[Silthus]

Problem

• An edited or paused workflow can keep running its old version for minutes after the save.
• Each save tells the CDP workers to reload before the save commits, so a worker can cache the old row.
• The email send checks in feat(cdp): key a code send on the sender the caller chose #127129 and feat(messaging): mark a code send that leaves the sender to the project #127182 depend on this fix.

Warning

Merge risk: medium, two-way door. No flag. Every workflow save now reloads the workers after commit.

Changes

• Workers reload a saved workflow once the save commits. hog_flow_saved publishes in transaction.on_commit.
• defer_hog_flow_reloads flushes bulk changes on commit too.
• A rolled-back save publishes nothing.
• A failed publish retries once, then reports. The save still succeeds.
• Mechanical: three callers drop their duplicate reload, and two stale comments go.

How did you test this code?

• Live run, real Postgres and Redis, a stand-in worker reading the row when the reload arrives:
  • Master: 20 of 20 editor saves reloaded mid-transaction, and the worker read the old row.
  • de0e86a8f86: 20 of 20 read the new row.
• Tests, red on master first: reload before commit, a failed publish failing the save, a duplicate command reload.

Release status

• No feature flag controls this change

Docs update

• None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

Skills: /tdd, /writing-tests, /recreating-fork-prs, /writing-pr-descriptions, /full-stop

More context for AI agents

• Session: map Map: send code-managed email templates with one PostHog call Silthus/posthog#461. Lane srv2 built it on the fork as fix(workflows): reload a saved workflow only after its commit Silthus/posthog#581. It replaces part of feat(messaging): send each email once per idempotency key on send/email #121867. de0e86a8f86 merges master at 74536afc862 and drops two comments.
• Decisions: the fix lands alone off master, before feat(cdp): key a code send on the sender the caller chose #127129 and feat(messaging): mark a code send that leaves the sender to the project #127182 (Michael). A failed reload publish retries once, then logs and reports.
• Reviews: a Sol round, a Sol and Opus fresh-eyes panel, a fixes round, and a Sol final read at de0e86a8f86. The final read flagged two lines that came from master (fix(workflows): reject a wait that reads a group property #105854, fix(workflows): delete schedules when the live trigger leaves schedule #127358), outside this diff.
• Live run: S1 to S6 cover the editor save, an outer transaction, a deferred bulk save, a rollback, autocommit and a delete.
• CI report: the ⚠️ Trunk lane section only names the backend Python lane; it asks for no change.
• Read closely: hog_flow_saved and defer_hog_flow_reloads in models/hog_flow/hog_flow.py.

🤖 Generated with Claude Code

[trunk-io]

😎 Merged successfully - details.

[github-actions]

🤖 CI report

⚠️ Trunk lane — backend Python lane

This PR is assigned to the backend Python lane. It runs backend Python tests and may merge in parallel with PRs in other lanes.

✅ Duplication (Python) — clean

New Python code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

✅ Duplication (TypeScript) — clean

New TypeScript code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

✅ Comment density — 2% of added code lines are comments (2 of 99)

This section warns when comments are more than 3% of the code lines a PR adds, and alerts above 6%. Before agent-assisted PRs, the typical share was about 2%. Only full-line comments count. Docstrings, generated files, snapshots, migrations, and workflow files are left out.

Comments that restate the code, record how the change came about, or narrate the next line add noise for the next reader. Keep the comments that explain a reason the code cannot show, and remove the rest. See .agents/skills/writing-code-comments/SKILL.md for the house rules.

Files with the most added comment lines:

File	Comment lines	Added lines
products/workflows/backend/management/commands/rewrite_email_asset_url.py	2	3

This check does not block merging. It updates on every push and clears when the share drops.

✅ Hogbox preview — ready, open the preview

▶ Open the preview

🔑 Login	[email protected] / 12345678 (demo data)
🧩 Running	this PR's backend on the PostHog :master base (frontend unchanged by this PR)
🔗 Link	stable across rebuilds: a re-push swaps the box underneath, the URL stays
🔒 Access	tailnet only (PostHog VPN)
🛠️ Admin	inspect & debug state in hogland
💤 Idle	sleeps after ~30 min idle (snapshot to S3, zero node cost) and wakes on your next visit in ~30s, behind a brief "waking up" screen

_{commit de0e86a · box box-f4fb78912a8a · ready in 2089s (push → usable) · build log · rebuilds on every push, torn down on close}

[hosthog]

HostHog preview — posthog-desktop-web

The previews for this PR have been torn down and no longer serve.

[parameterai]

Risk: No findings

This PR moves the CDP worker reload for saved workflows from inside the save transaction to transaction.on_commit, so workers never cache a row that has not committed yet, and removes the now-duplicate explicit reloads from three callers. I traced every write path whose explicit reload was removed and confirmed each goes through instance.save(), so the post_save receiver's on-commit publish covers it; the pause/resume paths keep their own robust on-commit publishes. No security issue introduced — the change strictly tightens cache-invalidation timing.

_{Sentinel reviewed de0e86a · Review settings}

[stamphog]

Approved.

The change enters workflow write-path territory, with assurance supplied by owning-team authorship and added regression coverage. No unresolved substantive concerns or other refusal grounds were found; discussion bot summaries are not current-head reviews.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	65L, 5F substantive, 195L/11F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1c-medium (195L, 11F, single-area, fix)
stamphog 2.7.0		.stamphog/policy.yml @ de0e86a · reviewed head de0e86a

[Silthus]

/trunk merge

[Silthus]

/trunk cancel

[Silthus]

/trunk merge

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-11-04 09:03 UTC	Run
prod-us	✅ Deployed	2026-11-04 09:20 UTC	Run
prod-eu	✅ Deployed	2026-11-04 09:23 UTC	Run