fix: one source edit no longer wipes the campaign id and the backfill position

Source.config_overrides carries two unrelated things under one column: the operator's per-source download settings, and state FC writes for itself. update() treated the whole column as operator-owned and assigned it wholesale, so a dialog save discarded patreon_campaign_id and the entire #693 backfill state machine. Not a hand-edited-JSON edge case: SourceFormDialog's structured tab rebuilds the object from two fields, so saving without touching anything was enough.

_merged_config now merges: the operator's keys replace wholesale (removing a key must still remove it), FC's keys survive and are applied LAST so a stale echoed cursor cannot roll a walk backwards. App-managed is _-prefixed or *_campaign_id, both matching data already on disk, so no migration.

Preserving the id exposed a bug the wipe was MASKING: nothing cleared it when a source's URL changed, and patreon_resolver reads that cache before attempting any lookup. A repointed source would have resolved the old creator forever and 387 C4 would have reported a confident wrong match. So update() drops *_campaign_id when the URL actually changes - but keeps the backfill cursor, which the walk's own stall guard validates and which is expensive to rebuild.

test_update_changes_fields was DOCUMENTING the bug: it asserted config_overrides == {videos: False} on a source whose create() had armed _backfill_state, so it could only pass because the state had been destroyed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LNXXULQDjVZmbuNa2G9mD9

tests/test_source_service.py

@@ -189,7 +189,148 @@ async def test_update_changes_fields(db):
     )
     updated = await svc.update(rec.id, enabled=False, config_overrides={"videos": False})
     assert updated.enabled is False
-    assert updated.config_overrides == {"videos": False}
+    # The operator's key lands, and FC's own state is not collateral. This
+    # assertion used to read `== {"videos": False}` — it was DOCUMENTING the bug
+    # the tests below now pin: `create` arms `_backfill_state` (#693), and every
+    # edit was silently discarding it.
+    assert updated.config_overrides["videos"] is False
+    assert updated.config_overrides["_backfill_state"] == "running"
+
+
+# --- config_overrides: the operator's keys and FC's own share one column ---
+#
+# `SourceFormDialog` posts the WHOLE object back, and its structured tab rebuilds
+# that object from two fields — so saving the dialog without touching anything
+# used to discard the resolved campaign id and the backfill position. The id
+# matters twice over: `patreon_resolver` reads it BEFORE attempting any lookup,
+# and the membership join (#387 C4, snippet #3947) keys on it.
+
+
+async def _source_with_state(db, svc, artist, **overrides):
+    """A source carrying both kinds of key: FC's own state and the operator's."""
+    rec = await svc.create(
+        artist_id=artist.id, platform="patreon", url="https://patreon.com/mixed",
+    )
+    await db.execute(
+        Source.__table__.update().where(Source.id == rec.id).values(
+            config_overrides={
+                "_backfill_state": "running",
+                "_backfill_cursor": "03:RESUME",
+                "patreon_campaign_id": "camp-1",
+                "videos": True,
+                **overrides,
+            },
+        )
+    )
+    await db.commit()
+    return rec
+
+
+@pytest.mark.asyncio
+async def test_an_operator_edit_keeps_fc_managed_state(db):
+    """THE bug. One dialog save used to cost the campaign id and the walk."""
+    artist = await _artist(db)
+    svc = SourceService(db)
+    rec = await _source_with_state(db, svc, artist)
+
+    updated = await svc.update(rec.id, config_overrides={"videos": False})
+
+    assert updated.config_overrides["patreon_campaign_id"] == "camp-1"
+    assert updated.config_overrides["_backfill_state"] == "running"
+    assert updated.config_overrides["_backfill_cursor"] == "03:RESUME"
+    assert updated.config_overrides["videos"] is False
+
+
+@pytest.mark.asyncio
+async def test_an_operator_key_left_out_of_the_edit_is_still_removed(db):
+    """The other half, and why this is a merge rather than a blanket keep: the
+    operator's own settings must still replace wholesale, or removing a key in
+    the dialog could never remove it."""
+    artist = await _artist(db)
+    svc = SourceService(db)
+    rec = await _source_with_state(db, svc, artist, since="2026-01-01")
+
+    updated = await svc.update(rec.id, config_overrides={"videos": False})
+
+    assert "since" not in updated.config_overrides
+
+
+@pytest.mark.asyncio
+async def test_a_null_config_clears_operator_settings_but_not_fc_state(db):
+    """`_parseConfig` sends null for an empty object, so this is the dialog's
+    real "I cleared the box" path — not a request to forget the walk."""
+    artist = await _artist(db)
+    svc = SourceService(db)
+    rec = await _source_with_state(db, svc, artist)
+
+    updated = await svc.update(rec.id, config_overrides=None)
+
+    assert "videos" not in updated.config_overrides
+    assert updated.config_overrides["_backfill_state"] == "running"
+    assert updated.config_overrides["patreon_campaign_id"] == "camp-1"
+
+
+@pytest.mark.asyncio
+async def test_a_stale_echoed_value_cannot_overwrite_what_the_walk_wrote(db):
+    """The dialog round-trips whatever it last READ. If the backfill advanced in
+    the meantime, saving that stale copy must not roll the walk backwards — so
+    FC's keys are applied last and win."""
+    artist = await _artist(db)
+    svc = SourceService(db)
+    rec = await _source_with_state(db, svc, artist)
+
+    updated = await svc.update(rec.id, config_overrides={
+        "videos": False,
+        "_backfill_cursor": "00:STALE",
+        "patreon_campaign_id": "wrong-campaign",
+    })
+
+    assert updated.config_overrides["_backfill_cursor"] == "03:RESUME"
+    assert updated.config_overrides["patreon_campaign_id"] == "camp-1"
+
+
+@pytest.mark.asyncio
+async def test_repointing_the_url_drops_the_resolved_campaign_id(db):
+    """A different creator behind the same row makes the cached id WRONG, not
+    stale. Preserving it above is exactly what makes this invalidation this
+    service's job — the old wholesale overwrite used to wipe the id by accident.
+    """
+    artist = await _artist(db)
+    svc = SourceService(db)
+    rec = await _source_with_state(db, svc, artist)
+
+    updated = await svc.update(rec.id, url="https://patreon.com/someone-else")
+
+    assert "patreon_campaign_id" not in updated.config_overrides
+    # The walk's position survives: it is expensive to rebuild, the walk has its
+    # own stall guard, and a cosmetic URL edit must not restart a long backfill.
+    assert updated.config_overrides["_backfill_cursor"] == "03:RESUME"
+
+
+@pytest.mark.asyncio
+async def test_rewriting_the_same_url_keeps_the_campaign_id(db):
+    """The dialog posts the URL on every save. An unchanged URL is not a
+    repoint, and treating it as one would re-resolve after every edit."""
+    artist = await _artist(db)
+    svc = SourceService(db)
+    rec = await _source_with_state(db, svc, artist)
+
+    updated = await svc.update(rec.id, url="https://patreon.com/mixed")
+
+    assert updated.config_overrides["patreon_campaign_id"] == "camp-1"
+
+
+def test_the_campaign_id_suffix_agrees_with_the_membership_join():
+    """Two modules must agree on the key shape: this one preserves and
+    invalidates it, `membership_roster` matches on it (snippet #3947). They
+    deliberately do not import across — a core CRUD service should not depend on
+    a membership feature — so the agreement is pinned here rather than hoped for.
+    Do NOT fix a failure by editing one side; decide which shape is right.
+    """
+    from backend.app.services.membership_roster import _CAMPAIGN_KEY_SUFFIX
+    from backend.app.services.source_service import _CAMPAIGN_ID_SUFFIX
+
+    assert _CAMPAIGN_ID_SUFFIX == _CAMPAIGN_KEY_SUFFIX
 
 
 @pytest.mark.asyncio