fix(billing): stop writing empty Autumn records on read failure

[posthog]

Problem

• A user's Autumn billing record was written with no email, name, or account type — degrading a real billing record.
• getAutumnCustomerFields opens a Hyperdrive Postgres connection to read five identity columns. A transient Postgres internal error was swallowed and the function returned bare defaults.
• Callers then passed those defaults to getOrCreateAutumnCustomer, which both reads balances and writes identity, so the record was created or touched with only source: thinkex.
• The drizzle wrapper inlines the bound parameters (including the user id) into the error message, so error tracking groups fragment into one issue per user.

Changes

• Retry then skip, never write empty identity — getAutumnCustomerFields retries the read once, then returns null instead of defaults when it still fails.
  • Billing panel (getWorkspaceBillingStateFn): returns no state for that load rather than overwriting the record.
  • Usage tracking (trackAutumnUsage): skips the identity write but still records the meter, which carries no identity.
• Stable error grouping — recordOperationalFailure normalizes a drizzle query error before capture: keep the SQL statement, drop the parameter list, surface the underlying driver cause. This runs on the shared capture path, so any drizzle failure benefits.
• Reuse the shared DB helper — the read now goes through withDb instead of a hand-rolled connect/dispose.

Read outcome	Before	After
Success	Full identity fields	Full identity fields
No user row	Defaults	Defaults
Transient failure	Defaults → empty identity write	Retry once → null → write skipped

Why

One user hit a transient Postgres failure while their billing panel loaded, and the graceful-degradation path silently corrupted their Autumn billing record. The cost is small in volume but persistent: every occurrence degrades a real record, and the per-user error titles splinter one fault into many issues as traffic grows.

Testing notes

• node_modules/.bin/vp check — format, lint, and types pass.
• New unit tests: src/integrations/autumn/client.server.test.ts (retry recovery, null on repeated failure, skip-write path) and a normalizeCapturedError case in operational-error.test.ts.
• Full vp test --run: all pass except a pre-existing, unrelated failure in src/integrations/posthog/build.test.ts (needs PostHog build env vars; fails identically with these changes stashed).

---

Created with PostHog Desktop from this inbox report.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: b0b6ae8f-5016-4076-beb3-d3d97914536f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit d85a9b8.}