carlos / platform Public

console: the dead-letter's comments name the account alone (auditActivityTx resolves no app), and auditActivityTx says its one permanent failure is sql.ErrNoRows on the account

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 1 day ago 2196d917e2e3328bc9b1ccd82b2d16e8b735c3fb parent 4a41b86

2 files changed, +8 −5

diff --git a/internal/console/selfserve_events.go b/internal/console/selfserve_events.go

index b2c8a1d3d..94e43d448 100644

--- a/internal/console/selfserve_events.go

+++ b/internal/console/selfserve_events.go

@@ -8,9 +8,9 @@ package console

// Phase is the phase entered, any other event's is "<phase>:<kind>"

// (reports:lane, health:probe, prechecks:facts, ready:refusal,

// stopping:timing). The pass delivers each one once as an audit row

-// (drainSelfServeEvents), and an event whose account or app cannot be

-// resolved five times (its account deleted) is dead-lettered so it never holds recovery

-// mode on for ever.

+// (drainSelfServeEvents), and an event whose account cannot be resolved

+// five times (the account deleted) is dead-lettered so it never holds

+// recovery mode on for ever.

import (

"context"

diff --git a/internal/console/selfserve_store.go b/internal/console/selfserve_store.go

index 739b81b68..811671ae9 100644

--- a/internal/console/selfserve_store.go

+++ b/internal/console/selfserve_store.go

@@ -1245,7 +1245,7 @@ FROM self_serve_events WHERE emitted = 0 ORDER BY at, id, seq LIMIT ?`, limit)

// it); otherwise deliver inserts the audit row inside tx. A failure rolls

// both back, leaving the event undelivered. Only a permanent failure

// counts an attempt against it: deliver could not resolve the event's

-// account or app (sql.ErrNoRows, auditActivityTx's account lookup). A

+// account (sql.ErrNoRows from auditActivityTx's account lookup). A

// transient one (a busy database, a cancelled context, a crash) counts

// nothing and is retried for as long as it lasts. The

// selfServeDeliverAttempts-th permanent failure dead-letters the event

@@ -1274,7 +1274,10 @@ func (s *Store) DeliverSelfServeEvent(ctx context.Context, e SelfServeEvent, del

// auditActivityTx inserts one audit row inside tx, for the account named by

// its sqid: the transactional twin of RecordActivity, so an event's audit

-// line and its emitted mark commit together.

+// line and its emitted mark commit together. Its one permanent failure is

+// sql.ErrNoRows on the account (DeliverSelfServeEvent counts only that);

+// any new constraint on audit would fail every retry uncounted and keep

+// recovery mode on, so it must be added to that rule as well.

func auditActivityTx(tx *sql.Tx, acct, app, address string, a Activity) error {

var accountID int64

if err := tx.QueryRow(`SELECT id FROM accounts WHERE sqid = ?`, acct).Scan(&accountID); err != nil {