fix(wake): #927 enqueue TOCTOU — move stale-tmp cleanup off the hot enqueue path (no concurrent in-flight-write clobber) (#928)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
This commit was merged in pull request #928.
This commit is contained in:
2026-07-26 10:56:40 +00:00
committed by Mos
parent 90265ef550
commit 13e6ce5e5c
7 changed files with 301 additions and 11 deletions

View File

@@ -95,6 +95,11 @@ cmd_init() {
echo "store.sh: failed to init $STATE_DIR" >&2
exit 1
}
# Maintenance/daemon-start stale-tmp reap (#927). Cleanup is OFF the per-enqueue
# hot path; `init` is a natural once-per-start maintenance point. It is
# age-scoped, so even if an operator runs `init` while an enqueue is in flight
# it can only reap demonstrably-orphaned (crash-left) tmps, never a live write.
_wake_clean_stale_tmp "$STATE_DIR"
echo "$STATE_DIR"
}
@@ -163,6 +168,11 @@ cmd_enqueue() {
exit 2
fi
# Ensure the layout exists. NB (#927): _wake_init_dir NO LONGER reaps stale
# tmps — that would race a concurrent enqueue's live in-flight write (deleting
# its tmp mid-rename -> spurious "durable pending write FAILED"). Stale-tmp
# reaping is a maintenance action (store.sh init / detector tick), never on this
# hot path.
_wake_init_dir "$STATE_DIR"
# --- serialize the whole allocate+write transaction (#908) ----------------