RHINENG-26348: add ability to repair system_advisories_0 partition

[TenSt]

This PR:

• adds one-off repair_system_advisories_0 flag (default off) for db-migration Job
• replaces corrupt system_advisories_0 and clears bucket-0 AAD/AA caches
• documents flag in clowdapp.yaml and major-migration runbook

Testing:
I've tested locally and all looks good. We will tests everything in stage before going to production even that stage doesn't have the corrupted partition.

Summary by Sourcery

Add a one-off, configurable repair pathway for the system_advisories_0 partition in the db-migration job, including cache cleanup for bucket-0 accounts.

New Features:

• Introduce repairSystemAdvisories0 configuration flag for the db-migration job to trigger a targeted repair of the system_advisories_0 partition.

Enhancements:

• Add a dedicated repairSystemAdvisories0Partition flow that reuses migration preparation and user-unblocking steps around the repair operation.
• Document the repair_system_advisories_0 flag and its destructive, one-off usage in the major migration runbook and ClowdApp configuration comments.

Documentation:

• Extend the major migration runbook with guidance on using the repair_system_advisories_0 flag for one-off recovery of corrupt system_advisories_0 data.

Chores:

• Add a repair_system_advisories_0.sql admin script to recreate the system_advisories_0 partition and clear related bucket-0 advisory caches.

[sourcery-ai]

Reviewer's Guide

Adds a gated, one-off database_admin flag and migration path to detach/drop/recreate the system_advisories_0 partition and clear related bucket-0 caches, plus documents how and where to use it in configuration and runbook docs.

File-Level Changes

Change	Details	Files
Introduce a one-off migration path to repair the system_advisories_0 partition and clear bucket-0 advisory caches, controlled by a new config flag.	Add repairSystemAdvisories0Partition helper that wraps prepareForMigration, executes a dedicated SQL script, and restores user privileges via unblockUsers Wire the repairSystemAdvisories0 flag into UpdateDB so the repair path runs after the main migration when enabled Read the new repair_system_advisories_0 boolean from DATABASE_ADMIN_CONFIG in config.go with a default of false	database_admin/update.go database_admin/config.go
Define the SQL procedure that detaches/drops/recreates system_advisories_0 and clears denormalized bucket-0 data.	Create repair_system_advisories_0.sql to conditionally detach the partition, drop it if present, recreate it with the correct hash partitioning and storage parameters, and reapply GRANTs for relevant roles Add DELETE statements that clear advisory_account_data and account_advisory rows whose accounts hash into remainder 0 using satisfies_hash_partition	database_admin/schema/repair_system_advisories_0.sql
Document the new repair_system_advisories_0 flag and its intended one-off usage in deployment and runbook docs.	Extend clowdapp.yaml DATABASE_ADMIN_CONFIG comment block to include repair_system_advisories_0 usage and caveats Update major-migration-runbook.md with a new section describing the flag’s location, effects, destructive nature, and operational guidance (when/how to enable and remove)	deploy/clowdapp.yaml docs/md/major-migration-runbook.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• In repair_system_advisories_0.sql, the existence check and detach logic rely only on relname without schema qualification; consider filtering on the expected schema (e.g., JOIN pg_namespace and check nspname) to avoid accidental interaction with identically named tables in other schemas.
• The new partition definition in repair_system_advisories_0.sql hardcodes the modulus (32) and partition options; you may want to derive these from the existing system_advisories partitioned table metadata or reuse a shared template to keep this in sync if partitioning parameters change in the future.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In repair_system_advisories_0.sql, the existence check and detach logic rely only on relname without schema qualification; consider filtering on the expected schema (e.g., JOIN pg_namespace and check nspname) to avoid accidental interaction with identically named tables in other schemas.
- The new partition definition in repair_system_advisories_0.sql hardcodes the modulus (32) and partition options; you may want to derive these from the existing system_advisories partitioned table metadata or reuse a shared template to keep this in sync if partitioning parameters change in the future.

## Individual Comments

### Comment 1
<location path="docs/md/major-migration-runbook.md" line_range="156" />
<code_context>
+|---|---|
+| **Config key** | `repair_system_advisories_0` (boolean, default `false`) |
+| **Where** | `DATABASE_ADMIN_CONFIG` on the **db-migration Job** only |
+| **Effect** | After migrate CONTINUE/MIGRATE, runs `prepareForMigration`, then `database_admin/schema/repair_system_advisories_0.sql`: detach/drop/recreate empty `system_advisories_0`, clear bucket-0 `advisory_account_data` and `account_advisory`. **Destructive** for hash remainder 0. |
+
+**Enable when:** one-off recovery from corrupt/unreadable `system_advisories_0`. Combine with `terminate_db_sessions=true` if detach/drop is blocked by app sessions.
</code_context>
<issue_to_address>
**suggestion (typo):** Consider rephrasing “After migrate CONTINUE/MIGRATE” for grammatical clarity.

The wording is confusing because “migrate” reads as a verb without a subject. Please consider a clearer alternative such as “After the CONTINUE/MIGRATE migration step runs” or “After CONTINUE/MIGRATE mode is used,” depending on what you intend to describe.

```suggestion
| **Effect** | After the CONTINUE/MIGRATE migration step runs, executes `prepareForMigration`, then `database_admin/schema/repair_system_advisories_0.sql`: detach/drop/recreate empty `system_advisories_0`, clear bucket-0 `advisory_account_data` and `account_advisory`. **Destructive** for hash remainder 0. |
```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.27%. Comparing base (7ae4e4b) to head (0a79236).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2287   +/-   ##
=======================================
  Coverage   59.27%   59.27%           
=======================================
  Files         148      148           
  Lines        9488     9488           
=======================================
  Hits         5624     5624           
  Misses       3276     3276           
  Partials      588      588           

Flag	Coverage Δ
unittests	59.27% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.