fix: purge tackle provenance on deletion

apps/api/app/retention.py

@@ -4,8 +4,8 @@ from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from typing import Callable
 
-from sqlalchemy import delete, or_, select
-from sqlalchemy.orm import Session
+from sqlalchemy import delete, select
+from sqlalchemy.orm import Session, selectinload
 
 from .models import CatchReport, ExternalObservation, ModerationEvent, ModerationStatus, SourceType, SubmissionAttempt
 
@@ -42,15 +42,15 @@ def apply_retention(
     counts["submission_attempts"] = len(attempts)
 
     candidate_cutoff = current - timedelta(days=min(policy.unreviewed_days, policy.approved_personal_days))
-    candidates = list(session.scalars(select(CatchReport).where(
+    candidate_rows = list(session.scalars(select(CatchReport).options(selectinload(CatchReport.tackle_components)).where(
         CatchReport.source_type == SourceType.user,
         CatchReport.reported_at < candidate_cutoff,
-        or_(
-            CatchReport.player_name.is_not(None), CatchReport.source_url.is_not(None),
-            CatchReport.raw_payload.is_not(None), CatchReport.screenshot_key.is_not(None),
-            CatchReport.screenshot_upload_token_hash.is_not(None),
-        ),
     )))
+    candidates = [item for item in candidate_rows if (
+        item.player_name is not None or item.source_url is not None or item.raw_payload is not None
+        or item.screenshot_key is not None or item.screenshot_upload_token_hash is not None
+        or any(component.source_url is not None or component.raw_payload is not None for component in item.tackle_components)
+    )]
     reports = [item for item in candidates if item.reported_at.replace(tzinfo=item.reported_at.tzinfo or timezone.utc) < current - timedelta(
         days=policy.approved_personal_days if item.moderation_status == ModerationStatus.approved else policy.unreviewed_days,
     )]
@@ -96,6 +96,9 @@ def apply_retention(
         report.raw_payload = None
         report.screenshot_key = None
         report.screenshot_upload_token_hash = None
+        for component in report.tackle_components:
+            component.source_url = None
+            component.raw_payload = None
     for observation in stale:
         session.delete(observation)
     for observation in published: