3.0 KiB
Data model completion audit — 2026-09-10
The model node previously described push persistence and account deletion as
unfinished. Those statements are obsolete. This audit compares its requirements
with the current SQL changelog, services and existing passing tests; it adds no
migration and changes no data.
| Requirement | Implemented evidence |
|---|---|
| Private accounts, email identity, invitations and revocable device logins | app_user, email_identity, account_invitation, admission_control, device_login; email/admission/device services use transactions and hashed proofs. |
| Work belongs to the owner's customer/project | Composite foreign keys in work_project and work_entry; OwnerTransactions locks the active owner while WorkService checks the daily total and record version. |
| Daily habits, historical bounds and days off | habit, habit_day, habit_limit, day_off, their unique keys and owner relations; HabitService handles Monday boundaries and hint-only limits. |
| Defaults applied once | account_defaults records per-owner initialization; catalog/preferences remain owner-bound. |
| Push subscriptions and retry state | A subscription references its device login; device/account validation and optimistic versions are enforced by PushSubscriptions. ReminderQueue persists per-subscription/date status, retries and leases. Device deletion cascades to subscriptions and deliveries. |
| Complete transactional account deletion | AccountDeletion consumes the fresh proof and deletes the private trail in one transaction. Spent invitation markers remain spent; deletion cascades cover identity, device, push and deletion-grant records. |
| Time and browser boundaries | Technical timestamps use UTC epoch seconds derived from Instant; business dates use SQL DATE/LocalDate and validated IANA ZoneId identifiers. Browser drafts are not stored in these server tables. |
Historical oidc_identity schema remains for compatibility with existing
database histories and is cleaned during account deletion. The active account
binding is email_identity; no external identity provider is needed.
Reviewed passing CI XML reports from the 2026-09-10 05:50–05:51 UTC run cover
AccountDeletion (5 tests), AccountDeletionProofs (7), DeviceLoginService (7),
WorkService (8), HabitService (12), CatalogService (6), and EmailAccounts (10),
all with zero failures/errors/skips. The existing local PushSubscriptions report
adds 15 passing tests including queue restart/retry and concurrent claim
behavior; AdmissionService adds three. The complete CI build for 13f6c25
(0.1.86-SNAPSHOT) succeeded and deployed. The schema's last change was
2833c48, before these test runs.
H2 selection and jOOQ comparison remain documented in the persistence spike and decision 0001. Real failed-migration rollback is covered by WJ-021, with consecutive failures and failed recovery covered separately. These establish the persistence implementation; physical Android/background push delivery and restoration from Hostsharing's own backups remain open under their own nodes.