fix(integ): bound production credential scans and classify disabled TTL

[TheodoreSpeaks]

Production copy of staging PR #7860. Hold until staging deployment and integration verification complete.

Summary

Credential deletion exceeded the integ client's 30-second timeout while the paused-execution reference query reached a 46-second p99. Materialize workspace-scoped rows before searching JSON across blocks, deployments, paused executions, and checkpoints, preserving archived-workflow cleanup.

Also give disabled TTL column creation a stable TABLE_ROW_TTL_DISABLED detail code so the integration probe can tolerate error wording changes without accepting unrelated 400s. Deploy this app change before the companion infra check.

Related integration update: https://github.com/simstudioai/infra/pull/362

PostgreSQL CI also exposed a cross-file DDL deadlock: one suite replaced OAuth triggers while another deleted a user. Run the shared-schema suites sequentially; their internal concurrency tests remain concurrent.

Testing

• App type-check and API validation audit passed.
• 48 credential cleanup/orchestration/webhook tests and 17 TTL/error-policy tests passed.
• Synthetic PostgreSQL validation confirmed identical results, workspace isolation, and archived-workflow coverage. Under the same alternative join plan, JSON inspection dropped from 2,003 rows to the target workspace's 3 rows.
• No schema migration or new retry behavior.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 15, 2026 8:55pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no outstanding correctness, security, or repository-rule issues identified.

Summary

This PR bounds credential-reference scans by materializing workspace-scoped snapshot rows before inspecting JSON, adds a stable error detail code when table-row TTL is disabled, and prevents shared-schema PostgreSQL test suites from deadlocking.

• Preserves credential cleanup across workflow blocks, deployments, paused executions, and checkpoints, including archived workflows.
• Classifies disabled TTL requests as TABLE_ROW_TTL_DISABLED, including through wrapped orchestration errors.
• Runs trigger-mutating PostgreSQL test files sequentially while retaining each suite's internal concurrency coverage.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Credential deletion requested] --> B[Select workflow snapshots for workspace]
  B --> C[Materialize workspace-scoped rows]
  C --> D[Search selected JSON for credential reference]
  D --> E[Clear exact credential references]
  E --> F[Persist changed snapshots]

Loading

_{Reviews (2) · Last reviewed commit: "fix(ci): serialize shared-schema Postgre..."}

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}