feat(data): FK guards prevent soft-deleting entities with active dependents

Soft-delete (GORM's deleted_at) doesn't trigger SQLite FK constraints,
so application-level checks are needed. Added countDependents() helper
and pre-delete guards:

- DeleteProject refuses if non-deleted quotes reference the project
- DeleteMaintenance refuses if non-deleted service log entries exist
- DeleteAppliance remains unrestricted (SET NULL FK semantics)
- Vendor deletion already blocked (no soft-delete support)

Error messages are actionable ("has N active quote(s) -- delete them
first") and bubble up to the status bar via the existing error path.

3 new tests: blocked project, blocked maintenance, allowed appliance.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: cpcloud

AGENTS.md

@@ -1013,6 +1013,7 @@ in case things crash or otherwise go haywire, be diligent about this.
 - [NAV-CLAMP] column navigation clamped at edges instead of wrapping
 - [DASH-RESIZE] dashboard dynamically resizes for terminal height (2b322cd)
 - [DASH-NO-ACTIVITY] removed recent activity from dashboard summary (a818e44)
+- [SAFE-DELETE] FK guards on soft-delete: projects with quotes and maintenance with service logs are refused with actionable error messages
 
 # Remaining work
 
@@ -1071,10 +1072,6 @@ in case things crash or otherwise go haywire, be diligent about this.
   HOAFeeCents and PropertyTaxCents. Why aren't those just plain int64s?
 
 ## Moar
-- [SAFE-DELETE] make sure that deleting, even soft deleting doesn't break the
-  model, e.g., if i try to delete a quote that's linked to a project, i get
-  a reasonable error message, probably in the status bar but open to thoughts
-  on where to show it
 - [HIDE-COMPLETED] would be nice to have a way to hide completed projects
   easily. we'll get to the generic way to do that when we implement filter,
   but i think it will still be useful as a standalone feature

internal/data/store.go

@@ -841,6 +841,13 @@ func (s *Store) CountMaintenanceByAppliance(applianceIDs []uint) (map[uint]int,
 }
 
 func (s *Store) DeleteProject(id uint) error {
+	n, err := s.countDependents(&Quote{}, "project_id", id)
+	if err != nil {
+		return err
+	}
+	if n > 0 {
+		return fmt.Errorf("project has %d active quote(s) -- delete them first", n)
+	}
 	return s.softDelete(&Project{}, DeletionEntityProject, id)
 }
 
@@ -849,6 +856,13 @@ func (s *Store) DeleteQuote(id uint) error {
 }
 
 func (s *Store) DeleteMaintenance(id uint) error {
+	n, err := s.countDependents(&ServiceLogEntry{}, "maintenance_item_id", id)
+	if err != nil {
+		return err
+	}
+	if n > 0 {
+		return fmt.Errorf("maintenance item has %d service log(s) -- delete them first", n)
+	}
 	return s.softDelete(&MaintenanceItem{}, DeletionEntityMaintenance, id)
 }
 
@@ -872,6 +886,14 @@ func (s *Store) RestoreAppliance(id uint) error {
 	return s.restoreEntity(&Appliance{}, DeletionEntityAppliance, id)
 }
 
+// countDependents counts non-deleted rows in model where fkColumn equals id.
+// GORM's soft-delete scope automatically excludes deleted rows.
+func (s *Store) countDependents(model any, fkColumn string, id uint) (int64, error) {
+	var count int64
+	err := s.db.Model(model).Where(fkColumn+" = ?", id).Count(&count).Error
+	return count, err
+}
+
 func (s *Store) softDelete(model any, entity string, id uint) error {
 	result := s.db.Delete(model, id)
 	if result.Error != nil {

internal/data/store_test.go

@@ -6,6 +6,7 @@ package data
 import (
 	"errors"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -622,6 +623,107 @@ func TestCountServiceLogsByVendor(t *testing.T) {
 	}
 }
 
+func TestDeleteProjectBlockedByQuotes(t *testing.T) {
+	store := newTestStore(t)
+	types, _ := store.ProjectTypes()
+	project := Project{
+		Title: "Blocked Project", ProjectTypeID: types[0].ID,
+		Status: ProjectStatusPlanned,
+	}
+	if err := store.CreateProject(project); err != nil {
+		t.Fatalf("CreateProject: %v", err)
+	}
+	projects, _ := store.ListProjects(false)
+	projID := projects[0].ID
+
+	// Attach a quote.
+	quote := Quote{ProjectID: projID, TotalCents: 1000}
+	if err := store.CreateQuote(quote, Vendor{Name: "V1"}); err != nil {
+		t.Fatalf("CreateQuote: %v", err)
+	}
+
+	// Delete should be refused.
+	err := store.DeleteProject(projID)
+	if err == nil {
+		t.Fatal("expected error deleting project with active quotes")
+	}
+	if !strings.Contains(err.Error(), "active quote") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Soft-delete the quote, then project deletion should succeed.
+	quotes, _ := store.ListQuotes(false)
+	if err := store.DeleteQuote(quotes[0].ID); err != nil {
+		t.Fatalf("DeleteQuote: %v", err)
+	}
+	if err := store.DeleteProject(projID); err != nil {
+		t.Fatalf("DeleteProject after quote removed: %v", err)
+	}
+}
+
+func TestDeleteMaintenanceBlockedByServiceLogs(t *testing.T) {
+	store := newTestStore(t)
+	cats, _ := store.MaintenanceCategories()
+	item := MaintenanceItem{
+		Name: "Blocked Maint", CategoryID: cats[0].ID, IntervalMonths: 3,
+	}
+	if err := store.CreateMaintenance(item); err != nil {
+		t.Fatalf("CreateMaintenance: %v", err)
+	}
+	items, _ := store.ListMaintenance(false)
+	maintID := items[0].ID
+
+	// Attach a service log.
+	now := time.Now()
+	entry := ServiceLogEntry{MaintenanceItemID: maintID, ServicedAt: now}
+	if err := store.CreateServiceLog(entry, Vendor{Name: "SL Vendor"}); err != nil {
+		t.Fatalf("CreateServiceLog: %v", err)
+	}
+
+	// Delete should be refused.
+	err := store.DeleteMaintenance(maintID)
+	if err == nil {
+		t.Fatal("expected error deleting maintenance with active service logs")
+	}
+	if !strings.Contains(err.Error(), "service log") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Soft-delete the service log, then maintenance deletion should succeed.
+	logs, _ := store.ListServiceLog(maintID, false)
+	if err := store.DeleteServiceLog(logs[0].ID); err != nil {
+		t.Fatalf("DeleteServiceLog: %v", err)
+	}
+	if err := store.DeleteMaintenance(maintID); err != nil {
+		t.Fatalf("DeleteMaintenance after logs removed: %v", err)
+	}
+}
+
+func TestDeleteApplianceAllowedWithMaintenance(t *testing.T) {
+	store := newTestStore(t)
+	appliance := Appliance{Name: "Deletable Fridge"}
+	if err := store.CreateAppliance(appliance); err != nil {
+		t.Fatalf("CreateAppliance: %v", err)
+	}
+	appliances, _ := store.ListAppliances(false)
+	appID := appliances[0].ID
+
+	// Attach a maintenance item.
+	cats, _ := store.MaintenanceCategories()
+	item := MaintenanceItem{
+		Name: "Filter", CategoryID: cats[0].ID, IntervalMonths: 6,
+		ApplianceID: &appID,
+	}
+	if err := store.CreateMaintenance(item); err != nil {
+		t.Fatalf("CreateMaintenance: %v", err)
+	}
+
+	// Appliance deletion should succeed (SET NULL semantics).
+	if err := store.DeleteAppliance(appID); err != nil {
+		t.Fatalf("DeleteAppliance should be allowed: %v", err)
+	}
+}
+
 func newTestStore(t *testing.T) *Store {
 	t.Helper()
 	path := filepath.Join(t.TempDir(), "test.db")