refactor(storage): route canonical writes through Bun

[mariusvniekerk]

Independent archive, PostgreSQL replication, and DuckDB mirror writers manually projected overlapping schemas, which made column ownership and transaction semantics vulnerable to drift. This layer routes canonical session, pricing, cursor, identity, and dependent writes through Bun transactions and the shared model registry.

PostgreSQL ownership serialization uses collision-resistant full-digest keys, SQLite pricing uses the canonical Bun writer and pricing contract, and usage-event snapshots order mixed-offset timestamps chronologically. Operational synchronization metadata and backend lifecycle remain adapter-owned. Stack 4 of 5.

^{generated by a clanker}

[roborev-ci]

roborev: Combined Review (18e86ea)

Storage refactor needs changes for two medium-severity data integrity regressions.

Medium

• internal/db/bun_write.go:141 — Batch ingestion no longer performs prior tool-result normalization, omitting positional event indexes, inferred content lengths, and inherited parent tool_use_id/subagent_session_id values. Parsers such as Poolside can therefore persist incomplete result events, while multiple zero-valued indexes can collide on canonical keys. Normalize result events at the archive-ingestion boundary before canonical conversion, preserve the previous defaults, and add coverage for parent-ID inheritance and multiple unindexed events.

• internal/db/bun_usage.go:224 — Revision normalization incorrectly applies to underscore-prefixed pricing metadata whose updated_at values are arbitrary versions such as "v42" or "2". Fresh PostgreSQL or DuckDB replication replaces these values with timestamps, and later pushes may not repair the corruption. Bypass timestamp revision handling for metadata patterns, preserve sanitized UpdatedAt values verbatim, and add target contract tests with non-timestamp metadata values.

---

Reviewers: 2 done | Synthesis: codex, 14s | Total: 33m22s

[roborev-ci]

roborev: Combined Review (7a4225f)

Medium-severity issue found: one malformed session can block an entire incremental PostgreSQL push.

Medium

• internal/postgres/push.go:462 — Incremental PostgreSQL preparation aborts the entire push when a snapshot contains a legacy unsupported timestamp. Because this occurs before batching, it bypasses per-session retry/error isolation and prevents valid sessions from being pushed.
  • Fix: Handle bunmodel.ErrUnsupportedTimestamp like the DuckDB path: force that session’s fingerprint to mismatch, then let pushBatch isolate the failure. Add coverage for an incremental push containing both valid and malformed sessions.

---

Reviewers: 2 done | Synthesis: codex, 7s | Total: 25m41s

[roborev-ci]

roborev: Combined Review (2ef9863)

Medium-severity concurrency issue found; no critical or high-severity findings.

Medium

• internal/db/bun_usage.go:172 — Pricing revisions are calculated before the upsert without locking. Concurrent pushers can derive revisions from the same stale row, allowing a later write to store an equal or older revision despite changed pricing. Compute the revision atomically against the current target row during the upsert to preserve monotonic revisions.

---

Reviewers: 2 done | Synthesis: codex, 5s | Total: 24m13s

[roborev-ci]

roborev: Combined Review (bb1a3c8)

Storage review found two medium-severity concurrency and replication parity issues.

Medium

• internal/db/bun_usage.go:194 — PostgreSQL pricing revisions use an unlocked read, allowing concurrent pushers to overwrite newer revisions with stale timestamps. Serialize pricing updates or restore an atomic monotonic revision calculation in the conflict clause.

• internal/postgres/worktree_mappings_push.go:158 — PostgreSQL mapping writes omit the canonical id and created_at fields, causing incorrect defaults and breaking DuckDB/PostgreSQL parity. Include and update both fields from canonical source mapping rows.

---

Reviewers: 2 done | Synthesis: codex, 12s | Total: 12m37s

[roborev-ci]

roborev: Combined Review (66ea17d)

Code changes are clean with no Medium, High, or Critical findings.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 34m12s

[roborev-ci]

roborev: Combined Review (a560de7)

Changes requested: two medium-severity replication issues could block progress or leave historical DuckDB data incomplete.

Medium

• internal/postgres/push.go:462 — Incremental preparation aborts the entire PostgreSQL push when any candidate has a legacy unsupported timestamp, bypassing batch fallback and potentially preventing all subsequent incremental progress when the watermark remains unchanged. Handle bunmodel.ErrUnsupportedTimestamp like the DuckDB path: assign a guaranteed-nonmatching marker and retain the session as a candidate so pushBatch can isolate its failure while other sessions continue.

• internal/duckdb/push.go:949, internal/duckdb/schema.go:28 — The canonical upsert now writes previously omitted fields such as parser_parent_session_id, but the mirror schema/write-contract version was not changed. Existing version-11 mirrors only repair sessions within the incremental watermark window, leaving unchanged historical sessions without provenance indefinitely. Bump the DuckDB schema version or add a mirror write-contract version that forces a complete session backfill when the projection changes.

---

Reviewers: 2 done | Synthesis: codex, 18s | Total: 22m29s