Resolve the new-incident insert conflict instead of dropping the payload

openIncident's INSERT had no ON CONFLICT clause, relying entirely on
incidentForGroup's earlier SELECT to avoid a duplicate. On more than
one replica, two webhook deliveries for the very first occurrence of
a brand-new groupKey can both pass that SELECT before either INSERTs;
the loser then hit incidents_open_group_key_idx's unique violation,
which rolled back its whole transaction — including that payload's
alert upserts, done earlier in the same transaction. ingest's error is
only logged and receiveWebhook answers 200 regardless, so nothing
retried it: the loser's alerts silently never existed.

Add ON CONFLICT (team_id, group_key) WHERE resolved_at IS NULL DO
NOTHING to the INSERT, matching the partial unique index. Postgres
only resolves that conflict after the winning transaction commits (or
rolls back), so by the time RETURNING comes back empty,
existingOpenIncident's follow-up SELECT is guaranteed to see the
winner's row. The loser attaches to it instead of failing outright,
and the rest of its payload commits normally. Covers both callers,
since the dead man's switch sweeper shares this same function.

New test (package api_test, fires N webhook deliveries for one
groupKey from a synchronized start with distinct fingerprints, so
they aren't accidentally serialized by upsertAlerts' own per-
fingerprint lock) confirmed meaningful: with the ON CONFLICT clause
reverted, it fails 10/10 on a missing alert fingerprint; restored, 0/10.
Note while building it: "exactly one incident" alone cannot
distinguish fixed from broken, since the DB's own unique index already
guarantees that either way — the real signal is the loser's payload
surviving.

Chart comment updated: all three of the chart's original reasons for
Recreate are now addressed in code, though replicas stays at 1 and the
strategy stays Recreate pending a deliberate decision to raise it.

Co-authored-by: Claude <noreply@anthropic.com>

internal/api/alertmanager.go

@@ -376,6 +376,17 @@ func incidentForGroup(ctx context.Context, tx *sql.Tx, notify NotifyConfig, team
 // its own. Hence the querier rather than a *sql.Tx. A nil severity leaves the
 // column for refreshSeverity to fill from the member alerts; the sweeper passes
 // one because its incidents have no members to derive it from.
+//
+// Both callers get here only after their own SELECT found no open incident for
+// this group_key — but on more than one replica, two webhook deliveries for the
+// very first occurrence of a brand-new group_key can both pass that SELECT
+// before either INSERTs. ON CONFLICT DO NOTHING against
+// incidents_open_group_key_idx is what makes the loser's INSERT a no-op instead
+// of a unique-violation error that would otherwise roll back its entire
+// payload; existingOpenIncident then hands it the winner's row. Postgres
+// resolves that conflict only once the winner's transaction has committed (or
+// rolled back), so by the time this RETURNING comes back empty, the winner's
+// row is guaranteed visible to that follow-up SELECT.
 func openIncident(ctx context.Context, q querier, notify NotifyConfig, teamID int64, groupKey, title string, groupLabels map[string]string, severity *string) (int64, error) {
 	onCall, err := currentOnCall(ctx, q, teamID)
 	if err != nil {
@@ -391,10 +402,18 @@ func openIncident(ctx context.Context, q querier, notify NotifyConfig, teamID in
 	err = q.QueryRowContext(ctx, `
 		INSERT INTO incidents (team_id, group_key, title, group_labels, signature, status, severity, triggered_at, assigned_to)
 		VALUES ($1, $2, $3, $4::jsonb, $5, 'triggered', $6, $7, $8)
+		ON CONFLICT (team_id, group_key) WHERE resolved_at IS NULL DO NOTHING
 		RETURNING id`,
 		teamID, groupKey, title, string(labelsJSON), incidentSignature(groupLabels, title), severity,
 		time.Now().Unix(), onCall).Scan(&id)
-	if err != nil {
+	switch {
+	case err == sql.ErrNoRows:
+		// Lost the race: someone else's incident for this group_key exists now.
+		// Everything below — the trigger event, assignment, page, escalation
+		// clock — already happened for that row when it was created; attach to
+		// it rather than fail this call (and the whole payload) outright.
+		return existingOpenIncident(ctx, q, teamID, groupKey)
+	case err != nil:
 		return 0, err
 	}
 
@@ -423,6 +442,21 @@ func openIncident(ctx context.Context, q querier, notify NotifyConfig, teamID in
 	return id, nil
 }
 
+// existingOpenIncident looks up the open incident openIncident's own INSERT just
+// lost a conflict against — the same lookup incidentForGroup does before ever
+// calling openIncident, repeated here for the caller that arrived second.
+func existingOpenIncident(ctx context.Context, q querier, teamID int64, groupKey string) (int64, error) {
+	var id int64
+	err := q.QueryRowContext(ctx,
+		"SELECT id FROM incidents WHERE team_id = $1 AND group_key = $2 AND resolved_at IS NULL",
+		teamID, groupKey,
+	).Scan(&id)
+	if err != nil {
+		return 0, err
+	}
+	return id, nil
+}
+
 // linkAlert adds an alert to an incident, emitting a timeline entry only the
 // first time. Re-sends of an already-linked alert are silent.
 func linkAlert(ctx context.Context, tx *sql.Tx, incidentID, alertID int64) error {