From d1a6c834324e803c768a68517bf768503bde5459 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Sun, 12 Jul 2026 05:28:34 -0700
Subject: [PATCH] fix(orb): fix production outage caused by the anti-join query

The anti-join added in the previous commit used a correlated NOT
EXISTS subquery with LOWER(ae.target_key) = ... -- wrapping the
indexed target_key column in a function defeats the index, forcing
a full scan of audit_events (100K+ rows) for every orb_pr_outcomes
row. This took down /v1/public/stats in production within minutes
of deploying (D1 CPU time limit exceeded, 503s).

Replaces it with a LEFT JOIN ... WHERE ae.id IS NULL, comparing
target_key directly with no function wrapping so D1 can use the
index. Verified directly against production: ~60ms / ~31K rows
read, versus a timeout before. Both sides of the comparison come
from the same GitHub API casing, so no LOWER() is needed here.
---
 src/orb/outcomes.ts | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/src/orb/outcomes.ts b/src/orb/outcomes.ts
index 2f57fbd8c4..d16cf12845 100644
--- a/src/orb/outcomes.ts
+++ b/src/orb/outcomes.ts
@@ -42,12 +42,23 @@ export interface OrbGlobalStats {
  * only (registered = 1) — an install that hasn't been opted in never contributes to the public counter. SUM over
  * no matching rows is NULL, so each total is nullish-guarded to 0 (fail-safe on an empty/cold table).
  *
- * The NOT EXISTS anti-join skips any (repo, pr_number) that already has a `github_app.pr_public_surface_published`
- * audit event — i.e. a PR the own-ledger disposition query in public-stats.ts already counted. Without it, a PR
- * reviewed before the self-host cutover (own-ledger) that also has a terminal outcome recorded here (Orb) gets
- * counted twice. Quantified 2026-07-12: 243 PRs (173 merged + 70 closed), 96% in one repo, inflating the public
- * "PRs reviewed" counter. That event_type's target_key only ever references the own-ledger's own repos, so this
- * is a no-op for every other registered installation's outcomes.
+ * The LEFT JOIN ... WHERE ae.id IS NULL anti-join skips any (repo, pr_number) that already has a
+ * `github_app.pr_public_surface_published` audit event — i.e. a PR the own-ledger disposition query in
+ * public-stats.ts already counted. Without it, a PR reviewed before the self-host cutover (own-ledger) that
+ * also has a terminal outcome recorded here (Orb) gets counted twice. Quantified 2026-07-12: 243 PRs (173
+ * merged + 70 closed), 96% in one repo, inflating the public "PRs reviewed" counter. That event_type's
+ * target_key only ever references the own-ledger's own repos, so this is a no-op for every other registered
+ * installation's outcomes.
+ *
+ * PERFORMANCE (2026-07-12 incident): the first version of this used a correlated `NOT EXISTS` subquery with
+ * `LOWER(ae.target_key) = ...` — wrapping the indexed `target_key` column in a function defeats the index,
+ * forcing a full scan of `audit_events` (100K+ rows) for every one of `orb_pr_outcomes`' rows. That took
+ * `/v1/public/stats` down in production (D1 "exceeded its CPU time limit and was reset", 503s) within minutes
+ * of deploying. The LEFT JOIN below compares `target_key` directly (no function wrapping), so D1 can use the
+ * index for the join — verified live: ~60ms / ~31K rows read, vs. a timeout before. Both sides of the compared
+ * repo#pr key come from real GitHub API `full_name`/`target_key` values (same canonical casing), so no LOWER()
+ * is needed here for correctness — do not reintroduce a function-wrapped comparison on `target_key` without
+ * re-verifying the query plan against production-scale data first.
  */
 export async function getOrbGlobalStats(env: Env, opts: { excludeAccount?: string } = {}): Promise<OrbGlobalStats> {
   // excludeAccount de-dups an account already counted by another source. "" = include all.
@@ -59,12 +70,11 @@ export async function getOrbGlobalStats(env: Env, opts: { excludeAccount?: strin
        COUNT(*) AS total
      FROM orb_pr_outcomes o
      JOIN orb_github_installations i ON i.installation_id = o.installation_id AND i.registered = 1
+     LEFT JOIN audit_events ae
+       ON ae.target_key = o.repository_full_name || '#' || o.pr_number
+       AND ae.event_type = 'github_app.pr_public_surface_published'
      WHERE (? = '' OR LOWER(COALESCE(i.account_login, '')) <> ?)
-       AND NOT EXISTS (
-         SELECT 1 FROM audit_events ae
-         WHERE ae.event_type = 'github_app.pr_public_surface_published'
-           AND LOWER(ae.target_key) = LOWER(o.repository_full_name) || '#' || o.pr_number
-       )`,
+       AND ae.id IS NULL`,
   )
     .bind(exclude, exclude)
     .first<{ merged: number | null; closed: number | null; total: number | null }>();