fix: keep relationships consistent when retiring objects

[seansica]

Why

Retiring or replacing an object could leave its relationships out of sync. Revocation only moved separate relationship objects—not references stored inside other objects. The API also allowed ordinary relationships to inactive objects.

What changes

• Deprecation waits until blocking relationships are removed. Existing subtechnique-of and revoked-by links are preserved.
• “Preserve relationships” now moves embedded references to the replacement too, while keeping history intact.
• Creating or restoring an ordinary relationship requires active endpoints. revoked-by remains an exception.
• Collection imports keep their existing behavior.

Checks

1,208 API tests passed. Real API and browser checks covered the paired workflow. Local tests used a temporary loopback workaround for a machine-specific port collision.

Operational note

Graph writes are serialized to prevent races. A crashed writer can leave a lock that needs operator cleanup; the recovery steps are documented.

Companion frontend change: mitre-attack/attack-workbench-frontend#972

Follow-up (out of scope)

Repair stale embedded backlinks left behind by earlier buggy updates. This PR fixes future updates but does not clean up existing stale metadata. The team still needs to decide how to perform that cleanup—for example, a one-time migration—and whether a recurring Data Quality check is warranted. No historical-backlink repair is included in this PR.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 82.73465% with 149 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.11%. Comparing base (69b37fe) to head (6a54e20).

Files with missing lines	Patch %	Lines
app/services/stix/analytics-service.js	61.70%	36 Missing ⚠️
app/services/stix/data-components-service.js	48.33%	30 Missing and 1 partial ⚠️
app/services/meta-classes/base.service.js	86.16%	19 Missing and 3 partials ⚠️
app/services/stix/detection-strategies-service.js	53.84%	18 Missing ⚠️
app/services/stix/techniques-service.js	40.90%	13 Missing ⚠️
app/services/stix/data-sources-service.js	0.00%	10 Missing ⚠️
app/services/stix/lifecycle-service.js	96.00%	7 Missing and 2 partials ⚠️
app/lib/domain-references.js	92.92%	7 Missing and 1 partial ⚠️
app/lib/graph-write-lock.js	95.34%	2 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             next     #514      +/-   ##
==========================================
+ Coverage   81.99%   82.11%   +0.12%     
==========================================
  Files         252      256       +4     
  Lines       41202    41521     +319     
  Branches     5311     5512     +201     
==========================================
+ Hits        33782    34096     +314     
+ Misses       7326     7323       -3     
- Partials       94      102       +8     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🎉 This PR is included in version 4.24.1 🎉

The release is available on:

• v4.24.1
• GitHub release

Your semantic-release bot 📦🚀