[LIghtJUNction]

Motivation

• Prevent unbounded persistent growth in custodial_upgrades caused by repeated abandoned identity.custodial_upgrade_start requests.
• Ensure expired upgrade challenges are removed by maintenance so the database and indexes cannot be exhausted.

Description

• On custodial_upgrade_start, delete expired challenges for the subject, serialize concurrent starts with a no-op update, and reject a new start while a live pending challenge exists by returning custodial_upgrade_in_progress (changes in src/msg/plugins/identity.py).
• Extend scheduled cleanup to delete expired rows from custodial_upgrades and report the number removed (changes in src/msg/workers/maintenance.py).
• Add regression tests that ensure a second live challenge is rejected and that expired challenges are purged by maintenance (changes in tests/test_custodial_upgrade.py and tests/test_operations_admin.py).

Testing

• git diff --check passed successfully.
• Bytecode compilation via python -m compileall (run through the project's uv helper) completed successfully for the targeted files.
• Linting with ruff on touched files reported pre-existing import-order and unused-import issues unrelated to the new logic.
• Targeted pytest runs were attempted for the modified tests but the environment lacks PostgreSQL tools (notably initdb), causing test setup errors; as a result full automated test execution could not complete in this environment.

---

Codex Task

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-28T11:47:38.026796Z	76ad86a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

复核 head 76ad86aab5b26980a7e4eaf0515c6415baa1e103 发现阻塞问题：identity.py 和 maintenance.py 中仅按 expires_at 删除升级记录，会同时删除已经接受的 pending_rewrap 任务及 completed 结果。挑战的五分钟 TTL 不能等同于重加密任务/完成回执的保留期。

我使用真实 PostgreSQL、Ed25519/age 升级流程，推进时间后单独应用本 PR 的无状态筛选清理谓词，重加密状态保留和完成结果查询两项回归均失败。当前主线已有 pending_rewrap OR (pending AND expires_at>now) 的重复升级保护，不能缩成仅检查未过期任务。

已在独立修复 PR #142 中保留既有保护，只回收可丢弃的 pending/failed 挑战；新增实际升级、回执查询和清理回归。没有修改本 PR 的分支。#142 原始组合本地相关回归 110 项通过，发布时主线刚合入 #119，正在对齐新主线；原补丁不宜直接合并。

[LIghtJUNction]

已被合并的 #142（merge commit edf0d55）取代，关闭。这些分支基于集成前的树，直接合并会与主线上的安全修复冲突或重复。