[HTExplicit]

Problem

#229 removed every reader of the retired Codex ticket feature but left its data in place on purpose (code-only release, so rollback stayed trivial). That data is still in the database:

• the 244/245 tables and their triggers, which still fire on every account and settings update;
• two settings rows, one of them holding the harvest proxy URL;
• ticket keys and the codex-runtime projection in accounts.extra;
• route bundles and cookie clocks holding raw cookie values in plugin state;
• routing leases;
• job rows of the retired kinds.

Change

Forward migration 263_purge_retired_codex_ticket_data.sql. It runs in one transaction with lock_timeout 10 s, is idempotent, and is a no-op on a fresh database. Each choice cites file:line evidence from the pre-removal code in its header.

1. Drops the triggers and functions from 244/245 first, then the three openai_codex_ticket_* tables.

2. Deletes the two settings the feature stored: openai_codex_ticket_enabled and openai_codex_ticket_harvest_proxy_url.

3. Removes from accounts.extra:

   • the codex_turn_ticket:* and codex_ticket_runtime:* keys, and codex_harvest_proxy_url;
   • the codexrip.codex-runtime entry of plugin_account_projections; the map itself goes only once it is empty.

   Accounts without these keys are not written.

4. Plugin state:

   • deletes the tickets, routing-demand and proxy-trust namespaces;
   • in codex-routing-private, deletes bundle.*, clock.*, seen.* and validation-result.*;
   • keeps the ledgers quality-run.*, validation.* and spent.*;
   • wire.* observations lose only their raw cookies member.

5. Deletes the routing-account and plugin-era tickets leases, and the job rows of codex_ticket_harvest, codex_ticket_stop and extension_operation. Their items go with them through the existing foreign key.

Code that only existed for this data is removed: the projection strip/preserve helpers and the three retired job-kind labels. Account writes now drop the retired extra keys, so importing an export taken before the purge cannot bring them back.

Rollback: the release-1 image (v0.2.11-codexrip.6) stays compatible. It reads none of the purged objects, and its migration runner skips the extra 263 ledger row. Images from before #229 lose the ticket feature state, which the owner accepted.

Verification

• TestMigration263PurgesRetiredCodexTicketData (integration) on a disposable PostgreSQL 18.1:
  • all migrations apply to an empty database;
  • the release-1 state is seeded with dormant rows of every kind, plus rows that must survive;
  • after 263, each purged and kept object is asserted;
  • a second apply changes nothing.
• Unit tests for the account-extra merges and the retired-kind job listing;
• go build ./..., go vet on the changed packages, vue-tsc --noEmit, the AccountTaskDrawer spec;
• a three-lens review (data safety, completeness, code), with every finding verified.

Not run: real model calls.

🤖 Generated with Claude Code