I have finished writing the code and it seems to work, now tests are fine, test coverage is around 81%. There are no breaking changes with the original version, with a original version's config file, it would run exactly as before and viceversa. No breaking changes with configs.
The only change that may confuse you is that the function "downloadFile" got renamed to "downloadFileAndSend", cause it does both. Now downloadFile simply downloads a file (I use it for prefetching).

I have added a sqlite3 database to keep track of the downloaded databases links, integrated with GORM. Can be hard to debug issues with GORM, especially because it is not strongly typed and because queries use strings (which provide no hints if some parameters are not being used) and can silently fail (with requests not found error message, which happens also at every insert).
I'll try to explain by examples GORM's (default) naming conversion which is like:

TableName->table_name
ATTRIBUTE->attribute
AttRiBuTe->att_ri_bu_te
It should be intuitive, but I wasted about half an hour on that, I don't want to waste your time too.
The database could be useful for deploying the "stats" thing written as a todo.

I'll try to describe the prefetching mechanism as how I have implemented it right now:

When a .db file is requested and downloaded, I save the link and the last time it got requested in the db (MirrorDB table), db links are hard to generate otherwise.
When a package file whose name is structured as name-version-subversion-arch.pkg.tar.zst is requested, I save name, version (merging version-subversion into version), arch and the local repo name in the db (Package table). I also keep track of when it got prefetched and when got downloaded.
When the prefetching routine is being called, as first I delete "old" MirrorDB entries (old = if not downloaded after ttl_unaccessed_in_days days, it gets deleted from the table) and dead packages. A package is assumed dead if:
after ttl_unaccessed_in_days days it had been updated, it hasn't been actively requested by a client
after ttl_unupdated_in_days days in which it had never been requested nor updated. Right now the default value is quite high, set at 300 days (after not updating a package for 300 days with no client asking for it, I consider it dead, so I won't prefetch it anymore)
Then it starts to download the db files stored in the MirrorDB table into "tmp-db" folder in the pacoloco cache directory, it extract them, parse them and once parsed, stored their relevant entries (package name, arch and version) in RepoPackage table. Then I delete all the "tmp-db" files.
Then I do an inner join between Package table and RepoPackage table to find only the installed packages which have a different version upstream (in the join condition, i check package name and arch to be equal, and version to be different). Once those have been found, the old packages files (with their signature files) gets deleted and the new version gets prefetched
The prefetching function is the same handleRequest function adapted to use a single writer (the file one), and it calls a different function to store package data in the db (cause it would have to store different data)
It supports all the supported packages extensions so far
As future/possible improvements:

signature checking with prefetched files could be useful
Add other heuristics to decide whether discard or prefetch a package
Finally, really thanks for your work so far.

Closes anatol#27
Closes anatol#14