add PR comment to VolumeRepair struct

nexus/db-model/src/volume_repair.rs

@@ -5,6 +5,13 @@
 use crate::schema::volume_repair;
 use uuid::Uuid;
 
+/// When modifying a Volume by replacing its parts, Nexus should take care to
+/// only replace one region or snapshot for a volume at a time. Technically, the
+/// Upstairs can support two at a time, but codifying "only one at a time" is
+/// safer, and does not allow the possiblity for a Nexus bug to replace all
+/// three regions of a region set at a time (aka total data loss!). This "one at
+/// a time" constraint is enforced by each repair also creating a VolumeRepair
+/// record, a table for which there is a UNIQUE CONSTRAINT on the volume ID.
 #[derive(Queryable, Insertable, Debug, Selectable, Clone)]
 #[diesel(table_name = volume_repair)]
 pub struct VolumeRepair {