feat(evidence): add safe retention and materialized reads

harness/tests/l0/test_vector_adapter_parity.py

@@ -8,7 +8,7 @@ from tht.adapters.vector.pgvector import PgVectorStore
 from tht.adapters.vector.thoth_http import ThothHttpVectorStore
 from tht.config import DatabaseConfig, RestConfig
 from tht.ports.vector import VectorRecord, VectorStoreError, VectorWriteRecord
-from tht.vectorstore.rest_client import VectorRestClient
+from tht.vectorstore.rest_client import VectorRestClient, VectorRestError
 
 
 def _write(record_id, kind, embedding, content_hash):
@@ -226,3 +226,27 @@ def test_http_adapter_legacy_fallback_preserves_kind_semantics(monkeypatch):
     )
     assert [hit.id for hit in hits] == ["right"]
     assert "kinds" in calls[0] and "kinds" not in calls[1]
+
+
+def test_http_delete_generation_uses_exact_allowlisted_rpc_payload(monkeypatch):
+    calls = []
+    monkeypatch.setattr(
+        "tht.vectorstore.rest_client.requests.post",
+        lambda url, json, **kwargs: calls.append((url, json)) or Response({"deleted": 2}),
+    )
+    client = VectorRestClient(RestConfig(base_url="https://vectors.test", api_key="writer"))
+    assert client.delete_generation("evidence", "gen:" + "a" * 32) == 2
+    assert calls == [("https://vectors.test/rpc/delete_vector_generation", {
+        "table_name": "evidence", "kind": "evidence", "generation": "gen:" + "a" * 32,
+    })]
+
+
+def test_http_delete_generation_legacy_404_fails_closed_without_body_leak(monkeypatch):
+    monkeypatch.setattr(
+        "tht.vectorstore.rest_client.requests.post",
+        lambda *args, **kwargs: Response({"message": "secret legacy endpoint detail"}, status=404),
+    )
+    client = VectorRestClient(RestConfig(base_url="https://vectors.test", api_key="writer"))
+    with pytest.raises(VectorRestError, match="delete_vector_generation RPC is unavailable") as error:
+        client.delete_generation("evidence", "gen:" + "a" * 32)
+    assert "secret" not in str(error.value)