feat(session): lock stored publication during start - #227
Draft
cursor[bot] wants to merge 43 commits into
Draft
Conversation
Store participant and published-release identity for SessionState::Created with exact replay and fail-closed rebinding. Command-replay persistence stays outside this first slice.
Assert the Database error message and source, and fail the replay SELECT after ON CONFLICT by redirecting search_path so classify runs instead of the insert.
Linux llvm-cov leaves the isolated query_one ? tail uncovered unless the Err arm is an explicit match. Keep the search_path redirect test.
Linux branch coverage missed the later AND operands of exact-replay classification. Rebind each stored field independently, and prove a domain-legal u64::MAX creation time fails closed as ValueOutOfRange.
The replay SELECT failure constructed Database evidence without checking its safe display text or source, leaving those two production lines uncovered on Linux.
SHOW transaction_isolation can fail after the caller transaction is already aborted. Persist must surface that as a typed database error instead of leaving the probe Result uncovered.
Satisfy clippy::manual_let_else in the library test that instantiates AssessmentSessionPersistenceError::Database.
Name instrument_version_ref in the public persist contract and assert the committed version column. Keep TRACEABILITY, changelog, and as-built schema at Active PR #61 rather than promoting the slice to protected-main truth. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Restore persisted created-session identity from PostgreSQL without asking whether the original release still accepts new sessions, so later suspend or retire cannot rewrite provenance. Missing rows return none; later stored states and malformed lookup references fail closed. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Name the opened successor so TRACEABILITY, as-built schema, and ERD point at the persist-and-load head instead of the persist-only #106 slice. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Require the as-built table to name persist-and-load Active PR #109, not persist-only #61. Cover reconstitution of numeric or blank participant, release, and version references, and exercise load-path Database, InvalidStoredIdentity, and ValueOutOfRange through realistic PostgreSQL failures. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Add a start composition that calls AssessmentSession::new then persist so a suspended or retired release cannot begin a new session and reconstitution cannot be used as the start path. Load remains a lookup, not authorization. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Point TRACEABILITY, as-built, ERD, and the documentation contract at the start-composition successor. #121 remains the uncovered-start predecessor. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Cherry-pick #98 so start can read the stored publication state instead of trusting a caller-supplied in-memory InstrumentRelease. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Load the exact instrument release in the same transaction before persist so a stale in-memory Published object cannot start a session after the stored release is suspended or retired. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Retarget as-built, ERD, and TRACEABILITY from in-memory-start #138 to the stored-release composition landing vehicle. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Hold SELECT … FOR UPDATE on instrument_release when classifying an existing row so a Duplicate published result cannot lose the row to a concurrent Suspend or Retire before the caller transaction ends. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Hold SELECT … FOR UPDATE on the published instrument_release row while start_created_assessment_session_from_stored_release classifies and inserts, so a concurrent Suspend or Retire cannot hide from that start. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Keep Active PR #196 as the persist-classification lock. Name the start-load FOR UPDATE on this head without promoting either lock to Implemented. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
PR #196 locks instrument_release during persist classification, but stored-release start still loaded with an unlocked SELECT. A participant start can insert after a concurrent Suspend or Retire commits.
What this PR does
Prefer this head over #196 for combined Created-only publication locks. Prefer #180 for command-history + start lock. Do not merge #196, #180, #164, or draft #100 in parallel. Do not merge until exact-head checks and independent last-push approval are satisfied.