fix(store): quarantine malformed pulled prompt deletes

[dnlrsls]

🔗 Linked Issue

Closes #1458 — tracker correction; only #1464 targets main.

🏷️ PR Type

• type:bug — Bug fix

Summary

• Closes the cursor-stall finding from chore(review): track prompt inbox identity foundation chain #1464 (r4116067096): a pulled keyed prompt delete without a session now dead-letters its raw payload with a typed identity reason instead of aborting the pull batch.
• Keep the inbox ID intact as evidence, do not persist an invalid tombstone, and let subsequent mutations advance. Valid keyed deletes and legacy idless deletes remain accepted.
• Document the quarantine semantics.

Evidence

• RED before correction: focused invalid-delete regression failed for blank and whitespace sessions; GREEN after correction.
• CODEX_HOME="" go test ./... -count=1 passed; golangci-lint run --new-from-rev=bec5f23fd21bb3323dc25bef5bc78791d4942e57 ./internal/store/... returned 0 issues; git diff --check passed.
• Native review review-2bdb0f9ebeed8613 approved and acknowledged.

Review focus

50 diff lines (45 additions, 5 deletions). The raw payload, reason code, missing tombstone, seq 1 cursor and subsequent valid seq 2 delete are asserted in internal/store/store_test.go.

Checklist

• Links to approved issue feat(store): preserve admitted prompt identity through sync and deletion #1458 via tracker chore(review): track prompt inbox identity foundation chain #1464
• Tests, documentation and native review
• CI and full CodeRabbit review on this published head

Summary by CodeRabbit

• Bug Fixes
  • Prompt deletions with an inbox ID but no session ID are now quarantined as dead-letter evidence instead of creating a tombstone.
  • The pull cursor advances after these invalid deletions, and subsequent valid deletions can still be applied.
  • Legacy deletions without an inbox ID remain valid.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5253dbe4-9e35-4f5b-9890-1f72367f87f5

📥 Commits

Reviewing files that changed from the base of the PR and between 37b7f07 and 0807ec2.

📒 Files selected for processing (3)

• docs/ARCHITECTURE.md
• internal/store/store.go
• internal/store/store_test.go

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

Pulled prompt deletes with an inbox ID and a blank session ID are now classified as invalid identity. The existing invalid-identity handling records dead-letter evidence and advances the cursor without writing a tombstone. Legacy deletes without an inbox ID remain valid.

Changes

Prompt delete identity handling

Layer / File(s)	Summary
Classify and quarantine invalid prompt deletes internal/store/store.go, internal/store/store_test.go, docs/ARCHITECTURE.md	The store classifies prompt deletes with an inbox ID and a blank session ID as invalid identity. Tests verify dead-letter evidence, no tombstone, cursor advancement, and application of a following valid delete. The architecture documentation describes this behavior and notes that legacy deletes without an inbox ID remain valid.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: alan-thegentleman

Merge Risk: ⚪ Minimal · up to 0807e

No actionable merge-blocking issue remains in the supplied evidence; the change is ready for normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 0807e

The change prevents a malformed delete from blocking later updates without applying that delete or creating an invalid tombstone. No newly introduced security issue was established. Access to retained payloads and behavior beyond the examined storage paths remain uncertain.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The newly accepted malformed input affects the existing pull target's cursor and deferred-evidence store, not the prompt table on the invalid path. The available dependency evidence does not establish a broader downstream or cross-service change.

Trust Boundaries and Controls

• observed — Remote mutation data reaches the prompt consumer through existing pull paths. Session and observation consumers compare mutation and payload identities, but the prompt consumer uses the payload SyncID without that comparison. This prompt behavior is outside the changed ranges and is not established as newly exposed by this PR.

Resilience and Maintainability Implications

• inferred — Transactional writes and sequence or chunk duplicate checks limit partial or repeated quarantine transitions. Concurrent behavior is supported by those code paths but was not independently established by a focused concurrency test.

Hardening Proposals

• proposed — Confirm who can read terminal deferred records and how long raw malformed payloads are retained, because this path newly stores payloads that previously caused the pull to abort. No unauthorized reader was established.

🚥 Pre-merge checks | ✅ 4 | ❓ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	❓ Inconclusive	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (2 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: quarantining malformed pulled prompt deletes.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (2 skipped: 1 unsupported, 1 too large.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dnlrsls]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.