test: pin the deletion scope with regression tests

[lesandie]

Why

The suite proved that a candidate list is deleted, batched and checkpointed correctly. It never proved the list contains only orphans.

FakeCH.query_row_block_stream ignores the anti-join SQL and returns pre-canned blocks, so the one statement that forms the entire safety boundary was never asserted on. The two tests that did read stream_query only checked ORDER BY.

Evidence

Mutation testing established the gap rather than assuming it — the repo was copied to a scratch dir, the delete scope was broken eleven ways, and the full suite was run against each.

Mutation	Before	After
LEFT ANTI JOIN → LEFT JOIN — candidates include referenced objects	65 passed	caught
--dry-run performs real deletions	65 passed	caught
Drop clusterAllReplicas fan-out — blobs referenced only by another replica look orphaned	65 passed	caught
Point disk_name at a nonexistent disk — orphans the whole bucket	65 passed	caught
Drop the remote_path = objpath join key	65 passed	caught
Drop the --useage grace window	65 passed	caught
Drop s3o.active=true	65 passed	caught
Remove the preflight_cluster() call	65 passed	caught
Preflight accepts any replica count	65 passed	caught
Ignore S3 delete errors	caught	caught
Tombstone unconfirmed rows	caught	caught

2 of 11 → 11 of 11.

What this does not change

s3gc.py is deliberately untouched. The anti-join is correct today and no behaviour changes. These tests exist so that a future edit which quietly widens the deletion scope fails a test instead of reaching a customer bucket.

What is now pinned

13 tests asserting the scope directly: anti-join semantics, the remote_path = objpath join key, the disk_name predicate, the clusterAllReplicas fan-out when a cluster is configured, active=true, the --useage window, candidates being drawn only from the auxiliary table, that a dry run cannot reach S3 at all, and that the cluster/replica preflight gates the delete path.

Defects recorded, not fixed

Each needs an explicit decision, so they are documented in CHANGELOG.md and tracked in TODO.md rather than changed here:

• USEAGE_HOURS=0 silently removes the only guard against deleting a part mid-write. ClickHouse uploads a part's blobs to S3 and registers them in system.remote_data_paths a moment later; in that window a live blob looks orphaned. There is no per-object re-check before the S3 delete, so the --useage clause is the whole safety margin — and if args.useage else "" emits no clause for 0, which render.py accepts (only negatives are rejected). Covered by test_useage_zero_disables_the_age_guard, which documents the hazard.
• --useafter is interpolated unquoted, the only unquoted value in the anti-join WHERE clause. Recorded as a strict xfail so it flips to a failure the moment it is fixed.
• The cluster/replica preflight is point-in-time, run once, while the anti-join is re-issued per sample over what can be hours. A replica lost mid-run is not re-detected.

Checks

pytest -v -m "not dev_cluster"     78 passed, 1 xfailed
render.py example.env              OK (94 lines)
kubeconform -strict                Valid: 1, Invalid: 0, Errors: 0

🤖 Generated with Claude Code