Ironflow v0.39.0

Data-plane deletion ships end to end: delete runs, tombstone and purge entity streams, and irreversibly redact payloads across every SDK surface. The retention sweep that powers all of it gets a round of correctness and safety hardening.

Features

• Data-plane deletion API: DeleteRun/DeleteRuns RPCs, entity-stream delete (tombstone, purge, entity-event retention), and payload redaction (RedactEvent/RedactStep/RedactRun) across every surface (#2346, #2354, #2358, #2360)
• Projection rebuilds are now refused when their replay window starts past the event retention horizon, instead of silently building an incomplete read model (#2369)

Fixes

• Retention no longer prunes a run whose triggering event never finished dispatching, which previously let an idempotency-key retry or NATS redelivery re-execute an already-run function (#2370)
• Retention: corrected the no-FK event inventory, SQLite ordering, and dead_letters cutoff (#2367)
• Retention: prune failures are now observable, and a bogus ordering rejection was dropped (#2366)

Improvements

• Retention batch size is now bounded by cascaded row count, and blob sweep by run (#2364)
• Retention prune queries are now indexed for run and event sweeps (#2363)
• Browser SDK comparison ledger now documents that the browser client skips DeleteRun, Redact*, and DeleteStream (#2371)