Retention follows per-user read and starred

reap_candidates still read entries.read/flagged, which nothing writes
since read state moved to entry_state -- so starring no longer protected
a file and the read-first ordering was dead. One file serves every
subscriber, so anyone starring it keeps it, and it counts as read only
once everyone subscribed has read it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AdXho5tTkjFLeUXKbEjKBh

PROGRESS.md

@@ -56,6 +56,20 @@ and until now nothing set them.
 
 ---
 
+## 2026-09-11 — Retention caught up with per-user state
+
+Moving read and starred into `entry_state` left `reap_candidates` reading `entries.read` and
+`entries.flagged`, which nothing writes any more: **starring stopped protecting a file**, and the
+"delete the ones already read first" ordering was dead. Harmless while the quota and age limits are
+0 -- the reaper deletes nothing at all then -- but it would have bitten the moment one was set.
+
+One file serves every subscriber, so both tests are now about all of them: **anyone** starring it
+keeps it, and it only counts as read once **everyone** subscribed has read it. A file whose feed
+nobody subscribes to has nobody left to keep it, so it sorts with the read ones. Tested with two
+subscribers disagreeing.
+
+---
+
 ## 2026-09-11 — Steps B and C: what is yours, what is everyone's
 
 Read, starred and playback position moved out of `entries` into `entry_state (user_id, feed_id,