close
Skip to content

fix(provenance): clear the rows that went unknown after the first repair - #6982

Merged
icecrasher321 merged 2 commits into
stagingfrom
provenance/second-repair-pass
Aug 22, 2026
Merged

fix(provenance): clear the rows that went unknown after the first repair#6982
icecrasher321 merged 2 commits into
stagingfrom
provenance/second-repair-pass

Conversation

@icecrasher321

Copy link
Copy Markdown
Collaborator

Summary

  • 0005 cleared the backlog that existed at the instant it ran, and is finished — the runner records a name in script_migrations and never offers it back, which is the contract a run-once repair wants. But the writer that produced that backlog kept running until the fix in fix(provenance): stop requiring a projection of roots no model sees #6981, so rows went unknown after it.
  • Nothing heals such a row in place: a partial cell update keeps it unknown, and only a full replace carrying complete provenance clears it. Each one therefore reports on every later read, which is how a few dozen rows account for thousands of log lines a week. There are 67 of them right now.
  • A second registry entry rather than deleting 0005's tracking row — the registry is append-only, and a repair that ran twice should say so twice.
  • It shares 0005's walk rather than restating it. The parent-first lock ordering (matching mutateTableRowsWithSecretProvenance) and the status re-check under that lock are subtleties worth having once, not twice. Idempotent, so it costs one empty query when there is nothing left.

Ordered deliberately after #6981: repairing while the writer still creates unknowns only refills the backlog.

Type of Change

  • Bug fix

Testing

Tested manually. bun run lint, all 24 CI audits, check:migrations, and type-check pass. 56 tests pass in packages/db, including cases asserting the second pass walks on the shared implementation (lock before delete, status re-checked) and that it registers under its own name.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

0005 is finished and will not run again — the runner records a name in
script_migrations and never offers it back, which is the contract a
run-once repair wants. But it cleared the backlog that existed at the
instant it ran, and the writer that produced that backlog kept running
until the fix in this branch. Nothing heals such a row in place, so each
one goes on reporting on every later read; a few dozen of them account
for thousands of log lines a week.

A second entry rather than deleting the first's tracking row: the
registry is append-only, and a repair that ran twice should say so
twice. It shares 0005's walk rather than restating it — the parent-first
lock ordering and the status re-check under that lock are subtleties
worth having once — and is idempotent, so it costs one empty query if
there is nothing left to repair.
@vercel

vercel Bot commented Aug 22, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
Image docs Ready Ready Preview Aug 22, 2026 8:36pm

Request Review

@cursor

cursor Bot commented Aug 22, 2026

Copy link
Copy Markdown

PR Summary

Medium Risk
Mutates user_table_row_secret_provenance and secret_provenance_version in production via a one-shot migration. Risk is bounded by reusing the existing locked, status-rechecked walk rather than a new algorithm.

Overview
Adds append-only script migration 0006_repair_unknown_table_row_provenance_second_pass so rows that went unknown after 0005 ran can be cleared. 0005 is already recorded as done and will never re-run; leftover sidecars keep logging on every read until a full replace.

Extracts the existing keyset walk into runUnknownTableRowProvenanceRepair and reuses it so lock order (parent row before sidecar) and the status = 'unknown' re-check stay in one place. A distinct registry name records that the repair ran twice. Intended to ship only after the writer fix is already live.

Reviewed by Cursor Bugbot for commit ddd3507. Configure here.

@greptile-apps

greptile-apps Bot commented Aug 22, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR adds a separately registered second pass of the unknown table-row provenance repair while reusing the original migration’s locking and status-recheck implementation.

  • Extracts the 0005 repair walk into a shared function.
  • Registers 0006 as an independent run-once migration.
  • Adds registry and shared-walk coverage for the second pass.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename Overview
packages/db/script-migrations/0005_repair_unknown_table_row_provenance.ts Extracts the existing repair walk into a reusable function without changing its page-processing behavior.
packages/db/script-migrations/0006_repair_unknown_table_row_provenance_second_pass.ts Adds a distinct migration entry that invokes the shared repair for rows created after the first pass.
packages/db/script-migrations/index.ts Registers the second-pass repair after the original migration.
packages/db/script-migrations/0005_repair_unknown_table_row_provenance.test.ts Verifies that the second pass uses the shared lock-before-delete walk and has a distinct migration name.

Reviews (3): Last reviewed commit: "chore(provenance): record the deploy ord..." | Re-trigger Greptile

@icecrasher321

Copy link
Copy Markdown
Collaborator Author

@greptile

@icecrasher321

Copy link
Copy Markdown
Collaborator Author

@cursor review

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 28290e2. Configure here.

promote-images needs migrate, so a script migration runs while the
previous image is still serving. A row an old instance creates between
this walk and the end of the rollout sits behind the cursor, and the
name is recorded on success, so it is never offered again. Widening the
walk would not help — the exposure is the minutes after it returns, not
the milliseconds during — so the requirement is to ship it in a release
after the writer fix is already promoted, which the file now says.
@icecrasher321

Copy link
Copy Markdown
Collaborator Author

@greptile

@icecrasher321

Copy link
Copy Markdown
Collaborator Author

@cursor review

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit ddd3507. Configure here.

@icecrasher321
icecrasher321 merged commit b861062 into staging Aug 22, 2026
29 of 30 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant