feat(analysis): bind exhaustive case-deletion refit to an analysis-run profile

[seonghobae]

Consolidation status

case_deletion_refit_v1 / tepp.case_deletion_refit.v1 is a Draft Analysis Run fold child, not independent protected-main authority. Current exact child head is b38fdce0c2dc1eb244ad2abf0fc4bed42dfe656c on protected main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0.

The surviving Validation / Analysis Run vehicle is #416 at 03f8de2ed0a0fb842d2022d411814e440df7cfb4. Fresh comparison is diverged with protected main as merge base: this child has 13 unique commits and is 81 #416 commits behind. Preserve every valid source/test/ADR/doctoring delta through an ordinary conflict-resolving non-force fold; simple Close is not consolidation.

Scientific / temporal finding and repair

Protected main already owns analysis_engine::fit_exhaustive_case_deletion, which fits the complete corpus and every actual D \\ {i} corpus. This PR keeps that reusable scientific runner as owner and adds only the Analysis Run historical-admission/artifact boundary.

The predecessor profile was not actually cutoff-safe or resource-bounded: it supplied no per-document snapshot/availability provenance, all rows reached the fitter, request/executor cutoffs were compared as RFC 3339 text, terminal provider validation reused the domain inference claim, and exhaustive refitting admitted an unbounded corpus even though the runner stores n(n-1) retained document identities plus one full and one posterior per deletion.

Repair lineage:

• RED bc877e152fc9ad239de88f7050fd95854cdefab6: equivalent cutoff spellings, terminal validation/domain-claim separation, and 257-document/no-fitter-call contract.
• Causal repair eff6eafcec5d644d3414332bd6ce750c344652bd: aligned immutable snapshot IDs + AvailableTime, parsed KnowledgeCutoff::instant() equality, cross-snapshot refusal, same-snapshot future censoring before scientific/duplicate admission, raw MAX_EVIDENCE_UNITS, current-representation budget 256 * 255 = 65,280 retained identities (max 256 admitted docs / 257 full+deletion fitter calls), terminal validation_status="validated", and bounded canonical artifact serialization.
• Runtime dependency 6d0fb9081334e30dbe062aa11bc594eed801f3e7: canonical corpus_split::cutoff_eligible promoted to production dependency.
• Contract migration 4a85e41519bf806334d2d4f41cde9938d9cd8d6c: future-duplicate replay invariance, cross-snapshot/misaligned provenance refusal, visible duplicate refusal, equivalent cutoff instants, and 257-document zero-fitter-call refusal.
• Resource hardening 7705111516eda65b38e4cf7d8d3069f786bab65d: every cutoff-visible document ID is bounded before quadratic retained-ID cloning; derived seed_domain_base:full is bounded before any expensive fit.
• Admission-edge tests b38fdce0c2dc1eb244ad2abf0fc4bed42dfe656c: oversized visible ID and oversized derived full seed fail with fitter call count 0; raw MAX_EVIDENCE_UNITS + 1 fails pre-fit; availability-slice misalignment is covered.
• ADR 816917b5089320595f6dcf97db88f8929225a8b0 / 8f2aca3ef9afd5d9ed573e9b15197ccb3b75f50f: ADR 0056 returned from premature Accepted to Proposed and records temporal/resource semantics including the remaining limit of the generic resource claim.
• Doctoring 738a97d76f9766afbc099cec97820e9cb5ee31da: currentizes owner split, replay invariant, resource denominator, residual issue, and live review gate.

Historical replay invariant: evidence from the requested snapshot with AvailableTime > knowledge_cutoff cannot affect the earlier admitted corpus, duplicate/scientific admission, artifact, or terminal result. Cross-snapshot evidence is a provenance violation and fails closed rather than being censored.

The 256-document ceiling is an application-path safety contract for the current quadratic representation, not a scientific assertion about valid sample size. It bounds retained identity count/bytes and the number of retained fitter outputs; it does not prove the byte size of arbitrary concrete fitter-owned evidence D or posterior P. That remaining production resource-envelope owner gap is tracked in #499. Do not raise the ceiling or claim a complete worker-memory/SLO bound until #499 has concrete fitter evidence or a representation change.

Documentation authority

docs/adr/0056-case-deletion-refit-analysis-run.md is Proposed. The child still carries a stale Accepted row in the shared docs/adr/README.md; canonical docs/TRACEABILITY.md / docs/product-technical-gap-baseline.md are also shared consolidation surfaces. Those current-state repairs have been handed to #435 and must point to the eventual #416/successor authority. PR body/comments are handoff evidence, not checked-in documentation completion.

Review / exact-head gate

All three pre-existing inline findings have concrete repair replies and are currently resolved: unbounded exhaustive refits, missing snapshot/availability admission, and incomplete verification evidence. One resource thread was deliberately reopened after detecting unbounded retained-identity bytes, then re-resolved only after 77051115... / b38fdce0... and residual issue #499. Thread resolution is not approval.

Live organization ruleset 18156473 requires one qualifying current-head approval, dismisses stale approvals after pushes, requires all review threads resolved, and enforces central required workflows. The former body text claiming two independent approvals was stale.

Fresh workflows for exact head b38fdce0c2dc1eb244ad2abf0fc4bed42dfe656c:

• CodeQL PR 34801851879: queued;
• Documentation Quality 34801851883: queued;
• Rust Foundation CI 34801851878: queued;
• SAST Semgrep 34801851881: queued;
• Security Scan 34801851894: queued.

No predecessor checks, coverage receipts, or reviews transfer to this head. This PR does not claim GREEN, 100% coverage, Ready, or merge authorization.

Fold gate

Before successor-based Close, verify on the surviving #416/successor exact head that explicit snapshot/availability provenance, parsed-instant cutoff binding, cutoff-before-scientific admission, future-evidence replay invariance, cross-snapshot refusal, raw and quadratic resource bounds, visible-identifier/derived-seed bounds, zero-fitter-call oversize refusals, admitted-count semantics, provider/domain status separation, bounded-wire proof, focused tests, ADR 0056 Proposed semantics, doctoring, TRACEABILITY, and every other valid child delta survived ordinary conflict-resolving consolidation. Then reacquire exact-head line/branch coverage, required security/CodeQL/documentation workflows, resolved current findings, and qualifying independent review on the unchanged survivor.

No self-approval, force push, destructive rebase, skip/xfail, coverage-denominator change, scanner suppression, no-op rerun, mutable dependency consumption, or predecessor evidence transfer is authorized.

[seonghobae]

Operator COMMENT on exact head 1ebb626.

This is not an APPROVE. Author COMMENTED is not an independent review. Ruleset 18156473 still needs two independent current-head APPROVEs from non-author, non-bot reviewers.

Bind is exhaustive actual case-deletion as case_deletion_refit_v1 (ADR 0056). Distinct from composed fitted-lineage (#412 / ADR 0055), Pareto (#409 / ADR 0053), fitted Schwarz-only (#404 / ADR 0049), and export retrieval (#411 / ADR 0054). Reweighting cannot substitute for an actual deleted-data fit. Not a Bayesian sampler. Not implemented-main.

Do not self-approve. Do not merge without two independent approvals. Predecessor Checks do not transfer.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 3 potential issues.

[seonghobae]

Restack on protected main (a243f18)

Non-force merge of origin/main (merge commit 2499329e); the only conflict was the CHANGELOG.md append, both entries kept. ADR 0056 already carries an admitted maturity value (active-PR).

Local evidence on the pushed head (toolchain 1.98.0): cargo test -p analysis_engine 38 passed / 0 failed, cargo clippy -p analysis_engine --all-targets -D warnings clean, cargo fmt --all --check clean, documentation/workspace/docstring contracts PASS, git diff --check clean.

🤖 Generated with Claude Code

[seonghobae]

Coverage gap on this branch: located, one of three lines repaired

Production line and branch coverage fails on 2499329e for three lines in crates/analysis_engine/src/case_deletion_refit_artifact.rs (local cargo llvm-cov -p analysis_engine):

• 240 — ? on AnalysisRunTerminalResult::succeeded(...): reachable only via an invalid completed_at. Repaired in the pushed commit with invalid_completed_at_fails_terminal_result_construction (asserts Err(Api(InvalidWirePayload))); 4/4 execution-contract tests pass, clippy/fmt/docstrings clean.
• 231 — ? on AnalysisResultSummary::new(…, document_count, 3, …): only fails above the 1e9 summary bound, unreachable after execute_* validation.
• 119 — post-serialize payload.len() > CASE_DELETION_REFIT_ARTIFACT_BYTE_LIMIT in to_json(): unreachable with validate()-bounded fields.

The last two are the "unreachable ? / dead byte-limit branch" categories recorded on #416 and need an owner decision.

The Python job failure on this head is main's #492-owned hourly-cron test, unrelated to this branch.

🤖 Generated with Claude Code