Live-data surgery
Six incidents around ad-hoc destructive operations: a sweep whose self-check under-claimed,
a committed cleanup that would have deleted the demo data because "Smoke" was its name, over
a thousand leaked rows from an earlier partial pass, and a bulk delete rolled back wholesale
by one surviving RESTRICT child. safe-smokes governs tests; this skill governs the one-off
surgery — same danger, different trigger surface. A warn-and-log hook
(hooks/sql-surgery-warn.mjs) backstops this skill by logging destructive SQL it sees.
The protocol, in order
- Read-only inventory first. Count, sample, and walk the FK graph of what the predicate
matches — as a result grid you read, not NOTICEs that scroll away.
- Check the markers sit on disposable rows. A name is not a disposability proof:
"Smoke" turned out to be the demo dataset. Verify by content, not label.
- BEGIN … ROLLBACK dry run. The transaction still returns the report rows, so you see
exactly what would happen at zero risk. Script version: dry-run by default, mutate only
under an explicit
--apply.
- Complement-count proof with NULL-collapsed predicates. Three-valued SQL makes
NOT (x = y) lie on NULLs; prove kept + deleted = total with predicates that collapse
NULL explicitly.
- Self-check re-runs EVERY predicate. A sweep's final assertion must re-run each seed
predicate individually — a combined check once under-claimed and left residue attributed
to success.
- FK order and atomicity. Delete children before parents; know that one surviving
RESTRICT child rolls back an entire atomic bulk delete — which is a feature, if you watch
for it.
- Gate tamper-evidence resets. Anything that resets audit trails, sequence baselines,
or tamper-evidence gets its own explicit confirmation, never rides along.
What this skill does not do
It does not apply inside test harnesses — safe-smokes owns test hygiene, including
flip-and-restore and teardown assertions. It does not authorise the surgery; it assumes the
decision is made and makes the execution provable.
Why
Ad-hoc surgery is where the worst class of loss lives: no harness, no teardown, real data,
and a plausible-looking predicate. The protocol converts "I'm fairly sure" into a result
grid. Evidence: PropOS LESSONS_LEARNED Sessions 12, 46, 53, 2026-07-02, 2026-07-06,
2026-07-20.
1---2name: live-data-surgery3description: Live-data surgery4---56# Live-data surgery78Six incidents around ad-hoc destructive operations: a sweep whose self-check under-claimed,9a committed cleanup that would have deleted the demo data because "Smoke" was its name, over10a thousand leaked rows from an earlier partial pass, and a bulk delete rolled back wholesale11by one surviving RESTRICT child. safe-smokes governs tests; this skill governs the one-off12surgery — same danger, different trigger surface. A warn-and-log hook13(hooks/sql-surgery-warn.mjs) backstops this skill by logging destructive SQL it sees.1415## The protocol, in order16171. **Read-only inventory first.** Count, sample, and walk the FK graph of what the predicate18 matches — as a result grid you read, not NOTICEs that scroll away.192. **Check the markers sit on disposable rows.** A name is not a disposability proof:20 "Smoke" turned out to be the demo dataset. Verify by content, not label.213. **BEGIN … ROLLBACK dry run.** The transaction still returns the report rows, so you see22 exactly what would happen at zero risk. Script version: dry-run by default, mutate only23 under an explicit `--apply`.244. **Complement-count proof with NULL-collapsed predicates.** Three-valued SQL makes25 `NOT (x = y)` lie on NULLs; prove kept + deleted = total with predicates that collapse26 NULL explicitly.275. **Self-check re-runs EVERY predicate.** A sweep's final assertion must re-run each seed28 predicate individually — a combined check once under-claimed and left residue attributed29 to success.306. **FK order and atomicity.** Delete children before parents; know that one surviving31 RESTRICT child rolls back an entire atomic bulk delete — which is a feature, if you watch32 for it.337. **Gate tamper-evidence resets.** Anything that resets audit trails, sequence baselines,34 or tamper-evidence gets its own explicit confirmation, never rides along.3536## What this skill does not do3738It does not apply inside test harnesses — safe-smokes owns test hygiene, including39flip-and-restore and teardown assertions. It does not authorise the surgery; it assumes the40decision is made and makes the execution provable.4142## Why4344Ad-hoc surgery is where the worst class of loss lives: no harness, no teardown, real data,45and a plausible-looking predicate. The protocol converts "I'm fairly sure" into a result46grid. Evidence: PropOS LESSONS_LEARNED Sessions 12, 46, 53, 2026-07-02, 2026-07-06,472026-07-20.
randommonicle