[server] Harden account erasure with bounded identifiers

Merged
AS
4d ago
+20729-5237

Hardens account erasure so bounded encrypted identifiers and physical proof survive until every required store is verified. Covers persisted canonical_activity_id/evidence_activity_id aliases, nullable/direct ownership, request-owned snapshots, PeerDB paging, and the full 500-table/1 MiB fail-closed catalog contract. Selects the required shared analytics schema from 0178 and the guarded identifier migration 0179 individually.

User decision: implement safety before merge. User approval for the normal automatic production release after CI passes. These comments transparently transcribe the task responses. Final exact-head CI passed. The normal approved maintenance release is next; no bypass or manual production rollout.

The safety changes:

  • Actual sink callbacks acquire the existing durable publication owner before membership reads and keep it through terminal writes and acknowledgement; replacement consumers use the same owner.
  • Normal/local dbt, bounded repair/rollback builds and cycling publication use that owner. Native child admission remains nonterminal until the actual synchronous adapter, child exit and fresh selected-model artifacts agree. Unknown executor outcomes retain the barrier.
  • Frozen physical intent can replay only under safely admitted ownership, preserving original parts, schema and mutation evidence. There is no automatic crash clearance or new tracking framework.
  • Migration 0179 blocks unfinished legacy requests and now selects the existing maintenance deployment mode so old web producers cannot create uncaptured requests after its guard. Retained identifiers bind to their original credential key configuration. Final physical progress checks use the current database clock and roll back stale descriptor retirement atomically.
  • Physical absence queries batch exact database/table/hash tuples within the existing budgets, including inactive and projection parts. Root capture deduplicates with SQL UNION before encryption without combining identifier families.

Contains main 762b92df6, including tiered storage, the shared quarantine correction and the cycling history fix. Main's six checkpoint fields and tiered/runtime hooks coexist with the newer request-owned and physical state.

Validation: exact 26.6 focused actual-writer/recovery qualification; exact 26.10 80/80 native cases (35 writer/owner/entrypoint, 40 erasure, 5 repair/rollback), all with retries disabled. The erasure matrix retains the 400k/800k-row resource case, aliases/ownership, frozen recovery, inactive/projection parts, survivors and metadata cleanup. Latest local checks also passed 58 real PostgreSQL store cases, affected units, root/server/web TypeScript and full lint/policy/SQL checks. Credential mutations: 48/48 killed. Root paging: 96.15%; transport positions: 97.37%, with only equivalent survivors and no exclusions. Evidence and retained diagnostic.

The final release review caught and fixed the missing 0179 maintenance marker. Stock classification changed from rolling to maintenance; 33 selector units, 10 real PostgreSQL cutover/capture cases and migration policy passed. This metadata-only change leaves the 80 native runtime results intact and requires a planned web availability interruption. The user explicitly approved that maintenance-window release after CI passes; the linked release decision record includes the exact response. The later current-main merge preserved both incident histories and the owned-client fixture: root TypeScript, 198 theCrag units and the strengthened native cycling-history/evidence/score case passed locally. Main’s final incident block remains at EOF to reduce further append conflicts.

Current head 8e7a6c5a2: CI 42711199875 passed: 109 successful jobs, five intentional skips and zero failures. Main 762b92df6 restores direct server deployment and independent mobile locking; its workflows and release documentation were inherited unchanged. Only the incident append conflicted; both histories are retained. Root TypeScript, changed-workflow actionlint, diff checks and the retained diagnostic patch check passed. Final conversation readback found zero unresolved threads; GitHub reports CLEAN/MERGEABLE and all required external checks passed. Earlier-head CI is historical evidence, not this head’s completed qualification.

Repeated read-only production preflight immediately before merge found zero cutover blockers, unfinished requests, retained user IDs/snapshots or unscrubbed rows under the exact 0179 predicate. Its locked migration guard still rechecks at execution time. After passing CI, merge is pinned to the checked head and the existing automatic release will be monitored. No manual production service update, acknowledgement, secret/key/offset change, historical identity scan, archive download or old-data retirement is authorized or performed.