Capture backfill SQL trap, GC rollback caveat, backup contract - #508
Merged
Conversation
Third data-safety review pass. Three captures: M1 gains a SQL sketch of the collision-safe backfill, because the prose spec has a silent implementation trap: computing the per-thread max in the same subquery that filters to NULL-position rows aggregates over only the NULLs, so the max coalesces to 0 and the backfill re-numbers from 1 - exactly the deploy-blocking collision the offset exists to prevent. The two-CTE shape (max over all rows, joined to the NULL rows) is now written out. The M3 rollback note gains its honest caveat: threads the GC already collected are permanently gone on revert - which is the outcome the user asked for when they deleted them, deferred one sweep, not a loss. The data-safety section records the contract with the backup/restore tool currently in development outside the repo: pre-M1 restores depend on the backfill's NULL-only idempotence and per-thread-max offset (restored and replica-role-inserted rows land with NULL positions and get swept), so weakening either guard silently breaks restores. Re-verify when the tool lands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Doc-only amendment from the third data-safety review pass: M1 gains a SQL sketch of the collision-safe backfill (the prose spec has a silent trap - computing the per-thread max in the same subquery that filters to NULL rows aggregates over only the NULLs, coalesces to 0, and re-numbers from 1, reintroducing the deploy-blocking collision; the two-CTE shape is now written out); the M3 rollback note gains its honest caveat (GC-collected threads are permanently gone on revert - the outcome the user requested, deferred one sweep); and the data-safety section records the one-way contract with the backup/restore tool in development outside the repo (pre-M1 restores depend on the backfill's NULL-only idempotence and per-thread-max offset; re-verify when the tool lands).
Generated by Claude Code