coulomb-social/docs/release/source-date-backfill-rehearsal-2026-10-29.md

Accepted-cohort creation-date patch rehearsal

The private plan identified one SQL space creation date and its missing index source date. All 36 imported article dates already matched source; the other two pages were local. This rehearsal checks that exact plan against the independently recovered pair. It does not authorize or execute a productive backfill.

prepare_index_date_patch in date_backfill.py verifies the observed index hash, source identity, date agreement and the two permitted operations. It inserts one frontmatter line without serializing the existing document. Every existing byte, including local edits, comments, spacing and the terminal newline, stays intact. Conflicting/existing dates, duplicate keys, unexpected paths/SQL selections or expanded operations refuse. An already matching index remains byte-identical.

Run against a retained isolated restore, using private paths locally:

uv run python scripts/rehearse-source-date-backfill.py \
  --restore-receipt /private/restore-receipt.json \
  --plan /private/date-backfill-plan.json \
  --candidate-image '<locally retained image digest>' \
  --output /tmp/date-backfill-rehearsal.json

The runner verifies the internal Docker network, database image and absence of published database ports. It copies recovered files into a temporary directory and mounts the patch module over the packaged candidate. This is explicit source overlay evidence, not evidence that a released image contains the new module.

Native result: source-date-backfill-rehearsal-2026-10-29.json. All SQL tables were compared. Only the selected creation date and copied index changed; grants, other fields, 38 other pages and all other files stayed identical. Reversal restored all rows/files, a stale SQL precondition refused replay, and the final transaction rolled back. All 82 original recovered files remained unchanged. The temporary application container is removed on failure/timeout so its SQL session cannot remain open; the recovered database is retained.

Validation: make check passed all 258 tests, including the mandatory real-browser journeys. The 21 date-backfill tests cover observed-content drift, conflicting dates, destination tampering, duplicate keys, preserved bytes and SQL-only/no-op plans. The public native receipt binds the private plan, patch module and runner by SHA256.

Remaining before production: a reviewed supervisor executor, fresh paired backup and immutable readback, quiesced writers, full live SQL/content preconditions, durable cross-store recovery journal and postflight. An SQL rollback alone cannot undo a filesystem write after a process crash. No productive date changes or backfill completion are claimed here.