Purge consumed ActivityPub incoming delivery metadata #316

Merged

erik merged 1 commit from feat/task-95f554ae-consumed-delivery-cleanup into main

2026-10-30 21:38:44 -05:00

erik commented

2026-10-30 21:26:13 -05:00

Owner

Summary

Atomically remove selected incoming bodies, copy metadata and all coalesced delivery aliases in the configured actor/follow scope. Buffered deduplication remains; removed remote identities may return with fresh copy IDs and higher receipt positions. Old-ID retries cannot delete a redelivered copy.
Preserve cursor encoding/high-water marks, atomic retry-safe removal, inactive/unfollow boundaries, and author-owned publications/comments/engagement.
Add guarded operator-only bounded cleanup of legacy body-less history and adoption/client-coordination guidance. No automatic migration or startup purge.
Bump source contract to user-approved 3.0.0 (breaking) with OpenAPI/classification/digest and metadata tests; npm versions, pins and lockfile unchanged.

Task: task-95f554ae. Coordinated counterpart: Rott task-5a4a4e82.

Verification

VITEST_MAX_WORKERS=2 ./scripts/pre-pr.sh passed: build/contract validation, generated CSS, formatting, lint, types and all 1,510 tests (803 template-site tests).
New regressions reproduced retained metadata and failure to admit post-removal redelivery before implementation.
Full cleanup, stable cursor/reopen behavior, scoped legacy body-less removal, stale-ID retry safety, redelivered post/boost handling and rollback in every affected table are covered.
Exact operator SQL tested for bounded scope/cutoff selection, preserving live bodies/other scopes/high-water, invalid input and failure rollback. Signed delivery/loopback HTTP tests remain local-only; CI unchanged and uses test:ci.

Safety and coordination

The user approved lifting the Slugkit implementation deferral and breaking 3.0.0 plan. Shared remote-vs-copy identity/rollout notes were recorded in both tasks before coding. Do not deploy server retention or run legacy cleanup before verified Rott redelivery recognition, stable post/boost read identities, offline/restart handling and repeat cleanup. Rott storage/retention implementation remains client-owned and is not claimed ready. No existing/production database inspection/migration/deletion, website deployment, release or Rott source changes were performed. Dev environment remained stopped; tests use isolated databases.

Gates

CI run 572 passed at 2197392. Independent review returned PASS with no actionable findings (static review; local test log inspected). Explicit human merge approval required; do not auto-merge.

## Summary - Atomically remove selected incoming bodies, copy metadata and all coalesced delivery aliases in the configured actor/follow scope. Buffered deduplication remains; removed remote identities may return with fresh copy IDs and higher receipt positions. Old-ID retries cannot delete a redelivered copy. - Preserve cursor encoding/high-water marks, atomic retry-safe removal, inactive/unfollow boundaries, and author-owned publications/comments/engagement. - Add guarded operator-only bounded cleanup of legacy body-less history and adoption/client-coordination guidance. No automatic migration or startup purge. - Bump source contract to user-approved **3.0.0 (breaking)** with OpenAPI/classification/digest and metadata tests; npm versions, pins and lockfile unchanged. Task: task-95f554ae. Coordinated counterpart: Rott task-5a4a4e82. ## Verification - VITEST_MAX_WORKERS=2 ./scripts/pre-pr.sh passed: build/contract validation, generated CSS, formatting, lint, types and all **1,510 tests** (803 template-site tests). - New regressions reproduced retained metadata and failure to admit post-removal redelivery before implementation. - Full cleanup, stable cursor/reopen behavior, scoped legacy body-less removal, stale-ID retry safety, redelivered post/boost handling and rollback in every affected table are covered. - Exact operator SQL tested for bounded scope/cutoff selection, preserving live bodies/other scopes/high-water, invalid input and failure rollback. Signed delivery/loopback HTTP tests remain local-only; CI unchanged and uses test:ci. ## Safety and coordination The user approved lifting the Slugkit implementation deferral and breaking 3.0.0 plan. Shared remote-vs-copy identity/rollout notes were recorded in both tasks before coding. **Do not deploy server retention or run legacy cleanup before verified Rott redelivery recognition, stable post/boost read identities, offline/restart handling and repeat cleanup.** Rott storage/retention implementation remains client-owned and is not claimed ready. No existing/production database inspection/migration/deletion, website deployment, release or Rott source changes were performed. Dev environment remained stopped; tests use isolated databases. ## Gates CI run 572 passed at 2197392. Independent review returned PASS with no actionable findings (static review; local test log inspected). Explicit human merge approval required; do not auto-merge.

erik added 1 commit

2026-10-30 21:26:13 -05:00

feat: purge consumed incoming delivery metadata

CI / build-lint-test (pull_request) Successful in 1m4s

Details

21973921e8