mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57ccandTyler Longwell
f4dbd208f5
The rollback guard `delivered_at = $stamp` was sound only at second granularity because `claim_due_reminder` wrote `Utc::now().timestamp()`. Two claims in the same wall-clock second produced the same i64 stamp, so a stale rollback from a slow pod could match (and silently clobber) a live claim freshly written by a fast pod. That's the very ABA hazard the guard exists to prevent. Switch the claim write to `Utc::now().timestamp_micros()`. The column stays `BIGINT` — microsecond-epoch values fit, and no reader interprets `delivered_at` as a whole-seconds count (every read is `IS NULL` / `IS NOT NULL`; verified across schema.sql:138, migrations/0003:17, event.rs:1049). No migration needed. Tests: - Add `rollback_under_same_wall_clock_second_does_not_clobber`: two back-to-back claims (no sleep) with a rollback between, assert the stamps are distinct, then prove the stale stamp_a rollback against the live stamp_b row returns false and the row is unchanged. Pins the actual race Eva [4] flagged — under seconds-granularity stamp_a == stamp_b on any modern host, the assertion fails, and the stale rollback silently clobbers. - Update `rollback_with_matching_stamp_reverts_then_reclaim_wins` comment that previously cited 1-second resolution as the reason for not comparing stamps. No longer true. - Update `rollback_with_stale_stamp_does_not_clobber_live_claim` comment: stamp_old+1 is now a 1-microsecond delta, not 1 second. Adversarial: reverted `claim_due_reminder` to `Utc::now().timestamp()`, ran the new test → loud fail at `assert_ne!(stamp_a, stamp_b)` with `stamp_a=1782498896, stamp_b=1782498896`. Restored. Validation: - cargo fmt --check (buzz-db, buzz-relay): OK - cargo clippy --tests --no-deps -- -D warnings (buzz-db, buzz-relay): OK - cargo test -p buzz-db --lib --include-ignored --test-threads=1: 88 pass - cargo test -p buzz-relay --lib: 369 pass - cargo check -p buzz-relay: OK Co-authored-by: Tyler Longwell <tlongwell@block.xyz> Signed-off-by: Tyler Longwell <tlongwell@block.xyz>