fix(sources): report durable removal success

[NicholaiVogel]

Summary

Source deletion could commit configuration removal before asynchronous source work and cleanup had finished, making a durable change appear incomplete or allowing a late indexer to write artifacts back after purge. This PR makes completion, retryable cleanup, and operation conflicts explicit while serializing source deletion against mutations and in-flight startup/route indexing.

Flow

Changes

• Return HTTP 200 when source configuration removal is committed; cleanupPending indicates an index run or cleanup marker is still being drained.
• Return HTTP 202 when a durable deletion tombstone is recorded but a lifecycle, provider, purge, or config-removal step cannot yet complete; cleanup remains retryable.
• Return HTTP 409 when deletion conflicts with an active source mutation or another deletion.
• Hold source-scoped leases across reconnect, snapshot import, imported-source replacement/reimport, transcript finalization, and deferred cleanup.
• Track daemon-startup and route index runs through cancellation and final purge, retaining the deletion lease until late writes can no longer recreate source artifacts.
• Preserve generation checks so an old tombstone/finalizer cannot purge a newer source generation; reserve imported-source IDs before source-owned writes.
• Update source API documentation and regenerate the event-loop audit report/ledger.

Type

• feat — new user-facing feature (bumps minor)
• fix — bug fix
• refactor — restructure without behavior change
• chore — build, deps, config, docs
• perf — performance improvement
• test — test coverage

Packages affected

• @signet/core
• @signet/daemon
• @signet/cli / dashboard
• @signet/sdk
• @signet/connector-*
• @signet/web
• predictor
• Other: source API documentation and event-loop audit report

Screenshots

No dashboard markup, styling, or visual behavior changed; screenshots are not applicable.

Migration Notes (if applicable)

No database migrations were touched.

• Migration is idempotent
• Rollback / compatibility note included in PR description

Testing

• bun test passes

• bun run typecheck passes

• bun run lint passes

• Tested against running daemon

• N/A

• bun test platform/core/src/sources-config.test.ts platform/daemon/src/routes/import-routes.test.ts platform/daemon/src/routes/sources-routes.test.ts platform/daemon/src/routes/source-deletion-startup-race.test.ts platform/daemon/src/source-index-progress.test.ts platform/daemon/src/routes/transcript-import-routes.scope.test.ts platform/daemon/src/routes/hooks-routes.notifications.test.ts platform/daemon/src/session-recall-dedupe.test.ts — 118 passed, 0 failed.

• bun run build — passed.

• bun scripts/audit-event-loop-contract.ts — passed (809 inventory; 153 legacy DB sites; no violations).

• bun test scripts/audit-event-loop-contract.test.ts — 24 passed, 0 failed.

• bun run comments:check — passed.

• bun run typecheck — passed.

• bun run lint — exited 0 with existing repository warnings.

• bun run format:check — passed with existing large-file warnings.

• git diff --check — passed.

The two assertions in platform/daemon/src/transcript-import-bytes.test.ts are base-identical failures: cross-agent content expected 403/received 409, and cross-agent transcript export expected 403/received 200. bun scripts/doc-drift.ts also exits 1 with byte-identical output on base and PR. No running-daemon manual test was performed. CI for the rebased head will be reported after publication.

AI disclosure

• No AI tools were used in this PR
• AI tools were used (see Assisted-by tags in commits)

Notes

The current PR remote head predates the rebase. CI for the rebased head is pending until the updated branch is pushed. No running-daemon manual test was performed.