fix(db): add id tiebreak to product-usage rollup and review-suppression queries

[JSONbored]

Summary

• Closes fix(db): missing tiebreak sort key defeats deterministic ordering in product-usage rollup + review-suppression eviction #4501. Two queries in src/db/repositories.ts ordered by a timestamp column alone with no secondary tiebreak — the same bug class already fixed in listPullRequestFiles (fix(review): make listPullRequestFiles order deterministic to stabilize content fingerprints #4481): same-millisecond ties under concurrent writes make row order (and therefore which rows survive a cap) query-plan-dependent instead of deterministic.
• upsertProductUsageDailyRollup's main scan and retention scan now order by (occurredAt, id) / (occurredAt desc, id desc) respectively.
• pruneReviewSuppressionsOverCap's eviction query and listReviewSuppressions's read query now order by (createdAt desc, id desc), matching the established tiebreak convention already used at repositories.ts:3046/5315/5372 (auditEvents, gateOutcomes, agentPendingActions).
• Also hardened a pre-existing test (enforces the per-repo bound...) with fake timers: under fast in-memory D1 execution, its 501 sequential inserts could tie on createdAt, making its "hash-0 is oldest" assumption depend on the (now-added) id tiebreak rather than insertion order — confirmed empirically by reproducing the flake against the fix and verifying 8/8 clean runs afterward.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (fix(db): missing tiebreak sort key defeats deterministic ordering in product-usage rollup + review-suppression eviction #4501).

Validation

• git diff --check
• npm run actionlint (via npm run test:ci)
• npm run typecheck
• npm run test:coverage locally (unsharded) — new invariant/regression tests confirmed to FAIL without the fix and pass with it, verified by temporarily reverting the fix and re-running
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries — invariant tests (deterministic order under same-timestamp ties, both tables) + regression tests (suppression eviction stable at the cap boundary; daily rollup byte-identical across repeated re-runs) per fix(db): missing tiebreak sort key defeats deterministic ordering in product-usage rollup + review-suppression eviction #4501's requirements

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests — N/A, no such change.
• API/OpenAPI/MCP behavior is updated and tested where needed — N/A, no external behavior change (internal ordering only).
• UI changes use live API data — N/A, no UI change.
• UI Evidence — N/A, no visible/UI change.
• Public docs/changelogs updated — N/A.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.08%. Comparing base (80d623f) to head (fea2459).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4560   +/-   ##
=======================================
  Coverage   94.08%   94.08%           
=======================================
  Files         427      427           
  Lines       37961    37961           
  Branches    13864    13864           
=======================================
  Hits        35715    35715           
  Misses       1586     1586           
  Partials      660      660           

Files with missing lines	Coverage Δ
src/db/repositories.ts	96.57% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-10 02:38:15 UTC}

3 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR adds an `id` DESC/ASC tiebreak to two query pairs in `src/db/repositories.ts` (product-usage rollup scan/retention scan, and review-suppression eviction/list) so that same-millisecond `createdAt`/`occurredAt` ties no longer make row order — and therefore which rows survive a cap — query-plan-dependent, matching the existing `(timestamp, id)` convention already used elsewhere in the file (e.g. `auditEvents`, `gateOutcomes`). I traced each changed query: `pruneReviewSuppressionsOverCap` and `listReviewSuppressions` now agree on `desc(createdAt), desc(id)` ordering so eviction and read stay consistent; the rollup's main scan orders ascending `(occurredAt, id)` to deterministically keep the earliest N events, and its retention scan orders descending to deterministically keep the newest N — both correct for their respective cap semantics. The new tests construct realistic same-millisecond tie scenarios (scrambled insertion order, boundary-straddling counts) rather than fabricating impossible states, and the review-memory-store flaky-test fix (fake timers to force strictly-increasing `createdAt`) is a legitimate fix for a real flake the id tiebreak exposed. No schema change, so no migration is needed, and the PR stays scoped to the linked issue (#4501) with no scope creep.

Nits — 5 non-blocking

• The three call sites in `src/db/repositories.ts` (pruneReviewSuppressionsOverCap, listReviewSuppressions, upsertProductUsageDailyRollup ×2) each carry a multi-line comment repeating the same tiebreak rationale — consider factoring the explanation into one shared comment or a short doc note near `MAX_REVIEW_SUPPRESSIONS_PER_REPO`/the rollup scan limits to avoid drift if the convention changes later.
• The new product-usage tests insert ~5000 filler rows via `env.DB.batch` per test to hit the scan-cap boundary; this is effective but adds meaningful runtime to the suite — worth confirming it doesn't push `test:coverage` wall-clock noticeably given there are now two such tests.
• Consider extracting a small helper (e.g. `withTiebreak(col, dir)`) if this `(timestamp, id)` ordering pattern gets added to further queries, to keep the convention centralized rather than repeated inline at each call site.
• The regression tests are thorough; a short top-of-file comment in `product-usage.test.ts` and `review-memory-store.test.ts` referencing fix(db): missing tiebreak sort key defeats deterministic ordering in product-usage rollup + review-suppression eviction #4501 and the general 'always tiebreak on id after a timestamp column' rule would help future contributors recognize the pattern before introducing a new untiebreaked query.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4501
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 48 registered-repo PR(s), 40 merged, 347 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 48 PR(s), 347 issue(s).
Gate result	✅ Passing	No configured blocker found.

Linked issue satisfaction

Addressed
The diff adds an id secondary sort key to both product-usage rollup queries (main scan and retention scan) and to both the suppression eviction query and listReviewSuppressions, exactly matching the established (createdAt/occurredAt, id) tiebreak pattern cited from the same file, and adds invariant tests for deterministic tie ordering plus regression tests reproducing the >5000-event rollup and sa

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 48 PR(s), 347 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.