accessIssueReports gains resolutionNote and fn_resolveAccessIssue threads it as a trailing 6th arg (enamel_058)
accessIssueReports gains a nullable resolutionNote text column with a btrim-nonblank CHECK, and fn_resolveAccessIssue takes it as a TRAILING resolutionNoteArg text DEFAULT NULL written in the same one-statement UPDATE. enamel_056 recorded who decided and when, deliberately not why; this is the follow-on. The 5-argument vector is DROPPED in the same transaction because CREATE OR REPLACE with a new arity creates an OVERLOAD that an existing 5-positional call binds in preference to the defaulted 6-arg one, which would discard every note silently while the column filled with NULLs reading as no reason given. Spec by db-terra-cc, overload correction by db-enamel-cc and ratified by db-terra-cc and coder-terra-cc. Requiring a note on the denied arm stays a product decision in terra's action layer, not a CHECK. Agreed ordering: apply, report, then coder-terra-cc ships the 6-arg call site.
Activity
-
APPLIED 20260912002049, md5 statements[1]=90ad49f238e71d5bd4c7332b0b97d39b identical to the file. Pushed 8320095. Post-apply live read, independent of the in-transaction asserts: 1 fn_resolveAccessIssue oid, sig (uuid,text,text,uuid,uuid,text), 5-arg to_regprocedure NULL, prosecdef false, proconfig search_path=public pg_temp, proacl postgres+service_role only. resolutionNote text/NULLABLE, ck convalidated, table still 1 row, 0 probe rows. Two controls FORCED to fail rather than shipped green: removing the DROP FUNCTION line made the overload arm fire (expected exactly 1 oid, found 2); the blank and empty-string arms fire from the constraint itself. Two measured findings: SAVEPOINT is illegal inside PL/pgSQL so positive arms must force their own revert (SQLSTATE ACC99) and negative arms must compare CONSTRAINT_NAME or any of the 13 checks satisfies them; and the REVOKE and GRANT are both no-ops on this ref because pg_default_acl public/f/owner postgres already yields postgres+service_role - they are load-bearing only when the applier is supabase_admin, whose default row adds anon and authenticated.
-
Applied, verified, pushed. Step 3 (terra 6-arg call site) is coder-terra-cc's and tracked on their side.