{"record":{"id":"a937a169e15458e6","repo":"block/buzz","slug":"community-deletion-serving-fence-is-unsafe-e","errorCode":null,"errorMessage":"Community deletion serving fence is unsafe: {e}","messagePattern":"Community deletion serving fence is unsafe: (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"crates/buzz-relay/src/main.rs","lineNumber":291,"sourceCode":"    let auto_migrate =\n        buzz_auto_migrate_enabled(std::env::var(\"BUZZ_AUTO_MIGRATE\").ok().as_deref());\n    if auto_migrate {\n        db.migrate().await.map_err(|e| {\n            error!(\"Failed to run database migrations: {e}\");\n            anyhow::anyhow!(\"Database migration failed: {e}\")\n        })?;\n        info!(\"Database migrations complete\");\n    } else {\n        info!(\"Skipping database migrations because BUZZ_AUTO_MIGRATE is not enabled\");\n    }\n\n    if let Err(e) = db.ensure_future_partitions(3).await {\n        error!(\"Failed to ensure partitions: {e}\");\n    }\n\n    db.validate_deletion_serving_catalog().await.map_err(|e| {\n        error!(\"Community deletion serving-fence validation failed: {e}\");\n        anyhow::anyhow!(\"Community deletion serving fence is unsafe: {e}\")\n    })?;\n    info!(\"Community deletion serving fences verified\");\n\n    // Freshness fence probe: cursor pages route to the replica only for\n    // history the probe has verified as fully replayed. Deliberately AFTER\n    // the migration decision: spawn_fence_probe first verifies the\n    // commit-time floor guard (catalog shape + observed behavior through the\n    // armed pool) against the live schema, so a relay running with\n    // BUZZ_AUTO_MIGRATE off and migration 0021 unapplied can never open the\n    // fence over an unenforced floor. Verification failure is loud but\n    // non-fatal: the fence stays closed and every cursor page routes to the\n    // writer.\n    match db.spawn_fence_probe().await {\n        Ok(true) => info!(\"Replica fence probe started (floor guard verified)\"),\n        Ok(false) => {}\n        Err(e) => {\n            error!(\n                \"Replica fence disabled — floor guard verification failed: {e}. \\","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/block/buzz/blob/ef2aa1ae38fadcc0bc22b8bf6ed96b35933146be/crates/buzz-relay/src/main.rs#L273-L309","documentation":"Fatal startup error: validate_deletion_serving_catalog() checked that the Postgres catalog backing community-deletion serving fences actually enforces what the fence protocol assumes (commit-time floor etc.). If the live schema does not match, the relay refuses to start rather than risk serving events from deleted communities through the fence.","triggerScenarios":"The deletion-serving-fence catalog objects (from the migration 0021 lineage) are missing or shaped wrong on the live DB: migrations not applied while older data exists, a partially applied migration, or manual schema changes that dropped/altered the fence objects.","commonSituations":"Running a newer relay image against a database with BUZZ_AUTO_MIGRATE left off in a managed-migration deployment; restoring a DB dump that skipped catalog objects; environments where migrations are applied out of order.","solutions":["Apply all pending migrations: start with BUZZ_AUTO_MIGRATE=true (or run the migration tooling) so the fence catalog matches the relay version","Inspect the {e} detail for which catalog object/check failed and verify in psql","Confirm the schema_migrations table shows the deletion-fence migrations (0021 and later) as applied","Do not bypass this check — it guards deleted-community data from being served"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Before deploying a new relay image with BUZZ_AUTO_MIGRATE off:\n# confirm the fence migrations are recorded:\npsql \"$DATABASE_URL\" -c \"select version from schema_migrations order by version desc limit 5\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat this error as a hard stop — never bypass the serving-fence validation","Keep migrations and relay version locked together in the deploy pipeline","Never hand-modify the deletion/fence catalog objects"],"tags":["postgres","schema","migration","startup","data-safety","buzz-relay"],"backgroundTag":"schema-validation-failed","analyzedSha":"ef2aa1ae38fadcc0bc22b8bf6ed96b35933146be","analyzedAt":"2026-08-20T04:38:24.874Z","contentChangedAt":"2026-08-20T04:38:24.874Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}