Reconstruct the risk analysis treatment plans as of a date - #1782

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/probo/measure_service.go, line 476:

<comment>If a delete commits after this update loads the measure, the zero-row update still records an UPDATE event, making the deleted measure reappear in as-of reads. Serialize the operations or verify the update affected a row before recording the event.</comment>

<file context>
@@ -463,10 +463,27 @@ func (s MeasureService) Import(
+					eventType = coredata.MeasureEventTypeUpdated
+				}
+
+				if err := insertMeasureEvent(
+					ctx,
+					tx,
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At apps/console/src/pages/organizations/risks/risk-analyses/treatment-plans/_components/TreatmentPlanListItem.tsx, line 70:

<comment>When a user has treatment-plan list permission without treatment-plan get permission, this fragment now requests `progress` and makes the list fail. Use a list-authorized progress path or align the resolver authorization with the surrounding list query.</comment>

<file context>
@@ -41,46 +41,40 @@ import { updateStoreCounter } from "#/hooks/useMutationWithIncrement";
     canDelete: permission(action: "risk-management:treatment-plan:delete")
-    measureCount: measures(first: 0) {
-      totalCount
+    progress {
+      done
+      inProgress
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/coredata/migrations/20260826T135100Z.sql, line 117:

<comment>When an existing plan or measure was edited before this migration, the seed records its current snapshot at the original creation time, fabricating history for later as-of dates. Stamp seed events at migration time instead, so pre-migration history remains unavailable as documented.</comment>

<file context>
@@ -0,0 +1,144 @@
+        ARRAY[]::TEXT[]
+    ),
+    r.category,
+    tp.created_at,
+    tp.updated_at,
+    tp.created_at
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At apps/console/src/pages/organizations/risks/risk-analyses/_lib/useMatrixAsOf.ts, line 52:

<comment>When this page remains open across local midnight without an `asOf` parameter, `asOfDate` stays yesterday because the memo only reruns when `search` changes; the page then switches from live data to historical data. Track the current date and refresh the derived value at the day boundary so an unpinned view remains live.</comment>

<file context>
@@ -0,0 +1,71 @@
+export function useMatrixAsOf() {
+  const [params, setParams] = useSearchParams();
+  const search = params.toString();
+  const asOfDate = useMemo(
+    () => parseAsOfDate(new URLSearchParams(search)),
+    [search],
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/coredata/measure_filter.go, line 93:

<comment>When an as-of search contains tsquery punctuation such as `foo & bar`, this construction produces an invalid query and the request fails instead of returning results. Escape each token or use a plain/web-search parser, and apply the same correction to `SQLFragment`.</comment>

<file context>
@@ -81,3 +81,37 @@ AND
+			TRUE
+		ELSE
+			to_tsvector('simple', name) @@ (
+				SELECT to_tsquery('simple', string_agg(lexeme || ':*', ' & '))
+				FROM unnest(regexp_split_to_array(trim(@query), '\s+')) AS lexeme
+			)
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At apps/console/src/pages/organizations/risks/risk-analyses/_components/RiskAnalysisPlansSection.tsx, line 405:

<comment>When switching from a historical date back to today, stale historical rows remain editable while the live-data refetch is pending. Keep plans read-only until the new live data is ready.</comment>

<file context>
@@ -239,109 +333,174 @@ function RiskAnalysisPlansTable({
+                        treatmentPlanKey={row.plan}
+                        connectionId={connectionId}
+                        matrixSize={matrixSize}
+                        readOnly={hasAsOf}
+                        onChanged={reload}
+                      />
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At apps/console/src/pages/organizations/risks/risk-analyses/treatment-plans/_components/TreatmentPlanProgressBar.tsx, line 41:

<comment>When a treatment plan contains a `NOT_STARTED`, `NOT_APPLICABLE`, or `UNKNOWN` measure, `total` includes it but `paintedEnd` does not, leaving that portion of the progress bar as an unexplained background segment while the label still reports it in the denominator. Count every valid state in a displayed bucket or add an explicit unclassified segment.</comment>

<file context>
@@ -0,0 +1,74 @@
+  const inProgressEnd = total === 0
+    ? 0
+    : Math.round(((done + inProgress) / total) * 100);
+  const paintedEnd = total === 0
+    ? 0
+    : Math.round(((done + inProgress + notImplemented) / total) * 100);
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/cmd/risk-analysis/view/view.go, line 124:

<comment>`time.Parse(time.RFC3339, ...)` normalizes out-of-range values instead of rejecting them, so the guard doesn't guarantee a valid timestamp. For example "2026-02-30T00:00:00Z" returns nil error and is sent as-is, then the server normalizes it to March 2, silently reconstructing cells as of an unintended date. Validate the semantic date (e.g. confirm the parsed value round-trips, or compare parsed month/day to the input) and send the canonical parsed value rather than the raw user string.</comment>

<file context>
@@ -114,9 +118,22 @@ func NewCmdView(f *cmdutil.Factory) *cobra.Command {
+			var asOf *string
+
+			if flagAsOf != "" {
+				if _, err := time.Parse(time.RFC3339, flagAsOf); err != nil {
+					return fmt.Errorf(
+						"--as-of must be RFC3339 (e.g. 2026-01-15T23:59:59Z): %w",
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/coredata/measure_filter.go, line 85:

<comment>`EventSQLFragment` duplicates nearly all of `SQLFragment`, so future filter changes can silently diverge between live and as-of reads. Extract the shared predicates into a helper and parameterize only the storage-specific expressions.</comment>

<file context>
@@ -81,3 +81,37 @@ AND
 	`
 }
+
+func (f *MeasureFilter) EventSQLFragment() string {
+	return `
+(
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/coredata/treatment_plan.go, line 699:

<comment>The new historical treatment-plan queries cross the entity boundary to read `measure_events` for net-score filtering. Move historical measure-state loading to the measure layer or caller, then pass the resulting IDs/states into treatment-plan queries instead of joining measure events here.

(Based on your team's feedback about cross-entity SQL joins.) </comment>

<file context>
@@ -517,6 +595,321 @@ WHERE %s
+							SELECT latest_event.state
+							FROM (
+								SELECT me.state, me.event_type
+								FROM measure_events me
+								WHERE me.measure_id = mid
+									AND me.created_at < @as_of
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At apps/console/src/pages/organizations/risks/risk-analyses/_components/RiskAnalysisMatrices.tsx, line 110:

<comment>When a viewer west of UTC opens an analysis created just after midnight UTC, this minimum permits an as-of instant before the analysis existed and shows an empty snapshot. Align `asOfDateBounds` and `matrixAsOf` to the same timezone so the minimum cannot query before creation.</comment>

<file context>
@@ -94,7 +107,13 @@ export function RiskAnalysisMatrices({ analysisKey }: RiskAnalysisMatricesProps)
 
   const matrixSize = { rows: analysis.matrixSize.rows, cols: analysis.matrixSize.cols };
-  const counts = analysis.matrixCells ?? [];
+  const { minDate, maxDate } = asOfDateBounds(analysis.createdAt);
+  const cells = analysis.matrixCells;
+
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/coredata/treatment_plan_event.go, line 208:

<comment>When an analysis contains many treatment plans, an as-of matrix request materializes every latest event and plan in memory through this unbounded loader. Page the reconstruction or aggregate the as-of matrix cells in SQL.</comment>

<file context>
@@ -0,0 +1,379 @@
+	return nil
+}
+
+func (es *TreatmentPlanEvents) LoadLatestByRiskAnalysisIDAsOf(
+	ctx context.Context,
+	conn pg.Querier,
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/coredata/measure_event.go, line 153:

<comment>This method duplicates the as-of event-folding query in `Measures.LoadByIDsAsOf`, so fixes to ordering, visibility, or filtering can produce inconsistent historical results. Extract the shared latest-event selection or reuse one implementation instead of maintaining both queries.</comment>

<file context>
@@ -0,0 +1,200 @@
+    measure_created_at,
+    created_at
+FROM (
+    SELECT DISTINCT ON (measure_id)
+        organization_id,
+        measure_id,
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/coredata/measure_event_type.go, line 38:

<comment>This enum omits the standard `MeasureEventTypes()` helper, so callers must duplicate the valid-value list instead of enumerating it from coredata. Add the helper alongside the constants.</comment>

<file context>
@@ -0,0 +1,73 @@
+	MeasureEventTypeDeleted MeasureEventType = "DELETED"
+)
+
+var (
+	_ fmt.Stringer             = MeasureEventType("")
+	_ encoding.TextMarshaler   = MeasureEventType("")
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/cmd/treatment-plan/view/view.go, line 188:

<comment>When a treatment plan's own `category` is empty but its linked risk carries a category, `list` shows the risk's category but `view` renders an empty "Category:" line for the same record. Match the list command's behavior: query `risk { category }` and fall back to it when `p.Category` is empty.</comment>

<file context>
@@ -183,6 +185,7 @@ func NewCmdView(f *cmdutil.Factory) *cobra.Command {
 			_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Risk:"), p.Risk.ID)
 			_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Risk Analysis:"), p.RiskAnalysis.ID)
 			_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Treatment:"), p.Treatment)
+			_, _ = fmt.Fprintf(out, "%s%s\n", label.Render("Category:"), p.Category)
 			_, _ = fmt.Fprintf(out, "%s%s (%s)\n", label.Render("Owner:"), p.Owner.FullName, p.Owner.ID)
 
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/coredata/treatment_plan_event_type.go, line 32:

<comment>This enum omits the pluralized list helper that every sibling string enum defines (e.g. AiSystemStatuses(), AccessReviewCampaignStatuses()) and that production validation code relies on via validator.OneOfSlice(...). Add a TreatmentPlanEventTypes() []TreatmentPlanEventType returning all five constants so validation/filtering callers can enumerate valid values instead of hardcoding or omitting checks.</comment>

<file context>
@@ -0,0 +1,77 @@
+	TreatmentPlanEventType string
+)
+
+const (
+	TreatmentPlanEventTypeCreated         TreatmentPlanEventType = "CREATED"
+	TreatmentPlanEventTypeUpdated         TreatmentPlanEventType = "UPDATED"
</file context>