Refuse incomplete split workflow history before cleanup writes #608

🤖 Generated by the Agentic Engineer

Description

Workflow cleanup must establish a complete history before planning any deletion. The capped-search path currently discards the parent query's advertised count before recursively reading disjoint date ranges. A smaller descendant inventory can therefore be treated as complete.

Steps to reproduce

A native local HTTP regression against unchanged catalogue code at 24a32fa returns a capped parent count of 1,000, followed by valid child responses containing zero or one eligible run. The real cleanup engine reports successful completion in both cases; with one eligible run and zero minimum retention, it issues one DELETE to the local fixture. No GitHub cleanup was executed.

Expected behavior

Every capped query retains its advertised count as a lower bound. Both child inventories must complete and together meet that node's bound before their result can support cleanup. A shortage refuses all mutation and produces no successful completion receipt.

Acceptance criteria

• Reject capped parents whose descendants contain zero, one or 999 runs, including non-dry-run execution with otherwise eligible deletion candidates.
• Check each capped node's own descendant count; earlier sibling results cannot conceal a deficient nested query.
• Retain advertised bounds above 1,000. A parent reporting 1,500 followed by 1,001 descendants must refuse.
• Accept exactly 1,000 descendants and preserve the existing parent-1,000/descendants-1,001 positive control; a capped total is a lower bound, not an exact equality assertion.
• Preserve retention, orphan revalidation, input defaults, credential boundaries, retry budgets, pagination/range/duplicate checks and all three hosted read-only reusable callers.
• Prove RED/GREEN through the real HTTP-backed cleanup engine, run the maintained validation, obtain current-head review/CI, merge, and exercise the exact merged source.

Priority and effort

High priority: incomplete observations must never authorize cleanup. Medium end-to-end effort covers the narrowly typed count propagation, nested/threshold regressions, native validation, review and merged readback. This is a reproduced source defect, not evidence that it caused a historical production mutation or the primary quota exhaustion.

Part of #596. Adaptive partitioning is deferred until this correctness floor is protected.