fix: empty reconstruction children during granted retention purge (v2.10.4)

[seonghobae]

Successor to dirty draft #177. Replays only the buyer-visible purge-children slice onto live #74 HEAD (fb3f3a4f, v2.10.3 404-drop). Do not merge #177. Do not merge this PR before #74. Do not merge #74 onto main.

Buyer impact

After a Demo Corp lineage reconstruction has started, a granted retention purge must still empty the registry. #74's 0020-only procedure deleted only status → scope → run → count → snapshot, so a Succeeded start would fail closed on an immutable trigger or FK.

purge_analysis_run_registry now handles immutable reconstruction children — analysis_run_lineage_edge, analysis_run_reconstruction, analysis_source_snapshot_member — without a superuser DISABLE TRIGGER. Missing child tables stay a no-op via to_regclass. Triggers re-enable on success and in the exception handler.

Delete order: lineage edges → reconstruction → 0018 rows → snapshot members → snapshot.

Insert an unrevoked analysis_run_retention_grant for session_user, GRANT analysis_run_retention_admin, then select purge_analysis_run_registry('approved-retention-purge'). The published phrase is not a secret.

This slice does not start reconstruction, invent a theta, expose purge on a public HTTP route, or grant the admin role to DATABASE_URL. It does not mix leftover pairs, RankWeave, Valkey, orchestrator envelope, fail-closed naruon/TEPP/ThreadWeave/Keyverse main-track, IRT/linking, or TEPP topic/ALR. Accessible names (v2.10.1), the HTML parser (v2.10.2), and the 404-drop (v2.10.3) stay as already landed on #74.

What to verify

1. After a Succeeded Demo Corp lineage start, follow the same grant + admin + phrase path. The registry empties, including reconstruction children.
2. A raw DELETE on those children still raises the immutable-trigger exception.
3. A 0020-only database without those relations still purges.
4. Purge is not on a public HTTP route. DATABASE_URL is not the admin role.

Tests

Live contract builds the three children with delete-reject triggers, then grant+admin purge empties them. Static contract requires the three relation names, to_regclass, and the specified delete order in 0020 and in the live 0023 replace.

Keyverse remains the IdP. React + live PostgreSQL. No file DB. No static HTML mock. Synthetic Demo Corp only.

  

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b71da66a-9ff6-4fa2-890b-71fe8069ec63

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.