`survey_rollback_pins` walks images, not projects, and deliberately
tolerates an absent project by falling back to the raw id as the display
name. Two things then dropped it on the floor: `destroy` called
`find_project` before the confirmation check, so it refused such a pin
every time, and the per-project table joins destructive items to rows by
project_id, where rows come only from projects in the store. The result
was a multi-GB `pre-migration-*` image that the scan measured, the panel
never rendered, and nothing could remove — in the one screen built to
find exactly that.
`destroy` takes the same early return `OrphanVolume` already takes, and
still validates the tag: `latest` names the project's live snapshot, so
the ownerless path must not be a way around that check.
The UI grows a bucket for destructive items matching no row, rather than
filtering them away. The typed gate already compared against the id via
`project_name`; the dialog now says "project id" instead of asking for a
project name that no longer exists.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc
shadow-testandClaude Opus 5
4f6c012071