fix: release-review follow-ups for account removal (workflow-state rejections, stats-row creator, sweep pages)

[waleedlatif1]

Summary

Fixes the real findings from the v0.9.26 release review (#9155) on the account-removal work (#9139, #9141, #9146), plus one gap the review surfaced. Every other thread on that release was answered there.

Workflow-state rejections complete instead of alerting (background/workflow-execution.ts, lib/execution/preprocessing.ts)

• Preprocessing rejects a workflow that is gone (deleted or archived), not attached to a workspace, or not deployed only after a successful read. By design those rejections write no execution log, so fix(trigger): complete async workflow runs whose failure is already recorded instead of failing them #9139's "complete only once the rejection was logged" gate never passed for them and the Trigger run still failed and alerted.
• PreprocessExecutionError now carries an internal workflowState, and isWorkflowStateRejection() lets the task complete those rejections without waiting for a log.
• The field is internal on purpose: every surface copies named fields, so no API output (v2 execute details, its stream error event, MCP error data) changes.
• Quota-type rejections still complete only once logged, now classified by meaning instead of a status-code set:
  • suspended account and usage limit, via getDeterministicAdmissionRejectionCode;
  • reservation headroom, via isReservationHeadroomDenial, kept out of the shared classifier so webhook and polling retries are unchanged;
  • rate limit, via RATE_LIMIT_EXCEEDED_CODE.
• Retryable and 5xx rejections still throw.
• This also quiets queued jobs of workflows that were deleted with an account.

One creator for fallback user_stats rows (lib/billing/core/usage.ts)

• Two paths created a missing stats row without the deleted-identity check signup makes:
  • the storage tracker's in-transaction upsert;
  • the ownership-transfer insert.
• createUserStatsIfMissing(executor, userId) is now the only fallback creator. A row it creates gets that check (email; linked sign-ins only for the signup request), which runs in a savepoint and fails open. An existing row still costs exactly one conflicting insert.
• forfeitFreeTierAllowance(executor, userId) merges the two forfeit paths: a transaction on db, a savepoint inside a caller's transaction.
• ensureUserStatsExists is now a wrapper; the storage tracker and the ownership transfer call the creator.
• One stated delta: a stats row created by an ownership transfer now starts at getFreeTierLimit(), like every other creator, instead of the column default. The two differ only when FREE_TIER_COST_LIMIT is set.

Retired Project storage sweep finishes only on the provider's last page (lib/projects/files/prefix-cleanup.ts)

• It inferred completion from a short page, but Blob, GCS and S3-compatibles can return short or empty pages that are not final, so cleanup could finish early and orphan objects. It now ends on page.done.
• Within a run it follows the continuation token past pages that removed nothing, and stalls (spending an attempt) when the token stops advancing.

Storage reference guard (lib/users/storage-reference-guard.ts): also checks each URL with its #fragment removed. That only adds candidates, so it can only keep more objects.

Docs: cancelByWorkspace is scoped to persisted queue jobs.

Type of Change

• Bug fix

Testing

• Each behavioral change has a test that went red with the change reverted.

  • Preprocessing: a test per tagged producer, and a failed read stays untagged.
  • Task: deleted, not-attached and undeployed complete with no log; suspended, usage, headroom and rate limit throw when unlogged.
  • Project sweep: short and empty non-final pages, and a stuck token.
  • Guard: fragments, including the malformed-encoding path.

• Integration (real Postgres, run locally): deleted-identity 22/22, covering:

  • a storage-created row and an ownership-transfer-created row withheld for a deleted identity;
  • an existing row untouched;
  • fail-open under a lock timeout, with the caller's transaction intact.

  Also foundation 35/35 and storage-sweep 3/3.

• Unit and integration-adjacent suites: 1104 tests across background, preprocessing, admission, billing, Project cleanup and users.

• Independent reviews: a correctness review (savepoints verified on real Postgres, no lock-order change, no transient 403/404), a design review (which drove the typed classifier and the single creator), and a final full-diff review with a per-rejection behavior table.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 17, 2026 3:02am UTC

[cubic-dev-ai]

No issues found across 17 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>This PR changes payment, billing, or quota logic. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

This PR fixes account-removal follow-ups across execution jobs, billing stats, and storage cleanup.

• Async jobs finish workflow-state refusals without waiting for a log.
• Storage writes and ownership transfers use one stats-row creator.
• Retired Project cleanup finishes only on the provider's last page.
• Stored asset links still protect keys before a URL fragment.
• The queue docs say workspace cancellation skips in-memory runs.

Intentional behavior acknowledged by waleedlatif1: failed identity checks grant the allowance rather than block the caller; ownership-transfer-created rows use getFreeTierLimit() instead of the column default.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Preprocessing refuses execution] --> B{Retryable?}
  B -->|Yes| C[Fail job]
  B -->|No| D{Workflow state refusal?}
  D -->|Yes| E[Complete with failure result]
  D -->|No| F{Known account or quota refusal?}
  F -->|No| C
  F -->|Yes| G{Log saved?}
  G -->|Yes| E
  G -->|No| C

Loading

_{Reviews (1) · Last reviewed commit: "refactor(billing): drop the unused execu..." · Reviewed by Greptile}