Repository navigation
Fence payout intent claims with persistent leases - #312
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Allow a future payout processor to claim one stored intent with an explicit expiry and persistent generation number. An expired or superseded processor cannot renew or release another claim; a lost reply can be reconciled with
lease-show. Refs #189.Add
claim,renew,release,recoverandlease-showto the existing operator CLI. Worker UUID identifies a coordinator, not authentication or signing authority. Strict TTL is 1–300 seconds; mutations lock the immutable parent before the child, use server time and exact worker/generation predicates, and report success only after commit. Persistent epochs and ordinary INSERT/UPDATE/DELETE/TRUNCATE guards prevent identity resets. SQL contention returns a finite busy result after rollback; existing receipt, submit/show and private-safe error contracts remain intact.V112 and its repeatable add only the separate claim relation and its transition guards. All 105 existing SQL files, the immutable V111 parent, current bootstrap dependencies and typed error handling are preserved. Application rollback to #188 retains schema112 and both parent/child tables and data. No new dependency, global configuration, shared conftest, SDK, backlog worker, signer, broadcast or reward policy.
Validation: 296 focused PostgreSQL/CLI/bootstrap cases passed without skips, including two regressions preserving legacy storage-error exit codes. SQL guard mutation failed as expected; the original passed. Independent source review found no issues. The frozen whole backend passed 2,585 tests with two existing skips (local frontend/Playwright and stand-only runsc), zero failures/errors; all 70 tracked test containers were removed. The first full attempt failed because the root launcher omitted the Docker SDK endpoint and used an unsuitable ambient DSN; that evidence is retained. Corrected baseline/candidate launch probes and the full recovery passed without source changes. Static, type, complexity and self-review gates passed; the existing fixture F811 was proven against base.
Installed on production from merged
171bc1209eabd0654b69d855dfad70c3bfbe4b0eafter CI5/5, native image/scanner smoke, complete isolated migration/compatibility rehearsal and separate production expansion/backend admissions. Root postcheck verified runtime source hashes, schema112/history/guards, health200 and preservation of all other containers, volumes, bindings and A4 settings. Installation evidence. Application rollback retains both tables and their data. Actual funds and accrual activation were not enabled.