Delete seeded scenarios no seed file claims any more

`previous_titles` stops a rename stranding the row it left behind, but the rows
already stranded still had to be deleted by hand on every deployment. The
seeder now removes them on the next boot, which retires the stale "Road to the
Champion" demo without a database console.

Only rows with a NULL owner and `is_public` are considered, and a player's own
scenario is neither, so nothing anybody created is reachable. An adventure
started from a deleted demo survives: `adventures.scenario_id` is `ON DELETE
SET NULL`, and the adventure holds its own copies of the cards and scripts, so
it loses only the inherited cover art.

Two cases skip the sweep, because neither is an instruction to remove live
content: a seed file that fails to parse claims no title, and an empty seed
directory reads as a packaging failure.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PacdRuPXSkQQy4ZYdH32hF

plan/16-world-state-refusals.md

@@ -158,8 +158,11 @@ resize a maximized window.
   the narration ends mid-sentence with `finish_reason: length`.
 - **Every `hp` stat still has the `initial == max` shape.** Now visible when it
   bites, rather than silent, but not designed out.
-- **The stale "Road to the Champion" scenario and adventure 42** are still on
-  production. Deleting them is hand-work and was deliberately not automated.
+- ~~**The stale "Road to the Champion" scenario and adventure 42** are still on
+  production. Deleting them is hand-work and was deliberately not automated.~~
+  Automated on 2026-08-28: `seed.py` now deletes seeded scenarios no seed file
+  claims. Adventure 42 survives with a NULL `scenario_id`, and losing the cover
+  art is the whole cost.
 - **The Bandit Camp demo (`04-rpg-world-state.json`) was not checked** for the
   same milestone problem. Its milestones were equally unnamed to the model
   before this change, so it is worth asking whether one has ever fired there.
@@ -311,6 +314,15 @@ because SVG can carry script and these bytes are served from the app's own
 origin. `backend/tools/make_pokeball.py` draws the ball with `zlib` alone, so
 regenerating it needs no image library.
 
+**Seeded scenarios no seed file claims are deleted.** `previous_titles` stops a
+rename stranding a row, but the rows already stranded still needed deleting by
+hand on every deployment. `_sweep_unclaimed` removes them on the next boot. Only
+a NULL owner with `is_public` is reachable, so nothing a player made can be
+touched, and `adventures.scenario_id` is `ON DELETE SET NULL`, so an adventure
+started from a deleted demo keeps its story and loses only the artwork. The
+sweep is skipped when a seed file fails to parse, and an empty seed directory
+never reaches it: neither reads as an instruction to delete live content.
+
 **Every new guest gets the played adventure.** `app/starter.py` copies a shipped
 export bundle into each new guest account, from the guest mint in
 `routers/auth.py`. The bundle is this session's adventure trimmed to its first
@@ -318,6 +330,12 @@ two exchanges, which ends on the knockout and shows an applied change, a refused
 one, and a milestone. It stops before the Onix bug above, and the state it
 leaves has Onix at its own 90 HP so a guest can play on from it.
 
+An adventure has no cover art of its own and inherits its scenario's, and a
+bundle carries no scenario id, because an id is local to one database. The
+starter file names its source under `scenarioTitle` instead, and
+`starter._link_scenario` looks it up, so the copy shows the Pokeball rather than
+a monogram tile.
+
 The row building that `POST /adventures/import` did inline moved into
 `bundle.materialize`, which both callers now use. The limit and rate checks
 stayed in the endpoint: the starter writes a file the server ships, so it has no

plan/STATUS.md

@@ -237,11 +237,20 @@ first orphaned and public forever. This is the same failure this file already re
 "Road to the Champion". Seed files now carry `previous_titles`, and the rename lands on
 the existing row. Verified: the Pokemon demo kept its id.
 
+**A seeded scenario nobody claims is now deleted on boot.** `previous_titles`
+stops a rename stranding a row; the sweep removes the ones already stranded, which
+retires "[Demo] Road to the Champion" without a console. Only rows with a NULL owner
+and `is_public` are reachable, and `adventures.scenario_id` is `ON DELETE SET NULL`, so
+an adventure started from a deleted demo keeps its story and loses only the cover art.
+A seed file that fails to parse, or an empty seed directory, skips the sweep.
+
 **Every new guest is given a pre-played adventure.** `app/starter.py` copies a shipped
 export bundle into each new guest account. The point is the first screen: real turns with
 their world-state chips, including a refused change and a milestone, before spending any
 of the daily demo turns. The row building inside `POST /adventures/import` moved to
-`bundle.materialize` so both callers share one writer.
+`bundle.materialize` so both callers share one writer. The copy is linked back to its
+demo scenario by title, because an adventure has no art of its own and a bundle cannot
+carry an id that means anything in another database.
 
 **An SVG data URI is not usable as scenario art.** `app/images.py` accepts raster formats
 only, deliberately, because SVG can carry script and the bytes are served from the app's
@@ -944,7 +953,7 @@ the SQLite dev parity this codebase protects on purpose).
 
 ```
 cd backend
-.venv/Scripts/python.exe -m pytest tests/          # 539 tests (~180s)
+.venv/Scripts/python.exe -m pytest tests/          # 549 tests (~180s)
 .venv/Scripts/python.exe -m tools.stress_session   # egress report (SQLite)
 
 # Same harness against a real Postgres. The target must be a THROWAWAY database