Protect image asset cleanup lifecycle

[SunkenInTime]

Summary

• capture Page image references before orphan content is removed, then delete only exact Strategy-owned assets no remaining Page, element, or Lineup references
• turn Strategy deletion, upload replacement, and stale-upload cleanup into durable tombstones that retain Convex storage IDs and R2 object keys until physical deletion succeeds
• claim bounded cleanup batches atomically, retry failed R2 deletes, recover stranded claims hourly, and preserve ambiguous legacy or shared physical targets
• run stale pending/failed upload cleanup through auth-independent internal functions and cron jobs

Verification

• npx tsc --noEmit
• npm run test:convex (42 tests)
• npm run audit:convex-contract
• npm run audit:convex-architecture
• git diff --check

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 9327a730-b7de-438a-9349-e9c7f7183d6a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This change makes image cleanup durable: deleted page, strategy, stale-upload, and replaced assets are tombstoned before their storage targets are reclaimed. Focused lifecycle checks verified that assets referenced by another page remain protected, shared storage targets are preserved, failed R2 deletion remains retryable, and legacy rows without strategy ownership survive strategy deletion.

Confidence Score: 5/5

The validated image lifecycle paths preserve referenced, shared, and legacy assets while safely retrying failed external deletion.

All identified destructive cleanup scenarios were exercised through focused Convex lifecycle flows with in-memory state and mocked R2 responses. Each observed result matched the ownership, reference, tombstone, and retry protections in the changed code.

Files Needing Attention: No files require follow-up based on the validated cleanup behavior.

T-Rex Logs

What T-Rex did

• Ran the page-deletion lifecycle on the base and PR head; the PR-head suite passed all nine tests and source excerpts show remaining strategy references removed before cleanup.
• Ran shared-target cleanup scenarios before and after the change; the PR-head run showed the shared R2 key is not deleted and the shared Convex storage remains readable.
• Ran a focused cleanup flow with a mocked R2 DELETE failure; the first run tombstoned and released the claim, and a subsequent run with 500 then 404 retried the same key and finalized the row.
• Ran a strategy-deletion lifecycle with an active legacy image row that has no strategy owner; both the baseline and PR-head runs kept the image row and backing storage alive, and cleanup only targets rows indexed by the deleted strategy.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "Protect image asset cleanup lifecycle" | Re-trigger Greptile}