fix(store): preserve verified prompt origin after local deletion

[dnlrsls]

🔗 Linked Issue

Closes #1458

Child of tracker #1464; merge into feat/prompt-inbox-foundation-tracker, not main. This slice does not enable cloud deletes or complete the tracker.

🏷️ PR Type

• type:bug — Bug fix
• type:feature — New feature
• type:question — Question requiring tracked work
• type:docs — Documentation only
• type:refactor — Code refactoring
• type:chore — Maintenance
• type:breaking-change — Breaking change

📝 Summary

• Retain the independently verified original local prompt-creation triple when explicitly deleting a prompt or session, in the same SQLite transaction.
• Read the exact sync ID fail-closed from either a live row or tombstone; imported/pulled tombstones and ordinary tombstone identity cannot mint origin.
• Test cross-project ownership and negative boundaries; document that local origin is not cloud authorization.

📂 Changes

File	Change
internal/store/store.go	Nullable origin columns and exact lookup; copy only during local delete.
internal/store/prompt_local_origin_test.go	Local delete, import/pull, duplicate, migration, replay and conflict regressions.
docs/codebase/prompt-inbox-provenance.md	Clarify retained evidence and unverified remote-delete boundary.

256 changed lines; no generated artifacts.

🧪 Test Plan

• Focused regression: go test ./internal/store -run 'TestLocalPrompt(Origin|CreationIdentity)' -count=1 — PASS (independent verification).
• Affected package: go test ./internal/store -count=1 — PASS (independent verification).
• Other local checks: go vet ./internal/store, git diff --check, CRLF-normalized gofmt comparison of changed Go files — PASS. Native review review-f620950200b1cd1c approved/acknowledged.
• GitHub full unit/E2E/plugin/lint/Windows and policy checks — pending after push; not inferred from local tests.

🤖 Automated Checks

All GitHub checks pending until they actually run; do not merge if any required check fails.

✅ Contributor Checklist

• Linked approved issue feat(store): preserve admitted prompt identity through sync and deletion #1458 (status:approved).
• Exactly one type:* label: type:bug.
• Recorded focused, package and additional checks with real outcomes; CI still pending.
• Docs updated for behavior.
• Conventional commit; no co-author trailer.
• Changed paths conform to transient-artifact policy.

💬 Notes for Reviewers

Local marker verifies only locally created source under exact stored identity. It cannot authorize registration, a dual-project cloud pair claim or remote deletion; T4b3/T4c remain separate. alpha session with beta prompt is intentional. Please inspect the pre-existing tombstone and pulled-live delete tests in particular. Merge by normal merge into #1464 only after CI and substantive review; #1464 stays out of main merge queue.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c639571e-5de2-4de7-b7bf-78806d8fcb23

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}