jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-11-01 23:11:58 +00:00

Files

npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 698049d627 fix(managed-agents): enforce fail-closed per-scope barrier before flush

Add a per-scope readiness latch (config_sync_ready_scope in AppState)
that the flush loop checks before publishing any row. Before this, the
flush loop ran independently of the boot barrier, so legacy pending rows
from a prior boot were publishable at t≈0 — before reconcile or barrier
had run — recreating the stale-store revert this PR exists to close.

Changes:

- Add publish_blocked field to RetainedEvent and carry it in all query
  sites (get_pending_sync, get_retained_event, get_retained_personas,
  legacy_migration reader). New rows start publish_blocked: false;
  the barrier sets it via set_publish_blocked.

- Add config_sync_ready_scope: Mutex<Option<PathBuf>> to AppState.
  Starts None. Set to Some(db_path) by run_boot_barrier on successful
  completion; never set on any error path.

- flush_active_pending_events checks readiness before snapshotting
  pending rows. If not ready it runs run_boot_barrier inline, then
  re-checks: a barrier failure skips this tick and retries on the next,
  so a transient relay-unreachable at boot does not wedge publishing
  for the session.

- flush_pending_events_at re-reads publish_blocked immediately before
  submit_signed_event_at_with_keys. A row gated after the pending
  snapshot was taken cannot publish.

- apply_workspace clears config_sync_ready_scope to None before
  spawn_event_sync so a workspace switch lands unready until its own
  barrier passes.

- Remove the 'in practice' timer-luck paragraph from event_sync.rs;
  replace with the enforced structural invariant.

- Remove all writer-consistent and sync_authoritative references from
  desktop/src-tauri; replace with exact, best-available,
  replica-lag-exposed language. Grep acceptance: empty.

- Add three deterministic tests in flush_barrier module:
  (a) test_row_gated_after_snapshot_cannot_submit: barrier gates a row
      after the pending snapshot; flush sees publish_blocked on re-read
      and skips it; row stays pending.
  (b) test_barrier_error_leaves_scope_unready: latch starts None, stays
      None until barrier succeeds, cleared on workspace switch.
  (c) test_retry_path_publishes_after_barrier_succeeds: latch None →
      scope not ready; latch set → flush proceeds and row publishes.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

2026-08-01 14:09:31 -04:00