fix(knowledge): re-verify connectorId at the actual hard-delete, fix docsDeleted count

Cursor findings: expectedConnectorId was only checked on the pre-transaction
SELECT in hardDeleteDocumentBatch, not on the DELETE itself — the billing
lookups and KB locking in between are async and can span a concurrent
"delete connector, keep documents" request, so the delete (and its embedding
cleanup) now re-verifies against a fresh in-transaction snapshot instead of
the stale existingIds. Also fixed docsDeleted to use hardDeleteDocuments'
actual returned count instead of the pre-filter candidate count, so a sync
log no longer overreports deletions that expectedConnectorId skipped.

/cleanup: dropped two comments that only restated the line below them.

Author: waleedlatif1

apps/sim/lib/knowledge/connectors/sync-engine.ts

@@ -1065,11 +1065,9 @@ export async function executeSync(
       // query — the FOR UPDATE lock above only covers the window up to its
       // own commit; this closes the remaining gap between that commit and
       // this call.
-      await hardDeleteDocuments(safeHardDeleteIds, syncLogId, connectorId)
-      result.docsDeleted += safeHardDeleteIds.length
+      result.docsDeleted += await hardDeleteDocuments(safeHardDeleteIds, syncLogId, connectorId)
     }
 
-    // Check if connector/KB were deleted before retrying stuck documents
     const postBatchLiveness = await checkSyncLiveness(connectorId, connector.knowledgeBaseId)
     if (postBatchLiveness.connectorDeleted) {
       throw new ConnectorDeletedException(connectorId)
@@ -1489,7 +1487,6 @@ async function updateDocument(
   kbOwner: KnowledgeBaseOwner,
   sourceConfig?: Record<string, unknown>
 ): Promise<DocumentData> {
-  // Fetch old file URL before uploading replacement
   const existingRows = await db
     .select({ fileUrl: document.fileUrl })
     .from(document)

apps/sim/lib/knowledge/documents/service.ts

@@ -2451,10 +2451,31 @@ async function hardDeleteDocumentBatch(
       }
     }
 
-    await tx.delete(embedding).where(inArray(embedding.documentId, existingIds))
+    /**
+     * Re-verify `expectedConnectorId` here too, not only on the pre-transaction
+     * SELECT above — the billing lookups and KB locking between that SELECT
+     * and this delete are async and can span a concurrent "delete connector,
+     * keep documents" request that clears these rows' `connectorId` in
+     * between. Deleting a detached document's embeddings would corrupt its
+     * search index even if the document row itself were spared, so both the
+     * embedding delete and the document delete are scoped to this re-verified
+     * ID set rather than the stale `existingIds`.
+     */
+    const stillTargetedIds = expectedConnectorId
+      ? (
+          await tx
+            .select({ id: document.id })
+            .from(document)
+            .where(
+              and(inArray(document.id, existingIds), eq(document.connectorId, expectedConnectorId))
+            )
+        ).map((d) => d.id)
+      : existingIds
+
+    await tx.delete(embedding).where(inArray(embedding.documentId, stillTargetedIds))
     const deletedRows = await tx
       .delete(document)
-      .where(inArray(document.id, existingIds))
+      .where(inArray(document.id, stillTargetedIds))
       .returning({ id: document.id })
 
     const deletedIds = new Set(deletedRows.map((row) => row.id))