fix(scribe): a delete must not depend on the lookup that names it (#3273)

CI caught the naming work reaching for Postgres from the unit lane, and the
connection error was the symptom of a real design fault rather than a test
gap: reading the title BEFORE the delete put a live query on the delete path,
so a lookup that failed would have stopped the delete happening.

That is a decoration breaking its payload — the same mistake just fixed in
rules_etag, made again two commits later. Every title lookup now fails open:
delete_task, delete_note, delete_milestone, delete_snippet and rule_history
lose the name, never the operation.

The five unit tests mock the lookup rather than reaching for a database, and
delete_note gains one asserting the delete still happens when the lookup
raises — the behaviour, not just the absence of a crash.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/scribe/mcp/tools/milestones.py

@@ -140,8 +140,14 @@ async def delete_milestone(milestone_id: int) -> dict:
     # Read the title BEFORE the delete: afterwards the row is trashed and the
     # confirmation could only echo the number back. A deletion the operator
     # cannot recognise is one they cannot tell was the wrong one.
-    doomed = await milestones_svc.get_milestone(uid, milestone_id)
-    title = getattr(doomed, "title", "") if doomed else ""
+    # Fail-open: the title is a COURTESY on top of the delete, so a lookup
+    # that errors must not stop the delete happening. Same posture the
+    # staleness marker takes — a decoration may never break its payload.
+    try:
+        doomed = await milestones_svc.get_milestone(uid, milestone_id)
+        title = getattr(doomed, "title", "") if doomed else ""
+    except Exception:
+        title = ""
     batch = await trash_svc.delete(uid, "milestone", milestone_id)
     if batch is None:
         raise ValueError(f"milestone {milestone_id} not found")

src/scribe/mcp/tools/notes.py

@@ -327,8 +327,14 @@ async def delete_note(note_id: int) -> dict:
     # Read the title BEFORE the delete: afterwards the row is trashed and the
     # confirmation could only echo the number back. A deletion the operator
     # cannot recognise is one they cannot tell was the wrong one.
-    loaded = await notes_svc.get_note_for_user(uid, note_id)
-    title = getattr(loaded[0], "title", "") if loaded else ""
+    # Fail-open: the title is a COURTESY on top of the delete, so a lookup
+    # that errors must not stop the delete happening. Same posture the
+    # staleness marker takes — a decoration may never break its payload.
+    try:
+        loaded = await notes_svc.get_note_for_user(uid, note_id)
+        title = getattr(loaded[0], "title", "") if loaded else ""
+    except Exception:
+        title = ""
     batch = await trash_svc.delete(uid, "note", note_id)
     if batch is None:
         raise ValueError(f"note {note_id} not found")

src/scribe/mcp/tools/rulebooks.py

@@ -604,7 +604,12 @@ async def rule_history(rule_id: int, version_id: int = 0) -> dict:
     versions = await rulebooks_svc.list_rule_versions(rule_id, uid)
     if versions is None:
         raise ValueError(f"rule {rule_id} not found")
-    rule = await rulebooks_svc.get_rule(rule_id, uid)
+    # Fail-open, like the deletes: a missing title must not turn a readable
+    # history into an error.
+    try:
+        rule = await rulebooks_svc.get_rule(rule_id, uid)
+    except Exception:
+        rule = None
     return {
         "rule_id": rule_id,
         "title": rule.title if rule else "",

src/scribe/mcp/tools/snippets.py

@@ -496,8 +496,14 @@ async def delete_snippet(snippet_id: int) -> dict:
     uid = current_user_id()
     # Read before deleting so the confirmation can NAME what went — an id
     # alone leaves the operator unable to tell which snippet this was.
-    doomed = await snippets_svc.get_snippet(uid, snippet_id)
-    title = getattr(doomed, "title", "") if doomed else ""
+    # Fail-open: the title is a COURTESY on top of the delete, so a lookup
+    # that errors must not stop the delete happening. Same posture the
+    # staleness marker takes — a decoration may never break its payload.
+    try:
+        doomed = await snippets_svc.get_snippet(uid, snippet_id)
+        title = getattr(doomed, "title", "") if doomed else ""
+    except Exception:
+        title = ""
     if not await snippets_svc.delete_snippet(uid, snippet_id):
         raise ValueError(f"snippet {snippet_id} not found")
     return {"deleted": True, "id": snippet_id, "title": title}

src/scribe/mcp/tools/tasks.py

@@ -367,8 +367,14 @@ async def delete_task(task_id: int) -> dict:
     # Read the title BEFORE the delete: afterwards the row is trashed and the
     # confirmation could only echo the number back. A deletion the operator
     # cannot recognise is one they cannot tell was the wrong one.
-    loaded = await notes_svc.get_note_for_user(uid, task_id)
-    title = getattr(loaded[0], "title", "") if loaded else ""
+    # Fail-open: the title is a COURTESY on top of the delete, so a lookup
+    # that errors must not stop the delete happening. Same posture the
+    # staleness marker takes — a decoration may never break its payload.
+    try:
+        loaded = await notes_svc.get_note_for_user(uid, task_id)
+        title = getattr(loaded[0], "title", "") if loaded else ""
+    except Exception:
+        title = ""
     batch = await trash_svc.delete(uid, "task", task_id)
     if batch is None:
         raise ValueError(f"task {task_id} not found")