Skip to content

chore(issues): land the #ZBAC9D correction that missed its own PR - #2509

Merged
BigSimmo merged 3 commits into
mainfrom
claude/zbac9d-correction-relay
Sep 1, 2026
Merged

chore(issues): land the #ZBAC9D correction that missed its own PR#2509
BigSimmo merged 3 commits into
mainfrom
claude/zbac9d-correction-relay

Conversation

@BigSimmo

@BigSimmo BigSimmo commented Sep 1, 2026

Copy link
Copy Markdown
Owner

Summary

  • Relay the two #ZBAC9D inbox requests that missed their own PR, unchanged.

No product code, no migration, no schema change. The canonical ledger docs/outstanding-issues.md is untouched; these are immutable request files under docs/outstanding-issues-inbox/, applied later by a serialized npm run issues:reconcile.

Why this is needed

PR #2494 merged at 2026-09-01T10:35:10Z. The correction was pushed to that branch at 10:47:41Z, twelve minutes later, so the squash carried only the first commit. Nothing was dropped by the squash — the correction simply was not on the branch when it merged. Worth stating plainly, because the surface symptom looks exactly like the known "squash lands a subset" trap and it is not that.

The consequence is not cosmetic. Request 224cda1c is now pending on main and raises #ZBAC9D to P1 on code evidence gathered before the production count was run. Reconciling in the current state would write a priority into the canonical ledger that the measurement does not support, and would drop the exposure figures entirely.

What lands here

Two request files, byte-identical to the ones that missed the merge:

Request Action
f3d9d01a cancel — retracts 224cda1c, the premature P1 escalation
79b8bfd3 update — reissues #ZBAC9D at P2 with the measured exposure and the trigger condition

The reissued row records what the owner-approved read-only production count actually found: 2851 documents, 0 privately owned, all 2851 carrying metadata.public_corpus = true, so the exposed count was 0. It also carries the finding that matters more than the priority — that this had to be closed before the first privately-owned document existed — and the second flawed predicate, retrieval_owner_matches_v2, found while fixing it.

The underlying defect has since been fixed and deployed in PR #2502 (merged 5cfda8033), which moved the four owner foreign keys to on delete restrict. The row's remaining value is the record: the measurement, the scope reasoning, the second predicate, and the still-dead src/lib/documents/is-public-document.ts.

Verification

Both requests were re-validated against the current ledger immediately before committing, rather than assumed still applicable:

  • 79b8bfd3's recorded baseRowFingerprint still matches the live fingerprint of the #ZBAC9D row exactly, so the update will not be rejected as stale.
  • f3d9d01a's target, 224cda1c, is confirmed still pending on main — so the cancellation will take effect rather than land as an ineffective no-op.

Documentation and ledger paperwork only. npx prettier reports the added files already formatted. No unit, build, browser or provider-backed check was run, because this diff contains no executable code and there is no changed failure path in two append-only JSON request files. npm run check:ledger-write-discipline in CI is the gate that governs this path.

No live Supabase, OpenAI or Railway access was used in producing this PR.

🤖 Generated with Claude Code


Note

Low Risk
Documentation-only inbox JSON; no runtime, auth, or data-path changes in this diff.

Overview
Adds two immutable outstanding-issues-inbox request files that should have shipped with PR #2494 but missed the squash merge.

One request cancels pending 224cda1c, which would have escalated #ZBAC9D to P1 before production measurement. The other updates #ZBAC9D at P2 with the owner-approved read-only count (0 privately owned documents, exposed count 0), the retrieval/is-public-document gap, and the trigger to fix this before the first private document exists.

No application code, schema, or canonical docs/outstanding-issues.md changes — CI issues:reconcile applies these later.

Reviewed by Cursor Bugbot for commit ecd0147. Configure here.

PR #2494 merged at 10:35:10Z; the correction was pushed at 10:47:41Z, so the
squash carried only the first commit. Nothing was dropped by the squash — the
correction simply was not on the branch yet when it merged.

The consequence matters: request 224cda1c is pending on main and raises
#ZBAC9D to P1 on code evidence gathered BEFORE the production count was run.
Reconciling without this correction would enshrine a priority the measurement
does not support.

This relays the two request files that missed the merge, unchanged:
  f3d9d01a  cancels 224cda1c
  79b8bfd3  reissues the update at P2 with the measured exposure (2851
            documents, 0 privately owned, exposed count 0) and the trigger
            condition that replaces the priority argument

Both were re-validated against the current ledger before committing: the
recorded baseRowFingerprint still matches, and the cancel's target is still
pending.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@supabase

supabase Bot commented Sep 1, 2026

Copy link
Copy Markdown

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.


Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 1, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-01T15:11:19.919937Z ecd0147 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@cursor

cursor Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_41019d22-97ef-48b3-ae36-300b02353054)

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ecd0147ad2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread docs/outstanding-issues-inbox/79b8bfd3-66bc-4111-80b7-5df25727c4c3.json Outdated
@coderabbitai

coderabbitai Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: bb5c3684-c665-485e-8239-ef1cbbb47977


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@BigSimmo
BigSimmo merged commit 164859d into main Sep 1, 2026
27 checks passed
@BigSimmo
BigSimmo deleted the claude/zbac9d-correction-relay branch September 1, 2026 15:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant