refac: atomic merge, lost-update race, RunPurge cost, duplicated walks

features/media_purge.feature

@@ -342,11 +342,12 @@ Feature: Owners and admins can merge duplicate images in use, with persisted pur
       And group B's UpdatedArticleIDs is empty, so no article of group B is in "articles_updated"
       And the stored last_purge_merged and last_purge_articles_updated equal the response totals
 
-    Scenario: A group that fails after rewriting bodies is reported as failed and contributes nothing
+    Scenario: A group that fails after rewriting bodies is rolled back, reported as failed and contributes nothing
       Given the image repository's Delete fails for a merged image of group A, and group B is planned
       When the client sends POST /v1/media/purge with {}
       Then the response status is 200, "failed_groups" is 1 and "groups_purged" is 1
-      And group A contributes 0 to "merged" and its article ids are not added to "articles_updated", even though its article bodies stay switched to the kept copy
+      And group A contributes 0 to "merged" and its article ids are not added to "articles_updated"
+      And group A's article bodies are back to their original text
       And "articles_updated" and "merged" count only the fully merged group B
       And a following GET /v1/media/purge-preview plans group A again, and the next run converges because the plan is recomputed from current data