PR#4 (gated): runbook de aposentadoria da bridge — NÃO mergear até A verde

[adm01-debug]

⚠️ NÃO MERGEAR / NÃO EXECUTAR ainda — passo final GATED

O passo destrutivo do PR#4 (remover o fallback de bridge no cliente, desativar a Edge Function external-db-bridge v156, e tratar o kill-switch) só pode rodar depois que o Plano A estiver verde em produção:

• PR#2 (A): escrita via PostgREST nativo + RLS (6 guardas) #525 (PR#2 — escrita REST nativa) mergeado;
• PR#3 (A): RLS de escrita p/ print_area_techniques e supplier_branches #527 (PR#3 — RLS de escrita) mergeado e aplicado;
• soak de produção confirmando escrita/leitura saudáveis.

Como A ainda está em draft, executar a remoção agora seria fora de ordem e perigoso. Este PR entrega apenas o runbook (docs/runbooks/retire-external-db-bridge.md) — nada de código/DDL/destruição.

Duas armadilhas que o runbook documenta (e que tornam o "só deletar" errado)

1. fail-open do kill-switch — getKillSwitchState retorna {enabled:true} quando a linha some. Logo, DELETE da linha edge_external_db_bridge RELIGA a bridge. Nunca deletar a linha enquanto o cliente ainda a lê. A linha é também o rollback do PR#2 (enabled=true restaura a bridge em segundos).
2. main ainda usa a bridge como fallback até o PR#2 mergear — deletar a função v156 antes quebra produção nos caminhos fora da whitelist REST nativa.

Ordem correta (no runbook)

A-verde → remover fallback no cliente → deploy + soak → só então desativar a função → por último, tratar o kill-switch (no mesmo PR que remove o último leitor).

Inclui critérios de soak e rollback. Série: #1 (C) → #2 (A núcleo) → #3 (A RLS) → #4 (aposentar bridge — gated).

---

Summary by cubic

Adds a gated runbook for safely retiring the Edge Function external-db-bridge. Documentation-only; destructive steps are blocked until Plan A is green in production (PR#2 #525 and PR#3 #527 merged + soak).

• New Features
  • Runbook with the exact order: A-green → remove client fallback → deploy/soak → disable external-db-bridge → handle kill-switch.
  • Documents two pitfalls: kill-switch fail-open (deleting the row re-enables the bridge) and main still falling back to the bridge until PR#2 merges.
  • Includes soak criteria and a rollback path (toggle kill-switch), and requires removing the kill-switch only after the last reader is gone.

^{Written for commit f7d861d. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
we-dream-big	Error		May 30, 2026 4:46pm

[coderabbitai]

Warning

Review limit reached

@adm01-debug, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 27 minutes and 21 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 86c178a0-f809-4fba-979b-0be48182dca0

📥 Commits

Reviewing files that changed from the base of the PR and between 637da2c and f7d861d.

📒 Files selected for processing (1)

• docs/runbooks/retire-external-db-bridge.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/d-retire-bridge-runbook

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[supabase]

This pull request has been ignored for the connected project doufsxqlfjyuvxuezpln because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Copilot]

Pull request overview

Documentation-only PR adding a gated runbook describing the correct order to retire the external-db-bridge Edge Function. No code or DDL changes; the runbook explicitly blocks destructive steps until PR#2 (#525) and PR#3 (#527) are merged and a production soak is green.

Changes:

• Adds docs/runbooks/retire-external-db-bridge.md documenting two pitfalls (kill-switch fail-open, current main bridge fallback), the correct retirement sequence, soak criteria, and rollback.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[adm01-debug]

Revisão (dev sênior) — manter aberta e gated, não mergear 🚧

Concordo integralmente com o gate da própria PR. Esta é doc-only (docs/runbooks/retire-external-db-bridge.md, +73 linhas, sem código/DDL), mas o passo destrutivo que ela documenta (remover o fallback de bridge no cliente + desativar a Edge Function external-db-bridge v156 + tratar o kill-switch) só pode rodar depois do Plano A verde em prod.

As duas armadilhas que o runbook documenta seguem válidas na main de hoje:

1. fail-open do kill-switch — getKillSwitchState retorna { enabled: true } quando a linha some (confirmado no fluxo de bridge.ts: no catch, bridgeEnabled = true). Logo, deletar a linha edge_external_db_bridge RELIGA a bridge. A linha também é o rollback de um clique (enabled = true restaura a bridge).
2. main ainda tem a bridge como fallback — invokeExternalDb/invokeBridge/invokeExternalDbDelete ainda caem na função para tabelas fora da whitelist REST nativa. Desativar a v156 antes de remover o último leitor quebra produção nesses caminhos.

Ordem correta (como no runbook): A-verde → remover fallback no cliente → deploy + soak → só então desativar a função → por último, tratar o kill-switch (no mesmo PR que remove o último leitor).

Veredito: deixo aberta e sem merge, como pedido no título. Merge só quando o gate (A verde + soak) for satisfeito — e o passo de desativar a função/kill-switch deve vir em PR de código própria, não neste doc.