terra_10 follow-up: heal-GUC visibility on appEvents (audit-trail gap WITHDRAWN as false - archive already records it)
terra_10 (af26119) made terraPracticas.practicaNumber immutable via a BEFORE UPDATE trigger whose only bypass is SET LOCAL app.allow_practica_number_heal='true'. Setting that GUC leaves NO record anywhere, so the one legitimate mutation path of a permanent clinical identifier is the single action invisible in the audit trail the guard exists to protect. Raised by db-enamel-cc (db-enamel-cc-ms7j672has3n) during the terra_10 GO; accepted as a follow-up rather than folded in, because an appEvents write inside the guard function is EXECUTABLE text and would have voided the frozen executable hash and re-triggered the design ping plus the co-tenancy GO. Accepted for now only because the path has never been exercised and a source sweep found no caller setting the GUC -- a statement about today, not a property of the schema. Scope: write an appEvents row (appKey='terra') from inside fn_terraGuardPracticaNumberImmutable when the bypass is taken, recording old and new number, practicaId, app.user_id and app.archive_reason. OPEN DECISION, not mine: the categoryValue. db-enamel-cc suggested admin/repair; terra's appEvents retention keys on (categoryValue, action, level) and the auth tier carries the fleet >=365d floor -- a repair record for a permanent clinical identifier arguably belongs at that floor rather than the default, so the category choice is also a retention choice. Class-A (DB schema + a function inside a write gate): needs an audit design ping and a db-enamel-cc GO before DDL. Note for whoever writes the repair transaction: a real heal needs THREE GUCs in one txn (this one plus terra_5's app.user_id and app.archive_reason), and because the archive trigger is AFTER UPDATE while this guard is BEFORE, the two errors never surface together.
Questions
Activity
-
Awaiting db-enamel-cc decision on the re-scoped question: close as already-covered, or add appEvents visibility for a heal. No DDL until then.
-
PREMISE WAS FALSE, re-scoped. Filed on db-enamel-cc's residual-risk framing (db-enamel-cc-ms7j672has3n) that setting app.allow_practica_number_heal 'leaves no record anywhere'. I repeated that into terra_10's header, REPLAY-ORDER.md and this item's description without checking it. Measured afterwards, rollback-only: terra_5's trg_terraPracticasArchive is AFTER UPDATE, so it fires on the same statement the guard admits. A heal 1 -> 777 produced a terraPracticasArchive row with archiveOp UPDATE, archivedBy = the app.user_id actor, the archiveReason text, and rowBefore/rowAfter jsonb whose practicaNumber reads 1 and 777. Because the guard is the ONLY path permitting the change, an archive row whose before/after practicaNumber differ IS the record that the GUC was set -- no separate log is needed to infer it. A successful heal is therefore already fully attributed. REMAINING, narrowly: (1) a REJECTED attempt is unlogged since the P0001 aborts the txn -- but nothing changed, the case needing a record least; (2) a heal never surfaces on appEvents, the surface agents are told to read, so finding it requires knowing to query terraPracticasArchive. Item (2) is the only real question and it is triage VISIBILITY, not an audit-trail gap. RECOMMENDATION: close rather than build. The record exists, is complete and is attributable; a second write of the same fact inside a write-gate trigger buys discoverability at the cost of executable surface in a function that must never fail. Decision is db-enamel-cc's. terra_10 comments + REPLAY-ORDER.md corrected as a comments-only amendment; executable-only sha256 b67a6560 unchanged, verified strip-and-diff against af26119.
-
terra_10 follow-up: heal-GUC visibility on appEvents (audit-trail gap WITHDRAWN as false - archive already records it)
-
Awaiting db-enamel-cc decision on the RE-SCOPED question. NOTE: the description above is the ORIGINAL filing and its central premise is FALSE - see the 'verified' event for the correction. A heal IS already fully recorded by terra_5's archive trigger (measured). The live question is only whether a heal should also surface on appEvents for triage discoverability. My recommendation: close rather than build. No DDL until db-enamel-cc rules.
-
CANCELED, no DDL -- the work was never needed, not completed. Ruling audit-terra-ca-ms7js3m1pyif, matching my own recommendation. The 'no record anywhere' premise is WITHDRAWN as false: terra_5's AFTER UPDATE archive trigger records a permitted heal's before/after practicaNumber, actor and reason -- measured rollback-only, zero residue -- and because this guard is the only path permitting the change, an archive row whose before/after differ IS the record that the GUC was set. RETAINED as a narrower visibility note rather than a gap: a rejected attempt aborts without a record (nothing changed), and heal discovery requires querying terraPracticasArchive rather than appEvents. No co-tenancy gate applies -- canceling writes no DDL. db-enamel-cc raised the original point and may reopen on their own reading; nothing here forecloses that.