Bound the dimension GC by the oldest surviving digest-carrying fact (#1795)

[erikdarlingdata]

Closes #1795, to the issue's own design notes.

The change

The #1782 guard deferred the WHOLE dimension GC whenever a dim-feeding purge failed — and the #1784 coverage clamp holds those purges every sweep on a coverage-lagging store (the production field state), so the GC deferred every sweep until a backfill landed. A 400-day orphan survived with nothing failed anywhere.

The GC now measures the true safety boundary: content older than the oldest SURVIVING digest-carrying fact row cannot be referenced by anything, whatever the reason those facts survive. Per the issue's notes:

• Bounded probe: min(collection_time) per dim-feeding table under exactly the predicate of a new V39 partial index per table — an index-edge read once per sweep, not an oldest-chunk walk through pre-query_text/query_plan_xml stored inline per row: 94% of a field store — normalize into hash-keyed dimension tables (~135x measured) #1767 NULL-digest rows. Probe predicate, index predicate, and PayloadDimensions.All are pinned to each other.
• Minimum across tables, same reasoning as the widest-retention horizon.
• Margins preserved: the measured side carries the same one-day margin as the assumed side (the hourly last_seen refresh guard); ComputeDimensionCutoff is pure and unit-tested (healthy floor → assumed horizon rules unchanged; held floor → clamped; no digest facts → assumed).
• The guard becomes unnecessary rather than dormant — it survives in one honest form: an UNMEASURABLE floor (table missing/unreachable) still defers the cycle, because pruning on an unknown boundary is the one way to dangle digests. New fixed log lines for both states (deferred-unmeasurable, bounded-by-surviving-facts).

Viewer: schema ladder gains the V39 arm (index-existence sentinel, the V22 pg_indexes idiom) so a fully-migrated store maps to exactly RequiredStoreSchemaVersion. StorageVersion 38 → 39; all version pins updated.

Fixture defect found and fixed en route

EnsureContinuousAggregatesAsync attaches refresh policies whose jobs fire IMMEDIATELY (#1788's finding). The live class's deep force-refresh collided with them (55P03), and a restore's DROP could collide with a running job's lock — silently stranding query_stats_db_hourly/db_daily in the shared fixture, whose leftover deep coverage then flipped the #1784 gate for every later test (the same manufactured-flake mechanism #1794 documented). The tests refresh manually and never needed the scheduler: the ensure wrapper now removes every rollup's refresh policy immediately, and the one force-refresh that can still catch an already-executing job retries bounded on 55P03 only — the product's own #1788 idiom, not a retry-wrap of an assertion.

Test plan

• New live test: on a coverage-clamped store the orphan is PRUNED and the referenced content SURVIVES, with the clamp verifiably holding and the bounded signature logged
• Rewritten deferral test: an unmeasurable floor (renamed table) defers with the new signature; measurable again → prunes
• Both watched RED by mutating ComputeDimensionCutoff to ignore the measured floor (unit pin + live test both fired)
• 3x consecutive full-class live runs against PostgreSQL 18.4 / TimescaleDB 2.28.1 — green, ZERO stranded aggregates after
• Full fast suite 3569 green (all version-ladder pins updated); service + viewer builds, 0 warnings
• darling-pg CI leg (fresh cluster, runs the V39 migration end to end)

🤖 Generated with Claude Code