feat/sites-1n

Source sites row not locked during INSERT SELECT — concurrent update race window

scripts/split-merged-sites.ts:163

SUC rows are locked with FOR UPDATE OF suc, but the sites sub-SELECT is unlocked. A concurrent lifecycle/metadata update could commit between lock acquisition and INSERT, causing the new site to be created with stale data.

Source site version not bumped after losing N-1 SUC links

scripts/split-merged-sites.ts:200

SUC version is bumped but sites.version on the source is not. Any shell using OCC on sites will not detect this structural change.

site_locations UNION ALL / LIMIT 1 may silently drop rows for multi-location sources

scripts/split-merged-sites.ts:183

LIMIT 1 applies to the entire UNION result. If source site has multiple site_locations rows, LIMIT 1 picks only one.

Dry-run plan 'keeps rpus[0]' uses contract_number sort — execution uses created_at

scripts/split-merged-sites.ts:234

Plan log can say 'keeps RPU X' while execution keeps RPU Y, undermining pre-run audit.

metric_streams rows not re-pointed to split-off sites

scripts/split-merged-sites.ts:140

Script copies assignees and locations but is silent on metric_streams (may FK to site_id).

Post-verification bounded by --limit — OK message misleading for partial runs

scripts/split-merged-sites.ts:258

findSuspiciousSites reused for verification includes the LIMIT. Drop LIMIT for the verification call.

Failed site IDs not accumulated and re-printed in summary

scripts/split-merged-sites.ts:251

catch block logs and continues. Post-verify shows remaining multi-RPU sites but doesn't list which sites specifically failed.

argValue does not guard against flag-as-value (--org --execute)

scripts/split-merged-sites.ts:79

argValue('--org') returns '--execute' if the user writes --org --execute.

CLI filter values logged to stdout — multi-tenant audit concern

scripts/split-merged-sites.ts:214

ORG_FILTER/SITE_FILTER echoed in console.log. If logs ship to a shared sink, this correlates org public IDs with split activity.

site_assignees copy lacks explicit org_id guard

scripts/split-merged-sites.ts:194

No explicit WHERE m.org_id = s.org_id guard. Defense-in-depth against hypothetical data corruption.

--limit NaN coercion silently drops LIMIT clause

scripts/split-merged-sites.ts:84

Number('foo') is NaN; NaN is falsy so LIMIT drops silently. With --execute this processes far more sites than intended.

Duplicate step 5 in prod runbook — verify step hidden

docs/development/site-contract-relationship.md:229

Runbook has two items labeled '5.' The verify step should be step 6.

splitSite() has no integration test for transaction invariants

scripts/split-merged-sites.ts:140

For a script that will mutate ~1,583 prod rows, at least one integration test against a fixture would verify the transaction before --execute on prod.

categoryOf() has no unit test

scripts/split-merged-sites.ts:101

Pure 4-case function. A 4-assertion unit test eliminates any transcription error.

Dry-run does not exercise the INSERT/UPDATE path

scripts/split-merged-sites.ts:238

Dry-run exits before splitSite(). A staging pilot (--limit 1 --execute on a Supabase branch) would give stronger confidence.