mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
DuncanandWill Pfleger
2c555c4640
M4 runs its whole body under one BEGIN IMMEDIATE with the marker written last, and SQLite DDL is transactional, so no shipped code path can leave a wrong-shaped object without the marker — a crash rolls everything back. The shape validator (table_shape_matches, scope_age_index_is_correct, validate_retention_schema_shape, and their shape constants) only defended against hand-mutated or foreign-tool DBs, an out-of-scope threat model. Replace it with the reachability-honest minimum: refuse to certify a pre-existing retention_policies/archive_meta table (fail closed, no marker), plain CREATE TABLE otherwise, and an unconditional DROP INDEX IF EXISTS + CREATE INDEX for the scope-age index (carries no data, so a fresh build is always correct). The BEGIN IMMEDIATE + pre-lock guard + in-lock recheck race machinery, seeding, and marker-last ordering are unchanged. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>