Summary

• prevent Marten from truncating the shared mt_doc_principal table when rebuilding PersonProjection or GroupProjection
• coordinate both event-sourced principal rebuilds, then prune only stale Person/Group rows while preserving directly stored ServiceAccounts
• route the admin endpoint, recovery CLI, and integration-test helper through the same safe rebuild path
• document the v0.9.1 recovery-command warning and the fixed operational contract

Root cause

Person, Group, and ServiceAccount share one polymorphic Marten document table. Marten's default single-projection teardown truncates that root table. Sequential Person/Group rebuilds therefore deleted the subtype rebuilt immediately before them, and ServiceAccounts could not be reconstructed from events.

Verification

• dotnet build Modgud.slnx -c Release --no-restore
• NuGet vulnerable-package audit: no vulnerable packages
• dotnet test Modgud.slnx -c Release --no-build --verbosity normal: 1,509 unit + 601 integration tests passed
• pnpm@10.13.1 build:all: public and in-app docs passed
• focused rebuild coverage verifies all Principal subtypes, stale-row cleanup, repeatability, archived GDPR streams, and unlinked identities
• local v0.9.1 database backup verified with pg_restore -l
• fixed image rebuilt two real local realms twice through the recovery CLI
• live https://modgud.localhost login -> admin rebuild -> same authenticated session -> readiness all returned 200
• local principal counts remained scenar: person=13, group=1, service-account=1; system: person=6, group=1; no rebuild errors in container logs