fix: backfill empty-provider dispatch rows + cross-link tmq#7 (#83)

[jakecelentano]

Summary

Two-part fix for dual-writer provider provenance (tower-fleet#210 F5):
backfill the 27 empty-provider dispatch rows that the bogocat-tmq plugin
wrote before the tms#73 resolver was ported.

Companion PR: bogocat/tmq#7 (resolver port).

What changed

• scripts/backfill-provider-83.py: DRY-RUN default, --apply writes.
  Sibling-join recovery: 1 row (5be270af, home-portal#297) gets
  provider=minimax, model=MiniMax-M3 from its Jul 12 sibling.
  Remaining 26 rows marked honestly unrecoverable (no sibling, no model
  in payload — NULLs are the truth).

Out of scope

• Reshaping the events schema or the payload column.
• Auditing other dual-writer risks fleet-wide.
• Deploying the updated bogocat-tmq plugin (see companion PR feat: tms polish — registry refactor, ST column, tms new/import #7).

Test plan

PYTHONPATH=lib python3 -m pytest tests/
297 passed in 0.67s

Verification

$ PYTHONPATH=lib python3 scripts/backfill-provider-83.py --apply
=== Provider Backfill Report (tms#83) ===
  Total empty-provider dispatch rows: 27
  Recoverable (sibling join):         1
  Unrecoverable (no sibling data):    26

  Updated 9dbdaf76... (5be270af): provider=minimax, model=MiniMax-M3
  Applied 1 row(s).

$ psql service=bogocat_ro -c "
  SELECT created_at::date, count(*)
  FROM tms_review.events
  WHERE event_type='dispatch' AND provider=''
  GROUP BY 1 ORDER BY 1;"
 created_at | count
------------+-------
 2026-07-14 |     2
 2026-07-15 |    19
 2026-07-16 |     5
(3 rows)
-- 27 → 26 (1 recovered, 26 honestly unrecoverable)

Follow-ups

• Deploy bogocat-tmq plugin update after tmq#7 merge
• Tower-fleet#210 F9: audit other dual-writer risks fleet-wide (separate sweep)

Closes #83

[jakecelentano]

Code Review — tms#86 + bogocat-tmq#7

Mode: standard | Lines: 461 combined (197 tms, 264 tmq) | Files: 3
Risk surface: Data correction (backfill script) + event logging logic
Reviewers: reviewer (deepseek-v4-pro), reviewer-m3 (MiniMax-M3)

Consensus (found by ≥2 reviewers)

Both PRs are correct and well-tested. No Critical (P0) findings.

P1 Warnings (all addressed in fixup commits)

#	Finding	Fix
W1	tmq#7 resolver diverges from tms#73 — known-model mapping is authoritative (overrides explicit provider) while tms#73 preserves it	Updated comments to say "refines" not "mirrors"; documented intentional divergence (3439495)
W2	Dead code in tests/test_events.py — unused helpers that misrepresented the old contract	Removed (3439495)
W3	Backfill docstring said "26 on Jul 15-16" but 1 remains on Jul 14	Fixed (f89be46)
W4	Unused import os in backfill script	Removed (f89be46)
W5	Sibling-join "first wins" assumption implicit	Added comment (f89be46)
W6	conn.commit() after with conn: was redundant/misleading	Clarified (f89be46)

reviewer (deepseek-v4-pro)

• W1: tmq#7 tightens behavior beyond tms#73 — documented as intentional
• W2: Dead code in test file is maintenance trap — removed
• W3/W6: Minor docstring/import nits — fixed
• Pre-existing: recent_events() SQL has WHERE after LIMIT (not this PR)

reviewer-m3 (MiniMax-M3)

• SQL injection: clean — all parameterized
• Connection management: correct — service=bogocat_ro for reads, bogocat for writes
• Resolver edge cases: all handled (missing settings, malformed JSON, empty defaults)
• Test coverage: 10 tests cover all 4 dispatch scenarios + dispatch_failed
• P2 suggestions: missing test for provider-only-without-model, test name misleading, auto-verify flag — noted, not blocking

Summary

Both PRs are ready. The companion tmq#7 PR ports the tms#73 resolver to the bogocat-tmq plugin, fixing the dual-writer gap. The tms#86 PR provides a safe backfill script (dry-run default, bogocat_ro for analysis) that recovers the 1 sibling-joinable row and honestly reports the 26 unrecoverable ones. All review findings are fixed in the latest commits.

<<REVIEW-VERDICT: PASS sha=f89be46d60a5c7997a232f2565327a42ac6d8e2a rounds=1 panel=deepseek-v4-pro,minimax-m3>>