Repair Policies

Staff-only repair of a company’s stored policy data: recompute stored segment hashes (segmentHashes), rebuild relationship history from immutable segments (joinHistory), or rewrite a reviewed field-value manifest across a single Policy’s history (fieldValues). Use it to fix what Validate Policy (validatePolicy) or Validate Policies (Batch) (validatePolicies) reports, such as a failed hashCorrectness check, and preview each repair with a dry run before you apply it.

Segment hashes and join history default to dryRun: true, have a bounded limit, and return an exclusive nextCursor; repeat the same scope with that cursor until it is null. Join history refuses link loss unless allowLinkLoss: true; inspect the dry-run loss samples before applying. A dry run rolls back the rebuilt relationships.

For fieldValues, supply repair.policyId and an explicit repair.dryRun. Preview returns current/projected SHA-256 fingerprints and occurrences. Apply requires both reviewed fingerprints, writes atomically, and returns unchanged on replay. A stale preimage or unexpected postimage returns 409 without changes. Apply records one transactional audit entry. Repairs do not create Policy versions.

Required permission: none — staff level staff (a staff user’s own Bearer token or a verified platform service identity); API keys are rejected.

Generic repair.changes uses delta paths and optional expectedValue guards. includeBoundQuotes writes linked live bound Quote rows directly in the same atomic transaction. Dry run returns per-version, per-delta and per-quote diffs, baselineMismatches, rebuildProof and complete-history fingerprints. Apply refuses baseline or changed-history mismatches, pricing financial changes, segment collapse, billing changes on a policy whose history states billing before or after the changes (422 policy-history-repair-invoicing-enabled), and billing changes on a policy with a linked invoice. expectedConfigHash pins the reviewed configuration; the changes report returns it as configHash. The report also lists recordedDifferences: the baseline key differences of each version whose differences the changes can all settle, by transaction, version, start date and key, with SHA-256 digests of both values as they stand after the changes, and one sha256 over the list. The list carries no values. Passing that digest as recordedDifferencesSha256 accepts exactly those differences, and recordedDifferencesPinMatched reports whether the pin still matches. With a pin, apply refuses with 422 policy-history-repair-baseline-difference-digest-mismatch when the pin no longer matches the history’s differences; policy-history-repair-baseline-rebuild-mismatch when a baseline difference is coded (a boundary, a segment count or a failed replay); policy-history-repair-baseline-difference-unrecordable when a version holds a key difference the changes cannot settle; policy-history-repair-baseline-difference-changed when the changes would add, remove or alter a difference in a version that holds recorded differences; and policy-history-repair-history-rebuild-mismatch when a difference appears in a version that holds none. A delta that writes into an item of a top-level calculated List the rebuilt parent lacks is seeded from the parent stored version when that version holds one value for the key across the segment’s days, with or without a pin, and declares calculated-collection-seeded. Each lock wait is limited to 5 s, and a held company row answers at once: either returns 409 policy-history-repair-company-busy without changes, and the caller retries with backoff.

On a policy that states billing (in any stored version or transaction delta, before or after the rewrites) or has an active invoice, the legacy rewrites manifest refuses the same financial changes, in a dry run as well as on apply: a rule whose path is policy.fullTermBillingInfo or below it returns 422 policy-history-repair-invoicing-enabled, and rules that would change any fullTermPricingInfo value other than a pricing component’s label return 422 policy-history-repair-pricing-financial-change. Nothing is written. The company’s invoicing state does not decide either refusal.