From 9a7ab035beceebae199057381e93eb04ed50fdaa Mon Sep 17 00:00:00 2001
From: olegberman <bermanoleg@gmail.com>
Date: Tue, 1 Sep 2026 00:00:00 -0400
Subject: [PATCH] Reset disposable staging sign-in counters

---
 .github/workflows/release.yml               | 6 ++++++
 test/unit/scripts/staging-workflow.test.mjs | 9 ++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a2d1eb6a..50469acb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -425,6 +425,12 @@ jobs:
             (["DB", "MAIL_OBJECTS", "HQBASE_JOBS", "MAIL_SENDER", "MAIL_EVENTS"] - $names) |
             length == 0
           ' <<<"$version"
+      - name: Reset disposable sign-in probes before final lifecycle
+        run: |
+          config=".hqbase/deployments/$DEPLOYMENT_NAME/wrangler.jsonc"
+          database="hqbase-$DEPLOYMENT_NAME"
+          pnpm exec wrangler d1 execute "$database" --remote --config "$config" \
+            --command "DELETE FROM rate_limits WHERE scope IN ('auth.email', 'auth.ip')"
       - name: Verify PWA, app shell, access, and operator lifecycle
         run: pnpm test:e2e:staging
       - name: Exercise populated remote backup and restore
diff --git a/test/unit/scripts/staging-workflow.test.mjs b/test/unit/scripts/staging-workflow.test.mjs
index a33e818c..6cb08a0c 100644
--- a/test/unit/scripts/staging-workflow.test.mjs
+++ b/test/unit/scripts/staging-workflow.test.mjs
@@ -225,6 +225,9 @@ describe("staging workflow lifecycle record", () => {
       "      - name: Prove the canonical same-version retry is idempotent"
     );
     const bindings = releaseWorkflow.indexOf("      - name: Verify active Worker bindings");
+    const resetSignInProbes = releaseWorkflow.indexOf(
+      "      - name: Reset disposable sign-in probes before final lifecycle"
+    );
     const lifecycle = releaseWorkflow.indexOf(
       "      - name: Verify PWA, app shell, access, and operator lifecycle"
     );
@@ -238,7 +241,8 @@ describe("staging workflow lifecycle record", () => {
     expect(final).toBeGreaterThan(repair);
     expect(retry).toBeGreaterThan(final);
     expect(bindings).toBeGreaterThan(retry);
-    expect(lifecycle).toBeGreaterThan(bindings);
+    expect(resetSignInProbes).toBeGreaterThan(bindings);
+    expect(lifecycle).toBeGreaterThan(resetSignInProbes);
     expect(backup).toBeGreaterThan(lifecycle);
     expect(releaseWorkflow.slice(stale, repair)).toContain("after_deploy_ledger_table_count:0");
     expect(releaseWorkflow.slice(stale, repair)).toContain("alias_table_count:2");
@@ -260,6 +264,9 @@ describe("staging workflow lifecycle record", () => {
     expect(releaseWorkflow.slice(retry, bindings)).toContain(
       'node "$GITHUB_WORKSPACE/scripts/release/bootstrap.mjs" --config "$config"'
     );
+    expect(releaseWorkflow.slice(resetSignInProbes, lifecycle)).toContain(
+      "DELETE FROM rate_limits WHERE scope IN ('auth.email', 'auth.ip')"
+    );
   });
 
   it("gates publication on the deployed update action and exact cleanup", () => {