fix: prune scoped metric deletes and enforce sample identity

Merged
AS
5d ago
+4155-52

Scoped metric-stream deletion currently joins candidate IDs against unrelated physical versions across the table. Resolve complete versions through immutable (id,user_id,provider_id,recorded_at) membership, then recheck mutable fields on the latest full row. Enforce the existing deterministic ID at new-publication ingress while retaining historical wire IDs and main’s Redpanda contracts.

Also restrict Docker latest tagging to the default branch. Preserve curated history-recovery/identity evidence and provide an explicit disposition for all 728 frozen paths from superseded #3231. Broker infrastructure belongs to #3233; account erasure and required analytics/schema dependencies belong to #3234. Deferred transport/marker-v2 prototypes remain at the immutable source rather than being imported wholesale.

Validation:

  • RED observed on old source: pruning read 77,824 rows (bound <32,768); ingress accepted caller identity.
  • 129 focused unit tests passed (ingress, sink, consumer, writer, producer and routes).
  • 20 sink integration tests passed on each real engine: ClickHouse 26.10.2.103 and exact 26.6.1.1193, retries disabled.
  • Root TypeScript check, Biome and diff whitespace checks passed.
  • Isolated Compose containers/network removed; no production actions, image build, migrations, offset changes, archive-body reads or historical re-audits.

The fixture proves pruning and semantic regressions, not a universal production scan bound. Historical receipts are dated observations with their original source revisions. No timeout/retry or optimizer tuning was added.

Summary by cubic

Fixes scoped metric-stream deletion so it no longer joins candidate IDs against unrelated physical versions across the table. The sink now resolves complete versions through immutable (id,user_id,provider_id,recorded_at) membership before rechecking mutable scope fields on the latest row. Also enforces the deterministic ID at publication ingress while retaining historical wire IDs, and restricts Docker latest tagging to the default branch.

Summary by Sourcery

Correct scoped metric-stream deletion identity handling and publication ID validation while preserving historical compatibility and tightening release evidence.

Bug Fixes:

  • Prevent scoped metric-stream deletions from selecting unrelated physical versions by resolving immutable sample identities before applying latest-row scope checks.
  • Enforce deterministic metric sample IDs for new publications while continuing to accept historical wire IDs.

Enhancements:

  • Preserve curated history-recovery, identity-audit, and superseded-PR disposition evidence, including ownership boundaries for deferred work.

CI:

  • Restrict Docker latest image tags to builds from the default branch.

Documentation:

  • Document completed history recovery, validation evidence, limitations, and the disposition of all paths from the superseded change.

Tests:

  • Add coverage for deletion pruning, mutable field corrections, mixed scopes, identity enforcement, historical IDs, and both supported ClickHouse versions.