collavre 0.22.0 → 0.24.0

data/app/models/collavre/creative/permissible.rb

@@ -3,13 +3,30 @@ module Collavre
     module Permissible
       extend ActiveSupport::Concern
 
+      # Single declarative registry of which persisted-attribute changes
+      # invalidate the permission cache, and how each is rebuilt. A single
+      # after_commit dispatcher maps the accumulated changes through this map so
+      # a new mutation path can never silently skip a required rebuild.
+      #
+      #   :rebuild       -> rebuild_for_creative (self + descendant subtree)
+      #   :rebuild_owner -> update_owner (move the owner cache entry)
+      #
+      # origin_id is immutable after create (see Linkable#attr_readonly), so its
+      # entry only fires on link creation and is defensive.
+      PERMISSION_INVALIDATING_ATTRIBUTES = {
+        "parent_id" => :rebuild,
+        "user_id"   => :rebuild_owner,
+        "origin_id" => :rebuild
+      }.freeze
+
       included do
         has_many :creative_shares, class_name: "Collavre::CreativeShare", dependent: :destroy
         has_many :creative_shares_caches, class_name: "Collavre::CreativeSharesCache", dependent: :delete_all
 
-        after_commit :rebuild_permission_cache, if: :saved_change_to_parent_id?, unless: :destroyed?
+        after_save :accumulate_permission_cache_changes
+        after_commit :dispatch_permission_cache_invalidation, unless: :destroyed?
         after_commit :cache_owner_permission, on: :create
-        after_commit :update_owner_cache, if: :saved_change_to_user_id?, unless: :destroyed?
+        after_rollback :clear_accumulated_permission_changes
       end
 
       def has_permission?(user, required_permission = :read)
@@ -23,42 +40,21 @@ module Collavre
         children_ids = children_scope.pluck(:id)
         return [] if children_ids.empty?
 
-        min_rank = CreativeShare.permissions[min_permission.to_s]
-        accessible_ids = Set.new
-
-        if user
-          user_entries = CreativeSharesCache
-            .where(creative_id: children_ids, user_id: user.id)
-            .pluck(:creative_id, :permission)
-
-          user_has_entry = Set.new
-          user_entries.each do |cid, perm|
-            user_has_entry << cid
-            perm_rank = CreativeSharesCache.permissions[perm]
-            if perm_rank && perm_rank >= min_rank && perm_rank != CreativeSharesCache.permissions[:no_access]
-              accessible_ids << cid
-            end
-          end
-
-          public_accessible = CreativeSharesCache
-            .where(creative_id: children_ids, user_id: nil)
-            .where("permission >= ?", min_rank)
-            .where.not(permission: :no_access)
-            .pluck(:creative_id)
-          accessible_ids.merge(public_accessible - user_has_entry.to_a)
-
-          owned_ids = children_scope.where(user_id: user.id).pluck(:id)
-          accessible_ids.merge(owned_ids)
-        else
-          accessible_ids = CreativeSharesCache
-            .where(creative_id: children_ids, user_id: nil)
-            .where("permission >= ?", min_rank)
-            .where.not(permission: :no_access)
-            .pluck(:creative_id)
-            .to_set
-        end
-
-        children_scope.where(id: accessible_ids.to_a).order(:sequence).to_a
+        # The deny-invariant (owner wins → user entry, incl. a no_access deny,
+        # beats public → effective-origin resolution) now lives in exactly one
+        # place: PermissionFilter. This site used to re-implement it inline.
+        accessible_ids = Collavre::Creatives::PermissionFilter.new(user: user)
+          .readable_ids(children_ids, min_permission: min_permission)
+
+        # readable_ids gates a linked shell on its origin being readable AND the
+        # viewer being able to see the shell's placement (owns it, or it sits in
+        # a subtree shared with the viewer). Listing one's OWN tree keeps the
+        # prior policy that a viewer always sees their own children — including a
+        # shell they own whose origin is no longer shared with them — so union
+        # those owned rows back in. (Owner has admin, so this is rank-independent.)
+        accessible_ids |= children_scope.where(user_id: user.id).pluck(:id) if user
+
+        children_scope.where(id: accessible_ids).order(:sequence).to_a
       end
 
       def all_shared_users(required_permission = :no_access)
@@ -105,21 +101,73 @@ module Collavre
 
       private
 
-      def rebuild_permission_cache
-        PermissionCacheJob.perform_later(:rebuild_for_creative, creative_id: id)
+      # Accumulate permission-affecting changes across every save in the
+      # transaction. after_commit sees only the *final* save's saved_changes, so
+      # if a permission attribute changes in one save and a later same-
+      # transaction save of this record touches only untracked columns, that
+      # permission change is clobbered out of saved_changes and a saved_changes-
+      # gated dispatcher would skip the rebuild, leaving the permission cache
+      # stale (fail-open, with no TTL/self-heal). Merging each save's changes
+      # keeps the invariant regardless of save ordering. This mirrors the fail-
+      # closed intent of the CreativeShare fix (#1393 / 00502d7d); it is
+      # centralized here via cross-save accumulation rather than an
+      # unconditional refresh so that permission-irrelevant Creative updates
+      # (progress rollup, description edits — a hot write path) stay cheap.
+      #
+      # No production path performs two real saves touching a permission
+      # attribute then an untracked column on one Creative in a single
+      # transaction today (the reorderer re-saves :sequence via update_column,
+      # which does not run changes_applied and so preserves saved_changes), so
+      # this is a defensive/latent fix. Note: update_column bypasses this
+      # callback too, which is why the reorderer's parent change still refreshes.
+      def accumulate_permission_cache_changes
+        changes = saved_changes.slice(*PERMISSION_INVALIDATING_ATTRIBUTES.keys)
+        return if changes.empty?
+
+        @accumulated_permission_changes ||= {}
+        changes.each do |attribute, (old_value, new_value)|
+          existing = @accumulated_permission_changes[attribute]
+          # Keep the earliest "old" and the latest "new" across saves.
+          @accumulated_permission_changes[attribute] = [ existing ? existing.first : old_value, new_value ]
+        end
       end
 
-      def cache_owner_permission
-        PermissionCacheJob.perform_later(:cache_owner, creative_id: id)
+      def clear_accumulated_permission_changes
+        @accumulated_permission_changes = nil
       end
 
-      def update_owner_cache
-        old_user_id, new_user_id = saved_change_to_user_id
-        PermissionCacheJob.perform_later(:update_owner,
-          creative_id: id,
-          old_user_id: old_user_id,
-          new_user_id: new_user_id
-        )
+      # Single dispatch point for permission-cache invalidation. Maps the
+      # accumulated permission-attribute changes through
+      # PERMISSION_INVALIDATING_ATTRIBUTES and enqueues each distinct rebuild
+      # exactly once.
+      def dispatch_permission_cache_invalidation
+        accumulated = @accumulated_permission_changes || {}
+        clear_accumulated_permission_changes
+
+        operations = accumulated.keys
+          .map { |attr| PERMISSION_INVALIDATING_ATTRIBUTES[attr] }
+          .uniq
+        return if operations.empty?
+
+        operations.each { |operation| run_permission_cache_operation(operation, accumulated) }
+      end
+
+      def run_permission_cache_operation(operation, accumulated)
+        case operation
+        when :rebuild
+          PermissionCacheJob.perform_later(:rebuild_for_creative, creative_id: id)
+        when :rebuild_owner
+          old_user_id, new_user_id = accumulated["user_id"]
+          PermissionCacheJob.perform_later(:update_owner,
+            creative_id: id,
+            old_user_id: old_user_id,
+            new_user_id: new_user_id
+          )
+        end
+      end
+
+      def cache_owner_permission
+        PermissionCacheJob.perform_later(:cache_owner, creative_id: id)
       end
     end
   end

data/app/models/collavre/creative.rb

@@ -5,6 +5,40 @@ module Collavre
   class Creative < ApplicationRecord
     self.table_name = "creatives"
 
+    # ---------------------------------------------------------------------------
+    # Reserved metadata key registry — engines register their own namespaces so
+    # `update_metadata` preserves them without core naming vendor-specific keys.
+    # ---------------------------------------------------------------------------
+    BUILTIN_RESERVED_METADATA_KEYS = %w[markdown_source content_type editor].freeze
+
+    class << self
+      def registered_reserved_metadata_keys
+        @registered_reserved_metadata_keys ||= []
+      end
+
+      def register_reserved_metadata_key(key)
+        registered_reserved_metadata_keys << key.to_s unless registered_reserved_metadata_keys.include?(key.to_s)
+      end
+
+      def reserved_metadata_keys
+        (BUILTIN_RESERVED_METADATA_KEYS + registered_reserved_metadata_keys).freeze
+      end
+
+      # ------------------------------------------------------------------------
+      # Read-only source registry — vendor engines register the `data.source.type`
+      # values whose content is owned by an external system (e.g. a synced GitHub
+      # repository) and therefore must not be edited in-app. Core enforces the
+      # read-only behavior via `read_only_source?` without naming any vendor.
+      # ------------------------------------------------------------------------
+      def read_only_source_types
+        @read_only_source_types ||= Set.new
+      end
+
+      def register_read_only_source(type)
+        read_only_source_types << type.to_s
+      end
+    end
+
     # Use non-namespaced partial path for backward compatibility
     def to_partial_path
       "creatives/creative"
@@ -43,10 +77,28 @@ module Collavre
       data&.dig("kind") == "inbox"
     end
 
-    attr_accessor :skip_github_validation
+    # Bypass the read-only-source guard for a single save (used by the vendor
+    # sync services that legitimately write the synced content into core).
+    attr_accessor :skip_read_only_source_validation
+
+    # The registered source identifier for this creative, or nil when the
+    # description is authored in-app.
+    def source_type
+      data.is_a?(Hash) ? data.dig("source", "type") : nil
+    end
+
+    # Whether this creative's description is owned by an external, registered
+    # source and therefore read-only in-app.
+    def read_only_source?
+      type = source_type
+      type.present? && self.class.read_only_source_types.include?(type)
+    end
 
+    # GitHub-sourced content still needs a vendor-specific predicate for the
+    # comment view's inline-image rendering (a GitHub-only concern, distinct
+    # from the neutral read-only behavior above).
     def github_markdown?
-      data.is_a?(Hash) && data.dig("source", "type") == "github_markdown"
+      source_type == "github_markdown"
     end
 
     # Find or create the "System" topic for this inbox creative.
@@ -133,7 +185,14 @@ module Collavre
 
     after_save :update_parent_progress
     after_destroy :update_parent_progress
-    after_save :update_mcp_tools
+    # Re-derive MCP tools only when the description (the tool source of truth)
+    # actually changed, and defer the HTML parsing to a background job so it
+    # never runs inline on progress/move/autosave writes. The dirty flag is
+    # captured in after_save (where saved_change_to_description? is reliable);
+    # a later same-transaction save can clobber saved_changes before the
+    # after_commit hook runs.
+    after_save :mark_mcp_tools_sync_pending, if: :saved_change_to_description?
+    after_commit :enqueue_mcp_tools_sync, if: :mcp_tools_sync_pending?
 
     # --- Drop Trigger ---
     def drop_trigger_enabled?
@@ -292,8 +351,17 @@ module Collavre
       @progress_service ||= Collavre::Creatives::ProgressService.new(self)
     end
 
-    def update_mcp_tools
-      McpService.new.update_from_creative(self)
+    def mark_mcp_tools_sync_pending
+      @mcp_tools_sync_pending = true
+    end
+
+    def mcp_tools_sync_pending?
+      @mcp_tools_sync_pending == true
+    end
+
+    def enqueue_mcp_tools_sync
+      @mcp_tools_sync_pending = false
+      UpdateMcpToolsJob.perform_later(id)
     end
 
     def progress_cannot_change_if_has_origin

data/app/models/collavre/creative_share.rb

@@ -20,11 +20,32 @@ module Collavre
     validates :permission, presence: true
     validates :user_id, uniqueness: { scope: :creative_id }, allow_nil: true
 
+    # Single declarative registry mirroring Creative::Permissible: which
+    # persisted CreativeShare attributes affect the permission cache, and how.
+    # Every create and update re-propagates the share unconditionally (see
+    # dispatch_share_cache_invalidation) — a fail-closed refresh that matches
+    # the prior propagate_cache and survives a multi-save transaction clobbering
+    # an earlier permission change out of the final saved_changes. This map
+    # governs the *extra* cleanup a move or reassignment needs on top of that
+    # base refresh, so a new share-mutation path still can't silently skip it:
+    #
+    #   :relocate    -> creative_id moved: purge this share's rows and rebuild
+    #                   the vacated (old creative, old user) subtree
+    #   :reassign    -> user_id changed: purge this share's rows and rebuild the
+    #                   old user's subtree at the current creative
+    #   :repropagate -> permission changed: covered by the unconditional
+    #                   re-propagate above (listed to document the invariant)
+    PERMISSION_INVALIDATING_ATTRIBUTES = {
+      "creative_id" => :relocate,
+      "user_id"     => :reassign,
+      "permission"  => :repropagate
+    }.freeze
+
     after_create_commit :notify_recipient, unless: :no_access?
     after_save :touch_creative_subtree
     after_destroy :touch_creative_subtree
 
-    after_commit :propagate_cache, on: [ :create, :update ]
+    after_commit :dispatch_share_cache_invalidation, on: [ :create, :update ]
     after_commit :broadcast_share_change, on: [ :create, :update ]
     after_destroy_commit :remove_cache
     after_destroy_commit :broadcast_share_destroy
@@ -92,34 +113,65 @@ module Collavre
       Creative.exists?(origin_id: creative.id, user_id: user.id)
     end
 
-    def propagate_cache
-      # If creative_id or user_id changed, handle old cache entries properly
-      if saved_change_to_creative_id? || saved_change_to_user_id?
-        # Delete only caches created by THIS share (fast operation, keep synchronous)
-        CreativeSharesCache.where(source_share_id: id).delete_all
-
-        # Rebuild caches for old user in old subtree (background job)
-        if saved_change_to_creative_id?
-          old_creative_id = creative_id_before_last_save
-          old_user_id = user_id_before_last_save || user_id
-          if old_creative_id
-            PermissionCacheJob.perform_later(:rebuild_user_cache_for_subtree,
-              creative_id: old_creative_id,
-              user_id: old_user_id
-            )
-          end
-        elsif saved_change_to_user_id?
-          old_user_id = user_id_before_last_save
-          if old_user_id
-            PermissionCacheJob.perform_later(:rebuild_user_cache_for_subtree,
-              creative_id: creative_id,
-              user_id: old_user_id
-            )
-          end
+    # Single dispatch point for permission-cache invalidation on share writes.
+    # Every create and update re-propagates the share unconditionally — a
+    # fail-closed refresh matching the prior propagate_cache, correct even when
+    # a multi-save transaction clobbers an earlier permission change out of the
+    # final saved_changes. On an update, a move (creative_id) or reassignment
+    # (user_id) additionally purges the stale rows this share left behind — the
+    # purge is carried on the same propagate_share job (purge_stale:) rather than
+    # deleted synchronously, so timing is uniform and it no longer blocks commit.
+    def dispatch_share_cache_invalidation
+      propagate_args = { creative_share_id: id }
+
+      unless previously_new_record?
+        operations = (saved_changes.keys & PERMISSION_INVALIDATING_ATTRIBUTES.keys)
+          .map { |attr| PERMISSION_INVALIDATING_ATTRIBUTES[attr] }
+          .uniq
+
+        # A move (creative_id) or reassignment (user_id) leaves stale rows keyed
+        # to this share. The purge rides ON the propagate_share job (purge_stale:
+        # true), which deletes those rows immediately before re-propagating — in
+        # one job, never as a standalone enqueue. The authz queue runs two
+        # threads, so a separate purge could otherwise run AFTER propagate and
+        # delete the freshly written rows (both key on source_share_id), dropping
+        # the share's access until an unrelated rebuild. Folding it in keeps the
+        # work async (off the commit path) so the revoke of the vacated access is
+        # merely deferred by the queue latency (~1-2s) — it only PROLONGS an
+        # already-granted permission by that window, never grants a new one,
+        # which the CTO judged acceptable for the perf win. Then rebuild the
+        # vacated subtree. creative_id takes precedence when both change,
+        # preserving the prior branch order.
+        if operations.include?(:relocate) || operations.include?(:reassign)
+          propagate_args[:purge_stale] = true
+          rebuild_vacated_subtree(relocated: operations.include?(:relocate))
         end
       end
 
-      PermissionCacheJob.perform_later(:propagate_share, creative_share_id: id)
+      PermissionCacheJob.perform_later(:propagate_share, **propagate_args)
+    end
+
+    # Rebuild the cache the moved/reassigned share vacated, for the old user in
+    # the old location, so an ancestor share (or its absence) is re-applied.
+    def rebuild_vacated_subtree(relocated:)
+      if relocated
+        old_creative_id = creative_id_before_last_save
+        old_user_id = user_id_before_last_save || user_id
+        return unless old_creative_id
+
+        PermissionCacheJob.perform_later(:rebuild_user_cache_for_subtree,
+          creative_id: old_creative_id,
+          user_id: old_user_id
+        )
+      else
+        old_user_id = user_id_before_last_save
+        return unless old_user_id
+
+        PermissionCacheJob.perform_later(:rebuild_user_cache_for_subtree,
+          creative_id: creative_id,
+          user_id: old_user_id
+        )
+      end
     end
 
     def remove_cache

data/app/models/collavre/inbox_item.rb

@@ -16,10 +16,10 @@ module Collavre
     after_commit :broadcast_badge_update, on: %i[create update destroy]
     after_create_commit :enqueue_push_notification
 
-    attribute :state, :string, default: "new"
-    validates :state, inclusion: { in: %w[new read archived] }
+    enum :state, { new: "new", read: "read", archived: "archived" }, default: :new, scopes: false
     validates :message_key, presence: true
 
+    # Kept explicit (not enum's generated `.new` class-scope, which collides with the constructor).
     scope :new_items, -> { where(state: "new") }
 
     def localized_message(locale: I18n.locale)

data/app/models/collavre/task.rb

@@ -11,6 +11,18 @@ module Collavre
 
     validates :name, presence: true
 
+    enum :status, {
+      pending: "pending",
+      queued: "queued",
+      running: "running",
+      delegated: "delegated",
+      pending_approval: "pending_approval",
+      done: "done",
+      failed: "failed",
+      cancelled: "cancelled",
+      escalated: "escalated"
+    }, default: :pending
+
     after_update_commit :check_trigger_loop_completion, if: :trigger_loop_candidate?
     after_update_commit :broadcast_stop_button_removal, if: :became_terminal?
 
@@ -24,6 +36,21 @@ module Collavre
       rel = rel.where(creative_id: creative_id) if creative_id
       rel.order(:created_at)
     }
+    # Tasks that hold a topic concurrency slot: running/delegated (executing)
+    # plus pending — a task that has been claimed (dequeue_next_for_topic moves a
+    # waiter queued -> pending, a retry re-queues to pending, initial dispatch
+    # creates pending) but whose AiAgentJob has not started yet — plus
+    # pending_approval — a task paused awaiting tool approval that intentionally
+    # keeps its resource (AiAgentJob sets should_release = false) and does NOT
+    # drain the topic queue (dequeue_next_for_topic only fires on terminal
+    # statuses done/failed/cancelled/escalated). Orphan detection must count all
+    # of these, otherwise a claimed-but-not-started or approval-paused slot looks
+    # free and a second waiter gets promoted into the same slot.
+    scope :occupying_topic_slot, ->(topic_id, creative_id = nil) {
+      rel = where(topic_id: topic_id, status: %w[running delegated pending pending_approval])
+      rel = rel.where(creative_id: creative_id) if creative_id
+      rel
+    }
 
     # Check if agent already has an in-flight task triggered by the same comment.
     # Treats "delegated" as in-flight: a Claude Channel task that is waiting on

data/app/models/collavre/user.rb

@@ -44,6 +44,15 @@ module Collavre
     has_many :creatives, class_name: "Collavre::Creative", dependent: nil
     before_destroy :destroy_creatives_leaf_first
 
+    # /compress and /merge summaries are durable recovery artifacts: they replace
+    # the deleted original conversation and anchor the restore control (rendered
+    # from the surviving result comment via CommentSnapshot). Detach them (nullify
+    # author) BEFORE the comments dependent: :destroy cascade — prepend ensures we
+    # run first — so deleting the authoring agent/user doesn't destroy the summary
+    # and orphan the snapshot, which would erase the only path to restore the
+    # compressed conversation.
+    before_destroy :preserve_durable_summary_comments, prepend: true
+
     belongs_to :creator, class_name: "Collavre::User", foreign_key: "created_by_id", optional: true
     has_many :created_ai_users, class_name: "Collavre::User", foreign_key: "created_by_id", dependent: :destroy
 
@@ -58,6 +67,15 @@ module Collavre
     attribute :system_admin, :boolean, default: false
     attribute :searchable, :boolean, default: false
 
+    # Typo correction (2D gating: typing-device AND input-location must both be on).
+    attribute :typo_correction_enabled, :boolean, default: true
+    attribute :typo_correction_threshold, :integer, default: 80
+    attribute :typo_correction_on_soft_keyboard, :boolean, default: true
+    attribute :typo_correction_on_voice, :boolean, default: true
+    attribute :typo_correction_on_physical_keyboard, :boolean, default: false
+    attribute :typo_correction_in_chat, :boolean, default: true
+    attribute :typo_correction_in_editor, :boolean, default: false
+
     attribute :google_uid, :string
     attribute :google_access_token, :string
     attribute :google_refresh_token, :string
@@ -114,12 +132,14 @@ module Collavre
     end
 
     # Whether this agent uses stateful sessions (incremental messaging).
-    # nil in agent_conf = auto-detect by vendor (openclaw → true).
+    # nil in agent_conf = auto-detect via the AiClient adapter layer, which
+    # vendor engines register into (core never string-matches a vendor name).
     def supports_session?
       explicit = parsed_agent_conf.dig("session", "enabled")
       return ActiveModel::Type::Boolean.new.cast(explicit) unless explicit.nil?
+      return false if llm_vendor.blank?
 
-      llm_vendor&.downcase == "openclaw"
+      Collavre::AiClient.vendor_supports_session?(llm_vendor)
     end
 
     encrypts :llm_api_key, deterministic: false
@@ -140,15 +160,45 @@ module Collavre
       end
     end
 
-    LLM_VENDOR_OPTIONS = [
-      [ "Google (Gemini)", "google" ],
-      [ "OpenAI", "openai" ],
-      [ "Anthropic", "anthropic" ],
-      [ "OpenClaw", "openclaw" ]
-    ].freeze
+    TYPO_CORRECTION_DEVICES = %w[voice soft_keyboard physical_keyboard].freeze
+    TYPO_CORRECTION_LOCATIONS = %w[chat editor].freeze
+
+    # 2D gating: typo correction runs only when the master switch is on AND the
+    # originating typing device AND the input location are both enabled. Unknown
+    # device/location values are treated as disabled (fail closed).
+    def typo_correction_active_for?(device:, location:)
+      return false unless typo_correction_enabled
+
+      device_on = case device.to_s
+      when "voice" then typo_correction_on_voice
+      when "soft_keyboard" then typo_correction_on_soft_keyboard
+      when "physical_keyboard" then typo_correction_on_physical_keyboard
+      else false
+      end
+
+      location_on = case location.to_s
+      when "chat" then typo_correction_in_chat
+      when "editor" then typo_correction_in_editor
+      else false
+      end
+
+      device_on && location_on
+    end
+
+    # LLM_VENDOR_OPTIONS is resolved dynamically from the AiClient vendor-option
+    # registry so core lists only its built-in providers while vendor engines
+    # (e.g. OpenClaw) contribute their own. Resolved lazily via const_missing so
+    # the value always reflects registrations made after this class first loads
+    # (they run in a to_prepare hook), and existing views keep referring to the
+    # constant unchanged.
+    def self.const_missing(name)
+      return Collavre::AiClient.vendor_options if name == :LLM_VENDOR_OPTIONS
+
+      super
+    end
 
     SUPPORTED_LLM_MODELS = [
-      "gemini-3-flash-preview",
+      "gemini-3.1-flash-lite",
       "gemini-1.5-flash",
       "gemini-1.5-pro"
     ].freeze
@@ -194,6 +244,11 @@ module Collavre
     validates :timezone,
               inclusion: { in: ActiveSupport::TimeZone.all.map { |z| z.tzinfo.identifier } },
               allow_nil: true
+    # Column is NOT NULL; clearing the profile field (or a crafted PATCH) casts to
+    # nil and would raise a DB error on save. Validate so the form re-renders.
+    validates :typo_correction_threshold,
+              presence: true,
+              numericality: { only_integer: true, greater_than_or_equal_to: 0, less_than_or_equal_to: 100 }
 
     generates_token_for :email_verification, expires_in: 1.day do
       email
@@ -255,10 +310,35 @@ module Collavre
       end
     end
 
+    # Keep durable compress/merge summaries (snapshot result comments) alive when
+    # their author is deleted: nullify authorship instead of cascading destroy.
+    def preserve_durable_summary_comments
+      Collavre::Comment
+        .where(id: Collavre::CommentSnapshot.where(result_comment_id: comments.select(:id)).select(:result_comment_id))
+        .update_all(user_id: nil)
+    end
+
     # Destroy creatives deepest-first so closure_tree always finds its parent
     def destroy_creatives_leaf_first
       all_creatives = creatives.flat_map { |c| c.self_and_descendants.to_a }.uniq
-      all_creatives.sort_by { |c| -c.self_and_ancestors.count }.each do |c|
+
+      # Order by depth in memory. The subtree is contiguous within all_creatives
+      # (every node between an owned root and its descendant is itself a
+      # descendant), so following parent_id links yields the same leaf-first
+      # ordering as self_and_ancestors.count without firing a COUNT query per
+      # creative (the previous N+1).
+      by_id = all_creatives.index_by(&:id)
+      depth_of = lambda do |creative|
+        depth = 0
+        node = creative
+        while node&.parent_id && (parent = by_id[node.parent_id])
+          depth += 1
+          node = parent
+        end
+        depth
+      end
+
+      all_creatives.sort_by { |c| -depth_of.call(c) }.each do |c|
         c.reload.destroy! if Creative.exists?(c.id)
       end
     end