← all branches

fix/dup-repair

safeviewing older commit
3de8c23 · incrementalPR #306reviewed 2026-07-14 14:23 UTC0H · 1M · 3L · 3I
The branch
Purpose
One-shot repair for June-2026 duplicate-contract contamination incident (#231): CFE pipeline minted twin contracts inside a known date window.
Goal
Identify and repair all duplicate contract groups: flip active/terminated so the evidence holder is active, soft-delete twins, re-point subscriptions, sweep 12 foreign-RPU residue bills.
Sub-goals
  • SG-1: Pure classification core tested in isolation
  • SG-2: Full repair shell with dry-run, typed confirmation, per-group FOR UPDATE transactions, verify pass
  • SG-3: Guard classify() and inWindow() against the Array.map-index footgun
  • SG-4: Foreign-bill sweep with S3 manifest
The changes (whole branch)
What
Extended the Array.map-index footgun guard (already in classify()) to inWindow() with an identical shape-check. Added 3 matching test assertions.
Why
inWindow() was unguarded — strings.map(inWindow) would pass a numeric index silently, disabling the window check and producing incorrect FLIP_KEEP_HISTORY verdicts instead of FLIP_DELETE_TWIN.
Areas
scripts/__tests__/repair-dup-contracts-core.test.ts+203−0scripts/lib/repair-dup-contracts-core.ts+132−0scripts/repair-dup-contracts.ts+579−0
Blast
3 files, +914/-0 total; all within scripts/ (no domain code touched)
operational-script one-shot pre-prod-run-required
✅unit-tests· 17/17 pass (vitest)➖ci-checks· not accessible via runner token➖coderabbit· no .coderabbit.yaml

Findings · 7

conventions1

info

Guard comment correctly explains the non-obvious footgun invariant

scripts/lib/repair-dup-contracts-core.ts:57

Positive practice.

tests4

medium

Empty-object guard uses truthiness, not key presence

scripts/lib/repair-dup-contracts-core.ts:59

!window.start || !window.end rejects {} correctly but gives no hint which field is missing on a half-formed object. No behaviour bug; uncovered edge.

low

No direct happy-path test for inWindow() with explicit window

scripts/__tests__/repair-dup-contracts-core.test.ts:187

All new assertions exercise the throw path. Direct explicit-window happy path is untested (covered transitively via classify).

low

Map-footgun test uses `as never` cast; error matched by broad regex

scripts/__tests__/repair-dup-contracts-core.test.ts:190

Valid but a tighter message assertion would be more precise.

info

Inline test comment accurately pins the prod incident date

scripts/__tests__/repair-dup-contracts-core.test.ts:187

Positive practice.

improvement2

low

Error message naming inconsistent between classify() and inWindow()

scripts/lib/repair-dup-contracts-core.ts:60

inWindow prefixes with function name; classify does not. Log correlation friction.

info

Truthiness guard semantics are correct but undocumented

scripts/lib/repair-dup-contracts-core.ts:59

A brief comment noting undefined/null/empty-string are all invalid would prevent future over-engineering.

History · 8 commits

  1. 80e0f62safeincremental0H · 0M · 1L2026-07-16 19:20
  2. d513853needs attentionincremental0H · 2M · 3L2026-07-16 19:13
  3. 3de8c23safeincremental0H · 1M · 3L2026-07-14 14:23current
  4. 8af2fabsafeincremental0H · 0M · 2L2026-07-14 14:16
  5. 8e6343eneeds attentionincremental0H · 1M · 3L2026-07-14 04:45
  6. 57eb1ebneeds attentionincremental0H · 2M · 4L2026-07-14 02:41
  7. a29f8f4needs attentionincremental0H · 4M · 6L2026-07-14 02:33
  8. 27179efneeds attentionfull5H · 4M · 3L2026-07-14 02:15