chore(issues): land the #ZBAC9D correction that missed its own PR

docs/outstanding-issues-inbox/79b8bfd3-66bc-4111-80b7-5df25727c4c3.json

@@ -0,0 +1,13 @@
+{
+  "version": 2,
+  "id": "79b8bfd3-66bc-4111-80b7-5df25727c4c3",
+  "createdOn": "2026-09-01",
+  "action": "update",
+  "payload": {
+    "id": "#ZBAC9D",
+    "pri": "P2",
+    "detail": "RE-VERIFIED against current main c944fcdad78e106a7fb7b9c99e5e3a829e022fc4 on 2026-09-01. CLOSED: the owner-deletion path is no longer outstanding. public.documents, document_labels, document_summaries and document_table_facts now use ON DELETE RESTRICT, with the live migration and a schema proof that pins the four visibility tables and their exact restrict action. CODE DEFECT (unresolved): public.retrieval_owner_matches treats the public sentinel as row_owner_id IS NULL, and retrieval_owner_matches_v2 treats include_public as row_owner_id IS NULL; neither predicate requires metadata.public_corpus = true. An ownerless row without the publication marker could therefore still enter a public retrieval result. EXPOSURE (measured 2026-09-01, owner-approved read-only GET against ref sjrfecxgysukkwxsowpy): total documents 2851; owner_id NOT NULL = 0; owner_id IS NULL = 2851; of those, metadata.public_corpus = true = 2851. EXPOSED COUNT = 0. The production corpus is deliberately published and has no privately owned or unmarked ownerless document. PRIORITY: P2, not P1. NEXT: change the retrieval contract so its public branch requires both owner_id IS NULL and metadata.public_corpus = true, preserving owned-document retrieval; this is a protected RAG behaviour change and requires the RAG flag, an offline regression proof, and a live eval-canary pair.",
+    "source": "repo-wide audit at 3ed1932 (six domain reviewers); re-verified against current main c944fcdad78e106a7fb7b9c99e5e3a829e022fc4 and an owner-approved read-only production count, database coordination chat 2026-09-01",
+    "baseRowFingerprint": "13eb57d22f4630a32ff989e07c37a577b5fd8eb3f7388c641c31998143ecdfe0"
+  }
+}

docs/outstanding-issues-inbox/f3d9d01a-becc-4d99-8f8b-74d0ca970038.json

@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "f3d9d01a-becc-4d99-8f8b-74d0ca970038",
+  "createdOn": "2026-09-01",
+  "action": "cancel",
+  "payload": {
+    "requestId": "224cda1c-ae72-4921-b8aa-e6b3e315796a",
+    "reason": "Superseded within the same PR by request 79b8bfd3-66bc-4111-80b7-5df25727c4c3 after the owner approved a read-only production count. The P1 escalation was premature: the code defect is real, but production holds 0 privately-owned documents, so nothing is exposed and the hazard cannot fire yet. Reissued at P2 with the measurement and an explicit trigger condition."
+  }
+}