release: fix raw retention boundary

[samo-agent]

Summary

• separate exact physical raw coverage (ash._raw_oldest_sample()) from the reusable minute-aligned planning/loss boundary (ash._raw_retention_start())
• floor both sides of the wait/query tie guard and print the same down-rounded remediation boundary it accepts
• keep source selection and report query attribution tied to physical coverage while status/report coverage expose the logical boundary
• preserve still-readable evidence after delayed rotation by choosing the older of ring geometry and the physical oldest minute
• add three independent exact B3 regressions, including the README query copied verbatim after a no-argument ash.start() call
• clarify the logical-vs-physical report and status contracts

Root cause

ash._raw_retention_start() exposed the exact first sample second. Readers query minute buckets, so status could not be fed back into since, and the guard rounded its advice up past the only partial minute. The same physical timestamp was also being used for source attribution and public planning even though those are different contracts.

Verification

• all three exact failures reproduced independently on current main (1fcf9e7): README drill errors, status self-feed errors, and advice rounds up to an empty result
• PostgreSQL 17.9 fresh install and full discovered upgrade chain: pass
• exact README/default-start/status/advice B3 step: pass
• report attribution, retention split, delayed-rotation range guard, compare, and chart step: pass
• behavioral reader suite through the changed retention section: pass
• release: prevent cleanup from deadlocking rotation #185 cleanup/rotation regression: pass
• grant_reader dynamic helper closure: 41/41 current non-admin functions after release: fix reader privilege blockers and sample slot race #181, including direct EXECUTE/call of ash._raw_oldest_sample(); rebuild preserves it and revoke removes it
• workflow YAML parse and git diff --check: pass
• Codex review plus independent adversarial verification: approved with no blockers

Rebase resolution

Rebased onto current main (1fcf9e7). The ash.status() catalog-comment conflict preserves both #185's day-granular rotation / consecutive_rotate_failures contract and this PR's logical-vs-physical retention contract. Two test fixtures that still used a now-invalid 30-minute rotation_period were converted to the deliberate one-day contract and their entirely-past/partial/delayed-evidence ranges were scaled without weakening any assertion.

Merge sequencing

Land this retention-boundary change before rebasing sibling PRs #182 and #180. PR #181's dynamic non-admin helper enumeration is retained and verified for the new helper. Expect documentation conflicts in blueprints/AAS_API.md and blueprints/AAS_EXAMPLES.md when #182 and #186 are rebased.

Fixes #163

[NikolayS]

REV Code Review Report

• PR: release: fix raw retention boundary #189 — release: fix raw retention boundary
• Reviewed commit: f1d7aa7
• Pipeline: 8/8 checks passed (docs-lint; PostgreSQL 14, 15, 16, 17 cron on/off, 18, 19beta)

No issues found. Reviewed the final pushed diff for security, runtime/SQL correctness, exact regression coverage, repository guidelines, API contracts, documentation, upgrade behavior, and merge sequencing.

Result: PASSED

Area	Findings	Potential	Filtered
Security	0	0	0
Bugs	0	0	0
Tests	0	0	0
Guidelines	0	0	0
Docs	0	0	0
Metadata / API contract	0	0	0

Manual evidence included the three independent #163 RED assertions on the #129 base, the copy-pasted README drill on a fresh default-start install, status-boundary self-feed, down-rounded remediation preserving all eight samples, delayed-rotation evidence, the full discovered upgrade chain, fresh/upgrade schema equivalence, and the complete reader-helper privilege closure.

Merge-sequencing note (non-blocking): land B3 before rebasing #180/#182; reconcile their shared report/workflow/source-provenance regions and rerun the exact boundary tests. #181 must retain dynamic non-admin helper enumeration.

---

REV-assisted review (parallel analysis following postgres-ai/rev)

[NikolayS]

Codex review report — PASS

Reviewed rebased head e724827 against current main (1fcf9e7). No remaining blocker.

• RED: all three exact #163 regressions fail independently on main: the README tie drill raises and advises the next minute; feeding status.raw_retention_start back into the drill raises; following the advice yields {up,0,NULL,…}.
• GREEN: the consolidated README/default-start/status/advice block passes on PostgreSQL 17.9, as do the full behavioral reader step and the report/compare/retention/chart step.
• Rebase conflict: combined #185's day-granular rotation and consecutive_rotate_failures status wording with #189's logical-vs-physical retention wording.
• Semantic collision fixed: two #189 fixtures still assigned a 30-minute rotation_period, which #185 deliberately forbids. Commit e724827 retains the product validation and scales the synthetic windows to one-day geometry; the entirely-past, partial-overlap, delayed-evidence, and down-rounding assertions are unchanged in substance.
• #181 privilege bundle: 41/41 current non-admin functions are granted. ash._raw_oldest_sample() is explicitly EXECUTE-able/callable by the reader, survives rebuild_partitions, and is removed by revoke_reader. The historical PR-body count of 42 became 41 because #181 intentionally moved _admin_funcs() out of the reader set.
• Previous-fix cross-check: #185's cleanup/rotation regression still passes on this installer.
• Additional verification: fresh install, discovered full upgrade chain, YAML parse, and git diff --check pass. Automated Codex review and an independent adversarial review found no issues.

This is verification and collision resolution against the existing #160 audit; no assertions were deleted or weakened.