fix(calibration): backfill upserts latest-decision-wins instead of silently dropping a changed terminal decision

ORB-review finding on the original INSERT OR IGNORE shape: with targetKey-only
deterministic ids, a target whose terminal decision changed between two
backfill runs had its second run's row silently dropped. ON CONFLICT(id)
DO UPDATE on the decision-bearing columns makes cross-run semantics match the
transform's own latest-terminal-wins dedupe; identical re-runs remain
effective no-ops, and ids/provenance are unchanged.

Author: JSONbored

scripts/backfill-calibration-corpus-core.ts

@@ -152,9 +152,12 @@ export function sqlStringLiteral(value: string): string {
 }
 
 /**
- * Render the synthesized rows as chunked `INSERT OR IGNORE` statements (idempotency comes from the
- * deterministic ids: a re-run, or an overlap with a prior partial apply, silently no-ops instead of
- * double-writing). Chunked so a statement never grows past what `wrangler d1 execute --command` sanely
+ * Render the synthesized rows as chunked UPSERT statements. Idempotency comes from the deterministic
+ * targetKey-derived ids; `ON CONFLICT(id) DO UPDATE` (rather than OR IGNORE) makes the semantics "latest
+ * decision wins" ACROSS runs too, matching the transform's own latest-terminal-wins dedupe: a target whose
+ * terminal decision changed between two backfill runs gets its pair UPDATED, never silently dropped
+ * (ORB-review finding on the original OR IGNORE shape), while a re-run over identical data remains an
+ * effective no-op. Chunked so a statement never grows past what `wrangler d1 execute --command` sanely
  * carries. Returns [] for an empty report.
  */
 export function buildBackfillInsertStatements(rows: readonly SynthesizedAuditRow[], chunkSize = 50): string[] {
@@ -169,7 +172,10 @@ export function buildBackfillInsertStatements(rows: readonly SynthesizedAuditRow
             .join(", ")})`,
       )
       .join(", ");
-    statements.push(`INSERT OR IGNORE INTO audit_events (id, event_type, actor, target_key, outcome, detail, metadata_json, created_at) VALUES ${values}`);
+    statements.push(
+      `INSERT INTO audit_events (id, event_type, actor, target_key, outcome, detail, metadata_json, created_at) VALUES ${values} ` +
+        `ON CONFLICT(id) DO UPDATE SET detail = excluded.detail, metadata_json = excluded.metadata_json, created_at = excluded.created_at`,
+    );
   }
   return statements;
 }

test/unit/backfill-calibration-corpus-core.test.ts

@@ -122,10 +122,13 @@ describe("synthesizeBackfillRows (#8157)", () => {
 describe("buildBackfillInsertStatements (#8157)", () => {
   const report = synthesizeBackfillRows([decisionRow(), decisionRow({ number: 8 }), decisionRow({ number: 9 })]);
 
-  it("renders INSERT OR IGNORE with the full audit_events column list and SQL-escaped values", () => {
+  it("renders latest-decision-wins UPSERTs with the full audit_events column list and SQL-escaped values", () => {
     const escaped = synthesizeBackfillRows([decisionRow({ repo: "o'brien/repo" })]);
     const [statement] = buildBackfillInsertStatements(escaped.rows);
-    expect(statement).toMatch(/^INSERT OR IGNORE INTO audit_events \(id, event_type, actor, target_key, outcome, detail, metadata_json, created_at\) VALUES /);
+    expect(statement).toMatch(/^INSERT INTO audit_events \(id, event_type, actor, target_key, outcome, detail, metadata_json, created_at\) VALUES /);
+    // ORB-review finding: a target whose terminal decision changed between runs must be UPDATED, never
+    // silently dropped -- the conflict clause updates exactly the decision-bearing columns.
+    expect(statement).toContain("ON CONFLICT(id) DO UPDATE SET detail = excluded.detail, metadata_json = excluded.metadata_json, created_at = excluded.created_at");
     expect(statement).toContain("o''brien/repo#7");
     expect(sqlStringLiteral("it's")).toBe("'it''s'");
   });