Fix label membership being cleared when a label query errors

[nulmete]

Related issue: Resolves #46399

When a label's query errors on a host (e.g. the extension socket is unavailable) instead of returning zero rows, Fleet was recording that error the same as a definitive "no match," clearing the host's existing label membership. This could unintentionally remove configuration profiles or other automations scoped to that label. The fix leaves existing label membership untouched when a label query errors.

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

Testing

• Added/updated automated tests

• QA'd all new/changed functionality manually

Summary by CodeRabbit

• Bug Fixes

  • Preserved existing dynamic label memberships when label queries fail or return unknown results.
  • Prevented failed label evaluations from being incorrectly treated as label removals.
  • Continued removing memberships only when a label query definitively reports no match.

• Tests

  • Added coverage for query errors and verified that existing label memberships remain intact.

[nulmete]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

Walkthrough

Label query errors are now represented as unknown results rather than non-matches. Asynchronous recording skips unknown results and avoids empty Redis updates. MySQL recording also skips unknown matches, preserving existing label_membership rows. Tests cover distributed query errors, Redis queue contents, and membership retention after a failed label query.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The code and tests satisfy #46399 by skipping errored label results so existing membership is preserved.
Out of Scope Changes check	✅ Passed	The changes stay focused on label-query error handling and related tests, with no unrelated scope added.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly and concisely describes the main fix: preserving label membership when a label query errors.
Description check	✅ Passed	The description includes the related issue, bug summary, and the required testing and changes-file checklist items.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 46399-query-errors-can-cause-label

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

This PR fixes dynamic label evaluation so that when a label query returns an error status (instead of a definitive “0 rows”), Fleet records the result as unknown and does not clear existing label membership—preventing unintended removal of label-scoped automation (resolves #46399).

Changes:

• Treat errored label query executions as nil/unknown and skip membership deletes/updates for those labels (MySQL + async Redis path).
• Update async Redis script/argument building to avoid writing “delete” entries for errored label results.
• Add/extend tests to validate that query errors preserve existing label membership.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
server/service/osquery_test.go	Adds coverage ensuring query error status is recorded as nil label result (unknown).
server/service/async/async_label.go	Skips nil label results when writing async label membership ops to Redis; guards ZADD when args are empty.
server/service/async/async_label_test.go	Updates expectations so nil results are skipped (not treated as deletes).
server/datastore/mysql/labels.go	Skips updates/deletes when label result is nil (unknown/error), preserving membership.
server/datastore/mysql/labels_test.go	Adds a regression test ensuring nil results keep existing membership (but currently has compile errors: invalid new("1") / new(true)).
changes/46399-query-errors-can-cause-label-membership-unassigned.md	Release note (content excluded by policy; not reviewed).

Files excluded by content exclusion policy (1)

• changes/46399-query-errors-can-cause-label-membership-unassigned.md

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.15%. Comparing base (3e695c7) to head (5aeba24).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #49403   +/-   ##
=======================================
  Coverage   68.15%   68.15%           
=======================================
  Files        3849     3849           
  Lines      243458   243465    +7     
  Branches    13110    13110           
=======================================
+ Hits       165934   165943    +9     
+ Misses      62526    62524    -2     
  Partials    14998    14998           

Flag	Coverage Δ
backend	69.67% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.