## Context A remote or virtual repository create, or an upstream association change, can commit after its client disconnects mid-`COMMIT` and leave no audit event and no application log line. pgx runs the `COMMIT` under the request context, so the store can report `context.Canceled` after Postgres has applied the change. The create handler and the three association route handlers book their events only on a nil store error. `logAndWriteInternalError`, which receives the context error, logs nothing. S17 requires an audit event naming the actor for each association change, because adding, moving, or removing an upstream can change which repository answers a virtual pull ([S17, Virtual upstream associations](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/S17-rest-management-api.md#virtual-upstream-associations-phase-6)). S17 requires one for each remote repository create too ([S17, Non-hosted repository CRUD](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/S17-rest-management-api.md#non-hosted-repository-crud-phase-6)). Audit logging is a P1 row of the GA epic https://gitlab.com/groups/gitlab-org/-/epics/22707, tracked in https://gitlab.com/gitlab-org/gitlab/-/work_items/605696. That item's criteria require each event to record the actor, action, target, and timestamp. ## What exists on main Each line holds at `origin/main` `d7fcf10e6` (2026-10-01) unless it names another source. - `internal/managementapi/resolve.go`, `logAndWriteInternalError`: returns with no log line and no status for an error matching `context.Canceled` or `context.DeadlineExceeded`, called a context error below. - `internal/managementapi/create.go`, `createRepositoryHandler`: books a remote create's `remote repository write` event and a virtual create's association events only when `RepositoryStore.Create` returns nil. `writeUpstreamListError` declines a context error, so `writeCreateStoreError` hands it to its default arm, `logAndWriteInternalError`. - `internal/managementapi/upstream_repositories.go`: `handleAssociateUpstream`, `handleUpdateUpstream`, and `handleDissociateUpstream` book `recordUpstreamAssociation` only on a nil store error. `writeAssociateError` falls through to `writeUpstreamMutationError`, whose default arm reaches `logAndWriteInternalError` through `logUpstreamInternalError`. - `internal/managementapi/update.go`, `writeVirtualUpdateError`: takes a context error first and logs `managementapi: updating virtual repository abandoned with its outcome unknown` at `WARN` with `repository_id`, `namespace_id`, and `error_message`. It books nothing and writes no status. `TestUpdateHandler_UpstreamList_AbandonedStoreCallLeavesAWarn` asserts the line field by field. Five other `WARN` messages in the package use the same `managementapi: <operation> abandoned with its outcome unknown` form. - `internal/managementapi/create_test.go`, `TestCreateHandler_CanceledCreate_WritesNothing`: a canceled hosted create writes no status and no body and logs no `ERROR` line. The test forbids no `WARN`. No association route test and no create-list test has the store return a context error. - `internal/datastore/repositories.go` (`RepositoryStore.Create`) and `internal/datastore/npm_virtual_upstreams.go` (`npmVirtualUpstreamWrite`): call `tx.Commit()` on a transaction begun with the request context and wrap the commit error with `%w`. pgx v5.11.0's `wrapTx.Commit` (`stdlib/sql.go`) runs the `COMMIT` under that context. `Create` assigns the repository id inside the store, in `insertRepository`. - `cmd/artifact-registry/remote_audit_sink.go`: `RecordUpstreamAssociation` writes one line and never checks whether the context is done. `newRemoteAuditLogSink` floors the audit logger at Info, so `log.level` cannot drop an audit event. - `docs/dev/observability.md`, `## Wide events`: the `virtual repository upstream association change` row lists three readings for an update whose `COMMIT` the handler never saw succeed. It lists none for a create or a route mutation. It says neither of the update's logged lines names the actor. The `remote repository write` row states one event per committed write to a remote-kind row. - `docs/specs/S17-rest-management-api.md`, `### Virtual upstream associations (Phase 6)`: the reconcile and the route mutations book their events after the store reports the commit. A client disconnect mid-`COMMIT` can commit a change that books no event. The update logs a `WARN`. The two sentences saying a create and the routes log nothing today link this issue. - S17, `## Acceptance Criteria`: one item requires an event naming the actor for each remote create and each association mutation. The reconcile item says a create or update whose store call returns a cancellation emits no event, whether or not its `COMMIT` applied. - `docs/specs/S13-virtual-remote-foundation.md`, `## Security Considerations`: lists audit events on remote repository create and on virtual upstream association change. S17 captures the actor, and S13 emits the payload. - `internal/managementapi/upstream_repositories.md`, `## No handler-side deadline on the mutations`: the routes arm no request deadline, because a fired one has no settled classification. The section points at the three related issues under Dependencies. - `internal/managementapi/delete.go`, `writeDeleteStoreError`: sends a remote delete's context error to `logAndWriteInternalError` as well. ## Change A create of any kind and each association route mutation whose store call returns a context error leave one `WARN` naming the write whose outcome is unknown, as the update arm does. S17 and `docs/dev/observability.md` describe that line in place of the sentences saying the handler logs nothing. The S17 DRI then decides whether such a change also books its audit events, and records the decision where criterion 6 says. The repository delete's default arm drops a remote delete's event the same way and stays outside this issue. ## Acceptance criteria 1. `POST /api/v1/:slug/repositories`, every `kind`: when `RepositoryStore.Create` returns a context error, the handler writes no status and no body, logs no `ERROR` line, books no audit event, and logs one `WARN`. The message takes the `managementapi: <operation> abandoned with its outcome unknown` form. The line carries `namespace_id` and the store error as `error_message`, whose text names the format as the logged `500`'s does, and carries no `repository_id`. A handler test asserts each field for a virtual create with a non-empty `upstream_repository_ids` and for a remote create, with one subtest for each of the two context errors. 1. `POST .../:format/upstream_repositories`, `PATCH .../:format/upstream_repositories/:id`, and `DELETE .../:format/upstream_repositories/:id`: when `Associate`, `Reposition`, or `Dissociate` returns a context error, the handler writes no status and no body, logs no `ERROR` line, books no `virtual repository upstream association change` event, and logs one `WARN`. The line carries `repository_id` (the virtual repository), `namespace_id`, and `error_message`. Each route's message names its own operation in the form criterion 1 names, so the three messages differ. A handler test asserts each field per route, with one subtest for each of the two context errors. 1. On the four handlers in criteria 1 and 2, a store error that is not a context error keeps the status, envelope, and log line it gets at `d7fcf10e6`. 1. In S17, the four hits of `git grep -n -E 'logs nothing|logs a .WARN.' d7fcf10e6 -- docs/specs/S17-rest-management-api.md` describe the new `WARN`. Two are the reconcile paragraph's sentences on the update's `WARN` and on the create. One is the route paragraph's sentence, and one is the reconcile item under `## Acceptance Criteria`. The original description names two of them. The other two name only the update's `WARN`. 1. In `docs/dev/observability.md`, the `virtual repository upstream association change` row lists for a create and for each route mutation the readings it lists for an update: the new `WARN` when the client left mid-`COMMIT`, the logged `500` line when a broken connection lost the acknowledgment, and nothing when the process exited before booking. The row says which of those lines name the actor. 1. Decision for the S17 DRI. S17's reconcile criterion already says "A create or update whose store call returns a cancellation emits no event, whether or not its `COMMIT` applied." The decision is whether that criterion stands for the create and extends to the routes, and what the `WARN` carries. The original description names three options: the `WARN` alone (the update arm's choice), a `WARN` carrying the actor and the submitted change so the line can stand in for the event, and a read on a detached context that books the events once the change is visible. The third amends the reconcile criterion and the route paragraph first. The decision covers the remote create's `remote repository write` event, which the same create arm drops. It also says whether the update arm moves with it. The DRI records it in the `virtual repository upstream association change` row, and in the `remote repository write` row for the remote create. A decision for the second or third option amends criteria 1 and 2. Each option has a cost the decision accepts: - The `WARN` alone names no actor, as the row already states for the update's line. - A stand-in `WARN` goes through the request logger, so a deployment at `log.level: error` drops it. `newRemoteAuditLogSink` floors the audit logger at Info, so `log.level` cannot drop an audit event. - A detached read has to tell this request's change from a concurrent caller's. A create's read can find the row only by name, because `RepositoryStore.Create` assigns the id. pgx's default watcher sends Postgres no cancel request (the query cancellations row of `docs/dev/observability.md`), so Postgres finishes a `COMMIT` it has received after the client leaves. A read that runs before that `COMMIT` finishes reads the earlier state. ## Specs and ADRs - [S17, Virtual upstream associations (Phase 6)](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/S17-rest-management-api.md#virtual-upstream-associations-phase-6): when the reconcile and the routes book their events, the residual S17 states for a disconnect mid-`COMMIT`, and three of the four hits criterion 4 rewrites. - [S17, Non-hosted repository CRUD (Phase 6)](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/S17-rest-management-api.md#non-hosted-repository-crud-phase-6): a remote create emits an audit event carrying the actor. - [S17, Acceptance Criteria](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/S17-rest-management-api.md#acceptance-criteria): the event per remote create and per association mutation, and the reconcile criterion that criterion 6 quotes. - [S13, Security Considerations](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/S13-virtual-remote-foundation.md#security-considerations): the audit inventory the S17 events implement. - [ADR-010, Audit Log Retention](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/adr/010_data_retention.md#audit-log-retention): lists repository creation among the administrative operations audit logs capture. ## Dependencies - https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/252, the `DeadlineExceeded` classification: no order. The new `WARN` lines use the predicate of `logAndWriteInternalError`, as the update arm's does, so whichever of the two issues lands second changes both predicates. - https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1401, the bound on the association stores' lock waits: no order. Its handler deadline makes a `DeadlineExceeded` on these routes a server-side timeout, which that issue answers as a timeout. Whichever of the two issues lands second decides which arm a fired handler deadline takes. - https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/978, the row-lock wait budget policy: no order with this issue. It decides the budget that https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1401 applies. - https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/3011, merged 2026-09-29: added the update arm's `WARN`. This issue is its follow-up. - https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/3013, merged 2026-09-29: wrote the residual into S17 and linked this issue from the create and route sentences criterion 4 rewrites. ## First step A `fix(managementapi)` MR adds the `WARN` at the top of `writeCreateStoreError` and `writeUpstreamMutationError`, with the tests and the S17 and `docs/dev/observability.md` edits of criteria 1 to 5. It needs no decision, because it repeats the update arm's merged choice and keeps S17's no-event criterion. The criterion 6 decision follows as an edit to the two observability rows for the `WARN` alone, or as an S17 amendment ahead of the code for either other option. ## Original description When a client disconnects while a virtual create or an upstream association change is committing, the change can apply with no audit event and no application log line. pgx runs the COMMIT under the request context (`wrapTx.Commit` in pgx v5.11.0's `stdlib/sql.go`), so a cancel that lands mid-COMMIT returns `context.Canceled` while Postgres may already have applied the change. Both paths hand that error to `logAndWriteInternalError` (`internal/managementapi/resolve.go:218`), which returns without a log line or a status for a context error: - The create handler (`createRepositoryHandler`, `internal/managementapi/create.go:104`) reaches it through the default arm of `writeCreateStoreError` (`create.go:434`). Its events, `recordCreatedUpstreamListEvents` (`create.go:152`) and a remote create's `recordRepositoryWrite` (`create.go:149`), run only on a nil error. - The associate, reposition, and dissociate handlers (`internal/managementapi/upstream_repositories.go:170`, `:223`, and `:272`) reach it through the default arm of `writeUpstreamMutationError` (`upstream_repositories.go:576`). Each books `recordUpstreamAssociation` only on a nil error. The audit trail then holds no event for a change that exists. The only line left is the access log's, which records a `200` with nothing written, when its sampler keeps it. A retry books nothing either: the create answers `409` for the taken name, the associate `409` for the duplicate, and the dissociate `404`. Once the store returns nil, the booking lands even after the client left: `remoteAuditLogSink.RecordUpstreamAssociation` (`cmd/artifact-registry/remote_audit_sink.go:144`) writes one `slog` line and never checks the context. The gap is only the COMMIT the handler never sees succeed. ## What the update arm does Step 17's update arm, not yet merged (head `a708371e4`), takes a context error first in `writeVirtualUpdateError` and logs `managementapi: updating virtual repository abandoned with its outcome unknown` at WARN, with `repository_id` and `namespace_id`. It books nothing. The change is still unrecorded, but the line points at it. The arm's `docs/dev/observability.md` row states that residual, and that the line names no actor. ## Proposed change 1. WARN on the create arm and the association routes the way the update arm does. One check at the top of `writeUpstreamMutationError` covers all three routes, because `writeAssociateError` falls through to it. The create arm's check goes at the top of `writeCreateStoreError`. A create has no repository id yet, so its line carries what its logged `500` carries: the namespace and the format. `TestCreateHandler_CanceledCreate_WritesNothing` (`create_test.go:584`) stays green, because it forbids only an ERROR line. No test pins the association routes' cancellation arm today. 2. Decide whether a change whose COMMIT the handler never saw succeed can book its event, and record the decision in the `virtual repository upstream association change` row of `docs/dev/observability.md`. The options are the WARN alone (the update arm's choice), a WARN carrying the actor and the submitted change so the line can stand in for the missing event, and a read on a detached context that books the events once the change is visible. The WARN predicate is `logAndWriteInternalError`'s (`context.Canceled` or `context.DeadlineExceeded`), so it moves with the `DeadlineExceeded` classification decision related below. The S17 spec names this gap in the two sentences that say a create and the association routes log nothing today (`docs/specs/S17-rest-management-api.md`, the audit lines under the reconcile and route sections). The fix updates both sentences. Line numbers are at `main` `5fe1e4db3`. Follow-up from gitlab-org/ops/artifact-registry!3011+s. Related to gitlab-org/ops/artifact-registry#1401+s Related to gitlab-org/ops/artifact-registry#978+s Related to gitlab-org/ops/artifact-registry#252+s