66 lines
2.5 KiB
Markdown
66 lines
2.5 KiB
Markdown
---
|
|
id: pg-fix-bigint-stamp-overflow
|
|
name: Guard pg's server-side stamp arithmetic against i64 extremes (review 004 item 5, implementation)
|
|
status: pending
|
|
depends_on: [pg-decide-stamp-arithmetic-side]
|
|
scope: moderate
|
|
risk: medium
|
|
impact: component
|
|
level: implementation
|
|
tags: [review-004-fixes, postgres-engine, queues]
|
|
---
|
|
|
|
## Description
|
|
|
|
Implement the guard decided by `pg-decide-stamp-arithmetic-side`, per
|
|
`docs/reviews/004-pre-release-general-review.md` §"Findings recorded,
|
|
not fixed" item 5. The sites: the claim statement (`queue.rs:386`),
|
|
heartbeat (`:912`), retry-reschedule (`:1000`), retention-sweep
|
|
(`:714`), and the lock stamp (`lock.rs:91`) — server-side sums over
|
|
consumer-supplied i64s whose overflow fails the UPDATE with "bigint
|
|
out of range", sticky per row (one extreme-stamped row poisons every
|
|
later claim/heartbeat/sweep that touches it).
|
|
|
|
Per the decision of record: clamp/validate at the enqueue seam, or
|
|
`LEAST`/`GREATEST`-guard the server expressions — do not re-decide;
|
|
if the implementation surfaces a reason the decision can't stand as
|
|
written, stop and record the discrepancy instead of deviating.
|
|
|
|
**Tests** (against the live harness server): a row stamped with
|
|
`visibility_timeout_s = i64::MAX` must not poison claim/heartbeat —
|
|
the row is claimable/heartbeatable per the decided semantics and
|
|
*other rows are unaffected*; the retention `i64::MIN` arm pinned
|
|
similarly. The sticky-failure property is the thing being retired:
|
|
before the fix, one extreme row fails every claim UPDATE that sums
|
|
against it.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] The decided guard lands at the decided sites; no re-deciding
|
|
(any discrepancy recorded, not deviated around)
|
|
- [ ] An `i64::MAX`-stamped row no longer makes claim/heartbeat
|
|
UPDATEs fail — pinned by test against the live server, with the
|
|
other-rows-unaffected assertion
|
|
- [ ] The retention `i64::MIN` arm pinned (sweep behavior per the
|
|
decided semantics)
|
|
- [ ] The decision's annotation/contract text updated if the
|
|
reachable failure set changed
|
|
- [ ] `cargo test -p alkstore-postgres` (harness server), clippy
|
|
`-D warnings`, fmt clean; workspace gates green server-less
|
|
|
|
## References
|
|
|
|
- docs/reviews/004-pre-release-general-review.md §"Findings recorded,
|
|
not fixed" item 5 (the finding, the sticky-failure mechanism)
|
|
- tasks/pg-decide-stamp-arithmetic-side.md (the decision of record
|
|
this implements)
|
|
- alkstore-postgres/src/queue.rs:386/714/912/1000, lock.rs:91 (the
|
|
stamp sites)
|
|
|
|
## Notes
|
|
|
|
> To be filled by implementation agent
|
|
|
|
## Summary
|
|
|
|
> To be filled on completion |