From c03c798e3490c33b36c0fc16fae9b18864fea32c Mon Sep 17 00:00:00 2001 From: "glm-5.3-flash" Date: Sun, 11 Oct 2026 12:23:13 +0000 Subject: [PATCH] =?UTF-8?q?decompose=20the=20pg=20scheduler-classification?= =?UTF-8?q?=20twin=20(review=20004=20item=209=20=E2=80=94=20recorded=20at?= =?UTF-8?q?=20the=20sqlite=20task's=20implementation:=20scheduler.rs:682?= =?UTF-8?q?=20carries=20the=20identical=20renew=20flattening;=20the=20ADR-?= =?UTF-8?q?009=20=C2=A71=20arm=20set=20is=20already=20landed=20engine-neut?= =?UTF-8?q?ral,=20pg=20implements=20to=20match)=20+=20gate=20wiring;=20tas?= =?UTF-8?q?kgraph=20validate=20green=20(96)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../pg-fix-scheduler-error-classification.md | 84 +++++++++++++++++++ tasks/review-004-fixes.md | 7 +- 2 files changed, 89 insertions(+), 2 deletions(-) create mode 100644 tasks/pg-fix-scheduler-error-classification.md diff --git a/tasks/pg-fix-scheduler-error-classification.md b/tasks/pg-fix-scheduler-error-classification.md new file mode 100644 index 0000000..3f9c55f --- /dev/null +++ b/tasks/pg-fix-scheduler-error-classification.md @@ -0,0 +1,84 @@ +--- +id: pg-fix-scheduler-error-classification +name: Classify run_schedules' renew-failure arms on pg (the sqlite twin, review 004 item 9) +status: pending +depends_on: [] +scope: narrow +risk: low +impact: component +level: implementation +tags: [review-004-fixes, postgres-engine, scheduler] +--- + +## Description + +The pg twin of `sqlite-fix-scheduler-error-classification` (completed), +recorded in that task's Notes as an unresolved follow-up: +`alkstore-postgres/src/scheduler.rs:682` carries the identical +`.unwrap_or(false)` flattening the sqlite task fixed — a mid-run +`lease.renew(LEADER_TTL_S)` failure (including the closed-store +`Database` error) is mapped to `false` and misreported as +`Error::LeadershipLost`, misdirecting the documented respawn recipe at +a dead store. + +The classification decision of record is already landed and +engine-neutral — the sqlite task's dated (2026-10-11) ADR-009 §1 / +core-contract.md §Errors annotation pins the arm set for the family — +so this task implements pg to match it, not re-decides: + +- `renew` → `Ok(false)` — the genuine loss arm (expired and + re-acquired elsewhere; exclusion lapses silently at TTL expiry, + ADR-008 §7) — returns `Err(LeadershipLost)`, unchanged, + return-before-tick. The respawn recipe matches on this arm only. +- `renew` → `Err(e)` — the machinery never reached the lock + semantics; not a loss, never `LeadershipLost`. The `Err` propagates + unchanged: the closed-store arm arrives pre-classified (pg's + post-close `renew` fails closed with `Database`, pinned by pg + lock_tests), and any other storage failure carries the driver's + source chain. + +No new variant minted — ADR-008 §5's act-differently rule holds +(`Closed` stays the wake-receiver variant; closed store is `Database` +engine-wide, the pg posture already). + +**Tests need the harness server** (the reason the sqlite task recorded +rather than landed this): model the two pins on the sqlite task's — +a mid-run close exits with the closed `Database` classification, never +`LeadershipLost`; a mid-run lease loss still returns `LeadershipLost` +(the respawn arm unchanged). + +## Acceptance Criteria + +- [ ] The pg renew arm implements the landed arm set: `Ok(false)` → + `LeadershipLost` unchanged; `Err(e)` propagates unchanged (no + flattening) — no re-deciding; any discrepancy with the sqlite + task's decisions of record recorded, not deviated around +- [ ] Both arms pinned by tests against the harness server (the + closed-store arm and the genuine-loss arm, modeled on the + sqlite task's two pins) +- [ ] The ADR-009 §1 / core-contract annotations verified to read + engine-neutral (they were landed as family-wide; cite them — + only pg-specific doc text needs touching, e.g. + engine-postgres.md's scheduler row if it describes the arm) +- [ ] `cargo test -p alkstore-postgres` (harness server), clippy + `-D warnings`, fmt clean; workspace gates green server-less + +## References + +- tasks/sqlite-fix-scheduler-error-classification.md (the twin — the + arm set's decisions of record, the two pin shapes, the recorded + follow-up this task discharges) +- docs/reviews/004-pre-release-general-review.md §"Findings recorded, + not fixed" item 9 (the original finding — recorded the sqlite site + only; the pg twin surfaced at implementation) +- docs/architecture/decisions/009-*.md §1 (the dated classification + annotation of record), core-contract.md §Errors +- alkstore-postgres/src/scheduler.rs:675-690 (the flattening site) + +## Notes + +> To be filled by implementation agent + +## Summary + +> To be filled on completion \ No newline at end of file diff --git a/tasks/review-004-fixes.md b/tasks/review-004-fixes.md index 91e1605..2ee07ce 100644 --- a/tasks/review-004-fixes.md +++ b/tasks/review-004-fixes.md @@ -2,7 +2,7 @@ id: review-004-fixes name: Review gate — review-004 fix batch (recorded-findings dispositions) status: pending -depends_on: [sqlite-fix-seam-panic-safety, sqlite-fix-watcher-death-subscribe, sqlite-fix-listener-bridge-alignment, sqlite-fix-scheduler-error-classification, sqlite-substrate-safety-comments, pg-fix-forwarder-hardening, pg-fix-forwarder-diagnosability, decide-log-facade-adoption, pg-decide-stamp-arithmetic-side, pg-fix-bigint-stamp-overflow, mem-doc-growth-outbox-notes, core-pin-offset-initial-value, core-fix-display-log-forging, docs-pg-identifier-truncation-note, normalize-tokio-dev-deps] +depends_on: [sqlite-fix-seam-panic-safety, sqlite-fix-watcher-death-subscribe, sqlite-fix-listener-bridge-alignment, sqlite-fix-scheduler-error-classification, sqlite-substrate-safety-comments, pg-fix-forwarder-hardening, pg-fix-forwarder-diagnosability, decide-log-facade-adoption, pg-decide-stamp-arithmetic-side, pg-fix-bigint-stamp-overflow, pg-fix-scheduler-error-classification, mem-doc-growth-outbox-notes, core-pin-offset-initial-value, core-fix-display-log-forging, docs-pg-identifier-truncation-note, normalize-tokio-dev-deps] scope: broad risk: low impact: phase @@ -31,7 +31,10 @@ numbering): 3. **Bridge alignment**: the listen bridge is std-thread shaped; the two bridges' residual difference (if any) named and justified. 4. **Scheduler classification**: the closed-store arm no longer - reports `LeadershipLost`; the window-state/annotation record is + reports `LeadershipLost` on *either* engine — the sqlite fix and + the pg twin (`pg-fix-scheduler-error-classification`, surfaced at + the sqlite task's implementation) both verified against the landed + ADR-009 §1 arm set; the window-state/annotation record is present. 5. **Substrate SAFETY comments**: every flagged block carries a concrete invariant; the PROVENANCE delta entry registered (the