[randomparity]

Fresh completed or failed delete_owned decommissions now reclaim their partition-scoped ledger rows only after a matching applied partition-delete effect and complete retained-storage result are available. State, result and reclamation commit in one SQLite transaction. Unreadable retained entries preserve their available original identity in ledger_identity; readable reconstruction includes the volume group so namesake disks remain distinguishable.

The change preserves other partitions and existing abandoned, nonterminal, retain, dry-run, unproven, missing-result, oversized-result and historical behavior. It performs no physical storage cleanup or general ledger collection. Retained results still follow the existing 30-day retention policy; longer archival remains operator-owned. Ineligible records can continue consuming ledger capacity.

Validation covers 277 focused tests, including 19 ineligibility cases, real SQLite rollback and concurrent-reader visibility, controlled fault checks, and mocked HMC boundaries through the engine. Independent branch and static security reviews approved with no findings. The final candidate passed just verify (1,239.12 seconds; one run) and uv run --no-sync prek run --all-files (126.21 seconds; all 14 hooks). No live HMC tests ran.

The approved implementation estimate was corrected from 220–360 to 400–475 changed source/test lines after verification coverage reached 425 lines. The revised estimate received a fresh design review and scope audit; implementation scope remained unchanged. Review history: three design passes, one branch pass, two scope audits, and one static security pass. Accepted review limits are the existing result-retention period and capacity retained by ineligible rows.

Provenance: campaign 152593d7a535-fdfc969e-824d-4d69-a9ae-3ce95496903a, source issue #1890, operator-approved provenance-preserving rule. ADR 0341 records the decision. No follow-up candidates or deferred findings.

Closes #1890

Review exit payloads

• Accepted design-review suppressions: existing 30-day result retention; longer archival remains operator-owned. Ineligible rows retain existing capacity behavior. These are approved limits, not newly deferred work.
• Verification covers 19 ineligibility cases and 277 focused tests, including real SQLite rollback, concurrent-reader visibility and controlled faults.
• Estimate history: corrected 220–360 to 400–475 changed source/test lines after the observed 425-line result; fresh estimate design review and scope audit approved without scope changes.
• Review history: three design passes plus one branch pass (four cumulative rounds, one charter), two scope audits, one static security pass. Branch and security reviews approved with zero findings; no new suppressions.
• Deferrals, follow-up candidates, rejected findings, outstanding notes and remaining findings: none.

[randomparity]

verdict: approve
exit: none
findings: 0
iterations: 1
security: approve
delivered-head-sha: a04eee9

Forge whole-branch review

forge review: not required (Cast single cohesive task; forge has no whole-branch reviewer; quest branch and security reviews remain required)

Review exit payloads

• Accepted design-review suppressions: existing 30-day result retention; longer archival remains operator-owned. Ineligible rows retain existing capacity behavior. These are approved limits, not newly deferred work.
• Verification covers 19 ineligibility cases and 277 focused tests, including real SQLite rollback, concurrent-reader visibility and controlled faults.
• Estimate history: corrected 220–360 to 400–475 changed source/test lines after the observed 425-line result; fresh estimate design review and scope audit approved without scope changes.
• Review history: three design passes plus one branch pass (four cumulative rounds, one charter), two scope audits, one static security pass. Branch and security reviews approved with zero findings; no new suppressions.
• Deferrals, follow-up candidates, rejected findings, outstanding notes and remaining findings: none.