fix(forks): clean up full-KB placeholders planned before the exclusion

The mapped-KB fill guarded a pre-change plan, but the full-KB path did
not: a placeholder planned by an old worker for a connector-managed
document is simply no longer returned by the page query, so nothing fills
it and it stays archived behind a live mapping that a remapped
document-selector still resolves to.

Report those child ids as failed documents so the shared cleanup clears
their references and drops the rows, and delete their persisted identity
so a later sync does not resolve to a row cleanup removes. Keyed on the
SOURCE being connector-managed, which can never become copyable, so it
cannot race a concurrent attempt mid-fill the way a "source is gone"
check could.

The mapping drop is now one helper shared with the mapped-KB catch.
Test proven red by removing the reconciliation block.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/ee/workspace-forking/lib/copy/copy-resources.test.ts

@@ -335,6 +335,42 @@ describe('copyForkResourceContent', () => {
     ).toBe(true)
   })
 
+  it('drops a full-KB placeholder a pre-change worker planned for a connector-managed doc', async () => {
+    // Rolling deploy: the fork tx ran on the old code and planned a placeholder for a
+    // connector-managed document, which this worker's page query no longer returns. Nothing
+    // would ever fill it, so it must be reported for cleanup rather than left archived behind a
+    // live mapping that a remapped document-selector still resolves to.
+    dbChainMockFns.where.mockImplementationOnce(() => ({
+      // The skipped-document count.
+      then: (resolve: (rows: unknown[]) => unknown) => resolve([{ total: 1 }]),
+    }))
+    dbChainMockFns.where.mockImplementationOnce(() => ({
+      // The stale-plan probe: the planned source is connector-managed.
+      then: (resolve: (rows: unknown[]) => unknown) => resolve([{ id: 'doc-1' }]),
+    }))
+    dbChainMockFns.limit.mockResolvedValueOnce([])
+
+    const result = await copyForkResourceContent({
+      contentPlan: basePlan({
+        knowledgeBases: [
+          { sourceId: 'src-kb', childId: 'child-kb', documentIdMap: { 'doc-1': 'child-doc-1' } },
+        ],
+        documentMappingContext: { edgeChildWorkspaceId: 'edge-child-ws', sourceIsParent: false },
+      }),
+      requestId: 'test',
+    })
+
+    expect(result.failed).toBe(1)
+    expect(result.failures).toEqual([{ kind: 'knowledge-document', childId: 'child-doc-1' }])
+    // The persisted identity goes too, or a later sync resolves to the row cleanup deletes.
+    expect(mockDeleteCopiedResourceMappingsByTargets).toHaveBeenCalledWith({
+      executor: expect.anything(),
+      edgeChildWorkspaceId: 'edge-child-ws',
+      sourceIsParent: false,
+      targets: [{ resourceType: 'knowledge_document', resourceId: 'child-doc-1' }],
+    })
+  })
+
   it('keeps a copied KB alive when the skipped-document count fails', async () => {
     // The count only feeds a log line. Letting it throw into the KB's catch would roll back a
     // perfectly good copy and clear every reference to it over a failed COUNT(*).

apps/sim/ee/workspace-forking/lib/copy/copy-resources.ts

@@ -1031,6 +1031,29 @@ export async function copyForkResourceContent(params: {
     billingContext ??= await resolveStorageBillingContext(childWorkspaceId)
     return billingContext
   }
+  /**
+   * Drop the persisted `knowledge_document` identity for a copied document that will not exist,
+   * so a later sync resolves the reference afresh instead of to a row the cleanup removes.
+   * Isolated like the rest of the post-commit phase: a mapping-cleanup failure is logged, never
+   * rethrown, since the caller is already reporting the document as failed.
+   */
+  const dropCopiedDocumentMapping = async (childDocumentId: string): Promise<void> => {
+    const mappingContext = contentPlan.documentMappingContext
+    if (!mappingContext) return
+    try {
+      await deleteCopiedResourceMappingsByTargets({
+        executor: db,
+        edgeChildWorkspaceId: mappingContext.edgeChildWorkspaceId,
+        sourceIsParent: mappingContext.sourceIsParent,
+        targets: [{ resourceType: 'knowledge_document', resourceId: childDocumentId }],
+      })
+    } catch (mappingCleanupError) {
+      logger.error(`[${requestId}] Failed to clean mapping for a failed copied document`, {
+        childDocumentId,
+        error: getErrorMessage(mappingCleanupError),
+      })
+    }
+  }
   /**
    * Report the connector-managed documents a copied KB leaves behind, since a fully
    * connector-synced base lands in the child with no documents at all. Strictly observability,
@@ -1173,6 +1196,35 @@ export async function copyForkResourceContent(params: {
   for (const kb of contentPlan.knowledgeBases) {
     try {
       await logSkippedConnectorDocuments(kb)
+      // A worker from before this exclusion (a rolling deploy) could have planned a placeholder
+      // for a connector-managed document. The page query below no longer returns its source, so
+      // nothing would ever fill it - leaving an archived empty row that a persisted mapping and
+      // a remapped `document-selector` still resolve to. Report those child ids as failed
+      // documents instead, so the shared cleanup clears the references and drops the rows.
+      //
+      // Keyed on the SOURCE being connector-managed, which is deterministic: such a document can
+      // never become copyable, so this can never race a concurrent attempt mid-fill (unlike a
+      // "source is gone" check, which could).
+      const plannedSourceIds = Object.keys(kb.documentIdMap)
+      if (plannedSourceIds.length > 0) {
+        const stalePlanned = await db
+          .select({ id: document.id })
+          .from(document)
+          .where(and(inArray(document.id, plannedSourceIds), isNotNull(document.connectorId)))
+        for (const { id } of stalePlanned) {
+          const childDocumentId = kb.documentIdMap[id]
+          if (!childDocumentId) continue
+          // Left in `documentIdMap` deliberately: if the KB itself later fails, its failure
+          // lists the same child id again, and the cleanup keys failed ids by kind in a Set.
+          await dropCopiedDocumentMapping(childDocumentId)
+          failedResources += 1
+          failures.push({ kind: 'knowledge-document', childId: childDocumentId })
+          logger.warn(
+            `[${requestId}] Dropping a fork placeholder planned for a connector-managed document`,
+            { sourceDocumentId: id, childDocumentId, childKnowledgeBaseId: kb.childId }
+          )
+        }
+      }
       let afterDocId: string | null = null
       for (;;) {
         // Only copy LIVE documents - exclude soft-deleted and archived rows, matching
@@ -1353,21 +1405,7 @@ export async function copyForkResourceContent(params: {
       })
       copiedResources += 1
     } catch (error) {
-      if (contentPlan.documentMappingContext) {
-        try {
-          await deleteCopiedResourceMappingsByTargets({
-            executor: db,
-            edgeChildWorkspaceId: contentPlan.documentMappingContext.edgeChildWorkspaceId,
-            sourceIsParent: contentPlan.documentMappingContext.sourceIsParent,
-            targets: [{ resourceType: 'knowledge_document', resourceId: docEntry.childDocId }],
-          })
-        } catch (mappingCleanupError) {
-          logger.error(`[${requestId}] Failed to clean mapping for a failed copied document`, {
-            childDocumentId: docEntry.childDocId,
-            error: getErrorMessage(mappingCleanupError),
-          })
-        }
-      }
+      await dropCopiedDocumentMapping(docEntry.childDocId)
       failedResources += 1
       failures.push({ kind: 'knowledge-document', childId: docEntry.childDocId })
       logger.warn(`[${requestId}] Failed to copy document into mapped KB during sync`, {