---
id: pg-fix-bigint-stamp-overflow
name: Guard pg's server-side stamp arithmetic against i64 extremes (review 004 item 5, implementation)
status: pending
depends_on: [pg-decide-stamp-arithmetic-side]
scope: moderate
risk: medium
impact: component
level: implementation
tags: [review-004-fixes, postgres-engine, queues]
---

## Description

Implement the guard decided by `pg-decide-stamp-arithmetic-side`, per
`docs/reviews/004-pre-release-general-review.md` §"Findings recorded,
not fixed" item 5. The sites: the claim statement (`queue.rs:386`),
heartbeat (`:912`), retry-reschedule (`:1000`), retention-sweep
(`:714`), and the lock stamp (`lock.rs:91`) — server-side sums over
consumer-supplied i64s whose overflow fails the UPDATE with "bigint
out of range", sticky per row (one extreme-stamped row poisons every
later claim/heartbeat/sweep that touches it).

Per the decision of record: clamp/validate at the enqueue seam, or
`LEAST`/`GREATEST`-guard the server expressions — do not re-decide;
if the implementation surfaces a reason the decision can't stand as
written, stop and record the discrepancy instead of deviating.

**Tests** (against the live harness server): a row stamped with
`visibility_timeout_s = i64::MAX` must not poison claim/heartbeat —
the row is claimable/heartbeatable per the decided semantics and
*other rows are unaffected*; the retention `i64::MIN` arm pinned
similarly. The sticky-failure property is the thing being retired:
before the fix, one extreme row fails every claim UPDATE that sums
against it.

## Acceptance Criteria

- [ ] The decided guard lands at the decided sites; no re-deciding
      (any discrepancy recorded, not deviated around)
- [ ] An `i64::MAX`-stamped row no longer makes claim/heartbeat
      UPDATEs fail — pinned by test against the live server, with the
      other-rows-unaffected assertion
- [ ] The retention `i64::MIN` arm pinned (sweep behavior per the
      decided semantics)
- [ ] The decision's annotation/contract text updated if the
      reachable failure set changed
- [ ] `cargo test -p alkstore-postgres` (harness server), clippy
      `-D warnings`, fmt clean; workspace gates green server-less

## References

- docs/reviews/004-pre-release-general-review.md §"Findings recorded,
  not fixed" item 5 (the finding, the sticky-failure mechanism)
- tasks/pg-decide-stamp-arithmetic-side.md (the decision of record
  this implements)
- alkstore-postgres/src/queue.rs:386/714/912/1000, lock.rs:91 (the
  stamp sites)

## Notes

> To be filled by implementation agent

## Summary

> To be filled on completion