fix(oplog-collections-transformer): warn+skip on empty ALL_SITE_IDS instead of error-retry

Per PR #363 review: an empty/blank ALL_SITE_IDS (misconfig, or a partial deployment
that doesn't fan user status) made publishUserStatus return a transient error, so the
status event Nak-stormed to MAX_DELIVER (1000) before a loud Term — wasteful, and broke
partial deployments. Detect the no-destination case at the sent==0 point and skip
cleanly: one WARN log + onSkipped("status_no_sites") metric + migration.ErrSkipped
(Ack-skip, no retries). Detection stays at sent==0 so malformed multi-entry values
(e.g. ALL_SITE_IDS=",") still warn rather than silently ack. A startup hard-fail on
empty ALL_SITE_IDS is the planned permanent form (TODO).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012X9qhQT4NwmCHjdndwNtFD

Author: claude

data-migration/oplog-collections-transformer/users.go

@@ -132,10 +132,14 @@ func (h *handler) publishUserStatus(ctx context.Context, account, statusText str
 		sent++
 	}
 	if sent == 0 {
-		// No destination sites: a statusText change would be lost. Surface a (transient) error
-		// so the event Naks and is visible rather than silently dropped — ALL_SITE_IDS is empty
-		// or misconfigured. (Future: hard-fail at startup instead of per-event.)
-		return fmt.Errorf("no destination sites for user_status_updated (account %q): ALL_SITE_IDS empty", account)
+		// No destination sites — ALL_SITE_IDS empty/misconfigured, or a partial deployment that
+		// doesn't fan status. Skip cleanly with a logged + metered signal rather than Nak-storming
+		// every status event. TODO: make empty ALL_SITE_IDS a startup hard-fail once the failure
+		// modes are understood.
+		slog.WarnContext(ctx, "ALL_SITE_IDS has no destinations — skipping user status fan-out",
+			"account", account, "request_id", natsutil.RequestIDFromContext(ctx))
+		h.metrics.onSkipped(ctx, "status_no_sites")
+		return migration.ErrSkipped
 	}
 	return nil
 }

data-migration/oplog-collections-transformer/users_test.go

@@ -110,11 +110,11 @@ func TestHandleUser_StatusTextUpdate_FansToAllSites(t *testing.T) {
 	assert.ElementsMatch(t, []string{testSiteID, "s2"}, dests)
 }
 
-func TestHandleUser_StatusTextUpdate_NoSites_ReturnsError(t *testing.T) {
+func TestHandleUser_StatusTextUpdate_NoSites_WarnsAndSkips(t *testing.T) {
 	pub := &fakePublisher{}
 	doc := `{"_id":"u1","username":"alice","statusText":"in a meeting"}`
 	h := newTestHandler(pub, &fakeTarget{}, &fakeLookup{doc: []byte(doc)})
-	h.allSiteIDs = nil // misconfigured: ALL_SITE_IDS empty
+	h.allSiteIDs = nil // ALL_SITE_IDS empty (misconfig, or a partial deployment without status fan-out)
 
 	ev := oplogEvent{
 		Op:                "update",
@@ -124,10 +124,8 @@ func TestHandleUser_StatusTextUpdate_NoSites_ReturnsError(t *testing.T) {
 		UpdateDescription: json.RawMessage(`{"updatedFields":{"statusText":"in a meeting"}}`),
 	}
 	err := h.handleUser(context.Background(), ev)
-	// Empty destinations must surface an error (Nak/visible), never a silent skip or drop.
-	require.Error(t, err)
-	assert.NotErrorIs(t, err, migration.ErrSkipped)
-	assert.NotErrorIs(t, err, migration.ErrPoison)
+	// No destinations: warn + Ack-skip — not a retry-storm error, not a silent drop.
+	assert.ErrorIs(t, err, migration.ErrSkipped)
 	assert.Empty(t, pub.events)
 }