Prevent deleted garden data from resurfacing

[juliosuas]

Summary

• Replace physical garden deletes with irreversible, scrubbed tombstones.
• Add a server-issued garden epoch so an offline device cannot restore pre-reset data, even with a future device clock.
• Make reset_my_garden(request_id) idempotent and prevent watering history from being recreated behind tombstones.
• Reconcile iOS state against an authoritative cloud snapshot without advancing the local epoch across a raced reset.
• Run the ordered Supabase migration history and effective RLS/ACL behavior against PostgreSQL 16 in CI.

Root cause

A deleted row disappeared from the server, so another device interpreted its stale local copy as a new row and upserted it again. Timestamps alone cannot make account-wide reset safe because device clocks are not authoritative.

Deployment order

This is stacked on #18 and intentionally targets fsociaty/rocio-cloud-recovery.

Deploy migration 20260721000100_preserve_garden_deletions.sql together with this client. Older clients omit the server epoch and still issue physical DELETE requests; they fail closed and must update. The migration has not been applied to the linked Supabase project yet.

Validation

• 46/46 XCTest cases passed on iPhone 17 Simulator (iOS 26.3.1).
• Release gate: 11/11.
• Cloud security source audit: 37/37.
• PostgreSQL 16: both ordered migrations, RLS/ACL catalog checks, cross-user isolation, future-clock stale insert, idempotent reset retry, watering tombstone rejection, account purge, and final rollback all passed.
• Configured and unconfigured Debug runtime paths launch without crashing.

Known follow-up

A second app that stays open can temporarily keep showing a plant tombstoned elsewhere until its next full sync or relaunch. The server will not resurrect it; active-flush UI convergence will be handled next.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e5805024-5a69-403a-b14a-3ebc795d016c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fsociaty/rocio-v1-product-loop

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}