The nightly verify cron was killed by the platform every run: with a
500-document batch at ~0.8s/doc it hit the function timeout around item
250, so the tail of the queue (1506 current documents) was never checked.
Worse, a document whose storage object could not be downloaded threw
before last_integrity_check_at was stamped, so it sorted back to the head
of the nulls-first queue and re-failed every night without ever surfacing
as an incident.
- Declare maxDuration = 300 and lower the default batch to 200 (named
constant, env-overridable) so a full run fits the budget with headroom.
- On download failure, write an INTEGRITY_FAILURE audit row marked
DOCUMENT_OBJECT_MISSING (description prefix + new_state.reason; the DB
check constraint audit_log_action_check allows only a fixed action set,
so a brand-new action value is not possible without a migration), then
stamp last_integrity_check_at so the row stops head-blocking the queue.
If the audit insert fails the stamp is skipped so the incident write is
retried next run.
- Fix the stale route comment: the schedule is nightly 03:00 UTC per
vercel.json, not weekly Sunday.
- seed-demo-account.ts now uploads a tiny valid PDF for the AWS inbox
demo document and stores its real SHA-256 and byte size, instead of
inserting a fabricated hash with no storage object (the seeded row that
tripped the cron every night).
- Add route tests: cron auth 401, happy-path stamping, hash mismatch,
missing-object incident + stamp, audit-failure retry, batch size, and
maxDuration.
From the 2026-07-09 production log triage.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Jakob Wennberg
7c739529d6