… handlers

Optimizes the Apple profile reconciler path by scanning hosts in bounded
batches (default 5k per tick via a host_uuid cursor in Redis) and
computing desired state in Go using per-label-mode handlers instead of a
large MySQL UNION join.

Each tick:
  1. ListAppleMDMHostsForReconcileBatch pulls the next batch of
     Apple-enrolled host UUIDs by cursor (no profile-status check).
  2. ListAppleProfilesForReconcile loads the full profile catalog and
     label assignments once per tick.
  3. BulkGetHostLabelMemberships and BulkGetHostMDMAppleProfilesByUUIDs
     load the per-batch label memberships and current state.
  4. computeAppleReconcileDeltas dispatches each (host, profile) pair
     to one of four in-code handlers: no-labels, include-all,
     include-any, exclude-any. Broken-label and dynamic-label-timing
     semantics match the legacy SQL.
  5. The downstream CA-throttle, user-enrollment, host-being-set-up
     skip, BulkUpsertMDMAppleHostProfiles, and ProcessAndEnqueueProfiles
     flow is reused unchanged.

Gated by FLEET_MDM_APPLE_BATCHED_RECONCILER=true so the legacy path
stays the default. The cursor is persisted in Redis (mysqlredis wrapper)
and resets when a full pass completes, mirroring the Windows reconciler
pattern. Includes unit tests for each handler and the delta computation.

https://claude.ai/code/session_01Vvy1keXRKZRzDbJQd7dzDn

Surface where a tick stalls and which commands the enqueue path fails
on so the cursor-stuck symptom can be traced to a specific step.

New log lines (look for cron=mdm_apple_profile_manager):
  - batched reconcile: listed hosts
  - batched reconcile: loaded profiles
  - batched reconcile: computed deltas (with to_install / to_remove)
  - batched reconcile: before bulk upsert
  - batched reconcile: enqueue complete (succeeded / failed cmd counts)
  - batched reconcile: failed command UUID (per failed cmd, with err)
  - batched reconcile: tick errored; cursor not advanced (with err)
  - batched reconcile: cursor advanced / tick complete, cursor unchanged
  - batched reconcile: ProcessAndEnqueueProfiles returned error

The cursor-advance deferred block was rewritten as a switch so the
outcome (errored / advanced / unchanged) is always logged with the
cursor values, making it easy to spot ticks that stall mid-pass.

https://claude.ai/code/session_01Vvy1keXRKZRzDbJQd7dzDn

ListAppleProfilesForReconcile used COALESCE(lbl.created_at,
'2000-01-01 00:00:00') with a string-literal default, which made
MySQL coerce the result column to VARCHAR. The MySQL driver returns
that as []uint8, and sql.NullTime.Scan can only accept time.Time or
nil — producing:

  sql: Scan error on column index 4, name "label_created_at":
  unsupported Scan, storing driver.Value type []uint8 into type
  *time.Time

This errored on every tick, so the reconciler never reached the
deferred cursor advance — the cursor stayed pinned at whatever
value a prior successful run had set it to, and no further work
got done.

Drop the COALESCE so the column stays TIMESTAMP. NULL → invalid
NullTime → zero time.Time, which the exclude-any handler already
treats as "no timing check" (matching the broken-label semantics).

https://claude.ai/code/session_01Vvy1keXRKZRzDbJQd7dzDn