src/hg/hgSession/hgSession.h
+++ src/hg/hgSession/hgSession.h
@@ -13,30 +13,40 @@
 
 /* Global variables - generally set during initialization and then read-only. */
 extern struct cart *cart;	/* This holds cgi and other variables between clicks. */
 extern char *database;		/* Current database, often but not always dbDatabase. */
 
 /* hgSession form inputs */
 #define hgsNewSessionName hgSessionPrefix "newSessionName"
 #define hgsNewSessionShare hgSessionPrefix "newSessionShare"
 #define hgsNewSessionDescription hgSessionPrefix "newSessionDescription"
 #define hgsDoNewSession hgSessionPrefix "doNewSession"
 
 // AJAX endpoint behind the "Share a link" menu button (see topLinks.js).  hgsShareAnon (when
 // set, or when no user is logged in) saves under the reserved anonymous user "l".
 #define hgsDoSaveSessionJson hgSessionPrefix "doSaveSessionJson"
 #define hgsShareAnon hgSessionPrefix "shareAnon"
+// AJAX endpoint that reserves (server-generates) a unique anonymous snapshot name and returns it as
+// JSON without saving, so the Share dialog can preview the exact link before the user commits.
+#define hgsDoAnonName hgSessionPrefix "doAnonName"
+// When set, doSaveSessionJson returns {"exists": true} instead of overwriting a session the logged-in
+// user already has under the requested name, so the Share dialog can warn before clobbering it.
+#define hgsFailIfExists hgSessionPrefix "failIfExists"
+// When set to a registered snapshotType (e.g. "blat"), doSaveSessionJson saves a lightweight
+// "snapshot" session holding only that feature's declared cart vars (see lib/snapshotSession.c)
+// instead of the whole cart.  The stored name is forced to the "__" snapshot prefix.
+#define hgsSnapshotType hgSessionPrefix "snapshotType"
 // Rename an existing session (hgsOldSessionName -> hgsNewSessionName) for the "Specify name" step.
 #define hgsDoRenameSessionJson hgSessionPrefix "doRenameSessionJson"
 
 // AJAX endpoints for the experimental client-rendered Sessions page (hgSession.js).  Each acts on
 // the session named by hgsOldSessionName (decoded) under the current user and returns JSON instead
 // of re-rendering the whole page.  All are covered by the hgsDo prefix in cleanHgSessionFromCart.
 #define hgsDoDeleteJson hgSessionPrefix "doDeleteJson"
 #define hgsDoShareJson hgSessionPrefix "doShareJson"
 #define hgsDoGalleryJson hgSessionPrefix "doGalleryJson"
 #define hgsDoOverwriteJson hgSessionPrefix "doOverwriteJson"
 #define hgsDoDescribeJson hgSessionPrefix "doDescribeJson"
 
 #define hgsSharePrefix hgSessionPrefix "share_"
 #define hgsGalleryPrefix hgSessionPrefix "gallery_"
 #define hgsEditPrefix hgSessionPrefix "edit_"