orb(observability): the orphaned review_targets table silently disables the anomaly alerter, the reputation quality signal, and the AMS bridge — and the reputation half expires to empty around 2026-09-20

[JSONbored]

Problem

review_targets has no live writer anywhere — stated outright in the code itself
(src/db/repo-identity-rename.ts:585-586: "has NO live writer anywhere in this codebase";
src/review/public-stats.ts:275: "the convergence cutover orphaned (nothing writes it anymore)"). It
was orphaned by the 2026-06-22 convergence cutover.

Three subsystems still read it as their primary source and are therefore inert or expiring, with no
alarm on any of them.

1. The Discord anomaly alerter can never fire

runAnomalyAlerts bails at if (anomalies.length === 0) return;. detectAnomalies(health, calibration)
draws every line from computeAgentHealth / computeCalibration, whose queries are all FROM review_targets or JOIN review_targets t ON t.id = a.target_id (src/review/ops.ts:219-249, :294-299).
The remaining two inputs come from defaultOpsHealthDeps (alerts-wire.ts passes no deps):
validateAgentConfig: () => [] and isHoldOnly: async () => false. So configIssues is always [],
holdOnly always false, every count 0.

Even with LOOPOVER_REVIEW_OPS=1 and a valid DISCORD_WEBHOOK_URL, the alerter runs hourly, computes an
all-zero snapshot, and returns. The whole "reversals / DLQ spike / disputed closes / calibration drift /
manual-rate spike" channel is dead — and the same zeros are served to the operator by the /status and
/calibration ops endpoints as an apparently healthy snapshot.

There is a second, independent break: review_audit.target_id is "owner/repo#123"
(outcomes-wire.ts:275-277) while review_targets.id is a different id namespace, so the reversal/DLQ
joins could not match even if the table were repopulated.

2. The reputation quality signal is a slowly-expiring ghost

#9015 repointed getSubmitterCadence to pull_requests and left the comment "reads the LIVE ledger" —
but getSubmitterReputation, getSubmitterReputationAcrossInstall, and listSubmitterCohortRows
(src/review/submitter-reputation.ts:302-312, :338-353, :388-399) still query FROM review_targets … terminal_at >= datetime('now', ?). With the ledger frozen at 2026-06-22 and a 90-day window, those
queries return a shrinking set that reaches permanently empty around 2026-09-20.

Consequences: promptInjection > 0 → "low" — the only hard-abuse rule in the reputation model — can
never fire on post-cutover data; "trusted" is unreachable, which makes the entire
src/review/ams-reputation-bridge.ts (an upgrade-only bridge whose sole output is "trusted") inert by
construction; the low_reputation skip in evaluateVisualVisionGate
(src/review/visual/visual-findings.ts:88) and evaluateScreenshotTableVisionGate
(screenshot-table-vision.ts:68) is inert and has no compensating hold — so restoring the signal
without fixing those reproduces #9015's "suspicion buys less scrutiny" shape.

3. The AMS-vs-human cohort dashboard silently empties

src/review/ams-miner-cohort.ts (#6488) degrades to present: false.

Dedup

#9015 is closed; its fix point 2 ("restore a live writer for review_targets or repoint the
cadence query") was satisfied by the narrower half only. Reporting the remainder as an incomplete fix.
The review_targets-frozen fact is noted in the prior audit's notes but no issue owns the consequences.

Requirements

• Decide once: repoint every reader at the live ledgers (pull_requests + audit_events with the
  owner/repo#n target key, as public-stats.ts and ops-wire.ts already do), or restore a writer.
  Do not leave both halves half-done again — enumerate every reader in the PR description.
• Fix the target_id namespace mismatch in the reversal/DLQ joins.
• Add a startup/health assertion that each reputation and ops source table has rows newer than its own
  window, so the next orphaning is loud rather than silent. This is the generalisable fix — the same
  class produced orb(db): the review-effort metric is silently broken on Postgres — avg(text) errors and the failure is swallowed #9084 and the DLQ dead-alert findings.
• Before restoring the reputation signal, give the two vision-gate skips a compensating hold.

Test Coverage Requirements

99%+ patch coverage, branch-counted; a test per repointed query asserting non-empty results against live
fixtures, and both arms of the staleness assertion.

Links & Resources

• src/review/ops.ts ~219-249, ~294-299; src/review/alerts.ts ~243-244; src/review/alerts-wire.ts ~31-37;
  src/review/submitter-reputation.ts ~114-124, ~302-312, ~338-353, ~388-399;
  src/db/repo-identity-rename.ts ~585-586; src/review/public-stats.ts ~275
• orb(security): reputation burst-downgrade fails OPEN — suspected abusers get LESS review (LIVE in prod) #9015 (partial fix), feat(review): wire the fully-built Discord anomaly-alerting module into the real cron path #8905, fix(review): anomaly-alert wire INSERTs nonexistent columns into notification_deliveries — alerts never deliver #9001, feat(ui): maintainer-facing AMS miner contributor-mix dashboard panel #6488

maintainer-only — observability and reputation integrity.

[linear-code]

JSO-6311

[JSONbored]

Verification pass — this issue is substantially stale, and acting on it as written would be wasted work

Re-verified every claim against main. The core premise holds: review_targets has no writer anywhere — zero INSERT/UPDATE/upsert in src/**, packages/**, scripts/**, or migrations/**. Not dead code, not flag-gated; the write path does not exist. The only INSERT INTO review_targets statements in the repo are test fixtures, plus scripts/export-grafana-reporting-db.sh, which writes a separate reporting Postgres copy (legitimate archive mining, out of scope).

But three of the five load-bearing claims describe pre-fix code. 16fa5ae15 and ad8975e67 already landed most of the remediation.

Already fixed — do not re-do

Claim	Status
Group 2, submitter reputation	Fully remediated. src/review/submitter-reputation.ts contains zero review_targets SQL. Every cited line range is now live-ledger code. test/unit/submitter-reputation.test.ts:187,597 actively assert expect(sql).not.toContain("review_targets"). The "expires to empty around 2026-09-20" prediction in the title no longer applies.
Group 3, AMS cohort	Never had a query. ams-miner-cohort.ts has no SQL of its own; it consumes listSubmitterCohortRows, already repointed. Its own header says it "needed no changes of its own to pick that up."
Group 1, anomaly alerter	Half remediated. The reversal and DLQ legs this issue emphasises are already on review_audit (ops.ts:246-259, :269-283), parsing owner/repo#n directly via parseReviewAuditTargetId — no join at all. Only byStatus/byVerdict/failedRows still read the orphaned table.
The vision-gate skips (§"Before restoring the reputation signal")	False as of today. Both skips now have compensating advisory findings, defined and wired: VISUAL_VISION_SKIPPED_LOW_REPUTATION_FINDING_CODE (visual-findings.ts:103, wired processors.ts:8982-8992) and SCREENSHOT_TABLE_VISION_SKIPPED_LOW_REPUTATION_FINDING_CODE (visual/screenshot-table-vision.ts:82, wired processors.ts:9330-9337). Both emit severity: "warning" into gate.warnings. visual-findings.ts:96-98 names this issue as the reason they exist.

Two reference errors, for anyone following the links: the public-stats.ts quote is at :298 (and :8), not ~275 — line 275 is an unrelated gamingFlagsCaught doc comment. And the second vision gate is at src/review/visual/screenshot-table-vision.ts, not src/review/screenshot-table-vision.ts.

Still genuinely open — including three this issue never named

All remaining live readers are in src/review/ops.ts (7 statements):

1. GET /v1/internal/decision is dead. handleInternalDecision (ops.ts:488, routed at routes.ts:4864) reads review_targets and 404s for every PR since the 2026-06-22 cutover. Not mentioned anywhere in this issue.
2. computeCalibration is triply broken (ops.ts:344, :349, :354) — the orphaned table, plus the namespace mismatch on both the SQL join at :354 and a JS Set membership at :346/:379 that this issue does not mention (revRows collects review_audit.target_id = owner/repo#123, then tests reverted.has(r.id) where r.id is loopover-orb:pull_request:owner/repo#123). So revertedCount is always 0, recommendedFloor always null, and the calibration-drift and disputed-close alerts have never been able to fire.
3. byStatus / stuckRetryable / failed are not repointable. This is the part that changes the fix from "repoint" to a decision. review_targets tracked queued/reviewing/error/error_retryable/failed; nothing live records those states — ops.ts:551-558's own comment says so. failedRows' distinct signal ("attempt-exhausted but not dead-lettered") has no live source either; it collapses into dlqCount or must be dropped deliberately.
4. checkReviewSourceFreshness (ops.ts:567) hardcodes a 90-day window against a permanently-frozen table, so loopover_review_source_fresh{table="review_targets"} reads 0 forever. Whatever the fix, this entry must be removed with the last reader or it becomes permanent alert noise. (ops.test.ts:679 already calls this "the ground state right now.")
5. src/review/stats.ts:410 — computeStats reads it, but handleStats is exported and wired to no route, so it is unreachable in production while still carrying tests.

The prescription needs correcting too

"Repoint at pull_requests + audit_events" is insufficient. It misses decision_records (migrations/0179), which is the live successor carrying action, reason_code, and record_json.$.aiConfidence — the actual source computeCalibration needs, keyed repo_full_name || '#' || pull_number, i.e. the same owner/repo#n namespace as review_audit. Repointing onto it fixes the calibration reads and the namespace mismatch in one move.

decided_sha/approved_sha (the per-head-SHA approve-once cache) have no live equivalent — that concept was dropped at the cutover, so handleInternalDecision cannot be restored to its old shape regardless.

Rescoped remaining work

• Repoint computeCalibration (readers 4/5/6) onto decision_records + review_audit, fixing the SQL join and the JS Set mismatch together.
• Decide handleInternalDecision: restore against pull_requests + decision_records (losing the sha-cache fields), or retire the route.
• Decide byStatus/stuckRetryable/failed: re-source from the selfhost queue tables, or delete the signals and the alerts that consume them. Deleting a signal is the kind of thing that should be explicit, not a side effect of a repoint.
• Remove the review_targets entry from checkReviewSourceFreshness with the last reader.
• Rewrite test/unit/ops.test.ts (:68, :185, :541) and test/unit/routes-internal-decision-calibration.test.ts — the latter currently encodes the namespace mismatch as expected behaviour (:44-48 seeds review_audit with the rowId shape). Keep the freshness tests at :679-729; they are load-bearing for the gauge.

Leaving open with the scope above rather than closing — the premise is real, but roughly half the described work is already done and one section is now factually wrong.