ObanErrorReporter purges imported data when the cleanup worker crashes — silent loss of completed CSV imports

[jonaugust]

Version: CE v3.2.1 (self-hosted, community-edition compose)

Summary: ObanErrorReporter.on_job_exception/1 matches crashed Oban jobs by queue: "analytics_imports" + presence of import_id in args — it never checks which worker crashed. Plausible.Workers.LocalImportAnalyticsCleaner runs in that same queue with import_id in its args. When the cleaner crashes (in our case: File.rm! → :eacces on import CSVs owned by a different uid), the reporter misinterprets it as a failed import:

• attempts 1–19 → import_fail_transient/1 → Plausible.Purge.delete_imported_stats!/1 — deletes the completed import's ClickHouse data while site_imports.status still reads completed
• attempt 20 (discard) → import_fail/1 → import marked failed + failure email

Observed impact: 15 successful local-storage CSV imports had all their data purged ~1 hour after completion (the cleaner's first scheduled run), while dashboards showed the imports as completed for 13 days. The only user-visible signal came two weeks later when the cleaner jobs exhausted retries and each import flipped to failed with a "please try the import again" email.

Repro sketch: complete a local CSV import, make the uploaded files un-deletable by the app user (e.g. chown root them), wait for the cleaner's scheduled run, observe imported_* tables purged for that import_id while the import still reads completed.

Suggested fix: scope on_job_exception/1 to worker: "Plausible.Workers.ImportAnalytics" (or exclude the cleaner), so cleanup failures can't purge import data. Arguably the cleaner also shouldn't share consequences with importers at all despite sharing the queue.

Happy to provide fuller forensics (query_log timelines, oban job history) if useful.