[patrickbrandao]

Part of #68 (backend items; the frontend test mocks that still use auto_fixed are for frontend-dev).

What changed

• down() lock timeout. DropAutofixSchema1803400000000.down() sets lock_timeout = '10s' at session level (migration:revert runs with --transaction none, where SET LOCAL does nothing) and resets it in finally.
• auto_fixed mapping. New RemapAutofixedStatus1803620000000 rewrites agent_messages.status = 'auto_fixed' (the failed original of a healed pair) to fallback_error with superseded = true. Before Remover Autofix/Phoenix do backend #16 both ERROR_MESSAGE_STATUSES and SUPERSEDED_STATUSES listed auto_fixed; both list fallback_error today, so history counts as it did. Idempotent, lock_timeout, no-op down().
• Cross-tenant e2e. reliability-analytics.e2e-spec.ts seeds another tenant's rows under the same harness name and model; every assertion is exact, plus an explicit isolation case on stats, per-agent and per-model.
• Docs. Guide: lost pair grouping (autofix_group_id gone), the mapping, rolling upgrades with several replicas, and the 30 s UserCacheInterceptor lag on /overview/reliability/* (decision: document, not invalidate per write). Release notes 0.1.0: one PT-BR upgrade note.

Tests

• Migration unit specs: passed; full backend run in the report.
• npm run test:e2e:docker -- test/reliability-analytics.e2e-spec.ts test/drop-autofix-schema-migration.e2e-spec.ts test/drop-install-metadata-migration.e2e-spec.ts: 23 passed.
• tsc -p tsconfig.test.json, eslint: clean.

qa-docker: yes, light (one data migration). Suggested: upgrade a DB seeded with an auto_fixed row and check the reliability endpoints.

🤖 Generated with Claude Code

[patrickbrandao]

Full backend unit run (npx jest --maxWorkers=4): 476 suites, 9088 tests passed.

[patrickbrandao]

Review: #157 fix(backend): remap auto_fixed history and finish Autofix removal leftovers

Reviewed git diff origin/main...a1e6905.

High risk: 1803620000000-RemapAutofixedStatus rewrites agent_messages.status from auto_fixed to fallback_error and sets superseded = true. Afterwards the remapped rows cannot be told apart from real fallback errors, and down() is a no-op. Criterion: "rewrites data without a way back". The maintainer decides this merge.

Blockers: none.

Should-fix: none.

Nits

• packages/backend/src/database/migrations/1803620000000-RemapAutofixedStatus.ts:26: a single UPDATE with a status filter and no index on status means one sequential scan of agent_messages inside the migration transaction, under lock_timeout 10s. The lock timeout covers waiting for the lock, not the scan itself. On a large install this lengthens the boot migration. Acceptable for a one-off. If big installs matter, consider a note in the release text.
• The documented rolling-upgrade caveat (old replicas fail writes after the column drop) is correct and stated in the PT-BR release notes.

Migration safety

• superseded exists (1798000000000-AddErrorClassification, NOT NULL default false). No check constraint on agent_messages.status blocks fallback_error.
• The migration is idempotent and loses no rows. Only the paired success row stays unlinked, which is documented.
• DropAutofixSchema.down() now sets lock_timeout at session level and resets it in finally. That is correct for --transaction none. Editing an already-shipped migration's down() is harmless.
• Unit and e2e tests (reliability analytics with an auto_fixed row) are present. Changeset, PT-BR release notes and docs are present.
• CI on a1e6905: all green.
• qa-docker: required (data migration). The suggested upgrade check has not been reported yet. It is a merge gate.

Head revisado: a1e6905
Veredito: risco alto (aguardar mantenedor)

[patrickbrandao]

qa-docker: PR #157 (PASS)

Image thinker:qa-157 built from the PR head (linux/arm64, 428.8 MB, build 3m23s under load). PostgreSQL 16.15 (postgres:16-alpine). Isolated Compose project, run-scoped volumes, mock provider only, THINKER_CATALOG_SYNC=false, random 64-hex THINKER_ENCRYPTION_KEY.

Step	Result
Boot on main image (fbd1f67), setup, agent key, mock provider, one routed request	pass
Seed agent_messages rows: auto_fixed (attempt 2) and a control fallback_error/superseded=false (attempt 3)	pass
Upgrade to PR image: RemapAutofixedStatus1803620000000 applied, boot healthy	pass
auto_fixed row is now fallback_error with superseded=true; zero auto_fixed rows left	pass
Control fallback_error row and the paired success row untouched	pass
Health, SPA, /v1/models, OpenAI chat, Anthropic /v1/messages, Responses via mock	pass
contracts/gateway (9 tests)	pass (9/9)
Backend e2e (test:e2e:docker)	pass (71 suites, 600 tests, 416s)
Teardown, no run-labelled volumes left	pass

Nothing flaky. Tested SHA: a1e6905

[patrickbrandao]

Re-review: #157 (delta since a1e6905)

Reviewed git diff origin/main...5aea9e1 and the delta from a1e6905.

The delta is a merge of main. The only conflict was in packages/backend/src/database/data-source-definitions.ts, and it is resolved correctly: RenameReservedCustomProviderAliases1803610000000 (from #155) comes first, then RemapAutofixedStatus1803620000000, both in import order and in timestamp order. The PR's own diff against main is unchanged (9 files). The two migrations touch different tables, so their order does not matter for correctness.

Blockers: none. Should-fix: none. The nits from the previous review still apply: a single full-table UPDATE on agent_messages during boot.

High risk (unchanged): the migration rewrites data without a way back (auto_fixed becomes fallback_error, and down() is a no-op). The maintainer decides this merge.

CI on 5aea9e1: all 20 checks green. qa-docker (upgrade with an auto_fixed row) is still a merge gate if it has not been run yet.

Head revisado: 5aea9e1
Veredito: risco alto (aguardar mantenedor)